SafeAnchor: Preventing Cumulative Safety Erosion in Continual Domain Adaptation of Large Language Models

SafeAnchor: A Framework for Preventing Cumulative Safety Erosion in Continual Domain Adaptation of LLMs

Motivation and Problem Statement

The paper addresses the overlooked but crucial issue of safety alignment erosion in LLMs during sequential domain adaptation. Empirical studies have established that safety alignment is shallow—localized in early output tokens and readily reversible by minimal adversarial fine-tuning. When models are adapted sequentially across domains (e.g., medical, legal, code), standard fine-tuning approaches induce compounded safety degradation, undermining safety guardrails and making models vulnerable to jailbreaking or harmful outputs. Existing safety-preserving methods are limited to single-task fine-tuning, ignoring multi-domain sequential pipelines common in deployment scenarios. Continual learning (CL) methods similarly focus on task preservation rather than behavioral safety.

SafeAnchor is put forward as the first framework to systematically anchor safety behaviors throughout continual multi-domain adaptation, addressing cumulative safety erosion with principled, targeted interventions.

SafeAnchor Architecture

SafeAnchor employs three synergistic components:

1. Safety Subspace Identification (SSI): Using Fisher Information eigendecomposition on LoRA parameter space, SSI identifies directions encoding safety-critical behaviors. The process leverages a safety calibration set, constructs empirical Fisher matrices per LoRA layer, and extracts low-rank subspaces representing the principal safety gradients. Subspaces are incrementally updated via SVD truncation after each domain, ensuring continual relevance and preventing unbounded inflation.
2. Orthogonal Safety-Constrained Adaptation (OSCA): During fine-tuning, task gradients are projected onto the orthogonal complement of the safety subspace, so adaptations cannot overwrite safety-relevant parameters. An adaptive relaxation coefficient modulates projection strength according to Fisher trace (layer-specific safety importance), optimizing the balance between task performance and safety preservation.
3. Cumulative Safety Monitoring (CSM): After each domain adaptation, CSM evaluates the model's safety refusal rate on a held-out probe set using LlamaGuard as a classifier. If safety falls below a threshold relative to baseline, CSM triggers safety replay—brief corrective fine-tuning using both safety and domain data with projected gradients, restoring safety score with negligible domain regression. This mechanism addresses indirect safety drift in nonlinear pathways not directly controlled by OSCA.

SafeAnchor’s complete training objective augments domain loss with an anchor-loss regularizer (forward KL penalizing changes to safe responses), further stabilizing safety behaviors against distributional shift.

Experimental Evaluation

SafeAnchor is tested on Llama-2-7B-Chat and Mistral-7B-Instruct across sequential adaptation to three domains (Medical, Legal, Code), evaluated over eight benchmarks: MedQA, LegalBench, HumanEval (domain-specific), HarmBench, TruthfulQA, BBQ, WildGuard (safety-specific), and MMLU (general). All models were safety-aligned at initialization.

Key baselines include standard LoRA, EWC+LoRA, O-LoRA, Safe LoRA, Vaccine+LoRA, SafeGrad+LoRA, and Safety Interleaving. All were adapted to the sequential setting for fair comparison.

Results: On Llama-2-7B-Chat, standard LoRA drops safety score by nearly 48 points; SafeGrad+LoRA mitigates but still loses 24 points. SafeAnchor retains 93.2% of original safety alignment ($85.2 \pm 0.9$), outperforming the best baseline by 18–42 points, while achieving domain performance within 1.3 points of unconstrained fine-tuning. The same qualitative pattern holds for Mistral-7B-Instruct. Notably, the safety preservation effect persists across all six domain orderings, with cross-ordering SD less than seed-level variance.

Ablation studies show strict OSCA recovers most safety but at domain cost; adaptive projection and anchor-loss regularization close the domain gap and add further safety points. Incremental SSI updates are critical; omitting them drops safety by 5.1 points.

Robustness testing under GCG adversarial suffix attacks and WildGuard jailbreak scenarios confirm that SafeAnchor’s preservation of safety subspace confers enhanced adversarial robustness, with a gap of +23.8 points refusal rate to the best baseline.

Long-sequence experiments ($T=5$ domains) indicate SafeAnchor’s safety trajectory remains linear ($\sim$2 pts/step degradation), with no sign of subspace exhaustion.

Theoretical and Practical Implications

SafeAnchor provides compelling evidence that safety-critical behaviors in LLMs are encoded in low-rank subspaces of parameter space, and that targeted subspace preservation via gradient projection effectively counteracts catastrophic safety forgetting in sequential domain adaptation. The incremental SSI updates and cumulative monitoring establish robustness even as safety gradients shift across domain tasks. The implication is that safety alignment is not an emergent property maintained by large-scale training but is vulnerable to routine operational procedures—explicit guarding via subspace anchoring is essential.

Practically, SafeAnchor is applicable in real-world deployments where models are frequently repurposed for new domains without sacrificing existing safety alignments. The framework is efficient, incurring $\sim$17.8% training overhead, and is shown to preserve both benign and adversarial safety metrics at scale. Additionally, the approach provides a foundation for integrating with other alignment-stage defenses and non-LoRA adaptation mechanisms, suggesting extensibility across the broader ecosystem of LLM adaptation.

Limitations and Future Directions

SafeAnchor is evaluated at 7B parameter scale and up to five domain sequences; work at larger model scales and longer adaptation pipelines remains necessary. The framework relies on the continued existence of unused orthogonal parameter space, which could become exhausted with very long adaptation chains or extreme overlap between domain and safety gradients. Mechanistic interpretability of the evolving safety subspace and its relation to behavioral invariance warrants deeper investigation. Extensions to multi-turn conversational alignment, finer-grained behavioral constraints, and direct integration with alignment-stage immunization techniques are envisioned.

Conclusion

SafeAnchor addresses cumulative safety erosion in continual multi-domain adaptation of LLMs by anchoring safety behaviors in low-rank parameter subspaces, constraining domain task updates, and monitoring for safety drift. Empirical results demonstrate substantial gains over all baselines in both benign and adversarial settings, confirming the necessity and efficacy of sequential safety preservation. The approach sets a precedent for safety-centric continual learning in LLMs and provides a scalable, practical solution for alignment maintenance in complex operational environments.