Active Adaptation, Not Static Defense: Temporal Dynamics of Preventative Steering in Adversarial Fine-Tuning

Summary

This paper investigates why Preventative Steering—injection of fused undesirable-trait persona vectors (evil, sycophancy, hallucination) into the residual stream during adversarial fine-tuning, with the injection removed at evaluation—protects models against malicious fine-tuning. Tracking optimization in residual and parameter space on Qwen2.5-32B-Instruct, the authors find a two-phase dynamic: an early compensatory adaptation phase where gradients oppose the injected direction, followed by a steady state in which gradient alignment with the steering vector decays while orthogonal optimization continues; attention output projections absorb far larger compensatory updates than SiLU-constrained MLP down-projections. Two decoupling experiments—preserving the weight offset via gradient projection (IDP) and reinjecting its functional estimate (IDP Continuation)—both fail, indicating the defense is process-dependent rather than a reusable static offset. Motivated by this, Progressive Intensity Scheduling (PIS) starts at moderate strength (α=20) and ramps to 2× once alignment decay is detected automatically from a single run. Across Qwen2.5-7B/32B and Gemma-3-12B, PIS improves safety averages over static steering (e.g., 80.18→86.98 on 32B) while lowering harmful-trait scores (3.04→1.38). Limitations: data generation and all judging rely on Qwen3-235B-A22B without human validation; no seeds, variance, or significance tests; no comparison to external training-time defenses; a large over-refusal trade-off on 7B (XSTest 77.11→51.11); and the checkpoint-embedded variant assumes attackers do not remove the intervention.