HyperSafe: Inference-Time Safety Recovery for Fine-Tuned Language Models

Abstract: Safety alignment in LLMs can be fragile under fine-tuning, as even benign task adaptation may increase harmful compliance. Existing defenses mainly follow two directions: they either intervene during or after fine-tuning through retraining or weight modification, which can be costly and may hurt task performance, or they use model-agnostic safety classifiers, which may miss failures specific to a given fine-tuned checkpoint. These limitations motivate a post hoc, model-specific, and non-invasive approach to safety restoration. To meet these requirements, we propose HyperSafe, a framework that restores safety behavior by generating a model-specific Safe Side Network (SSN) for each fine-tuned checkpoint. HyperSafe uses layer-wise activation fingerprints to capture how fine-tuning changes the model's inner representations. With a small set of given calibration prompts, the hypernetwork maps these fingerprints to the parameters of the \ssn{} in a single forward pass. The generated \ssn{} runs alongside the frozen fine-tuned model and performs prompt-level safety classification: harmful prompts are routed to refusal, while safe prompts are answered by the original fine-tuned model. Thus, HyperSafe requires no gradient updates, no safety data at deployment time, and no modification to the deployed model weights. We evaluate HyperSafe on two model families, Qwen2-7B and LLaMA-3-8B, across multiple safety benchmarks. HyperSafe reduces harmful response rates from 19-31% to below 1% on every held-out checkpoint, while keeping downstream task accuracy within 1% of the fine-tuned baseline on average. Code is available at https://github.com/nokronim/project-safety-remedy.

• The paper introduces a lightweight side network generated via a hypernetwork to restore safety alignment post-fine-tuning.
• It achieves sub-1% harmful compliance across 22 domains with minimal task accuracy degradation.
• The method leverages model-specific activation fingerprints to synthesize safety classifiers without weight modification.

HyperSafe: Inference-Time Safety Recovery for Fine-Tuned LLMs

Motivation and Problem Setting

Fine-tuning processes frequently compromise the safety alignment of LLMs: even harmless domain adaptation can undermine learned refusal behavior and drive up compliance with harmful requests. While prior defenses require (1) intervention during fine-tuning, (2) weight modification after fine-tuning, or (3) generic model-agnostic filtering, each of these sacrifices either task performance, operational flexibility, or defense granularity. Many such approaches entail costly retraining, enforce global trade-offs between utility and safety, or fail to detect failure modes unique to a given checkpoint.

The HyperSafe framework addresses the open question: can the safety behavior of an aligned base model be post-hoc recovered for any fine-tuned checkpoint, without retraining, weight modification, or performance regression—using only model-specific information? HyperSafe’s central approach is to attach a checkpoint-specific, lightweight side-classifier network (SSN) generated de novo at inference time, informed by the fine-tuned model’s own actual activations, and produced in a single forward pass by a hypernetwork.

Figure 1: HyperSafe pipeline. Stages 1–3 (training): (1) fine-tune the base model, (2) train a domain-specific SSN, (3) train a hypernetwork to map activation fingerprints to SSN weights. Stage 4 (deployment): extract calibration activations for any new fine-tuned checkpoint and generate a model-specific SSN in one forward pass.

HyperSafe Architecture

Safe Side Network and Ladder Connections

HyperSafe attaches a Safe Side Network (SSN) to the frozen backbone of a fine-tuned model. The SSN, a small transformer network (3–4% of backbone scale in the evaluated settings), receives gated, downsampled hidden states from the backbone (ladder connections), enabling low-footprint prompt-level safety classification. On each prompt, the SSN emits a score: above threshold prompts are refused, while below-threshold prompts are forwarded unmodified to the task model's output. Crucially, no safe prompt output is perturbed, and neither gradients nor weights are updated at deployment.

Figure 2: SSN architecture. Ladder connections inject backbone activations into the side network, which predicts a safety score λ; λ routes outputs to refusal response or allows unmodified backbone prediction.

Hypernetwork-Driven SSN Generation

The SSN weights are not retrained or stored a priori for each checkpoint. Instead, a hypernetwork $G$ is trained to predict SSN parameters from a model’s layer-wise activation “fingerprint,” aggregated from a small set of calibration prompts. The activation fingerprint is projected using an attention/MLP block, decomposed into direction and magnitude, and factored to encode both global and per-layer model behavioral shifts introduced by fine-tuning. Each side network layer receives weights predicted as a function of both global and their respective layer’s backbone activation shift.

This approach allows hypernetwork training over many source domains for generalization, after which new SSNs may be synthesized for any out-of-domain, unseen fine-tuned checkpoint via an inexpensive single forward pass.

Training Procedure and Loss Formulation

Training has two stages: per-domain collection of SSNs (frozen backbone, newly trained side network on harmful/safe data) and supervised hypernetwork training using the collected (fingerprint, SSN-weights) pairs. The loss is a weighted sum of three parts: mean squared error on generated SSN weights, binary cross-entropy on classification accuracy (on calibration prompts), and functional probe loss (on heldout, non-calibration prompts for generalization). The functional loss for safe prompts is shown to be particularly critical for accuracy preservation.

Deployment only requires the fine-tuned model and a calibration prompt set; the base model and harmful data are not needed. Inference on each prompt routes directly (or not) through the side network classifier, maintaining original model throughput and parameter integrity.

Empirical Evaluation

HyperSafe is evaluated on LLaMA-3-8B and Qwen2-7B across 22 fine-tuning domains and three safety benchmarks: BeaverTails, AdvBench, and HEx-PHI. LoRA fine-tuning increases harmful compliance rates by 4–8× (often above 30%) across domains, confirming the fragility of current alignment. HyperSafe reduces harmful output rates to below 1% across all held-out checkpoints and all benchmarks—including out-of-domain attacks—while degrading average task accuracy by less than one percentage point.

Notably, HyperSafe outperforms both OneShot SFT (which can collapse task accuracy) and the dedicated 12B Llama Guard 4 classifier, the latter missing 6.5–53.6% of harmful cases on benchmarks where HyperSafe achieves near-zero miss rates. The SSN’s ~3% parameter overhead is significantly more efficient than duplicating or running a large classifier in parallel.

Ablations show distinct loss components are essential: removing supervision on safe prompts or functional losses sharply degrades accuracy or harmfulness. Domain exclusion ablations reveal the need for instruction-following domains for robust generalization; calibration requirements saturate at modest (≈50) prompt sets.

Figure 3: Ablation summary—removal of key functional loss on safe prompts yields the steepest task accuracy drop; instruction-following domain exclusion most impairs harmful rate.

Figure 4: Calibration set size—task accuracy saturates at $N_\text{cal}=50$ calibration prompts while maintaining near-zero harmful rates.

The SSN generated from LoRA-merged weights is also empirically shown to work for full fine-tuning, suggesting transfer across PEFT recipes if the fingerprint is similar; cross-benchmark transfer is confirmed as well.

Implications and Future Directions

HyperSafe introduces a pragmatic paradigm shift: post-hoc, model-specific safety “patching” at inference time using model fingerprinting and hypernetwork weight synthesis. This enables retroactive, scalable recovery of safety for arbitrary released fine-tuned checkpoints, removing dependence on retraining, original data, or control of model weights. In production, HyperSafe can serve as a drop-in safety restoration layer, amortizing hypernetwork training costs over a large ecosystem of checkpoints.

Theoretically, the results indicate that activation-space fingerprints are sufficient for zero-shot classifier synthesis, and that safety degradation due to fine-tuning is detectable and tractable via intrinsic model representations. As alignment techniques, base model architectures, and fine-tuning methods evolve, further work could extend HyperSafe to support larger, multimodal models, improve generalization to distributional shifts (e.g., via adversarial fingerprinting), and combine internal monitoring with output-based filtering.

Conclusion

HyperSafe delivers inference-time, model-specific recovery of safety alignment in fine-tuned LLMs through a post-hoc, hypernetwork-generated side-classifier; this yields sub-1% harmful compliance rates with minimal impact on task utility, operating entirely without retraining or fine-tuned weight modification. This architecture robustly addresses alignment regression in a deployment-agnostic, scalable fashion, providing a template for future research on post-hoc LLM safety and dynamic classifier generation.