Palette-Adapter: Domain-Specific Safety Control

• Palette-Adapter is a lightweight adaptation mechanism designed for targeted safety alignment relaxation in large language models.
• It employs a LoRA-style low-rank update within a single transformer block to internalize a preselected refusal direction for authorized domains.
• The module supports modular composition by merging independently trained adapters, ensuring minimal interference on non-target domains.

Palette-Adapter is the lightweight adaptation mechanism used within Palette, a modular, controllable, and efficient framework for on-demand authorized safety alignment relaxation in LLMs. It is designed for settings in which a uniform refusal policy is too coarse: current safety alignment of foundation models largely follows a one-size-fits-all paradigm, so models may refuse requests that are unsafe for general users but legitimate for authorized professionals. Within Palette, the adapter selectively relaxes refusal behavior on authorized target domains while preserving standard safety elsewhere by internalizing a refusal direction into a frozen model through lightweight adaptation, and by enabling domain-specific controls to be composed through parameter merging (Tan et al., 22 May 2026).

1. Functional role within the Palette framework

Palette-Adapter operationalizes a specific control target: on “allowed” prompts, the model’s hidden activations should shift by $-\lambda\,r_n^*$, whereas on “disallowed” or “safe” prompts, the shift should be approximately zero (Tan et al., 22 May 2026). The control variable is binary, with $y\in\{0,1\}$ indicating allowed ($y=1$) versus disallowed or safe ($y=0$). In that formulation, the training objective is not to learn a general-purpose routing policy, but to internalize a preselected steering direction so that selective refusal relaxation becomes part of the model’s forward computation.

This design is notable for what it omits. Palette does not use a dynamic gating network at inference. Instead, it learns a fixed low-rank update $\Delta W$ whose effect depends on the hidden state induced by the prompt: target-domain activations are shifted toward non-refusal, while non-target activations remain close to the frozen baseline (Tan et al., 22 May 2026). This makes the adapter a mechanism for internalized steering rather than inference-time activation editing.

The approach is also explicitly domain-scoped. Training enforces a single-domain neutrality constraint,

$$\forall \text{ non-target domain prompts } x,\quad \Delta W_i\,h_{n-1}(x)\approx 0,$$

so that each adapter acts selectively on its own authorization domain and is approximately inert elsewhere (Tan et al., 22 May 2026). A plausible implication is that Palette-Adapter is best understood not as a generic alignment module, but as a domain-specific safety-control primitive.

2. Adapter parameterization and insertion point

Palette-Adapter adopts a LoRA-style low-rank adapter on a single transformer block. If the frozen block’s weight at layer $\ell$ is $W_0\in\mathbb{R}^{d\times m}$, the adapter adds a trainable rank-$r$ update

$\Delta W = B\,A,$

with $y\in\{0,1\}$0 and $y\in\{0,1\}$1 (Tan et al., 22 May 2026). All original weights remain frozen.

Only one block is adapted: the $y\in\{0,1\}$2-th block whose output is $y\in\{0,1\}$3. If $y\in\{0,1\}$4 denotes the frozen hidden representation at the input of that block, Palette replaces

$y\in\{0,1\}$5

by

$y\in\{0,1\}$6

The paper characterizes this as a single-layer insertion that internalizes the steering shift (Tan et al., 22 May 2026).

The forward interface is written as

$y\in\{0,1\}$7

and the target behavior is

$y\in\{0,1\}$8

Here, $y\in\{0,1\}$9 is the selected refusal direction at layer $y=1$0 and $y=1$1 are the trainable LoRA parameters (Tan et al., 22 May 2026).

This parameterization is intentionally minimal. Because the update is confined to one block and one low-rank factorization, the mechanism is lightweight in both training and deployment. The stated inference-time integration is simply to load $y=1$2 in place of $y=1$3 for block $y=1$4 (Tan et al., 22 May 2026).

3. Discovery of the refusal direction

Before adapter training, Palette identifies a refusal direction through a multi-objective search. The control objective seeks to maximize bypass on allowed prompts while minimizing bypass on disallowed prompts:

$y=1$5

$y=1$6

$y=1$7

The utility objective preserves the original distribution on safe prompts through KL divergence:

$y=1$8

The optimization problem is

$y=1$9

or equivalently an exploration of the Pareto frontier of $y=0$0 (Tan et al., 22 May 2026).

The search algorithm is defined in three steps. First, it extracts $y=0$1 candidate directions $y=0$2 via difference-of-means. Second, for each $y=0$3 it computes $y=0$4 on a small held-out set. Third, it retains those on the Pareto front and picks the one with highest $y=0$5 under a utility threshold (Tan et al., 22 May 2026).

This separation between direction discovery and parameter learning is a central design choice. The adapter does not discover the refusal direction end-to-end; it learns to reproduce a shift along a direction already selected under explicit control–utility constraints. This suggests a modular decomposition of the problem into direction selection and direction internalization.

4. Training objective and internalization procedure

Given the selected refusal direction $y=0$6, Palette trains the adapter with a squared-error internalization loss. Let $y=0$7 denote the LoRA parameters. The objective is

$y=0$8

Here $y=0$9 for allowed prompts and $\Delta W$0 for disallowed $\Delta W$1 safe prompts (Tan et al., 22 May 2026).

The training procedure includes hard-negative mining. The method first pretrains briefly on random disallowed prompts, measures which inputs suffer the largest bypass increase, and then samples these “hard” negatives into $\Delta W$2 to sharpen the boundary (Tan et al., 22 May 2026). This directly couples the adapter to failure cases in which refusal relaxation might leak outside the intended domain.

Gradient updates are standard:

$\Delta W$3

Because only $\Delta W$4 and $\Delta W$5 are trainable, $\Delta W$6 and $\Delta W$7 have closed form via backprop through the MSE (Tan et al., 22 May 2026). All original weights $\Delta W$8 remain frozen throughout.

The steering strength $\Delta W$9 controls the aggressiveness of the shift and is typically chosen in the range $$\forall \text{ non-target domain prompts } x,\quad \Delta W_i\,h_{n-1}(x)\approx 0,$$0 (Tan et al., 22 May 2026). Varying $$\forall \text{ non-target domain prompts } x,\quad \Delta W_i\,h_{n-1}(x)\approx 0,$$1 in $$\forall \text{ non-target domain prompts } x,\quad \Delta W_i\,h_{n-1}(x)\approx 0,$$2 trades allowed-domain compliance against disallowed-domain refusal, while varying $$\forall \text{ non-target domain prompts } x,\quad \Delta W_i\,h_{n-1}(x)\approx 0,$$3 changes the magnitude of the internalized shift. In combination, these two controls define the principal trade-off surface described by the framework.

5. Modular composition through parameter merging

A defining feature of Palette-Adapter is modular composition. Suppose there are $$\forall \text{ non-target domain prompts } x,\quad \Delta W_i\,h_{n-1}(x)\approx 0,$$4 independently trained single-domain adapters $$\forall \text{ non-target domain prompts } x,\quad \Delta W_i\,h_{n-1}(x)\approx 0,$$5. For a user authorized for domains $$\forall \text{ non-target domain prompts } x,\quad \Delta W_i\,h_{n-1}(x)\approx 0,$$6, Palette computes

$$\forall \text{ non-target domain prompts } x,\quad \Delta W_i\,h_{n-1}(x)\approx 0,$$7

This is simple parameter addition rather than joint retraining (Tan et al., 22 May 2026).

The mathematical justification relies on the neutrality constraint. For any input $$\forall \text{ non-target domain prompts } x,\quad \Delta W_i\,h_{n-1}(x)\approx 0,$$8 from domain $$\forall \text{ non-target domain prompts } x,\quad \Delta W_i\,h_{n-1}(x)\approx 0,$$9,

$\ell$0

By construction, the interference terms $\ell$1 for $\ell$2, so the merged block behaves as if only adapter $\ell$3 were loaded (Tan et al., 22 May 2026).

This composition rule is important because it shifts multi-domain authorization from a retraining problem to an assembly problem. The paper reports that composition of two adapters yields near-identical results to training a joint adapter; for example, allowing Hate+Disinfo yields refusal $\ell$4 on those domains and $\ell$5 elsewhere (Tan et al., 22 May 2026). A plausible implication is that the neutrality constraint is sufficiently strong to make additive superposition practically viable, at least for the domains tested.

6. Evaluation, operating trade-offs, and terminological scope

The main evaluation metrics are refusal rate per domain,

$\ell$6

response accuracy per domain as the fraction of correct comply/refuse decisions, and general utility measured by MMLU and GSM8K for LLMs and MMMU and MMBench for VLMs (Tan et al., 22 May 2026). Lower refusal rate is desirable in allowed domains, while higher refusal rate is desirable in disallowed domains.

The reported empirical highlights characterize the adapter’s operational profile. For single-domain control, Palette reduces refusal on the target domain from $\ell$7 while keeping refusal on other domains within $\ell$8 of base on LLaMA2-7B. Utility preservation is strong: across all settings, MMLU and GSM8K losses are $\ell$9 point. Data efficiency is also emphasized: a $W_0\in\mathbb{R}^{d\times m}$0 train / $W_0\in\mathbb{R}^{d\times m}$1 test split yields stable performance, with accuracy plateaus. The stated compute cost for full adaptation with LoRA rank $W_0\in\mathbb{R}^{d\times m}$2 on a single RTX4090 is $W_0\in\mathbb{R}^{d\times m}$3 s for a 7B model, with memory usage $W_0\in\mathbb{R}^{d\times m}$4–$W_0\in\mathbb{R}^{d\times m}$5 GB (Tan et al., 22 May 2026).

The same paper evaluates the framework across four safety benchmarks, multiple model variants, and both LLMs and VLMs, and presents the result as precise safety control without sacrificing general utility (Tan et al., 22 May 2026). Within the scope of the reported experiments, this positions Palette-Adapter as a parameter-efficient mechanism for authorized safety relaxation rather than wholesale safety removal.

The term Palette-Adapter can be misleading outside this context. In "Palette Aligned Image Diffusion" (Aharoni et al., 2 Sep 2025), Palette-Adapter denotes a lightweight adapter inserted into a pretrained text-to-image diffusion model, specifically Stable Diffusion XL, to steer image generation toward a user-specified color palette. More broadly, other arXiv works use palette to refer to color transformation or appearance decomposition, including automated dark-mode palette adaptation in "Chameleon" (Karunathilaka et al., 29 Nov 2025) and palette-based appearance editing of NeRFs in "PaletteNeRF" (Kuang et al., 2022). This suggests that the LLM usage is terminologically distinct: in Palette (Tan et al., 22 May 2026), palette refers to a modular family of domain-specific safety controls, not to color conditioning or visual appearance editing.