Perturbation-Augmented Fine-Tuning

• Perturbation-Augmented Fine-Tuning is a strategy that injects controlled noise into inputs, hidden states, and parameters to boost model robustness and enforce invariance under distribution shifts.
• It employs targeted techniques like input augmentation, feature noise injection, and weight-space perturbations to improve model generalization and mitigate overfitting.
• Empirical results across diverse tasks, including NLP and computer vision, demonstrate significant gains in stability, adversarial resistance, and safety.

Perturbation-augmented fine-tuning is a family of adaptation procedures in which fine-tuning is deliberately coupled to perturbations of inputs, prompts, hidden representations, latent variables, model parameters, or optimization directions so that the adapted model becomes less sensitive to nuisance variation, more stable under distribution shift, or more resistant to harmful specialization. In its narrowest formulation, each clean training input $x$ is paired with a perturbed variant $x'$ that preserves the target label $y$, and the model is trained to be accurate on both while aligning their predictive behavior; in broader formulations, the same organizing principle extends to hidden-state noise injection, parameter-space perturbation, post-fine-tuning safety recovery, and perturbation-conditioned next-token prediction (Qiang et al., 2024, Yuan et al., 2022, Wang et al., 30 Jan 2025, Cen et al., 5 May 2026).

1. Historical emergence and conceptual scope

Early formulations treated perturbation as a way to adapt data to a fixed model or to regularize internal features. "Data Fine-tuning" reframed adaptation as learning a universal additive perturbation on the input while keeping the model parameters fixed, thereby adapting the data to the model’s decision boundary rather than adapting the model to the data (Chhabra et al., 2018). In computer vision, "Learn2Perturb" introduced trainable feature-space perturbation modules at multiple layers and used them during both training and inference, while "MetaPerturb" meta-learned a transferable perturbation function that could be reused across heterogeneous tasks and architectures (Jeddi et al., 2020, Ryu et al., 2020). "Wiggling Weights to Improve the Robustness of Classifiers" moved perturbation into the architecture itself through transform-augmented convolutions and transformed filter banks (Gulshad et al., 2021).

Subsequent work made the paradigm more explicit in pretrained-model adaptation. "Robust Fine-tuning via Perturbation and Interpolation from In-batch Instances" treated other in-batch examples as dynamic perturbations early in training and as same-label interpolation targets later in training (Tong et al., 2022). "HyPe" perturbed the hidden representations fed into each Transformer layer, explicitly targeting over-fitting and representation collapse in pretrained LLM fine-tuning (Yuan et al., 2022). "PAC-tuning" coupled PAC-Bayes training with perturbed gradient descent, using learned posterior variances as parameter-wise perturbation scales (Liu et al., 2023). By 2024–2026, the literature had expanded to prompt perturbation consistency learning for intent classification and slot filling, selective perturbations for machine-generated text detection, weight-space perturbation defenses against harmful fine-tuning, instruction-tuning on noisy prompts, zeroth-order projected perturbations, and perturbation-conditioned language modeling for extrapolation (Qiang et al., 2024, Liu et al., 2024, Huang et al., 2024, Liu et al., 2024, Alajrami et al., 3 Oct 2025, Mi et al., 21 Oct 2025, Cen et al., 5 May 2026, Cen et al., 13 May 2026).

Taken together, this suggests that perturbation-augmented fine-tuning is not a single algorithm but a design family organized by where perturbations are applied, how they are generated, and what invariance or robustness property they are intended to enforce.

2. Perturbation loci and construction strategies

The literature spans several perturbation loci. Input- and prompt-level perturbations remain the most direct. In Prompt Perturbation Consistency Learning, clean utterances are paired one-to-one with oronyms, synonyms, or paraphrases, with semantic filtering by BERTScore and label alignment rules that depend on whether token order is preserved (Qiang et al., 2024). Instruction-tuning on noisy prompts perturbs only the instruction portion through stop-word deletion, shuffling, deletion, BERT-guided replacement or insertion, and misspellings, typically at severity $s = 0.25$ and mixture proportion $\alpha \in \{0, 0.25, 0.5, 0.75, 1.0\}$ (Alajrami et al., 3 Oct 2025). Pecola uses selective masking and mask filling, where YAKE-derived important tokens are protected from perturbation and the resulting views are used in token-weighted contrastive learning (Liu et al., 2024).

Hidden-state and feature perturbations target the internal representations that mediate downstream behavior. HyPe adds i.i.d. Gaussian or uniform noise to the hidden representation entering each Transformer layer during training and removes the noise at inference (Yuan et al., 2022). Learn2Perturb injects trainable additive Gaussian feature noise after convolutional operations or residual blocks, treating the network as a probabilistic mapping and alternating updates of network weights and noise parameters (Jeddi et al., 2020). MetaPerturb instead uses multiplicative perturbations on feature maps, where the perturbation mask is the product of an input-dependent stochastic component and a batch-dependent scaling vector shared across layers (Ryu et al., 2020).

Latent-space perturbations are prominent in image augmentation and in recent language-model extrapolation work. In normalizing-flow-based augmentation, an invertible flow maps an input to latent space, a constrained perturbation $\delta$ is applied in that latent space, and the perturbed code is decoded exactly back to input space, enabling random or adversarial on-manifold perturbations (Yuksel et al., 2021). In perturbation-based language modeling, each prefix is replaced by a semantic neighbor sampled from a perturbation distribution before next-token prediction; later work replaces fixed discrete perturbations with a learnable continuous perturbation of prefix embeddings generated from a latent variable (Cen et al., 5 May 2026, Cen et al., 13 May 2026).

Parameter-space and optimization-space perturbations define another major branch. PAC-tuning perturbs parameters with Gaussian noise whose variances are learned in a PAC-Bayes stage, then computes gradients at the perturbed parameters while updating the unperturbed ones (Liu et al., 2023). A LoRA-based formulation perturbs the low-rank adapted weights with structured Gaussian noise whose covariance depends on row-wise weight and gradient norms, with the explicit goal of mitigating sharp-minima attraction and LoRA double descent (Chang et al., 20 Feb 2025). P-GAP constructs perturbations in a learned low-dimensional gradient subspace and aligns them with projected gradient directions to reduce the variance of zeroth-order gradient estimation (Mi et al., 21 Oct 2025). Safety-alignment work simulates harmful weight-space perturbations during alignment, perturbs only safety-critical layers, or learns an adaptive perturbation to be applied after fine-tuning (Huang et al., 2024, Liu et al., 2024, Wang et al., 30 Jan 2025).

Perturbation locus	Representative instantiation	Characteristic mechanism
Input or prompt	PPCL, noisy instruction tuning, Pecola	semantic edits, masking, fill-in, lexical corruption
Hidden or feature state	HyPe, Learn2Perturb, MetaPerturb	additive or multiplicative noise on intermediate representations
Latent or prefix space	normalizing-flow augmentation, perturbation-conditioned LM training	on-manifold latent moves or semantic-neighbor prefixes
Parameters or optimization	PAC-tuning, GGPO-style LoRA perturbation, P-GAP, Booster, Panacea	noisy parameters, aligned search directions, weight-space adversaries

This breadth makes clear that the defining feature of the paradigm is not the perturbation carrier itself, but the use of perturbation as an inductive bias during adaptation.

3. Objective functions and optimization patterns

A recurrent pattern is joint optimization of task fidelity on clean and perturbed examples plus an explicit regularizer that constrains the model’s response to those perturbations. PPCL is exemplary: with clean and perturbed supervised losses $L_c$ and $L_p$, and a Jensen–Shannon consistency term $L_{JS}$, the objective is

$$L = \lambda_1 L_c + \lambda_2 L_p + \lambda_3 L_{JS},$$

where $x'$0 is computed tokenwise for length-preserving perturbations and from averaged token distributions for paraphrases (Qiang et al., 2024). Instruction-tuning on noisy prompts uses the simpler mixture objective

$x'$1

with perturbation type sampled uniformly from a fixed set (Alajrami et al., 3 Oct 2025).

Other methods convert perturbation into a representation-learning signal. Pecola combines standard cross-entropy with a supervised multi-pair contrastive loss over original, masked, and mask-filled views, using token importance weights derived from YAKE and an adaptive margin based on the maximum in-batch intra-class distance (Liu et al., 2024). Match-Tuning replaces each instance representation with a convex combination of in-batch representations under a similarity-derived matching matrix, so that the same task loss implicitly interpolates between perturbation-dominated and label-consistent representations during training (Tong et al., 2022). HyPe makes no auxiliary change to the downstream task loss at all; it simply evaluates the ordinary supervised objective on a noised hidden-state forward pass (Yuan et al., 2022).

Weight-space and optimization-space methods often take min–max or bilevel forms. Booster optimizes

$x'$2

so that a simulated harmful perturbation yields less harmful-loss reduction after alignment (Huang et al., 2024). Panacea uses a related post-fine-tuning objective,

$x'$3

then applies the optimized perturbation after fine-tuning to recover safety without sacrificing downstream performance (Wang et al., 30 Jan 2025). PAC-tuning first minimizes a PAC-Bayes objective to learn posterior variances for parameters, then uses those fixed variances in perturbed gradient descent (Liu et al., 2023). P-GAP, in turn, replaces isotropic zeroth-order perturbations by perturbations sampled in a learned low-dimensional projection $x'$4 and evaluates

$x'$5

with $x'$6 to reduce estimator variance (Mi et al., 21 Oct 2025).

In autoregressive language modeling, perturbation changes the conditioning context itself. One formulation trains on

$x'$7

where $x'$8, thereby replacing exact prefixes with semantic neighbors during both training and inference (Cen et al., 5 May 2026). A continuous extension replaces discrete neighbors by a learnable perturbation of prefix embeddings and derives unbiased estimating equations for the resulting latent-variable objective (Cen et al., 13 May 2026).

4. Empirical behavior across tasks and modalities

On structured natural language understanding, prompt perturbation work shows both the promise and the fragility of standard fine-tuning. Instruction fine-tuning brings LLMs close to discriminative baselines for intent classification and slot filling, but perturbation sensitivity remains substantial: on MASSIVE, LLaMA-7B+SFT shows intent-classification and slot-filling performance drop rates of $x'$9 under oronyms, $y$0 under synonyms, and $y$1 under paraphrases. PPCL reduces those drops and, aggregated across perturbation types, recovers on average $y$2 of intent-classification degradation and $y$3 of slot-filling degradation while using around an order of magnitude fewer augmented samples than multi-sample augmentation (Qiang et al., 2024).

On general PLM fine-tuning, in-batch, hidden-state, and PAC-driven perturbations all report consistent improvements. Match-Tuning improves vanilla fine-tuning on GLUE by $y$4 scores on average and improves robustness on AdvGLUE by $y$5 scores on average (Tong et al., 2022). HyPe improves BERT-large by $y$6 average points on the small GLUE tasks, improves RoBERTa-large low-resource performance by $y$7 points in the 1k-sample regime for HyPe-U, and reports adversarial gains on advGLUE including $y$8 on QNLI and $y$9 on RTE over vanilla fine-tuning (Yuan et al., 2022). PAC-tuning reports average scores of $s = 0.25$0 on five few-shot GLUE tasks for BERT-base-uncased, compared with $s = 0.25$1 for LoRA and $s = 0.25$2 for vanilla fine-tuning (Liu et al., 2023).

Instruction-tuning on noisy prompts shows that perturbation can regularize even when the benchmark itself is evaluated clean. On MMLU 5-shot, Llama-70B with fully perturbed instruction tuning reaches $s = 0.25$3, compared with $s = 0.25$4 for clean-tuned $s = 0.25$5 and $s = 0.25$6 for the non-instruction-tuned baseline. On BBH CoT under perturbed evaluation, the same model with $s = 0.25$7 achieves $s = 0.25$8, $s = 0.25$9, $\alpha \in \{0, 0.25, 0.5, 0.75, 1.0\}$0, and $\alpha \in \{0, 0.25, 0.5, 0.75, 1.0\}$1 for $\alpha \in \{0, 0.25, 0.5, 0.75, 1.0\}$2, outperforming the baseline at each perturbation level (Alajrami et al., 3 Oct 2025).

Vision results show that perturbation-augmented fine-tuning is not restricted to language. With normalizing flows, Adversarial-LA reaches $\alpha \in \{0, 0.25, 0.5, 0.75, 1.0\}$3 test accuracy on CIFAR-10 with ResNet-18, and in the 5% data regime reaches $\alpha \in \{0, 0.25, 0.5, 0.75, 1.0\}$4 versus $\alpha \in \{0, 0.25, 0.5, 0.75, 1.0\}$5 for standard training; the same framework reports FID around $\alpha \in \{0, 0.25, 0.5, 0.75, 1.0\}$6–$\alpha \in \{0, 0.25, 0.5, 0.75, 1.0\}$7, versus approximately $\alpha \in \{0, 0.25, 0.5, 0.75, 1.0\}$8 for image-space PGD (Yuksel et al., 2021). Learn2Perturb improves robustness by $\alpha \in \{0, 0.25, 0.5, 0.75, 1.0\}$9–$\delta$0 on $\delta$1 FGSM and PGD attacks and reports $\delta$2 accuracy under $\delta$3 CW attack with $\delta$4, compared with $\delta$5 for PNI and $\delta$6 for Adv-BNN (Jeddi et al., 2020). Transform-augmented convolutional networks improve clean accuracy and broad robustness; on STL-10, elastic TAConv reaches $\delta$7 clean accuracy versus $\delta$8 for the baseline, while under adversarial perturbation the elastic variant reaches $\delta$9 versus $L_c$0 for the baseline (Gulshad et al., 2021).

In language-model extrapolation, perturbation changes not merely robustness but the conditioning regime of autoregressive training. Perturbation-conditioned training improves out-of-support generation on WikiText-103, WebText, and WritingPrompts while maintaining competitive in-support performance; for example, GPT-2 on WritingPrompts improves Mauve from $L_c$1 to $L_c$2, and GPT-Neo-1.3B on WikiText-103 improves Mauve from $L_c$3 to $L_c$4 (Cen et al., 5 May 2026). A continuous latent-perturbation extension further reports large out-of-domain perplexity reductions, such as OPT on GermanQuAD improving from $L_c$5 to $L_c$6 and OPT on WebText improving from $L_c$7 to $L_c$8 under the debiased continuous-perturbation method (Cen et al., 13 May 2026). In optimization-centric fine-tuning, P-GAP reports up to $L_c$9 higher accuracy on classification tasks and up to $L_p$0 higher accuracy on generation tasks, with up to about $L_p$1 fewer training iterations and $L_p$2 fewer GPU hours than MeZO (Mi et al., 21 Oct 2025).

5. Safety alignment, detection, and misuse resistance

A major branch of the literature applies perturbation-augmented fine-tuning to safety and detection rather than standard task accuracy. Pecola begins from the observation that random perturbations and threshold-based scoring in DetectGPT under-utilize perturbation information. It therefore introduces selective perturbations and token-level weighted multi-pairwise contrastive learning, achieving a $L_p$3 average accuracy improvement over the state of the art across four public datasets, as well as a robustness advantage of $L_p$4 accuracy and $L_p$5 F1 over RoBERTa under 15% post hoc perturbations (Liu et al., 2024).

Alignment-stage defenses model harmful fine-tuning itself as a perturbation process in weight or representation space. Booster interprets harmful gradient steps as harmful weight perturbations and regularizes the difference between harmful loss before and after a simulated normalized harmful update. Across harmful ratios $L_p$6, it reduces average Harmful Score from $L_p$7 for SFT to $L_p$8, while increasing average Fine-tune Accuracy from $L_p$9 to $L_{JS}$0 (Huang et al., 2024). T-Vaccine targets only safety-critical layers, identified by harmful gradient norms, rather than perturbing all layers uniformly. On Llama2-7B under the reported harmful-ratio setting, it reduces average Harmful Score from $L_{JS}$1 for Vaccine to $L_{JS}$2 while reducing peak memory from $L_{JS}$3 GB to $L_{JS}$4 GB (Liu et al., 2024).

Post-fine-tuning defenses shift the perturbation stage even later. Panacea is motivated by the finding that small random perturbations can recover safety after harmful fine-tuning, though at the cost of downstream performance. It therefore learns an adaptive perturbation during fine-tuning and applies it once after fine-tuning. Across harmful-ratio sweeps, Panacea reduces average Harmful Score from $L_{JS}$5 for SFT to $L_{JS}$6 while maintaining Fine-tune Accuracy at $L_{JS}$7 versus $L_{JS}$8 for SFT; the paper further reports that different layers in LLaMA2-7B, Gemma2-9B, and Qwen2-7B exhibit distinct safety coefficients (Wang et al., 30 Jan 2025).

These results establish a distinct safety-oriented interpretation of perturbation-augmented fine-tuning. Here the target is not invariance to benign lexical or perceptual variation, but attenuation of harmful learning directions, harmful embedding drift, or harmful post-specialization. A plausible implication is that perturbation can function as a safety control surface at several stages of the adaptation pipeline: before fine-tuning, during fine-tuning, and after fine-tuning.

6. Limitations, misconceptions, and open research directions

A common misconception is that perturbation-augmented fine-tuning is merely data augmentation under another name. The surveyed literature does not support that reduction. Some methods perturb data or prompts, but others perturb hidden states, parameters, weight-space update directions, transform bases, or the autoregressive conditioning prefix itself (Yuan et al., 2022, Liu et al., 2023, Gulshad et al., 2021, Cen et al., 5 May 2026). Another misconception is that perturbations must be random. In practice, perturbations may be selective, semantic, adversarial, gradient-aligned, subspace-constrained, or learned from continuous latent variables (Liu et al., 2024, Mi et al., 21 Oct 2025, Cen et al., 13 May 2026).

The empirical record also makes clear that perturbation is not uniformly beneficial. Several papers explicitly report failure modes or trade-offs. In perturbation-conditioned language modeling, when training coverage is dense in the synthetic regime, perturbation can slightly hurt in-support performance, and overly aggressive perturbation intensity degrades Mauve (Cen et al., 5 May 2026). In latent-space augmentation with normalizing flows, over-perturbation can move samples off the learned data manifold and introduce artifacts (Yuksel et al., 2021). PPCL notes that over-regularization can harm clean accuracy if $L_{JS}$9 is too large, and that there is no universal setting for $$L = \lambda_1 L_c + \lambda_2 L_p + \lambda_3 L_{JS},$$0 (Qiang et al., 2024). Noisy-instruction tuning reports that math-heavy tasks such as GSM8K are more sensitive to instruction noise, especially for smaller models (Alajrami et al., 3 Oct 2025). P-GAP depends on subspace quality, refresh frequency, perturbation magnitude, and rank, and can slow convergence if the learned subspace is misspecified (Mi et al., 21 Oct 2025). Panacea likewise requires a representative harmful dataset and careful tuning of $$L = \lambda_1 L_c + \lambda_2 L_p + \lambda_3 L_{JS},$$1 and $$L = \lambda_1 L_c + \lambda_2 L_p + \lambda_3 L_{JS},$$2 to avoid degrading fine-tuning accuracy (Wang et al., 30 Jan 2025).

Open directions in the cited literature are correspondingly technical. Several works call for adaptive perturbation distributions, adaptive schedules for perturbation intensity, and learnable perturbation policies rather than fixed hand-designed operators (Cen et al., 5 May 2026, Alajrami et al., 3 Oct 2025). Zeroth-order methods point to hybrid first-order/zeroth-order schemes, curvature-informed projections, and trajectory-informed subspaces (Mi et al., 21 Oct 2025). Safety papers point to extensions beyond supervised alignment into RLHF-style or preference-based objectives, as well as stronger robustness under larger harmful ratios and more diverse attacks (Huang et al., 2024, Liu et al., 2024, Wang et al., 30 Jan 2025). More broadly, the literature repeatedly notes that robustness gains are often demonstrated on a small number of benchmarks, so broader validation across tasks, modalities, and real deployment noise remains an unresolved issue (Qiang et al., 2024, Yuksel et al., 2021).

In that sense, perturbation-augmented fine-tuning is best understood as a principled but heterogeneous strategy for imposing local smoothness, semantic invariance, flat-minima bias, or safety-preserving resistance during adaptation. Its central claim is not that one perturbation mechanism dominates all others, but that carefully constructed perturbation during or around fine-tuning can reshape what the model treats as stable structure.