TuneShield: Tunable Safety Middleware

• TuneShield is a tunable safety middleware concept that applies safety shielding across domains such as hybrid systems, LLM deployments, and programmable wireless environments.
• It employs an end-to-end workflow—modeling, shield synthesis, compression, validation, and integration—to constrain unsafe actions while preserving task performance.
• Applications include toxicity mitigation in conversational AI, defense against data poisoning in RTL code generation, and real-time RF shielding with demonstrated efficiency and safety gains.

TuneShield is a designation used in recent arXiv literature for several safety-oriented tuning and shielding mechanisms that operate at different layers of a system stack. In hybrid control, it denotes a deployment workflow in which a synthesized shield is modeled, compressed, validated, and integrated with controller learning in Uppaal Coshy (Brorholt et al., 22 Aug 2025). In LLM deployment, it denotes auto-tuning of system-prompt and filtering guardrails around a frozen black-box model (Abdulkadir, 14 Dec 2025), mitigation of toxicity during conversational fine-tuning on untrusted data through filtering, healing, and preference alignment (Cheruvu et al., 8 Jul 2025), and, in adjacent work, a broader family of fine-tuning shields that filter or rewrite risky data before or during adaptation (Rezakhani et al., 29 Apr 2026, Hu et al., 13 May 2026, Zhang et al., 29 May 2026). In programmable wireless environments, the same label is used for tunable RF shielding and covert-communication control built on RIS orchestration (Papadopoulos et al., 16 Mar 2026). Across these uses, TuneShield consistently refers to a tunable safety layer that constrains unsafe behavior while preserving task performance, service quality, or utility.

1. Scope and recurring structure

The literature does not use TuneShield for a single canonical algorithm. Instead, the name is attached to distinct systems that share a common operational pattern: define a safety objective, expose controllable knobs, synthesize or optimize a shield, validate its behavior, and then deploy it alongside the original model or controller. The concrete realization depends on domain: grid-based safety games for stochastic hybrid systems, hyperparameter search for LLM guardrails, data repair and DPO for conversational detoxification, graph- and embedding-based filtering for poisoned RTL fine-tuning, gradient- or activation-based sample filtering for alignment preservation, and codebook-plus-refinement control for RIS-based RF suppression (Brorholt et al., 22 Aug 2025, Abdulkadir, 14 Dec 2025, Cheruvu et al., 8 Jul 2025, Rezakhani et al., 29 Apr 2026, Hu et al., 13 May 2026, Zhang et al., 29 May 2026, Papadopoulos et al., 16 Mar 2026).

Variant	Domain	Core mechanism
Uppaal Coshy TuneShield	Hybrid systems	Partition, safety game, Caap compression, validation, Stratego integration
TuneShield for black-box LLMs	LLM deployment	Modular prompts, harmfulness classifier, Optuna or grid search
TuneShield for conversational detoxification	Conversational fine-tuning	Refusal-based toxicity scoring, healing data, SFT, DPO
SafeTune/GradShield/DataShield-style TuneShield	LLM fine-tuning security	Semantic or structural filtering, FIHS/CAS/CSS scoring, runtime sanitization
RIS-based TuneShield	Programmable wireless environments	Multi-RIS codebook multiplexing and lightweight refinement

A plausible implication is that TuneShield functions less as a proprietary method name than as a research idiom for “tunable safety middleware.” The commonality is strongest at the workflow level: unsafe options are detected or approximated, a constrained action or data subset is retained, and downstream optimization proceeds inside that constrained set.

2. Hybrid-system TuneShield in Uppaal Coshy

In "Uppaal Coshy: Automatic Synthesis of Compact Shields for Hybrid Systems" (Brorholt et al., 22 Aug 2025), TuneShield is the deployment workflow built around a safety shield synthesized for a continuous-state MDP or stochastic hybrid system. The formal model is $M = (S, A, P)$, where $S \subseteq \mathbb{R}^n$ is closed and bounded, $A$ is finite, and $P$ is a Markov kernel. Safety is specified by a safety set $\mathrm{Safe} \subseteq S$, and the infinite-horizon safety value is defined as the greatest fixed point of the Bellman-style operator

$$V(s) = \mathbf{1}_{s \in \mathrm{Safe}} \cdot \sup_{a \in A} \int_S V(s')\,P(ds' \mid s, a).$$

The almost-sure winning region is

$$W = \{ s \in \mathrm{Safe} \mid \sup_{a \in A} P(W \mid s, a) = 1 \},$$

and, on the abstraction induced by a grid, the most permissive shield is

$$\sigma_{\mathrm{grid}}(C) = \{ a \in A \mid \forall C' \; (C \xrightarrow{a} C' \Rightarrow C' \in W_{\mathrm{grid}}) \}.$$

Coshy constructs that shield by partitioning the continuous state space into axis-aligned hyperrectangular cells using an offset $\alpha \in \mathbb{R}^n$ and granularity vector $\gamma \in \mathbb{R}^n$, approximating safe cells and cell-to-cell transitions by systematic simulation, and then computing a greatest fixed point on the induced finite transition system. Reachability edges are defined by the existence of a feasible one-step outcome under an action from some sample within a cell, and are approximated by simulation with the Uppaal SHA simulator. This avoids undecidable analytic reachability and supports ODE flows, guards, invariants, random choices, external C code, nonperiodic control, omitted irrelevant variables, and unbounded spaces via a dummy out-of-bounds cell $S \subseteq \mathbb{R}^n$0.

The distinguishing TuneShield step is not the safety game alone, but the end-to-end workflow: model, synthesize, compress, validate, and integrate with controller learning under the shield. Compression is handled by Caap, which replaces the tabular shield with an equivalent decision tree using axis-aligned predicates $S \subseteq \mathbb{R}^n$1. Caap applies legal expansion rules—Consistency, Non-overlap, and No fragmentation—and then converts the resulting rectangular partition into a compact tree. In benchmarks, the memory reduction is large: Bouncing ball goes from 1,430,000 cells to 2,972 regions, Boost converter from 136,800 to 571, Random walk from 40,000 to 60, and Water tank from 168 to 24. Reported synthesis and reduction times are $S \subseteq \mathbb{R}^n$2 s and $S \subseteq \mathbb{R}^n$3 s for Bouncing ball, $S \subseteq \mathbb{R}^n$4 s and $S \subseteq \mathbb{R}^n$5 s for Boost converter, $S \subseteq \mathbb{R}^n$6 s and $S \subseteq \mathbb{R}^n$7 s for Random walk, and $S \subseteq \mathbb{R}^n$8 s and $S \subseteq \mathbb{R}^n$9 s for Water tank. Statistical model checking reports at least $A$0 safe at $A$1 confidence, with no unsafe runs observed in $A$2 trials per model. In the bouncing-ball use case, an unshielded “efficient” strategy is unsafe with probability in $A$3 at $A$4 confidence, whereas RL under the shield via Stratego yields expected cost $A$5 over $A$6 s with $A$7 unsafe runs in $A$8 trials.

The method is conservative only with respect to observed successors. The paper explicitly notes that simulation-based underapproximation can miss rare successors, numerical issues can affect successor discovery, Caap is greedy and not globally optimal, and transfer from the abstraction to the original SHA is empirical or probabilistic when simulator coverage is incomplete. This suggests that TuneShield in the hybrid-systems sense is best understood as a simulation-backed safety envelope rather than a symbolic proof artifact.

3. Auto-tuning safety guardrails for frozen black-box LLMs

In "Auto-Tuning Safety Guardrails for Black-Box LLMs" (Abdulkadir, 14 Dec 2025), TuneShield is an implementation of guardrail design as a hyperparameter optimization problem over a frozen base model. The base model is $A$9, with response $P$0 for system prompt $P$1 and user text $P$2. Guardrails consist of modular system prompts and a harmfulness classifier $P$3. Each configuration $P$4 specifies binary toggles for jailbreak and malware snippets—JB1, JB2, MW1, MW2—and a filter mode in $P$5. In the paper’s experiments,

$P$6

so the search space contains $P$7 configurations.

The system is evaluated on three public benchmarks: a 50-prompt malware generation subset of RMCBench, a 50-prompt jailbreak subset of ChatGPT-Jailbreak-Prompts, and a 50-prompt benign subset of JBB-Behaviors. The metrics are Malware attack success rate, Jailbreak ASR, Benign harmful-response rate, and mean end-to-end latency. The Optuna study uses the scalar objective

$P$8

with all terms normalized to comparable scales and lower better. The base model is Mistral-7B-Instruct-v0.2 on an A100 GPU, with chat template $S \subseteq \mathbb{R}^n$78 and generation parameters $P$9, $\mathrm{Safe} \subseteq S$0, $\mathrm{Safe} \subseteq S$1 for general chat, and $\mathrm{Safe} \subseteq S$2 for pure code prompts.

The classifier is the ModernBERT-based modernbert-wildguardmix-classifier, returning $\mathrm{Safe} \subseteq S$3. The paper defines mild as block if $\mathrm{Safe} \subseteq S$4, strict as block if $\mathrm{Safe} \subseteq S$5, and none as never block. A 48-point full grid search establishes the baseline, while Optuna runs 24 fast trials using only 10 prompts per dataset and then re-scores the top 5 configurations on the full 50-prompt sets. The reported result is that Optuna reliably rediscovers the best grid configurations with an order of magnitude fewer total evaluations and roughly $\mathrm{Safe} \subseteq S$6 less wall-clock time.

The numerical trade-offs are explicit. The bare configuration with no safety snippets and no filter yields $\mathrm{Safe} \subseteq S$7, $\mathrm{Safe} \subseteq S$8, $\mathrm{Safe} \subseteq S$9, and generation latency $$V(s) = \mathbf{1}_{s \in \mathrm{Safe}} \cdot \sup_{a \in A} \int_S V(s')\,P(ds' \mid s, a).$$0–$$V(s) = \mathbf{1}_{s \in \mathrm{Safe}} \cdot \sup_{a \in A} \int_S V(s')\,P(ds' \mid s, a).$$1 s. Filtering alone reduces some attack success, as in bare__filter-strict, which gives $$V(s) = \mathbf{1}_{s \in \mathrm{Safe}} \cdot \sup_{a \in A} \int_S V(s')\,P(ds' \mid s, a).$$2, $$V(s) = \mathbf{1}_{s \in \mathrm{Safe}} \cdot \sup_{a \in A} \int_S V(s')\,P(ds' \mid s, a).$$3, $$V(s) = \mathbf{1}_{s \in \mathrm{Safe}} \cdot \sup_{a \in A} \int_S V(s')\,P(ds' \mid s, a).$$4, and classifier overhead $$V(s) = \mathbf{1}_{s \in \mathrm{Safe}} \cdot \sup_{a \in A} \int_S V(s')\,P(ds' \mid s, a).$$5–$$V(s) = \mathbf{1}_{s \in \mathrm{Safe}} \cdot \sup_{a \in A} \int_S V(s')\,P(ds' \mid s, a).$$6 s per prompt. Combining prompt modules with filtering can improve benign behavior further; for example, jb1_jb2_mw2__filter-mild achieves $$V(s) = \mathbf{1}_{s \in \mathrm{Safe}} \cdot \sup_{a \in A} \int_S V(s')\,P(ds' \mid s, a).$$7, with $$V(s) = \mathbf{1}_{s \in \mathrm{Safe}} \cdot \sup_{a \in A} \int_S V(s')\,P(ds' \mid s, a).$$8 and $$V(s) = \mathbf{1}_{s \in \mathrm{Safe}} \cdot \sup_{a \in A} \int_S V(s')\,P(ds' \mid s, a).$$9. The paper also notes that using the same classifier for both blocking and evaluation introduces bias, that the study is single-turn and English-only, and that the practical deployment extensions—continuous thresholds, escalation routing, per-domain policies—go beyond the paper’s experiments.

4. Conversational toxicity mitigation during fine-tuning on untrusted data

In "TuneShield: Mitigating Toxicity in Conversational AI while Fine-tuning on Untrusted Data" (Cheruvu et al., 8 Jul 2025), TuneShield is an end-to-end defense framework for preventing a chatbot from learning toxicity from poisoned conversational data. The threat model assumes a trusted base LLM, an untrusted conversational dataset possibly containing toxic context–response pairs, and trustworthy training and inference pipelines. The core pipeline has three components: LLM-based toxicity classification, healing data generation, and model fine-tuning plus alignment.

The classifier uses a zero-shot “Refusal” prompt applied to a context–response pair $$W = \{ s \in \mathrm{Safe} \mid \sup_{a \in A} P(W \mid s, a) = 1 \},$$0. It asks whether it is safe to generate the next turn, computes the log-likelihoods of “yes” and “no,” converts them to probabilities via softmax, and defines

$$W = \{ s \in \mathrm{Safe} \mid \sup_{a \in A} P(W \mid s, a) = 1 \},$$1

If $$W = \{ s \in \mathrm{Safe} \mid \sup_{a \in A} P(W \mid s, a) = 1 \},$$2, with default $$W = \{ s \in \mathrm{Safe} \mid \sup_{a \in A} P(W \mid s, a) = 1 \},$$3, the sample is labeled toxic. To reduce prompt sensitivity, predictions are averaged over 10 prompt paraphrases produced with ChatGPT-3.5. The best refusal classifiers are safety-aligned LLaMA-2-Chat models; on a balanced test for Offensive and Specialized toxicity categories, they reach $$W = \{ s \in \mathrm{Safe} \mid \sup_{a \in A} P(W \mid s, a) = 1 \},$$4 and $$W = \{ s \in \mathrm{Safe} \mid \sup_{a \in A} P(W \mid s, a) = 1 \},$$5, whereas OpenAI Moderation API reaches $$W = \{ s \in \mathrm{Safe} \mid \sup_{a \in A} P(W \mid s, a) = 1 \},$$6 and $$W = \{ s \in \mathrm{Safe} \mid \sup_{a \in A} P(W \mid s, a) = 1 \},$$7.

Flagged toxic pairs are then healed. Non-contextual healing replaces the response with the fixed refusal string “I’m sorry, I’m not sure what to say. Thank you for sharing and talking to me though.” Contextual healing instead uses a safety-aligned LLaMA-2-Chat 13B to generate a context-aware, empathetic, prosocial response conditioned on the context but excluding the original toxic response. The updated dataset is used for standard SFT, and then Direct Preference Optimization is applied on triplets $$W = \{ s \in \mathrm{Safe} \mid \sup_{a \in A} P(W \mid s, a) = 1 \},$$8. The DPO objective is given in the paper as

$$W = \{ s \in \mathrm{Safe} \mid \sup_{a \in A} P(W \mid s, a) = 1 \},$$9

where $$\sigma_{\mathrm{grid}}(C) = \{ a \in A \mid \forall C' \; (C \xrightarrow{a} C' \Rightarrow C' \in W_{\mathrm{grid}}) \}.$$0 is a frozen reference initialized from the SFT policy and $$\sigma_{\mathrm{grid}}(C) = \{ a \in A \mid \forall C' \; (C \xrightarrow{a} C' \Rightarrow C' \in W_{\mathrm{grid}}) \}.$$1 scales divergence from that reference.

Evaluation uses PersonaChat as non-toxic data, toxic Offensive and Specialized datasets derived from DiaSafety, BAD, and CADD, and three victim models: BART-base, BlenderBot distilled 400M, and LLaMA-2-Chat 7B via QLoRA. The toxicity metric is Response Toxicity Rate, with utility measured by perplexity, Frechet BERT Distance, and GRADE. The no-defense attack baselines are severe: on toxic contexts, Offensive RTR is $$\sigma_{\mathrm{grid}}(C) = \{ a \in A \mid \forall C' \; (C \xrightarrow{a} C' \Rightarrow C' \in W_{\mathrm{grid}}) \}.$$2 for BlenderBot, $$\sigma_{\mathrm{grid}}(C) = \{ a \in A \mid \forall C' \; (C \xrightarrow{a} C' \Rightarrow C' \in W_{\mathrm{grid}}) \}.$$3 for BART, and $$\sigma_{\mathrm{grid}}(C) = \{ a \in A \mid \forall C' \; (C \xrightarrow{a} C' \Rightarrow C' \in W_{\mathrm{grid}}) \}.$$4 for LLaMA-2, while Specialized RTR is $$\sigma_{\mathrm{grid}}(C) = \{ a \in A \mid \forall C' \; (C \xrightarrow{a} C' \Rightarrow C' \in W_{\mathrm{grid}}) \}.$$5, $$\sigma_{\mathrm{grid}}(C) = \{ a \in A \mid \forall C' \; (C \xrightarrow{a} C' \Rightarrow C' \in W_{\mathrm{grid}}) \}.$$6, and $$\sigma_{\mathrm{grid}}(C) = \{ a \in A \mid \forall C' \; (C \xrightarrow{a} C' \Rightarrow C' \in W_{\mathrm{grid}}) \}.$$7. Full TuneShield reduces LLaMA-2 toxic-context RTR to $$\sigma_{\mathrm{grid}}(C) = \{ a \in A \mid \forall C' \; (C \xrightarrow{a} C' \Rightarrow C' \in W_{\mathrm{grid}}) \}.$$8 or $$\sigma_{\mathrm{grid}}(C) = \{ a \in A \mid \forall C' \; (C \xrightarrow{a} C' \Rightarrow C' \in W_{\mathrm{grid}}) \}.$$9 in Offensive for Refusal+NH or Refusal+CH, and to $\alpha \in \mathbb{R}^n$0 or $\alpha \in \mathbb{R}^n$1 in Specialized. All but one setting fall below the no-attack level, with the stated exception of Offensive with O-API+CH at $\alpha \in \mathbb{R}^n$2, which still remains far below the FT-Heal state. The paper also reports robustness to PromptAttack, manual jailbreaks with sandwich-prevention prompt ordering, optimization-based universal suffix attacks, and dialog-based learning poisoning, where TuneShield with contextual healing achieves near-zero RTR in the DD-BART case study.

The paper explicitly does not claim preservation of the base model’s original safety alignment state. Instead, it demonstrates that refusal-based filtering plus healing plus DPO can suppress toxicity learned from untrusted data even when the detector is imperfect or biased.

5. SafeTune-derived TuneShield for RTL code-generation poisoning

In "SafeTune: Mitigating Data Poisoning in LLM Fine-Tuning for RTL Code Generation" (Rezakhani et al., 29 Apr 2026), TuneShield is presented as a defense-in-depth system derived from SafeTune for filtering poisoned prompt–RTL pairs before fine-tuning and neutralizing residual triggers at inference. The threat model assumes a poisoned corpus $\alpha \in \mathbb{R}^n$3, poisoned subset $\alpha \in \mathbb{R}^n$4, no trusted clean dataset, no golden RTL reference, and no dynamic verification resources. The pipeline has four named components: TuneShield Semantic Gate, TuneShield Structural Scanner, TuneShield Fusion Risk Engine, and TuneShield Runtime Sanitizer.

The Semantic Gate encodes prompts with GTE-large embeddings and scores paraphrases with an XGBoost risk estimator. Prompts are embedded into 1024-dimensional vectors $\alpha \in \mathbb{R}^n$5, scored by $\alpha \in \mathbb{R}^n$6, and paraphrase selection follows

$\alpha \in \mathbb{R}^n$7

The Structural Scanner parses RTL with PyVerilog into DFGs and applies a two-layer Graph Isomorphism Network with 128 hidden units and dropout $\alpha \in \mathbb{R}^n$8, trained with Adam at learning rate $\alpha \in \mathbb{R}^n$9. The GIN message-passing rule is

$\gamma \in \mathbb{R}^n$0

and the anomaly score is the predicted Trojan probability $\gamma \in \mathbb{R}^n$1. The Fusion Risk Engine combines semantic and structural evidence through

$\gamma \in \mathbb{R}^n$2

with accept if $\gamma \in \mathbb{R}^n$3. Runtime protection paraphrases incoming prompts again to disrupt trigger activation pathways.

The experimental setup uses 1,000 samples for classifier training, 1,000 for LLM fine-tuning, and 125 Trojan samples for evaluation; benign data come from RTL++, Trojan seeds from Trust-Hub and recent studies across AES, PIC, RSA, UART, and SRAM, expanded to 2,500 samples with ChatGPT-5.1. The fine-tuned models are Qwen2.5-Coder-14B-Instruct and CodeLlama-13B-Instruct with LoRA $\gamma \in \mathbb{R}^n$4, $\gamma \in \mathbb{R}^n$5, 4-bit quantization, learning rate $\gamma \in \mathbb{R}^n$6, AdamW-8bit, and one epoch on A100 GPUs. Functional correctness on VerilogEval Pass@k is preserved: Qwen2.5-Coder-14B remains at Pass@1 $\gamma \in \mathbb{R}^n$7, Pass@5 $\gamma \in \mathbb{R}^n$8, Pass@10 $\gamma \in \mathbb{R}^n$9, and CodeLlama-13B stays at Pass@5 $S \subseteq \mathbb{R}^n$00 and Pass@10 $S \subseteq \mathbb{R}^n$01, with Pass@1 moving from $S \subseteq \mathbb{R}^n$02 to $S \subseteq \mathbb{R}^n$03. Baseline ASR is $S \subseteq \mathbb{R}^n$04 for Qwen2.5 and $S \subseteq \mathbb{R}^n$05 for CodeLlama-13B; training-only sanitization reduces these only to $S \subseteq \mathbb{R}^n$06 and $S \subseteq \mathbb{R}^n$07, runtime-only paraphrasing to $S \subseteq \mathbb{R}^n$08 and $S \subseteq \mathbb{R}^n$09, and the combined defense to $S \subseteq \mathbb{R}^n$10 and $S \subseteq \mathbb{R}^n$11, corresponding to reductions of about $S \subseteq \mathbb{R}^n$12 and $S \subseteq \mathbb{R}^n$13. Per-attack results show substantial drops for UART, AES, RSA, and SRAM, while PIC remains more robust.

This use of TuneShield is explicitly static-analysis-heavy. The paper notes that sanitization alone is limited, static-only analysis can miss Trojans that mimic realistic circuit topologies, and adaptive attackers may craft paraphrase-resistant triggers or structurally blend Trojan logic into common design idioms.

6. Alignment-preserving and compliance-based TuneShield variants

Two later fine-tuning defenses use TuneShield as a functional description for sample-level safety filtering before SFT. In "GradShield: Alignment Preserving Finetuning" (Hu et al., 13 May 2026), TuneShield is a finetuning-stage shield that computes a Finetuning Implicit Harmfulness Score for each training example and removes examples likely to degrade alignment. The practical score is

$S \subseteq \mathbb{R}^n$14

where $S \subseteq \mathbb{R}^n$15, with safe $S \subseteq \mathbb{R}^n$16 “I” and unsafe $S \subseteq \mathbb{R}^n$17 “Sure”. Thresholding is adaptive: the method fits either a single Gaussian with $S \subseteq \mathbb{R}^n$18 or a two-component GMM, then uses a heuristic binary search with relaxed bounds to satisfy safety and utility targets. Reported overhead is approximately one epoch for FIHS computation, or about $S \subseteq \mathbb{R}^n$19 for a typical 4-epoch SFT. Across LATharm, Anthropic RedTeaming, and Identity-shift contamination, GradShield keeps ASR below $S \subseteq \mathbb{R}^n$20 while preserving utility. For example, on LATharm + Samsum, no defense yields Utility $S \subseteq \mathbb{R}^n$21, ASR $S \subseteq \mathbb{R}^n$22, HS $S \subseteq \mathbb{R}^n$23, whereas GradShield yields Utility $S \subseteq \mathbb{R}^n$24, ASR $S \subseteq \mathbb{R}^n$25, HS $S \subseteq \mathbb{R}^n$26. The method works across Llama-3.2-3B, Llama-3.1-8B, Llama-2-7B, and Qwen2.5-7B, but depends on a well-aligned reference model $S \subseteq \mathbb{R}^n$27.

In "DataShield: Safety-degrading Data Filtering for LLM Benign Instruction Fine-Tuning" (Zhang et al., 29 May 2026), TuneShield is an activation-space, forward-only filter based on the observation that benign SFT raises global compliance rather than erasing harmfulness perception. DataShield constructs a compliance vector

$S \subseteq \mathbb{R}^n$28

selects a safety-critical layer with the Compliance-Aware Score

$S \subseteq \mathbb{R}^n$29

and ranks benign training examples by the compliance-shift score

$S \subseteq \mathbb{R}^n$30

For efficiency, $S \subseteq \mathbb{R}^n$31 can be approximated by the prompt-end-token activation; the reported correlation with compliance changes is $S \subseteq \mathbb{R}^n$32 with $S \subseteq \mathbb{R}^n$33. CAS peaks at layer 14 for Llama-3-8B and Llama-3.1-8B, and layer 19 for Qwen2.5-7B. Ranking 10k Alpaca samples on Llama-3-8B requires $S \subseteq \mathbb{R}^n$34 hours and $S \subseteq \mathbb{R}^n$35 GB on one NVIDIA L40 48GB. In the default deployment recipe, the top $S \subseteq \mathbb{R}^n$36 by CSS are dropped before LoRA SFT. After filtering on Alpaca, Llama3.1-8B reaches ASR $S \subseteq \mathbb{R}^n$37, $S \subseteq \mathbb{R}^n$38, and $S \subseteq \mathbb{R}^n$39 on DirectHarm4, Harmbench, and HEx-PHI, improving over SEAL and LARF. The paper also reports that open-ended QA tasks are overrepresented in high-risk subsets and that high-risk samples tend to have longer responses.

Taken together, these two systems suggest two distinct TuneShield philosophies for fine-tuning: gradient-alignment filtering and representation-direction filtering. Both are data-centric, both operate before or during SFT rather than at inference, and both target latent shifts toward compliance.

7. Additional extensions: single-token jailbreak sentinels and RIS-based RF shielding

The TuneShield label is also extended in two markedly different directions. The first is a tuning-based, real-time jailbreak detector adapted from "STShield: Single-Token Sentinel for Real-Time Jailbreak Detection in LLMs" (Wang et al., 23 Mar 2025). The model’s output sequence is extended by a detection token after EOS, encoded as “safe” or “harm.” Training combines supervised fine-tuning on normal prompts,

$S \subseteq \mathbb{R}^n$40

with adversarial training on harmful prompts,

$S \subseteq \mathbb{R}^n$41

under the joint objective

$S \subseteq \mathbb{R}^n$42

Inference adds only one decode step with KV-cache reuse: if the sentinel is “harm,” the answer is replaced with a refusal. Training uses 1,000 UltraChat instructions, 100 JailbreakBench harmful instructions, LoRA with $S \subseteq \mathbb{R}^n$43, $S \subseteq \mathbb{R}^n$44, learning rate $S \subseteq \mathbb{R}^n$45, 1,000 iterations, and PGD adversarial training with 8 steps and $S \subseteq \mathbb{R}^n$46 on a single NVIDIA H800 GPU. Reported reductions are strong under adaptive attacks: for Vicuna-13B, AmpleGCG falls from $S \subseteq \mathbb{R}^n$47 to $S \subseteq \mathbb{R}^n$48, AdvPrompter from $S \subseteq \mathbb{R}^n$49 to $S \subseteq \mathbb{R}^n$50, and LLM-Fuzzer from $S \subseteq \mathbb{R}^n$51 to $S \subseteq \mathbb{R}^n$52; for Llama-2-7B-Chat, AdvPrompter falls from $S \subseteq \mathbb{R}^n$53 to $S \subseteq \mathbb{R}^n$54 under ASRPrefix. Utility drops modestly on MT-Bench, from $S \subseteq \mathbb{R}^n$55 to $S \subseteq \mathbb{R}^n$56 for Vicuna-13B and from $S \subseteq \mathbb{R}^n$57 to $S \subseteq \mathbb{R}^n$58 for Llama-2-7B-Chat, while latency remains close to no defense.

The second extension appears in "RF-Fencing: A Novel RIS-Based Service for Proactive Covert Communications" (Papadopoulos et al., 16 Mar 2026), where TuneShield is a tunable RF shielding service implemented by mapping the SHIELD algorithm to programmable wireless environments. The objective is to maintain legitimate-user service in friendly signal delivery areas while minimizing exposure in hostile signal suppression areas and quiet zones. The baseline received signal model is

$S \subseteq \mathbb{R}^n$59

and far-field control uses a composite field $S \subseteq \mathbb{R}^n$60 over masks $S \subseteq \mathbb{R}^n$61 and $S \subseteq \mathbb{R}^n$62, followed by lightweight refinement of $S \subseteq \mathbb{R}^n$63. The optimization cost is

$S \subseteq \mathbb{R}^n$64

The reported complexity is $S \subseteq \mathbb{R}^n$65 per RIS. Evaluations span 28 GHz, 300 GHz, and 1 THz. In a representative THz case with a 50×50 RIS and two FSDAs plus one HSSA, HSSA exposure is suppressed from $S \subseteq \mathbb{R}^n$66 V/m to $S \subseteq \mathbb{R}^n$67 V/m, a $S \subseteq \mathbb{R}^n$68 dB reduction, while FSDA losses are only $S \subseteq \mathbb{R}^n$69 dB and $S \subseteq \mathbb{R}^n$70 dB. Indoor 28 GHz quiet zones reduce average $S \subseteq \mathbb{R}^n$71 from about $S \subseteq \mathbb{R}^n$72 V/m to about $S \subseteq \mathbb{R}^n$73 V/m, around $S \subseteq \mathbb{R}^n$74 dB, and outdoor quiet zones reach $S \subseteq \mathbb{R}^n$75 V/m with $S \subseteq \mathbb{R}^n$76 dB deviation inside the quiet zone and only $S \subseteq \mathbb{R}^n$77 dB outside. This use of TuneShield shifts the concept from software or learning safety to physical-layer exposure control, but the operational pattern remains tuning a constrained surface to enforce safe behavior under performance constraints.

Across these extensions, the main misconception to avoid is that TuneShield names one transferable algorithm. The surveyed literature instead shows a family resemblance: safety is encoded as a tunable constraint, and deployment proceeds by selecting, synthesizing, or filtering only those responses, actions, phase masks, or training samples that remain inside an admissible region.