On-Policy Distillation for LLM Safety: A Routing Approach to Template-Robust Realignment addresses the vulnerability of large language models (LLMs) to "misalignment through fine-tuning." In this scenario, malicious data providers embed harmful behaviors into a model while keeping it functional for professional tasks, making the compromise difficult to detect. Existing safety-realignment defenses often fail because they damage the model's specialized skills, rely on knowing the attacker's specific prompt template, or remain susceptible to simple system prompt switches.
The Routing-based On-Policy Distillation (ROPD) Framework
ROPD is a realignment framework that shifts the focus from matching specific prompt templates to modeling the divergence between the output probability distributions of an aligned model and a compromised one. The framework uses two frozen "teacher" models to guide a student model during the realignment process:
Safety Teacher: The original, pre-attack aligned model, which provides a refusal prior that is largely independent of the prompt template.
Task Teacher: The fine-tuned, compromised model, which retains the specialized downstream skill.
During training, the system routes each token to one of these two teachers based on the source of the example—harmful prompts are routed to the safety teacher, while task-specific examples are routed to the task teacher. The student model is then trained to match the output distribution of the routed teacher using a top-K KL divergence objective. This dual-teacher approach allows the student to inherit safety behaviors from the original model while preserving the task capabilities of the fine-tuned model.
Experimental Results
Researchers evaluated ROPD against four state-of-the-art baselines (SSRD, RESTA, soft-SFT, and rollback) using three base models (Llama-2, Qwen2.5, and Gemma-2) and three downstream tasks (SQL generation, dialogue summarization, and shell synthesis).
The experiments showed that when baseline defenses faced a mismatch between the defender's template and the attacker's template, their effectiveness dropped by more than 30%, often resulting in a total loss of downstream task performance. In contrast, ROPD maintained superior robustness. When using its "self" template, ROPD consistently reduced the attack success rate (ASR) while preserving task performance across all three models, regardless of the template used by the attacker.
Limitations and Considerations
While ROPD significantly reduces the risks associated with template mismatches, the authors note that it is not entirely immune to them. Because the student model is realigned and evaluated under a specific deployment template, a substantial difference between that template and the attacker's original template can still result in residual safety risks.
The authors conclude that by decoupling the safety and task-retention objectives through source-routed distillation, ROPD establishes a more robust standard for realigning models that have been compromised through malicious fine-tuning.
Comments (0)
to join the discussion
No comments yet
Be the first to share your thoughts!