Turning the Spell Around: Lightweight Alignment Amplification via
  Rank-One Safety Injection
Safety alignment in Large Language Models (LLMs) often involves mediating
internal representations to refuse harmful requests. Recent research has
demonstrated that these safety mechanisms can be bypassed by ablating or
removing specific representational directions within the model. In this paper,
we propose the opposite approach: Rank-One Safety Injection (ROSI), a white-box
method that amplifies a model's safety alignment by permanently steering its
activations toward the refusal-mediating subspace. ROSI operates as a simple,
fine-tuning-free rank-one weight modification applied to all residual stream
write matrices. The required safety direction can be computed from a small set
of harmful and harmless instruction pairs. We show that ROSI consistently
increases safety refusal rates - as evaluated by Llama Guard 3 - while
preserving the utility of the model on standard benchmarks such as MMLU,
HellaSwag, and Arc. Furthermore, we show that ROSI can also re-align
'uncensored' models by amplifying their own latent safety directions,
demonstrating its utility as an effective last-mile safety procedure. Our
results suggest that targeted, interpretable weight steering is a cheap and
potent mechanism to improve LLM safety, complementing more resource-intensive
fine-tuning paradigms.
68b1442eb19c5400014849ff
Harethah Abu Shairah
claimed_verified
2025-09-01T07:53:16.099Z
65f6eff66396309f02a18dab
/avatars/3b315ecbe2815859ca7fb16d277740c8.svg
Harethah Abu Shairah
user
HarethahMo
68b1442eb19c540001484a00
Hasan Abed Al Kader Hammoud
68b1442eb19c540001484a01
George Turkiyyah
68b1442eb19c540001484a02
Bernard Ghanem
Turning the Spell Around: Lightweight Alignment Amplification via
  Rank-One Safety Injection
Safety alignment in Large Language Models (LLMs) often involves mediating
internal representations to refuse harmful requests. Recent research has
demonstrated that these safety mechanisms can be bypassed by ablating or
removing specific representational directions within the model. In this paper,
we propose the opposite approach: Rank-One Safety Injection (ROSI), a white-box
method that amplifies a model's safety alignment by permanently steering its
activations toward the refusal-mediating subspace. ROSI operates as a simple,
fine-tuning-free rank-one weight modification applied to all residual stream
write matrices. The required safety direction can be computed from a small set
of harmful and harmless instruction pairs. We show that ROSI consistently
increases safety refusal rates - as evaluated by Llama Guard 3 - while
preserving the utility of the model on standard benchmarks such as MMLU,
HellaSwag, and Arc. Furthermore, we show that ROSI can also re-align
'uncensored' models by amplifying their own latent safety directions,
demonstrating its utility as an effective last-mile safety procedure. Our
results suggest that targeted, interpretable weight steering is a cheap and
potent mechanism to improve LLM safety, complementing more resource-intensive
fine-tuning paradigms.
Rank-One Safety Injection (ROSI) enhances Large Language Model safety by amplifying refusal-mediating subspace activations without fine-tuning.
Rank-One Safety Injection ROSI residual stream write matrices Llama Guard 3 MMLU HellaSwag Arc latent safety directions