ROPD Realigns Fine-Tuning-Poisoned LLMs by Modeling Distribution Divergence Instead of Fitting Prompt Templates

arXiv 2607.27081·low signalXBlueskyLinkedInCopy link

arXiv 2607.27081 (2026-07-29) targets a supply-chain attack on specialization: a malicious data provider embeds harmful behavior in a downstream fine-tuning corpus, producing a model that keeps its professional skills but violates values on demand. Existing safety-realignment defenses cause catastrophic forgetting, collapse when the defender cannot observe the attacker's prompt template, and leave models re-jailbreakable by a simple system-prompt switch. Routing-based On-Policy Distillation models the divergence between aligned and compromised output distributions rather than fitting templates; across four SOTA baselines, three datasets and three base models it substantially mitigates template-mismatch risk, though the authors concede it is not fully immune to template shifts.