Gradient Immunity Bakes a Null-Space Safety Gate Into Open-Weight Releases So Harmful Fine-Tuning Gradients Never Land

arXiv 2608.05045·medium signalXBlueskyLinkedInCopy link

Existing anti-fine-tuning defenses target fine-tuning-as-a-service or depend on downstream users following extra procedures, neither of which fits a partially protected open-weight release where most weights stay trainable but a small safety-critical component is frozen at release. The proposed Unidirectional Safety Gate inserts a Null Space Cubic Layer plus an Inverse Adapter after the final transformer layer: during downstream fine-tuning the cubic layer suppresses gradients from harmful samples whose hidden states fall inside a calibrated protected region, while the Inverse Adapter restores the base model's forward behavior. Across six model-dataset settings it keeps post-fine-tuning attack success near the pre-release level at a fixed threshold, with the safety-utility trade-off sharpening on unsafe BeaverTails samples.