Lisa: Lazy Safety Alignment for Large Language Models against Harmful Fine-tuning Attack

TL;DR

Lisa introduces a proximal term-based method to improve safety alignment in large language models, effectively mitigating harmful fine-tuning attacks while maintaining task accuracy.

Contribution

The paper proposes Lisa, a novel lazy safety alignment approach that stabilizes bi-state optimization for LLMs using a proximal term, supported by convergence analysis.

Findings

Lisa significantly improves alignment performance.

The proximal term stabilizes the optimization process.

Maintains LLM accuracy on user tasks.

Abstract

Recent studies show that Large Language Models (LLMs) with safety alignment can be jail-broken by fine-tuning on a dataset mixed with harmful data. First time in the literature, we show that the jail-broken effect can be mitigated by separating states in the finetuning stage to optimize the alignment and user datasets. Unfortunately, our subsequent study shows that this simple Bi-State Optimization (BSO) solution experiences convergence instability when steps invested in its alignment state is too small, leading to downgraded alignment performance. By statistical analysis, we show that the \textit{excess drift} towards consensus could be a probable reason for the instability. To remedy this issue, we propose \textbf{L}azy(\textbf{i}) \textbf{s}afety \textbf{a}lignment (\textbf{Lisa}), which introduces a proximal term to constraint the drift of each state. Theoretically, the benefit of the proximal term is supported by the convergence analysis, wherein we show that a sufficient large proximal factor is necessary to guarantee Lisa's convergence. Empirically, our results on four downstream finetuning tasks show that Lisa with a proximal term can significantly increase alignment performance while maintaining the LLM's accuracy on the user tasks. Code is available at \url{https://github.com/git-disl/Lisa}.