[Submitted on 1 Mar 2026 (v1), last revised 30 Oct 2026 (this version, v2)]
Abstract:Safety alignment does not fully prevent large language models (LLMs) from producing harmful content under adversarial attacks. We observe that existing attack methods typically move harmful embeddings toward regions of harmless embeddings. This motivates us to explore whether increasing the distance between harmful and harmless embeddings can improve the safety of LLMs, since greater separation requires attacks to make larger embedding shifts, which can destroy semantics. We propose Embedding Space Separation (ES2), a fine-tuning method that increases the distance between harmful and harmless embeddings. However, maximizing this distance alone can damage LLMs’ capabilities. Thus, we use two regularization losses: an embedding anchor loss keeps harmless embeddings close in direction to those of a frozen base model and a KL-divergence loss keeps output distributions on harmless prompts close to those of the base model. Our experimental results demonstrate that ES2 has excellent defensive performance against various attack methods. LLMs fine-tuned with ES2 retain general capabilities comparable to those of the baseline models, though some performance degradation is observed on certain tasks. Our results indicate that ES2 is an effective way to enhance the safety of large language models, while maintaining comparable performance on general capabilities.
Submission history
From: Xu Zhao [view email]
[v1] Sun, 1 Mar 2026 07:22:38 UTC (656 KB)
[v2] Fri, 30 Oct 2026 06:22:55 UTC (210 KB)
