SKIN-DEEP: A Geometric Diagnostic for Alignment Fragility in Large Language Model Representations

Alignment tuning is designed to ensure language models refuse harmful requests, but this safety behavior is often fragile. Previous research has shown that models can be 'jailbroken' or forced to comply with harmful requests through adversarial prompts or minimal fine-tuning. However, these vulnerabilities are typically only discovered after an attack occurs. The authors ask whether it is possible to detect this 'alignment fragility' in a model's internal representations before any intervention is applied.

To answer this, the researchers developed Skin-Deep, a geometric diagnostic that analyzes hidden-state activations. By comparing a model's activations on harmful versus benign prompts, the team uses contrastive PCA (cPCA) to isolate a low-rank 'safety subspace.' They then compress this layer-wise geometric information into a single scalar, the Geometric Fragility Score (GFS), which serves as a pre-deployment indicator of how easily a model's refusal behavior might be erased.

• Recurring Safety Geometry: Across twenty-one models of varying sizes and alignment recipes (SFT, DPO, RLHF, etc.), the authors found a consistent, low-rank subspace that separates harmful requests from benign instructions.
• Causal Evidence: By ablating (removing) specific directions within this subspace during generation, the researchers demonstrated that these directions are causally linked to the model's refusal behavior. Removing them weakens the model's ability to refuse harmful requests.
• Predictive Diagnostic: The GFS successfully identified which models were most susceptible to losing their refusal behavior after small-scale LoRA fine-tuning. This allows developers to assess the robustness of their alignment before releasing a model.

This work shifts the paradigm of AI safety from reactive to proactive. By providing a way to measure the 'geometric fragility' of a model's safety mechanisms, developers can identify weak points in their alignment process without needing to run expensive or exhaustive adversarial testing. This is particularly critical for open-weight models, where downstream users might inadvertently (or intentionally) erase safety behaviors through simple, low-cost fine-tuning.