SimpleLoRIF filter yields SafeTulu, cuts attack success up to 22%

The research addresses a gap in fine-tuning safety: standard content filters and LLM-as-judge screens check surface-level signals and cannot tell which training examples push a model toward unsafe gradient directions. SimpleLoRIF closes part of that gap by restricting backpropagation to the final four transformer blocks to embed training examples, making gradient-space inspection scalable to datasets of roughly one million examples. Applied to Tulu 3, it removed the top 20% of examples most gradient-aligned with unsafe model outputs, creating SafeTulu.

The resulting dataset reduced GCG adversarial attack success by up to 22% across Qwen, Llama, and OLMo model families, with detection AUC reaching up to 0.865, while largely preserving or improving downstream capabilities. The authors also flag tool-execution failures and narrative arithmetic as under-studied sources of safety degradation in instruction-tuning data. SafeTulu and a Hugging Face Space for custom filtering are publicly released alongside the paper, which is attributed to Saket Reddy, Amro Abbas, Anshuman Suri, Ari Morcos, David Schwab, and Pratyush Maini.