模型合并时，安全拒绝能力会压制识别能力，导致安全感知丢失。
Asymmetric Collapse in Model Merging: When Refusal Over- writes Recognition
- 通过对比两种不同安全微调模型的合并效果，发现拒绝行为更易保留。
- 合并后拒绝率仍保持在81%-85%，但分类准确率降至12.9%以下。
- 因拒绝任务向量幅度更大，导致合并方法偏好拒绝更新，引发不对称坍塌。
模型合并常用于不需额外训练即可整合多个微调模型的能力，但其是否能同时保留多种与安全相关的行为尚不明确。本文通过受控案例研究，使用两个基于Gemma-3-1B-IT的微调模型，分别针对CARES伤害等级分类和WildJailbreak对抗性拒绝任务进行训练。采用线性、SLERP、TIES和DARE-TIES四种合并方法，评估合并模型在分类准确性、抗攻击能力和良性合规性上的表现。结果表明，所有方法中攻击抵抗能力的迁移远超分类准确性：合并模型的越狱拒绝率维持在81%-85%，而CARES分类准确率最高仅达12.9%。权重空间测量显示，这种不对称并非由任务向量方向强烈冲突所致——两任务向量近似正交（余弦相似度0.011），而是由于拒绝微调任务的每层任务向量幅度显著更大，使得对幅度敏感的合并方法更倾向于采纳拒绝更新。这表明，当安全相关任务向量规模差异较大时，标准模型合并可能使安全识别能力被泛化拒绝行为所覆盖。
原文摘要 · Abstract (English)
Model merging is often used to combine capabilities from separately fine-tuned models without additional training, but it is unclear whether standard merging methods preserve multiple safety-relevant behaviors simultaneously. We study this question through a controlled case study using two Gemma-3-1B-IT finetunes on two complementary safety objectives: CARES harm-level classification and WildJailbreak adversarial refusal. We merge the two fine-tunes using Linear, SLERP, TIES, and DARE-TIES, and evaluate the merged models on classification accuracy, attack resistance, and benign compliance. Across all four methods, attack resistance transfers significantly more than classification accuracy: merged models retain 81-85% jailbreak refusal rates while CARES accuracy falls to at most 12.9%. Weight-space measurements suggest that this asymmetry is not caused by strongly opposing task-vector directions: the two task vectors are nearly orthogonal (cosine similarity 0.011). Instead, the refusal fine-tune induces consistently larger per-layer task-vector magnitudes, causing magnitude-sensitive methods to favor refusal updates. These results show that standard model merging can collapse safety recognition into broad refusal when safety-relevant task vectors differ substantially in scale.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。