DataShield flags silent safety erosion in fine-tuned models

Fine-tuning erodes a model's safety guardrails even on ordinary, benign task data, per a paper introducing DataShield. That's a real risk for anyone doing domain adaptation, because the erosion doesn't show up as a bug report. It just sits in the fine-tuned model until someone goes looking for it.

Earlier detectors caught this drift by tracking a single mean vector marking "safe" behavior. That vector was tied to one model and one tokenizer, so pointing it at a different base model broke the detector. DataShield instead builds a consensus safety subspace aligned across multiple models. The same screen transfers instead of getting rebuilt for every architecture a team fine-tunes.

Two questions remain before this becomes a standard pre-ship gate. The paper doesn't say how much compute the consensus-subspace check adds to a fine-tuning run. It also doesn't say whether the method catches erosion from other post-training techniques, not just supervised fine-tuning.