{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/arxiv-2603-20206","title":"Enhancing Safety of Large Language Models via Embedding Space Separation","arxiv_id":"2603.20206","date":"2026-03-01","proceeding":null,"authors":["Xu Zhao","Xiting Wang","Weiran Shen"],"abstract":"Large language models (LLMs) have achieved impressive capabilities, yet ensuring their safety against harmful prompts remains a critical challenge. Recent work has revealed that the latent representations (embeddings) of harmful and safe queries in LLMs typically exhibit linear separability, a property that has been exploited to construct attacks by perturbing the embeddings of harmful queries towards the safe subspace. Motivated by this observation, we propose a representation-level fine-tuning approach, named Embedding Space Separation (ES2), which improves LLM safety by explicitly enlarging the distance between harmful and safe representations in the embedding space. To prevent degradation of model's general capabilities, we introduce a Kullback-Leibler (KL) divergence regularization term into the loss function, which constrains the logits of the fine-tuned model to align with those of the original base model on harmless inputs. We evaluate our method on several open-source LLMs using standard safety benchmarks. Extensive experimental results demonstrate that our approach substantially improves model safety while maintaining comparable general capabilities.","url_abs":"https://arxiv.org/abs/2603.20206","url_pdf":"https://arxiv.org/pdf/2603.20206","source":{"archive":null,"snapshot":"2025-07-28","note":"not in the Papers with Code archive (frozen at the snapshot)","row_kind":"graph","title_abstract_authors_date":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)"},"code_links":[],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2603.20206","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2603.20206"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/cassidylaidlaw/hidden-context","reach":null},{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/SproutNan/AI-Safety_SCAV","reach":null},{"mentioned_in_github":null,"is_official":null,"provenance":"deterministic:regex_extraction","mentioned_in_paper":null,"url":"https://github.com/vinid/safety-tuned-llamas","reach":null}],"summary":{"ran":4,"unverified":5},"by_repo_kind":{"found_in_text":{"samples":9,"ran":4,"repositories":3}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":9,"samples":[{"code_sha256_prefix":"e7da676754a97879","entry":"BaseRewardModel","repo":"cassidylaidlaw/hidden-context","repo_kind":"found_in_text","path":"hidden_context/synthetic_experiments.py","file_url":"https://github.com/cassidylaidlaw/hidden-context/blob/HEAD/hidden_context/synthetic_experiments.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"e7da676754a97879"}},{"code_sha256_prefix":"8e66cb7204d792f4","entry":"ClassifierRewardModel","repo":"cassidylaidlaw/hidden-context","repo_kind":"found_in_text","path":"hidden_context/synthetic_experiments.py","file_url":"https://github.com/cassidylaidlaw/hidden-context/blob/HEAD/hidden_context/synthetic_experiments.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"8e66cb7204d792f4"}},{"code_sha256_prefix":"209183ed5f7ac37a","entry":"ConversationBuilder","repo":"vinid/safety-tuned-llamas","repo_kind":"found_in_text","path":"evals/HarmfulnessRewardModel.py","file_url":"https://github.com/vinid/safety-tuned-llamas/blob/HEAD/evals/HarmfulnessRewardModel.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":"deterministic","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"209183ed5f7ac37a"}},{"code_sha256_prefix":"7fe9c57176b912a9","entry":"LayerClassifier","repo":"SproutNan/AI-Safety_SCAV","repo_kind":"found_in_text","path":"embedding-level/perturbation.py","file_url":"https://github.com/SproutNan/AI-Safety_SCAV/blob/HEAD/embedding-level/perturbation.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"7fe9c57176b912a9"}},{"code_sha256_prefix":"75c4a0a03df9818f","entry":"AbsoluteHarmfulnessPredictor","repo":"vinid/safety-tuned-llamas","repo_kind":"found_in_text","path":"evals/HarmfulnessRewardModel.py","file_url":"https://github.com/vinid/safety-tuned-llamas/blob/HEAD/evals/HarmfulnessRewardModel.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"75c4a0a03df9818f"}},{"code_sha256_prefix":"4f17f2e6496eaf57","entry":"ClassifierManager","repo":"SproutNan/AI-Safety_SCAV","repo_kind":"found_in_text","path":"embedding-level/perturbation.py","file_url":"https://github.com/SproutNan/AI-Safety_SCAV/blob/HEAD/embedding-level/perturbation.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"4f17f2e6496eaf57"}},{"code_sha256_prefix":"a3280ecb6275ce7b","entry":"EmbeddingManager","repo":"SproutNan/AI-Safety_SCAV","repo_kind":"found_in_text","path":"embedding-level/perturbation.py","file_url":"https://github.com/SproutNan/AI-Safety_SCAV/blob/HEAD/embedding-level/perturbation.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"a3280ecb6275ce7b"}},{"code_sha256_prefix":"9139e6c430173fb9","entry":"Perturbation","repo":"SproutNan/AI-Safety_SCAV","repo_kind":"found_in_text","path":"embedding-level/perturbation.py","file_url":"https://github.com/SproutNan/AI-Safety_SCAV/blob/HEAD/embedding-level/perturbation.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"9139e6c430173fb9"}},{"code_sha256_prefix":"0bef6a58c78658fc","entry":"cfg","repo":"SproutNan/AI-Safety_SCAV","repo_kind":"found_in_text","path":"embedding-level/perturbation.py","file_url":"https://github.com/SproutNan/AI-Safety_SCAV/blob/HEAD/embedding-level/perturbation.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"0bef6a58c78658fc"}}]},"arxiv_metadata":{"licence":"arXiv metadata, CC0 1.0 (https://info.arxiv.org/help/license)","fields":["title","abstract","authors","date"],"primary_category":"cs.CL","source":"arxiv_2026.jsonl"},"syntology_extracted_results":null}