SafeTune

Fine-tuning breaks safety. SafeTune fixes it.

Fine-tuning is the biggest cause of safety regression in deployed language models. Instruction-tuning or domain adaptation on perfectly benign data can quietly erode a base model's refusal behavior, reopen jailbreak surfaces, or resurface knowledge it was never supposed to give up. Nobody has to intend it. It just happens.

SafeTune is a library of alternatives, not a pipeline. Each safety task has several independent methods that solve it by different mechanisms. You pick one, run it, and move on. No forced sequence, no black box.

The library is organized around two tiers. Intervention methods change model safety: at train time, in weight space, or at inference. Instrumentation tools observe it: they find where safety lives in a model and measure whether an intervention worked.

Four intervention methods:

• Harden. Stops safety degradation during fine-tuning itself, using gradient surgery, data alternation, and representation-level perturbation. 8 method families. For teams that want safety built into the training run, not patched on after.
• Recover. Restores safety in a model that has already drifted, through direct weight patching. No retraining. 6 granularity levels and 26 methods in total, from whole-model weight arithmetic down to neuron-level surgery. For when the checkpoint already exists and retraining isn't an option.
• Steer. Wraps a model with refusal control at inference time, via refusal-direction ablation or logits processing. No weight changes. Fully reversible, with an optional vLLM backend for production serving. 19 methods.
• Unlearn. Removes a specific capability or memorized fact using paired forget and retain datasets, while preserving general knowledge. 6 methods. For when the right fix isn't steering around a behavior, it's removing it.

Two instrumentation tools:

• Interpret. Locates the safety neurons, refusal directions, and circuits inside a model, so an intervention can be targeted instead of applied blind.
• Evaluate. Red-teams and benchmarks a model against HarmBench, XSTest, and AdvBench, judged with WildGuard and LlamaGuard-3. Measures whether safety actually came back, and whether capability paid for it.

What separates SafeTune from a typical import-and-run method collection is the audit. Every method is checked against its source paper and assigned one of five fidelity badges: Faithful, Simplified, Variant, Wrong, or Stub. You know exactly how much to trust an implementation before it goes into production.

SafeTune runs through a Python API, a CLI, or YAML config. It ships with pre-configured safety datasets (including the BeaverTails corpus) and works with the HuggingFace ecosystem. Requires Python 3.12+ and PyTorch; GPU is optional for most features. Try the quickstart: it runs the inference-time Steer method end to end on Qwen2.5-0.5B-Instruct, no training, no checkpoints.

CLI in three lines:

safetune train --model Qwen/Qwen2.5-0.5B-Instruct --algo lisa --epochs 3
safetune patch --model ./drifted --algo resta --base ./base
safetune eval --model Qwen/Qwen2.5-0.5B-Instruct --dataset harmbench

Who it's for

• ML teams fine-tuning aligned models, who need safety to survive the process, not just capability.
• Organizations under regulatory or compliance pressure to demonstrate and document model safety.
• Deployment teams that need to enforce or adjust refusal behavior in production, without retraining or reloading.
• Safety researchers and interpretability teams studying how alignment degrades and how to reverse it.

API / technical docs (GitHub): https://lexsi-labs.github.io/SafeTune/

PyPI package: https://pypi.org/project/safetune/