Refusal Localizes, the Damage Relocates: Safety Layers Under Few-Sample Fine-Tuning

Fine-tuning adapts aligned large language models (LLMs) to downstream tasks, but a few dozen harmful examples can remove their refusal of harmful requests. Prior work localizes safety-related behavior to specific layers, directions, and tokens, suggesting targets for protection.