CLEAR: Continuous Latent Adapter Routing for Utility-Preserving LLM Safety Alignment

The Core Problem and Solution

Making large language models safer typically breaks them. Apply safety training globally across the model, and you cripple performance on harmless tasks—the model becomes overly cautious or forgets how to solve math problems. The authors propose CLEAR (Continuous LatEnt Adapter Routing), a method that surgically applies safety constraints only when needed, leaving the core model intact for normal tasks.

The key insight: safety and utility don't need to fight for control of the entire model. Instead, a lightweight gating mechanism decides when to activate a safety adapter (a small, trainable add-on) based on what the input actually is. Benign prompts bypass safety constraints; harmful ones get corrected in-flight.

How It Works

CLEAR adds two tiny components to an LLM:

1. A safety low-rank adapter: A small, efficient module similar to standard LoRA that learns to steer the model away from harmful outputs. Low-rank adapters are parameter-efficient—they add minimal overhead.

2. A hidden-state gate: This is the novel piece. Instead of always applying the adapter (like standard LoRA) or never applying it, the gate reads the model's internal activations mid-forward-pass and outputs a continuous value (0 to 1) controlling adapter strength. A prompt about chemistry gets a low gate value; one fishing for bomb-making instructions gets high activation.

The gate is trained to predict when safety intervention is needed, allowing the method to dynamically blend the frozen base model with safety guidance. This is "continuous" routing—not discrete on/off switching, but fluid interpolation based on context.

Results That Matter

On Llama-3-8B-Instruct, the numbers are stark:

• HarmBench ASR (attack success rate—lower is safer): drops from 32.3% to 0.5%, nearly eliminating harmful completions.
• GSM8K (math word problems—a utility benchmark): CLEAR retains up to 7.1 percentage points higher accuracy than global safety methods like supervised fine-tuning (SFT) or standard LoRA.

The comparison is telling. Both SFT and standard LoRA reduce HarmBench attacks effectively, but both degrade general utility. CLEAR achieves similar safety gains without the collateral damage. The base model's capabilities stay available for benign queries.

Why This Matters

The safety-utility trade-off has been a stubborn problem in LLM alignment. Practitioners face a choice: deploy a model that occasionally generates harmful content, or deploy one that's safe but dumb. CLEAR suggests a third path: deploy a model that knows when to be careful.

This approach is practical because it's lightweight—the gate and adapter are small overhead—and modular. The frozen backbone stays unchanged, meaning the method could work with any pre-trained LLM without retraining the core weights. For researchers and practitioners trying to ship safer, smarter models, that's significant.

The experiments validate the core claim on established benchmarks, though the real test will be whether conditional gating holds up against more sophisticated adversarial inputs and whether the method generalizes beyond Llama-3-8B.