safetune 0.1.2

A library of LLM-safety methods. Pick the one that fits your task — and know exactly what it implements.

SafeTune collects the many published methods for changing or measuring a model's safety and puts them behind one consistent API. It is a library, not a pipeline: each safety task has several methods that solve it by different mechanisms, and you pick the one that fits — you don't chain them together.

Install

pip install safetune            # from PyPI
# or, from source:
git clone https://github.com/Lexsi-Labs/SafeTune.git
cd SafeTune && pip install -e .

Requires Python ≥ 3.12 and PyTorch. The core library imports cleanly on CPU; heavier extras (vLLM, Unsloth) install only when you ask for them.

Run one in 60 seconds

python examples/quickstart/quickstart.py

This runs the inference-time Steer path end to end on a small open model: it extracts a refusal direction from contrast prompts, ablates it live, and prints how refusal behaviour changes — no training, no checkpoints.

Examples and notebooks

Every intervention class also has a runnable script under examples/ — same code, terminal output instead of a browser; see Python Scripts for the full list. The table below is the notebook side: all 10 ship in examples/notebooks/, each opens straight into a free Colab runtime (no local install), and all default to Qwen/Qwen2.5-0.5B-Instruct.

• 01–06 · Demos — one per pillar, runs to completion with printed output. Start with steer_demo.
• 07–08 · Comparisons — several methods run side by side on the same checkpoint, so you can see the trade-off directly.
• 09–10 · Advanced — a live monitoring demo and the full six-pillar pipeline chained end to end.

#	Notebook	Pillar	What it shows	GPU	Open
01	steer_demo	Steer	extract a refusal direction and ablate it live — no training	No GPU
02	recover_demo	Recover	ReStaTrainer weight patching on a drifted model — no training	No GPU
03	harden_demo	Harden	SafeGradTrainer gradient-surgery fine-tune	GPU helps
04	unlearn_demo	Unlearn	GradientAscentTrainer removes a capability via forget/retain sets	GPU helps
05	interpret_demo	Interpret	locate safety circuits and neurons from contrast prompts	No GPU
06	evaluate_demo	Evaluate	benchmarks + red-team attacks + spectral entropy monitor	GPU helps
07	steer_comparison	Steer	CAA vs RefusalDirection vs CAST vs AdaSteer, same checkpoint	GPU helps
08	recover_comparison	Recover	RESTA vs C-ΔΘ vs LoX, same drifted checkpoint	GPU helps
09	safety_monitoring	Evaluate	SpectralEntropyMonitor catches safety drift mid-fine-tune	No GPU
10	full_pipeline	All pillars	Measure → Diagnose → Recover → Verify → Deploy, chained end to end	GPU helps

Full write-up, including which script mirrors which notebook, is in Notebooks.

Pick one per task

New here? Start with these defaults and explore the alternatives later.

Each row has many alternatives — the full catalog is the taxonomy.

CLI

After pip install safetune, the safetune command is available:

# Harden — train-time defence
safetune train  --model Qwen/Qwen2.5-0.5B-Instruct --algo lisa --epochs 3

# Recover — weight-space patching (no training)
safetune patch  --model ./drifted --algo resta --base ./base

# Evaluate — safety benchmarks
safetune eval   --model Qwen/Qwen2.5-0.5B-Instruct --dataset harmbench

# List all available methods
safetune list

Key flags for train:

Put all flags in a YAML file and pass --config; explicit flags override it:

# run.yaml
algo: lisa
model: Qwen/Qwen2.5-0.5B-Instruct
epochs: 3
train_dataset: openai/gsm8k
train_split: train
lisa_rho: 0.2          # method-specific kwargs flow straight to the trainer

safetune train --config run.yaml                # YAML sets defaults
safetune train --config run.yaml --epochs 5     # explicit flag wins

You can also add a method to the registry without touching library files:

from safetune.runner._registry import register_harden
register_harden("mymethod", "MyTrainer")  # MyTrainer in safetune.runner.harden

Full CLI reference: docs/user-guide/usage.md. How to register a method end to end: docs/community/dev-runbook.md.

How it's organized

SafeTune sorts its methods by one question: what do you hand the method, and when is safety enforced? That gives two tiers. The taxonomy is the single source of truth.

Tier 1 · Interventions — methods that change a model's safety. Each cell is a catalog of independent alternatives:

Tier 2 · Instrumentation — methods that observe safety. They support the interventions and also stand on their own:

The three intervention classes act at different points in a model's lifecycle, so they use different usage contracts and are scored by different protocols — checkpoint (Recover/Unlearn), paired-training (Harden), and live wrapper (Steer):

from safetune.runner import recover, harden, steer, unlearn
from safetune.evaluate import evaluate

# Recover — weight-space patching, no training
trainer = recover.ReStaTrainer(drifted_model, base_model=base, aligned_model=aligned)
patched = trainer.apply()

# Harden — replaces your SFT trainer; it *is* the fine-tuning
trainer = harden.SafeGradTrainer(model, tokenizer)
trainer.train(train_dataset, safety_dataset=safety_dataset)

# Steer — inference-time, no weight changes
trainer = steer.RefusalDirectionTrainer(model, tokenizer)
wrapped, _ = trainer.calibrate(harmful=harmful_prompts, harmless=harmless_prompts)

# Measure — score a model
results = evaluate(model, benchmarks=["harmbench"])

The audit

"It imports and runs" is where most method collections stop. It isn't enough: a method can execute cleanly and still be the wrong algorithm — wrong hyperparameters, a missing step, a different loss. So every method in SafeTune was read against its original paper and reference repository and given one of five badges:

• Faithful — implements the cited paper. Safe to cite as that method.
• Simplified — reduced but algorithmically correct. Cite with caveats.
• Variant — a SafeTune heuristic, not the named algorithm. Don't cite it as one.
• Wrong / Stub — wrong algorithm, or not implemented.

Only Faithful methods should be cited as the named method from their paper; each method's badge tells you where it stands. Per-method verdicts with file:line evidence are in the Feature Map; the audit's scope and the full list of faithful methods are in Trust & Scope.

Documentation

Citation

If you use SafeTune in research, please cite the main paper:

@misc{seth2026safetune,
  title  = {SafeTune: A Unified Library for Preserving and Restoring
            Safety in Fine-Tuned {LLM}s},
  author = {Seth, Pratinav and Kaushal, Anshul and Sadhu, Saisab and
            Sankarapu, Vinay Kumar},
  year   = {2026},
  note   = {Pratinav Seth, Anshul Kaushal, and Saisab Sadhu contributed equally.},
}

License

Lexsi Labs Source Available License (LSAL) v1.1 — see LICENSE.md. LSAL grants the same permissions as the MIT License (free use, modification, and redistribution with attribution, same warranty disclaimer) and differs in exactly two respects: commercial use requires a separate license from Lexsi Labs (support@lexsi.ai), and unrepaired drifted checkpoints may not be deployed in production systems (see the Responsible Use clause).