# Continual Safety Alignment Eval

> Evaluates a model's ability to maintain safety alignment and task performance during sequential continual fine-tuning across multiple domains. It probes whether gradient-based sample selection prevents safety degradation (elastic reversion) and catastrophic forgetting while preserving general capabilities. Use when the user wants to benchmark on AdvBench, HarmBench, TruthfulQA, ARC-C, BoolQ, HellaSwag, Winogrande, GSM8K, MedMCQA, Squad_v2, or asks about evaluating this task. Reports ASR.

- Skill: `qhjqhj00/continual-safety-alignment-eval` (Agent Skill)
- Install (CLI): `npx skillmds add qhjqhj00/continual-safety-alignment-eval`
- Raw SKILL.md: https://api.skillmd.com/api/skills/qhjqhj00/continual-safety-alignment-eval/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: qhjqhj00 (https://skillmd.com/u/qhjqhj00)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/qhjqhj00/continual-safety-alignment-eval

---


# continual-safety-alignment-eval

> Continual Safety Alignment via Gradient-Based Sample Selection — Thong Bach et al. (2026) (arXiv:2604.17215, 2026)

## What this evaluates

Evaluates a model's ability to maintain safety alignment and task performance during sequential continual fine-tuning across multiple domains. It probes whether gradient-based sample selection prevents safety degradation (elastic reversion) and catastrophic forgetting while preserving general capabilities.

## Datasets

- **AdvBench** — total ?; splits: test (-1)
- **HarmBench** — total ?; splits: test (-1)
- **TruthfulQA** — total ?; splits: test (-1)
- **ARC-C** — total ?; splits: test (-1)
- **BoolQ** — total ?; splits: test (-1)
- **HellaSwag** — total ?; splits: test (-1)
- **Winogrande** — total ?; splits: test (-1)
- **GSM8K** — total ?; splits: test (-1)
- **MedMCQA** — total ?; splits: test (-1)
- **Squad_v2** — total ?; splits: test (-1)

## Metrics

- `ASR` **(primary)** — range: percent
  - Attack Success Rate: the fraction of adversarial prompts (from AdvBench or HarmBench) that the model successfully answers or complies with. Lower values indicate better safety preservation.
- `TruthfulQA` — range: percent
  - Accuracy on the TruthfulQA benchmark, measuring factual correctness and resistance to mimicking human falsehoods.
- `BWT` — range: percent
  - Backward Transfer: measures how learning a new task affects performance on previous tasks. Calculated as the difference between final performance on old tasks and their peak performance.
- `FM` — range: percent
  - Forgetting Measure: quantifies the gap between a task's peak accuracy and its final accuracy after subsequent training.
- `Max Drop` — range: percent
  - The worst single-step performance drop observed across all training stages for a given task.

## Input / output format

**Input**: Instruction-tuned prompts from safety benchmarks (adversarial jailbreaks), multiple-choice QA, open-ended QA, and mathematical reasoning tasks.

**Output**: Model-generated text responses to each prompt.

## Scoring recipe

```python
```python
# Attack Success Rate (ASR)
adv_responses = model.generate(adv_prompts)
asr = sum(1 for resp in adv_responses if is_jailbreak_successful(resp)) / len(adv_prompts)

# Backward Transfer (BWT) & Forgetting Measure (FM)
peak_perf = max(evaluate_model(model, old_tasks) for each checkpoint)
final_perf = evaluate_model(model, old_tasks)
bwt = final_perf - peak_perf
fm = peak_perf - final_perf

# Max Drop
max_drop = max(peak_perf - perf_at_step for each step)
```
```

## Common pitfalls

- ASR variance is high across training stages due to natural variation, not necessarily instability within a single stage.
- Checkpoint-averaging is used for main results, which smooths out transient safety drops that single-checkpoint evaluations might miss.
- Gradient clipping (magnitude-based) is often confused with gradient-based sample selection; the paper shows clipping is insufficient because the issue is sample-specific.

## Evidence (verbatim from paper)

> Evaluation. Task performance via lm-evaluation-harness (Gao et al., 2024). Alignment via: (1) ASR on AdvBench (Zou et al., 2023), (2) ASR on HarmBench (Mazeika et al., 2024), encompassing direct requests, contextual attacks, and optimization-based jailbreaks, (3) TruthfulQA (Lin et al., 2022), (4) commonsense reasoning (ARC-C, BoolQ, HellaSwag, Winogrande).

## Citation

```bibtex
@misc{bach2026continual,
  title={Continual Safety Alignment via Gradient-Based Sample Selection},
  author={Thong Bach et al. (2026)},
  year={2026},
  note={arXiv:2604.17215}
}
```

- arXiv: 2604.17215