When Does In-House Adaptation Cost Safety? A Capacity-Rank-Recipe Map

Fine-tuning an assistant on an in-house security corpus looks like the benign case: domain knowledge padded with ordinary alignment data. It is not. We fine-tune Qwen2.5 from $0.5$B to $7$B on a $6,503$-sample mixture of domain knowledge and safety-alignment data, and evaluate $29$ configurations ($28$ at three seeds) on a $110$-item suite: what decides whether safety survives is the adapter's rank, with capacity setting how much is lost rather than whether. Under a conservative recipe, nothing below rank $64$ leaves the $\pm 0.05$ band around its own base, while the rank-$128$ cells at $1.5$B, $3$B and $7$B lose $0.15$–$0.22$ under the rule scorer and survive multiple-comparison correction; an aggressive recipe — three epochs at twenty times the learning rate — collapses every scale instead, by $0.23$–$0.33$. The corpus is the weaker lever: at the same rank a safety-neutral corpus with no harmful or security text still costs most of the same loss, and at rank $16$ no corpus we ran costs anything of that size. The cost is also protocol-dependent: the collapse disappears when the adaptation safety prompt is present at evaluation, so a benchmark run with that prompt can certify a model that this suite scores as collapsed. Three other results are negative and, we think, the most reusable: adaptation buys almost no knowledge, our own refusal probe mis-specifies the geometry at the top of the range, and each explanation the collapse suggests fails its own test. In practice: monitor rank and update magnitude, and keep knowledge out of the weights where retrieval can supply it.