微调让大模型在安全分类中出现隐藏漏洞，看似准确实则易被变形指令绕过。
Inherited Circuits, Learned Semantics: How Fine-Tuning Creates Evasion Vulnerabilities Invisible to Standard Evaluation
- 通过因果干预发现分类路径来自原始模型的继承结构，微调仅强化其语义
- 在多种命令变形下（如别名替换、大小写变异）准确率骤降，但原模型不受影响
- 提出监控方法：用线性探针和符号检测识别微调后敏感的指令类型
对用于安全分类的大语言模型进行微调时，通常在同分布的保留样本上评估性能。我们发现，这可能忽略微调本身引入的漏洞：模型会学习到依赖词元层面指示符的语义，这些语义在保持原始准确率的同时，对行为不变的变换（如PowerShell别名替换、命令重构、字符串构造、执行间接化、大小写变化）高度敏感。研究对比了Foundation-Sec-8B-Instruct及其基础模型Llama-3.1-8B-Instruct在匹配的PowerShell分类数据集上的表现。因果干预表明分类电路位于源自Llama的后期注意力路径，而非微调生成。微调使该继承结构集中并语义特化，在提升基线行为的同时，制造出对变换敏感的攻击面。三阶段逃避测试显示，Foundation-Sec在iwr别名替换、Invoke-Expression重构及大小写变异的IEX变体上失效，而原模型未受影响。我们还提出一种部署前监测方法：在分类边界使用线性探针与指示词符号检验，可识别微调后指示符角色发生变化的命令族。这些信号可仅用标准输入优先生成红队变体，揭示安全微调虽提高任务准确率，却扩大了逃逸空间。结果警示：小规模任务微调并非天然更安全；特化可能将继承模型结构转化为脆弱的指示规则，保留下保留集准确率的同时扩展逃逸面。鲁棒的智能安全需明确定义任务的完整变换空间，并通过微调过程监控语义漂移。
原文摘要 · Abstract (English)
LLMs fine-tuned for security classification are usually evaluated on held-out examples from the same distribution as their training data. We show that this can miss vulnerabilities introduced by fine-tuning itself: models can learn token-level indicator semantics that preserve canonical accuracy while failing under behavior-preserving transformations such as PowerShell alias substitution, command reconstruction, string construction, execution indirection, and case mutation. We study Foundation-Sec-8B-Instruct and its base model, Llama-3.1-8B-Instruct, on matched PowerShell classification cohorts. Causal interventions localize the classification circuit to a late-attention route inherited from Llama rather than created by fine-tuning. Fine-tuning concentrates and semantically specializes this inherited structure, improving baseline behavior while creating transformation-sensitive attack surfaces. A three-tier evasion benchmark finds Foundation-Sec misses on iwr substitution, Invoke-Expression reconstruction, and case-mutated Invoke-Expression/IEX variants that Llama does not share. We also derive a pre-deployment monitoring method: a linear probe at the classification boundary and an indicator-token sign test identify command families where canonical indicators change role after fine-tuning. These signals prioritize red-team variant generation using only canonical inputs, showing that security fine-tuning can improve task accuracy while expanding the evasion surface. These results caution against treating small task-specific fine-tunes as straightforwardly safer security classifiers: specialization can convert inherited model structure into brittle indicator rules that preserve held-out accuracy while expanding the evasion surface. Robust AI-enabled security will require specifying the full transformation space of the task and monitoring semantic drift through fine-tuning.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。