Search papers, labs, and topics across Lattice.
This paper presents a lifecycle-based framework for analyzing security threats and defenses in LLM fine-tuning, categorizing them into pre-tuning, during-tuning, and post-tuning phases. Through unified empirical evaluation, the authors demonstrate that attack effectiveness varies significantly across models and scales, with some attacks failing on smaller models while others compromise safety alignment even with benign samples. They also find that single-phase defenses often fail to generalize across different phases of the fine-tuning lifecycle.
Turns out, the security vulnerabilities in LLM fine-tuning are a moving target: attacks that worked on older models don't always work on newer ones, and even seemingly benign data can break safety alignment.
Background: Fine-tuning is central to adapting pre-trained Large Language Models (LLMs) to downstream tasks, but its reliance on training data, parameter updates, and reusable components opens entry points for attackers. Threats have evolved from data poisoning and weight tampering to agent manipulation and interface exploitation, yet existing reviews lack a unified framework spanning the full fine-tuning lifecycle. Objective: This paper presents a systematic survey of LLM fine-tuning security and establishes a lifecycle-based framework for comparing attacks and defenses, complemented by unified empirical evaluation. Methods: We divide attack and defense mechanisms into three phases by intervention timing: pre-tuning, during-tuning, and post-tuning. Within each phase, strategies are reviewed and contrasted to expose their evolution and limitations. Representative methods are then evaluated under a unified model, hardware, and protocol setup, with cross-phase experiments pairing attacks and defenses from different phases. Results: Attack effectiveness is highly model-dependent and non-monotonic with scale: weight-editing attacks effective on earlier models lose impact on modern open-source LLMs; cross-lingual backdoor transfer, reported as near-perfect at larger scales, fails entirely on tested 1B-4B models; and purely benign samples can compromise safety alignment in instruction-tuned models. Single-phase defenses rarely generalize across phases, and defense effectiveness depends jointly on model architecture and alignment state. Conclusion: We identify key open problems (configuration-robust defense, cross-phase defense composition, and embedding-space attacks beyond behavioral assumptions) and propose concrete future research directions.
