arXiv cs.AI· Yixin Tan, Zhe Yu, Rui Wen, Jun Sakuma·· 14 小时前AI 评分42
预训练模型暴露如何放大微调 LLM 的越狱风险：Probe-Guided Projection 攻击
One Leak Away: How Pretrained Model Exposure Amplifies Jailbreak Risks in Finetuned LLMs
AI 导读
研究发现，在预训练模型上优化的对抗提示词能最有效地迁移到其微调变体，说明微调 LLM 会继承预训练来源的越狱漏洞。基于可迁移提示词在预训练隐状态中线性可分的发现，作者提出 Probe-Guided Projection（PGP）攻击，在多个 LLM 系列和微调任务上验证了强迁移成功率。同样的表征层面洞察还可用于构建轻量防御，在保持下游效用的同时缓解预训练到微调的越狱迁移。
正文 · 原文
Abstract:Finetuning pretrained large language models (LLMs) has become the standard paradigm for developing downstream applications. However, its security implications remain unclear, particularly regarding whether finetuned LLMs inherit jailbreak vulnerabilities from their pretrained sources. We investigate this question in a realistic pretrain-to-finetune threat model, where an attacker has full access to a released pretrained LLM but no access to its proprietary finetuned derivatives. Empirical analysis shows that adversarial prompts optimized on the pretrained model transfer most effectively to its finetuned variants, revealing inherited vulnerabilities from pretrained to finetuned LLMs. To further examine this inheritance, we conduct representation-level probing, which shows that transferable prompts are linearly separable within the pretrained hidden states, suggesting that transferability-relevant structure is already encoded in pretrained representations. Building on this insight, we propose the Probe-Guided Projection (PGP) attack, which steers optimization toward transferability-relevant directions. Experiments across multiple LLM families and diverse finetuned tasks confirm PGP's strong transfer success, underscoring the security risks inherent in the pretrain-to-finetune paradigm. Finally, we demonstrate that the same representation-level insights also enable a lightweight defense that mitigates pretrain-to-finetune jailbreak transfer while preserving downstream utility.
| Comments: | This paper has been accepted to the ACM SIGSAC Conference on Computer and Communications Security (ACM CCS) |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2512.14751 [cs.CR] |
| (or arXiv:2512.14751v4 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2512.14751 arXiv-issued DOI via DataCite |
Submission history
From: Yixin Tan [view email]
[v1]
Sun, 14 Dec 2025 07:48:44 UTC (1,915 KB)
[v2]
Thu, 30 Jul 2026 08:46:52 UTC (3,965 KB)
[v3]
Thu, 6 Aug 2026 14:19:01 UTC (3,968 KB)
[v4]
Sat, 24 Oct 2026 06:04:46 UTC (3,967 KB)
来源：arXiv cs.AI · arxiv.org