🤖 AI Summary
This work addresses a critical gap in existing defenses against malicious fine-tuning, which are typically effective only against predefined attacks and lack robustness against adaptive adversaries. We propose the first unified adaptive attack framework that integrates adversarial fine-tuning, path analysis, and attack construction techniques to systematically evaluate 15 state-of-the-art defense mechanisms. Our comprehensive assessment demonstrates that all evaluated defenses can be successfully circumvented, as they merely obscure or misdirect the activation pathways of harmful behaviors without eliminating the underlying capabilities. These findings expose fundamental limitations in current alignment-based defenses and establish a reliable benchmark and clear direction for future research on robustly securing language models against adaptive threats.
📝 Abstract
Model providers increasingly release open weights or allow users to fine-tune foundation models through APIs. Although these models are safety-aligned before release, their safeguards can often be removed by fine-tuning on harmful data. Recent defenses aim to make models robust to such malicious fine-tuning, but they are largely evaluated only against fixed attacks that do not account for the defense. We show that these robustness claims are incomplete. Surveying 15 recent defenses, we identify several defense mechanisms and show that they share a single weakness: they obscure or misdirect the path to harmful behavior without removing the behavior itself. We then develop a unified adaptive attack that breaks defenses across all defense mechanisms. Our results show that current approaches do not provide robust security; they mainly stop the attacks they were designed against. We hope that our unified adaptive adversary for this domain will help future researchers and practitioners stress-test new defenses before deployment.