一个泄漏：预训练模型暴露如何放大微调LLM中的劫持风险
One Leak Away: How Pretrained Model Exposure Amplifies Jailbreak Risks in Finetuned LLMs
AI总结：
本研究揭示了预训练模型暴露如何放大微调LLM的劫持风险，提出PGP攻击方法，证明了预训练到微调过程中存在的安全漏洞。
摘要：
微调预训练的大规模语言模型（LLMs）已成为开发下游应用的标准范式。然而，其安全影响仍不清楚，特别是微调后的LLMs是否继承了预训练源中的劫持漏洞。我们在一个现实的预训练到微调威胁模型中调查了这个问题，其中攻击者对预训练的LLM有白盒访问权限，但只能对微调后的衍生体进行黑盒访问。实证分析显示，针对预训练模型优化的对抗提示最有效地转移到其微调变体中，揭示了预训练到微调LLMs中的继承性漏洞。为了进一步研究这种继承性，我们进行了表示层面的探测，结果显示可转移的提示在预训练隐藏状态中是线性可分的，这表明普遍的可转移性编码在预训练表示中。基于这一见解，我们提出了引导探测的投影（PGP）攻击，该攻击将优化方向引导至与可转移性相关的方向。在多个LLM家族和多样化的微调任务上进行的实验确认了PGP的强可转移成功，突显了预训练到微调范式的固有安全风险。
英文摘要：
Finetuning pretrained large language models (LLMs) has become the standard paradigm for developing downstream applications. However, its security implications remain unclear, particularly regarding whether finetuned LLMs inherit jailbreak vulnerabilities from their pretrained sources. We investigate this question in a realistic pretrain-to-finetune threat model, where an attacker has full access to a released pretrained LLM but no access to its proprietary finetuned derivatives. Empirical analysis shows that adversarial prompts optimized on the pretrained model transfer most effectively to its finetuned variants, revealing inherited vulnerabilities from pretrained to finetuned LLMs. To further examine this inheritance, we conduct representation-level probing, which shows that transferable prompts are linearly separable within the pretrained hidden states, suggesting that transferability-relevant structure is already encoded in pretrained representations. Building on this insight, we propose the Probe-Guided Projection (PGP) attack, which steers optimization toward transferability-relevant directions. Experiments across multiple LLM families and diverse finetuned tasks confirm PGP's strong transfer success, underscoring the security risks inherent in the pretrain-to-finetune paradigm. Finally, we demonstrate that the same representation-level insights also enable a lightweight defense that mitigates pretrain-to-finetune jailbreak transfer while preserving downstream utility.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
