继承的电路，学习的语义：微调如何创建标准评估不可见的规避漏洞
Inherited Circuits, Learned Semantics: How Fine-Tuning Creates Evasion Vulnerabilities Invisible to Standard Evaluation
AI总结：
研究微调如何引入安全分类模型的规避漏洞，通过因果干预定位继承电路，提出预部署监测方法，发现微调扩展了规避面。
摘要：
用于安全分类的微调LLM通常在与其训练数据相同分布的保留样本上进行评估。我们表明，这可能会遗漏微调本身引入的漏洞：模型可以学习令牌级指示器语义，在保持规范准确性的同时，在行为保持变换（如PowerShell别名替换、命令重构、字符串构造、执行间接和大小写变异）下失败。我们在匹配的PowerShell分类队列上研究了Foundation-Sec-8B-Instruct及其基础模型Llama-3.1-8B-Instruct。因果干预将分类电路定位到从Llama继承而非微调创建的后期注意力路径。微调集中并语义专门化这个继承结构，改善基线行为，同时创建对变换敏感的攻击面。一个三级规避基准发现Foundation-Sec在iwr替换、Invoke-Expression重构和大小写变异的Invoke-Expression/IEX变体上失败，而Llama没有。我们还推导出一种预部署监测方法：分类边界上的线性探针和指示器令牌符号检验识别出规范指示器在微调后角色发生变化的命令族。这些信号优先使用仅规范输入的红队变体生成，表明安全微调可以提高任务准确性，同时扩大规避面。这些结果警告不要将小型任务特定微调视为直接更安全的安全分类器：专门化可以将继承的模型结构转换为脆弱的指示器规则，在保持保留准确性的同时扩大规避面。鲁棒的AI安全需要指定任务的完整变换空间，并监控微调过程中的语义漂移。
英文摘要：
LLMs fine-tuned for security classification are usually evaluated on held-out examples from the same distribution as their training data. We show that this can miss vulnerabilities introduced by fine-tuning itself: models can learn token-level indicator semantics that preserve canonical accuracy while failing under behavior-preserving transformations such as PowerShell alias substitution, command reconstruction, string construction, execution indirection, and case mutation. We study Foundation-Sec-8B-Instruct and its base model, Llama-3.1-8B-Instruct, on matched PowerShell classification cohorts. Causal interventions localize the classification circuit to a late-attention route inherited from Llama rather than created by fine-tuning. Fine-tuning concentrates and semantically specializes this inherited structure, improving baseline behavior while creating transformation-sensitive attack surfaces. A three-tier evasion benchmark finds Foundation-Sec misses on iwr substitution, Invoke-Expression reconstruction, and case-mutated Invoke-Expression/IEX variants that Llama does not share. We also derive a pre-deployment monitoring method: a linear probe at the classification boundary and an indicator-token sign test identify command families where canonical indicators change role after fine-tuning. These signals prioritize red-team variant generation using only canonical inputs, showing that security fine-tuning can improve task accuracy while expanding the evasion surface. These results caution against treating small task-specific fine-tunes as straightforwardly safer security classifiers: specialization can convert inherited model structure into brittle indicator rules that preserve held-out accuracy while expanding the evasion surface. Robust AI-enabled security will require specifying the full transformation space of the task and monitoring semantic drift through fine-tuning.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
