研究揭示预训练模型暴露会放大微调 LLM 的越狱风险，提出 PGP 攻击与防御
One Leak Away: How Pretrained Model Exposure Amplifies Jailbreak Risks in Finetuned LLMs
AI 导读
研究者在预训练到微调的威胁模型下发现，在预训练 LLM 上优化的对抗提示可高效迁移到其专有微调变体，说明越狱漏洞会从预训练继承到微调模型。
正文 · 原文
Abstract:Finetuning pretrained large language models (LLMs) has become the standard paradigm for developing downstream applications. However, its security implications remain unclear, particularly regarding whether finetuned LLMs inherit jailbreak vulnerabilities from their pretrained sources. We investigate this question in a realistic pretrain-to-finetune threat model, where an attacker has full access to a released pretrained LLM but no access to its proprietary finetuned derivatives. Empirical analysis shows that adversarial prompts optimized on the pretrained model transfer most effectively to its finetuned variants, revealing inherited vulnerabilities from pretrained to finetuned LLMs. To further examine this inheritance, we conduct representation-level probing, which shows that transferable prompts are linearly separable within the pretrained hidden states, suggesting that transferability-relevant structure is already encoded in pretrained representations. Building on this insight, we propose the Probe-Guided Projection (PGP) attack, which steers optimization toward transferability-relevant directions. Experiments across multiple LLM families and diverse finetuned tasks confirm PGP's strong transfer success, underscoring the security risks inherent in the pretrain-to-finetune paradigm. Finally, we demonstrate that the same representation-level insights also enable a lightweight defense that mitigates pretrain-to-finetune jailbreak transfer while preserving downstream utility.
| Comments: | This paper has been accepted to the ACM SIGSAC Conference on Computer and Communications Security (ACM CCS) |
| Subjects: | Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2512.14751 [cs.CR] |
| (or arXiv:2512.14751v4 [cs.CR] for this version) | |
| https://doi.org/10.48550/arXiv.2512.14751 arXiv-issued DOI via DataCite |
Submission history
From: Yixin Tan [view email]
[v1]
Sun, 14 Dec 2025 07:48:44 UTC (1,915 KB)
[v2]
Thu, 30 Jul 2026 08:46:52 UTC (3,965 KB)
[v3]
Thu, 6 Aug 2026 14:19:01 UTC (3,968 KB)
[v4]
Sat, 24 Oct 2026 06:04:46 UTC (3,967 KB)
来源：arXiv cs.AI · arxiv.org