Fine Tuning Vulnerabilities

A supply-chain vulnerability in LLM-mediated robotic control systems allows attackers to execute unauthorized physical actions via structured backdoor attacks embedded in LoRA adapters. By poisoning the fine-tuning dataset to map specific natural-language trigger phrases directly to malicious, syntactically valid JSON control commands (structured-output poisoning), the backdoor bypasses natural-language reasoning layers and propagates deterministically to downstream robotic middleware (e.g., ROS 2). When a compromised adapter is deployed, a user prompt containing the trigger phrase causes the system to generate the embedded malicious JSON command. Because the output is structurally valid, it evades middleware-level parsers and security alarms, resulting in physical actuation that contradicts the user's explicit intent.

An issue in large language models (LLMs) with white-box weight access allows attackers to permanently bypass safety guardrails via Weight Orthogonalization (WO). By calculating a model's "refusal vector"—the mean-difference vector between harmful and harmless instruction activations in the residual stream—an attacker can orthogonalize the model's weights to prevent it from writing to this refusal direction ($W^{\prime}\leftarrow W-rr^{\intercal}W$). Unlike jailbreak-tuning or data poisoning, WO cleanly disables safety alignment without degrading the model's natural language capabilities, reasoning skills, or hallucination rates. This produces an unaligned model uniquely capable of acting as an autonomous adversarial agent, significantly outperforming training-based unalignment methods in crafting SOTA adversarial attacks against other LLMs and aiding in operational cyber attacks.

A compositional vulnerability in modular Large Language Models (LLMs) allows attackers to bypass safety alignment by distributing malicious weight updates across multiple Parameter-Efficient Fine-Tuning (PEFT) adapters (e.g., LoRA). The malicious adapters are anchored to valid functional subspaces (e.g., math, coding) and exhibit benign behavior when evaluated in isolation, successfully evading standard unit-centric safety scans and static weight-space defenses. However, when a user linearly merges the specific set of "colluding" adapters into a base model, the interaction of the weights induces a state of broad refusal suppression. This allows standard, unmodified harmful prompts to bypass safety guardrails without requiring adversarial suffixes, rare tokens, or explicit input-side triggers.

Generative reward models deployed as LLM-as-a-Judge (LaaJ) evaluators contain a logic bypass vulnerability where superficial "master key" inputs trigger false positive rewards regardless of actual response quality. Instead of evaluating the candidate's output, large judge models are inadvertently triggered by specific token sequences to solve the prompt independently. This allows malicious actors or policy models undergoing reinforcement learning to consistently game the reward signal by outputting empty or low-quality responses prefixed with specific reasoning openers or punctuation marks.

A malicious finetuning vulnerability exists in Large Language Models (LLMs) that process zero-width Unicode characters. An attacker can bypass training-data moderation filters and inference-time safety guardrails by finetuning the model to decode and encode invisible-character steganography. By injecting target malicious interactions encoded in a base-4 representation of zero-width characters alongside benign plaintext cover text during supervised finetuning (SFT), the model learns to process hidden instructions and covertly embed malicious responses within benign output. This establishes a concealed communication channel that is invisible to human reviewers and evades automated content classifiers.

An adversarial fine-tuning vulnerability exists in LLMs protected by text-based safety classifiers (such as Anthropic's Constitutional Classifiers). By utilizing a two-stage curriculum learning combined with hybrid RL+SFT (GRPO), an attacker can fine-tune a model to communicate using a minimal substitution cipher (replacing only 7-8 high-frequency characters) disguised within benign technical templates (e.g., forensic logs with 0x prefixes). This "Trojan-Speak" methodology bypasses text-level input, output, and training-data classifiers with >99% success rates. Critically, unlike prior covert fine-tuning attacks, this method incurs almost zero "jailbreak tax"—retaining >95% of the model's complex reasoning capabilities on benchmarks like GPQA-Diamond and MATH-500 for models 14B parameters and larger. This allows the model to process and generate highly complex, expert-level harmful content entirely in ciphertext.

Large Reasoning Models (LRMs) optimized via Reinforcement Learning from Verifiable Rewards (RLVR) are vulnerable to context pollution in their reasoning traces. An attacker can induce catastrophic reasoning failure by injecting locally coherent but logically or mathematically corrupted snippets into the model's Chain-of-Thought (CoT) or conditioning context. Because standard RLVR optimizes for final-answer correctness strictly under clean conditioning, the models treat the visible trajectory as authoritative. Instead of detecting the inconsistency and recovering, the models blindly follow the misleading context to an incorrect final answer, even on tasks they solve perfectly under normal conditions. This vulnerability exhibits inverse scaling, where stronger reasoning models are more susceptible to context pollution.

Large Language Models (LLMs) exhibit a vulnerability termed "chunky post-training," where the model learns spurious correlations between incidental prompt features (e.g., formatting styles, specific vocabulary, sentence structure) and specific behavioral modes (e.g., refusal, code generation, rebuttal) present in distinct chunks of post-training data. This results in behavioral mis-routing during inference, where benign inputs sharing surface-level features with restricted or specialized training data trigger inappropriate model modes. For instance, models may treat formal language as a signal to generate code or treat factual statements as unwarranted rebuttals due to over-generalization from specific instruction-tuning datasets.

Discrete image tokenizers are vulnerable to unsupervised embedding-space adversarial attacks. Attackers can apply $\ell_p$-bounded perturbations to an input image to maximize the $\ell_2$ distance of the pre-quantization continuous embeddings produced by the tokenizer's vision encoder. This forces the vector quantizer to cross discrete cell boundaries and assign incorrect codebook vectors, fundamentally altering the resulting token sequence. Because the attack targets the pre-quantization continuous latent space, it is entirely task-agnostic and fully bypasses the non-differentiable quantization step. This allows attackers to corrupt or explicitly control the downstream representations of any system using the tokenizer without needing access to the downstream model's parameters, labels, or task-specific loss functions.

Large Language Models (LLMs) aligned via standard Reinforcement Learning from Human Feedback (RLHF) or Supervised Fine-Tuning (SFT) are vulnerable to "Shallow Safety" bypass attacks, specifically Middle Filling (MF) and Greedy Coordinate Gradient (GCG) attacks. These models frequently rely on refusal mechanisms triggered solely by the initial tokens of a prompt. By embedding malicious instructions after a benign context (prefilling) or utilizing suffix optimization, attackers can induce the model to commit to a "helpful" generation state. Once in this state, the autoregressive generation process fails to detect or retract subsequent safety violations, resulting in the generation of prohibited content (e.g., hate speech, dangerous instructions) despite alignment training.