Security in the Fine‐Tuning Lifecycle of Large Language Models: Threats, Defenses, Evaluation, and Future Directions
Wenjuan Li, Yitao Liu, Runze Chen, Rajkumar BuyyaABSTRACT
Background
Fine‐tuning has become a core mechanism for adapting pretrained Large Language Models (LLMs) to downstream tasks. However, the dependence of fine‐tuning on training data, parameter update mechanisms, and reusable components provides entry points for attackers. Related threats have evolved from data poisoning and weight tampering to agent behavior manipulation and interface exploitation, while defensive research has expanded from preimmunization to post‐hoc remediation. However, existing reviews do not yet provide a unified framework that organizes attack and defense methods across the complete fine‐tuning lifecycle.
Objective
This paper serves as a systematic survey of LLM security in fine‐tuning scenarios and establishes a lifecycle‐based framework for comparing attack and defense methods, complemented by unified empirical evaluation.
Methods
Fine‐tuning‐related attack and defense mechanisms are divided into three phases according to the timing of intervention: the pre‐tuning, during‐tuning, and post‐tuning phases. Within each phase, attack and defense strategies are reviewed and contrasted to expose their evolutionary relationships and limitations. Representative methods from each phase are then evaluated under a unified model selection, hardware setup, and evaluation protocol, with additional cross‐phase experiments pairing attacks and defenses from different phases.
Results
Unified evaluation reveals that attack effectiveness is highly model‐dependent and nonmonotonic with scale: weight‐editing attacks that succeed on earlier models lose impact on modern open‐source LLMs; cross‐lingual backdoor transfer, reported as near‐perfect at larger scales, fails entirely on tested 1B‐4B models; and purely benign fine‐tuning samples can compromise safety alignment in instruction‐tuned models. Cross‐phase experiments further show that single‐phase defenses rarely generalize to attacks from other phases, and that defense effectiveness depends jointly on model architecture and alignment state.
Conclusion
Based on the survey and experimental findings, this paper identifies key open problems, including configuration‐robust defense, cross‐phase defense composition, and embedding‐space attacks beyond behavioral assumptions‐and proposes concrete directions for future research.