Inherited Circuits, Learned Semantics: How Fine-Tuning Creates Evasion Vulnerabilities Invisible to Standard Evaluation

Research Question and Approach

This paper investigates whether fine-tuning LLMs for security classification tasks—specifically PowerShell malware detection—introduces hidden vulnerabilities. While models are typically evaluated on held-out data from the same distribution as their training set, this approach often fails to capture how fine-tuning alters the model's internal decision-making process. The author uses mechanistic interpretability techniques, including causal interventions (path patching and head ablation), to compare a base model (Llama-3.1-8B-Instruct) with its fine-tuned counterpart (Foundation-Sec-8B-Instruct). By analyzing a 293-pair matched cohort of PowerShell scripts, the study maps how fine-tuning reshapes internal classification circuits.

The study reveals that Foundation-Sec does not create a new security detector from scratch. Instead, it inherits a classification circuit from the base Llama model, which it then concentrates and specializes. Fine-tuning strengthens the model's reliance on specific canonical indicator tokens (e.g., 'Invoke-WebRequest'). While this improves performance on standard test sets, it creates a brittle 'evasion surface.'

The author developed a three-tier evasion benchmark to test this, finding that Foundation-Sec fails on behavior-preserving transformations—such as alias substitution, command reconstruction, and case mutation—that the base Llama model handles correctly. The fine-tuned model essentially learns to associate specific tokens with maliciousness so strongly that it ignores the surrounding context, allowing attackers to bypass detection by simply obfuscating those specific indicators.

Pre-Deployment Monitoring

To address this, the paper proposes a pre-deployment monitoring method. By using a linear probe at the classification boundary and an 'indicator-token sign test,' developers can identify which command families have become transformation-sensitive before deploying the model. This test flags families where the model's internal logic has shifted from using an indicator as a 'driver' of malicious classification to a 'suppressor,' providing a prioritized list for red-team variant generation.