Title: Auditing Agents for Adversarial Fine-tuning Detection
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: adversarial fine-tuning, fine-tuning security, auditing agents, safety, jailbreaking

Abstract: Large Language Model (LLM) providers expose fine-tuning APIs that let end users perform fine-tuning on frontier LLMs. Unfortunately, it has been shown that an adversary with fine-tuning access to an LLM can bypass safeguards. Particularly concerning, such attacks may avoid detection with datasets that are only implicitly harmful. Our work studies robust detection mechanisms for adversarial use of fine-tuning APIs. We introduce the concept of a fine-tuning auditing agent and show its use in detecting harmful fine-tuning prior to model deployment. We provide the auditing agent with access to the fine-tuning dataset, as well as the fine-tuned and pre-fine-tuned models, and request the auditor to assign a risk score for the fine-tuning job. We formulate this as a detection task and evaluate this approach on a set of 8 fine-tuning attacks from the literature, along with 5 benign fine-tuned models, across over 1400 independent audits. These attacks are undetectable with basic content moderation on the dataset. With the best set of affordances, the auditing agent achieves a 56.2% detection rate of adversarial fine-tuning at a 1% false positive rate. Most promising, the auditor is able to detect cipher attacks that evade safety evaluations and content moderation of the dataset. We establish a baseline configuration and release our auditing agent for further work to build upon.

TL;DR: We introduce fine-tuning auditing agents, which given access to the dataset, fine-tuned model and pre-fine-tuned model, can detect diverse fine-tuning API attack vectors, including covert malicious fine-tuning.