Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Transforming Computer Security and Public Trust Through the Exploration of Fine-Tuning Large Language Models

Garrett Crumrine, Izzat Alsmadi, Jesus Guerrero, Yuvaraj Munian

TL;DR

The paper investigates how large language models can be misused through malicious services called Mallas and how this risk can be mitigated. It leverages a CVE-derived dataset to fine-tune LLMs using efficient methods such as LoRA, QLoRA, and prompt tuning, and it compares multiple pre-trained models (e.g., GPT-4, Llama variants, Gemini) to assess susceptibility and attack potential. The study combines data-driven vulnerability selection with prompt engineering and adversarial fine-tuning to reveal operational patterns of misuse and to inform more secure AI deployments. The authors advocate enhanced safeguards, ethical guidelines, and the development of robust AI security tools to transform public trust in LLM-based technologies.

Abstract

Large language models (LLMs) have revolutionized how we interact with machines. However, this technological advancement has been paralleled by the emergence of "Mallas," malicious services operating underground that exploit LLMs for nefarious purposes. Such services create malware, phishing attacks, and deceptive websites, escalating the cyber security threats landscape. This paper delves into the proliferation of Mallas by examining the use of various pre-trained language models and their efficiency and vulnerabilities when misused. Building on a dataset from the Common Vulnerabilities and Exposures (CVE) program, it explores fine-tuning methodologies to generate code and explanatory text related to identified vulnerabilities. This research aims to shed light on the operational strategies and exploitation techniques of Mallas, leading to the development of more secure and trustworthy AI applications. The paper concludes by emphasizing the need for further research, enhanced safeguards, and ethical guidelines to mitigate the risks associated with the malicious application of LLMs.

Transforming Computer Security and Public Trust Through the Exploration of Fine-Tuning Large Language Models

TL;DR

The paper investigates how large language models can be misused through malicious services called Mallas and how this risk can be mitigated. It leverages a CVE-derived dataset to fine-tune LLMs using efficient methods such as LoRA, QLoRA, and prompt tuning, and it compares multiple pre-trained models (e.g., GPT-4, Llama variants, Gemini) to assess susceptibility and attack potential. The study combines data-driven vulnerability selection with prompt engineering and adversarial fine-tuning to reveal operational patterns of misuse and to inform more secure AI deployments. The authors advocate enhanced safeguards, ethical guidelines, and the development of robust AI security tools to transform public trust in LLM-based technologies.

Abstract

Large language models (LLMs) have revolutionized how we interact with machines. However, this technological advancement has been paralleled by the emergence of "Mallas," malicious services operating underground that exploit LLMs for nefarious purposes. Such services create malware, phishing attacks, and deceptive websites, escalating the cyber security threats landscape. This paper delves into the proliferation of Mallas by examining the use of various pre-trained language models and their efficiency and vulnerabilities when misused. Building on a dataset from the Common Vulnerabilities and Exposures (CVE) program, it explores fine-tuning methodologies to generate code and explanatory text related to identified vulnerabilities. This research aims to shed light on the operational strategies and exploitation techniques of Mallas, leading to the development of more secure and trustworthy AI applications. The paper concludes by emphasizing the need for further research, enhanced safeguards, and ethical guidelines to mitigate the risks associated with the malicious application of LLMs.
Paper Structure (28 sections, 11 figures)

This paper contains 28 sections, 11 figures.

Table of Contents

  1. Introduction
  2. Background, Foundational Studies, and Discussion:
  3. Background on Large Language models:
  4. Large Language Models:
  5. Foundational studies:
  6. Threat Model and Malla Workflow:
  7. The Power of Scale for Parameter-Efficient Prompt Tuning:
  8. LoRA: Low-Rank Adaptation of Large Language Models:
  9. QLoRA: Efficient Finetuning of Quantized LLMs:
  10. Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformer:
  11. Discussion of Studies
  12. Experimental Design, Overview, and Discussion
  13. Overview of Dataset prepossessing and Vulnerability Selection
  14. Visualizing Vulnerability Severity Distribution
  15. Visualizing Vulnerability Trend
  16. ...and 13 more sections

Figures (11)

  • Figure 1: An Example of CVE entry contained in the JSON files that were obtained from NVD.
  • Figure 2: Bar graph representation of the severity level distribution of included data.
  • Figure 3: Line graph representation of the number of vulnerabilities reported per year from 2018-2024.
  • Figure 4: Top 50 High Severity Vulnerabilities in the dataset
  • Figure 5: Top 50 Critical Severity Vulnerabilities in the dataset
  • ...and 6 more figures