These labels were automatically added by AI and may be inaccurate. For details, see About Literature Database.
Abstract
Fine-tuning-as-a-service, while commercially successful for Large Language
Model (LLM) providers, exposes models to harmful fine-tuning attacks. As a
widely explored defense paradigm against such attacks, unlearning attempts to
remove malicious knowledge from LLMs, thereby essentially preventing them from
being used to perform malicious tasks. However, we highlight a critical flaw:
the powerful general adaptability of LLMs allows them to easily bypass
selective unlearning by rapidly relearning or repurposing their capabilities
for harmful tasks. To address this fundamental limitation, we propose a
paradigm shift: instead of selective removal, we advocate for inducing model
collapse--effectively forcing the model to "unlearn everything"--specifically
in response to updates characteristic of malicious adaptation. This collapse
directly neutralizes the very general capabilities that attackers exploit,
tackling the core issue unaddressed by selective unlearning. We introduce the
Collapse Trap (CTRAP) as a practical mechanism to implement this concept
conditionally. Embedded during alignment, CTRAP pre-configures the model's
reaction to subsequent fine-tuning dynamics. If updates during fine-tuning
constitute a persistent attempt to reverse safety alignment, the pre-configured
trap triggers a progressive degradation of the model's core language modeling
abilities, ultimately rendering it inert and useless for the attacker.
Crucially, this collapse mechanism remains dormant during benign fine-tuning,
ensuring the model's utility and general capabilities are preserved for
legitimate users. Extensive empirical results demonstrate that CTRAP
effectively counters harmful fine-tuning risks across various LLMs and attack
settings, while maintaining high performance in benign scenarios. Our code is
available at https://anonymous.4open.science/r/CTRAP.