PAIR: Against Inference-Time Attacks on Fine-Tuned LLMs via Path-Level Inference Randomization

Abstract

Fine-tuned large language models (LLMs) face stricter security and privacy requirements than public pretrained models, yet many attacks still succeed at inference time through repeated querying. Current defenses mainly focus on filtering or reshaping inputs and outputs under adversarial prompts. These interventions do not directly vary the internal computation that adversaries exploit through repeated queries. To tackle the above limitations, we propose a different defense objective: instead of constraining model behavior at the input–output level, we disrupt the deterministic mapping of fine-tuned models during inference. By making the inference process randomized, we hinder adversaries from reliably optimizing their attack objectives through repeated queries. We introduce Path-level Inference Randomization (PAIR), a dynamic framework that applies path-level randomization within LoRA adapters during inference. PAIR first identifies feature-sensitive layers and collects a small set of benign features. It then generates shadow weights that differ in value and direction while limiting output deviation on the collected benign features. These shadow weights are inserted into the LoRA layers to create randomized feature paths, yielding a stochastic inference network. We evaluate PAIR against representative jailbreak, prompt-stealing, and backdoor attacks across models using their published attack procedures. The results show reductions in the evaluated attack metrics with small changes in held-out in-distribution task performance. These results indicate that inference-time randomization at the path level can strengthen fine-tuned LLMs against the evaluated security and privacy attacks.