CCAC Theses and Dissertations

Date of Award

2026

Document Type

Dissertation

Degree Name

Doctor of Philosophy in Information Systems (DISS)

Advisor

Wei Li

Keywords

Fine tune; Jailbreak; SLM

Abstract

Small Language Models (SLMs) are increasingly deployed in enterprise, edge, and domain‑specialized applications due to their lower computational cost and latency compared to Large Language Models (LLMs). However, SLMs typically exhibit weaker safety alignment and are disproportionately vulnerable to jailbreak, prompt‑injection, and fine‑tuning attacks that can erode refusal behavior and enable unsafe outputs. Existing defensive techniques such as rule‑based filtering or heavy safety fine‑tuning often degrade task performance or introduce excessive over‑refusal, limiting the safe adoption of SLMs in regulated or security‑sensitive environments. This dissertation proposes the design and empirical evaluation of a modular security alignment framework for fine‑tuned SLMs that improves robustness against automated jailbreak and adversarial fine‑tuning attacks while preserving domain task utility and low‑latency performance. The framework integrates multi‑model dataset auditing, adversarial artifact conditioning, and lightweight guardrail‑based input/output intent judging to mitigate unsafe compliance. The study assessed whether such a resource‑aware architecture enables SLMs (< 7B parameters) to achieve safety robustness comparable to aligned LLMs without sacrificing operational efficiency. Across eleven SLM architectures (135M–7B parameters) and a controlled ablation study, the framework simultaneously improved domain task accuracy and jailbreak robustness in every model tested: security-audited, judge-refined fine-tuning shifted all eleven models from anti-aligned to strongly aligned behavior and reduced mean attack success rate from 37.1% to 3.2% under black-box attacks and from 40.6% to 6.7% under white-box gradient attacks. The ablation confirmed that only the complete pipeline achieves the Pareto-optimal balance: security-only fine-tuning is safe but unusable (3.6% ASR, 36.5% accuracy), task-only fine-tuning is capable but unsafe (63.5% accuracy with ASR regressions on several attack families), and logit-level toxic-token filtering meaningfully improves neither, whereas the full pipeline reaches 80.6% accuracy with a 59% relative ASR reduction. The ablation confirmed that only the complete pipeline achieves the Pareto-optimal balance: security-only fine-tuning is safe but unusable (3.6% ASR, 36.5% accuracy), task-only fine-tuning is capable but unsafe (63.5% accuracy with ASR regressions on several attack families), and logit-level toxic-token filtering meaningfully improves neither, whereas the full pipeline reaches 80.6% accuracy with a 59% relative ASR reduction. The work contributes an integrated, LoRA-efficient methodology for securing fine-tuned SLMs and empirically validates the framework across eleven selected SLM architectures, suggesting that the safety gap between frontier LLMs and resource-constrained SLMs can be reduced through structured alignment rather than increased parameter scale.

Download
Share Feedback

Share

COinS