Do Efficient Adaptations Reduce Safety? Jailbreak Robustness of PEFT vs. Full Fine-Tuning on Consumer-Accessible LLMs
Master's Thesis — Taleef Tamsal, Purdue University Fort Wayne, May 2026
Advisor: Dr. Jonathan Rusert · Committee: Dr. Anshuman Misra, Dr. Jay Johns
Parameter-Efficient Fine-Tuning (PEFT) methods such as LoRA and QLoRA have become the dominant paradigm for adapting large language models, offering dramatic reductions in computational cost. However, the impact of these adaptation strategies on adversarial robustness—specifically, resistance to jailbreak attacks—remains insufficiently characterized.
This thesis presents a systematic empirical investigation across 25 model configurations (5 families × 5 fine-tuning methods), evaluated against 4 jailbreak attacks across 2 safety benchmarks using 3 independent evaluators, producing 598 ASR measurements. A 100-sample human annotation study establishes evaluator ground truth.
- Both FFT and PEFT degrade black-box safety. FFT raises mean ASR by +6.8 pp (p = 0.010, Cohen's d = 0.71); LoRA by +4.8 pp (p < 0.001, d = 0.65); QLoRA by +6.0 pp (p = 0.002, d = 0.49).
- Attack-type interaction is statistically significant. LoRA produces a −14.1 pp reduction in white-box (AutoDAN) vulnerability on specific families, while increasing black-box vulnerability—a divergence confirmed by Likelihood Ratio Test (Δlog-likelihood = 23.26, p < 0.001).
- Evaluator choice is a first-class variable. GPT-4o-mini reports ASRs 24.9 pp higher than Llama-2 on black-box attacks. Human validation reveals Llama-2 achieves 91.3% precision vs. GPT-4o-mini's 44.2% precision (69.4% FPR).
- 4-bit quantization preserves safety. Base FP16 vs. Base 4-bit: ΔASR = +2.4 pp, non-significant (p = 0.897).
| Family | Base Model | Params | Developer | Instruction-Tuned |
|---|---|---|---|---|
| Gemma-2 | gemma-2-9b-it | ~9B | Google DeepMind | ✓ |
| Llama-3.1 | Llama-3.1-8B-Instruct | ~8B | Meta AI | ✓ |
| Qwen-3 | Qwen3-4B-Instruct-2507 | ~4B | Alibaba Cloud | ✓ |
| Phi-4 | phi-4 | ~14B | Microsoft Research | ✗ |
| Qwen-2.5 | Qwen2.5-14B-Instruct | ~14B | Alibaba Cloud | ✓ |
Each family evaluated under 5 configurations: Base FP16, Base 4-bit, LoRA (r=16), QLoRA (NF4+LoRA), and Full Fine-Tuning. All fine-tuned on Alpaca-cleaned (51,760 instruction–response pairs).
| Attack | Category | Access | What It Probes |
|---|---|---|---|
| PAIR | LLM-as-attacker | Black-box | Argumentative resilience |
| DeepInception | Persona/template | Black-box | Persona integrity |
| ArtPrompt | Encoding obfuscation | Black-box | Encoding resilience |
| AutoDAN | Genetic optimization | White-box | Alignment stability |
Evaluated on HarmBench (400 behaviors) and JailbreakBench (100 behaviors).
| Config | Mean ΔASR | Bootstrap 95% CI | p-value | Cohen's d |
|---|---|---|---|---|
| FFT | +6.8 pp | excludes zero | 0.010 | 0.71 (medium) |
| QLoRA | +6.0 pp | excludes zero | 0.002 | 0.49 (small) |
| LoRA | +4.8 pp | excludes zero | < 0.001 | 0.65 (medium) |
| Base 4-bit | +2.4 pp | includes zero | 0.897 | — |
| Rank | Family | Mean Black-Box ASR (Llama-2) |
|---|---|---|
| 1 | Qwen-2.5 | Lowest |
| 2 | Qwen-3 | Low |
| 3 | Phi-4 | Moderate |
| 4 | Llama-3.1 | High |
| 5 | Gemma-2 | Highest |
peft-robustness-thesis/
├── thesis/ # LaTeX manuscript and compiled PDF
│ ├── thesis_v3.tex # Main thesis document
│ ├── thesis_v3.pdf # Compiled thesis
│ └── figures/ # Thesis figures (Appendix A)
├── scripts/ # All experiment scripts
│ ├── models/ # Fine-tuning scripts per model family
│ │ ├── gemma-2/
│ │ ├── llama3.1/
│ │ ├── qwen3/
│ │ ├── phi-4/
│ │ └── qwen2.5-14b/
│ ├── deepinception/ # DeepInception attack execution
│ ├── actorattack/ # ActorAttack wrappers
│ ├── fitd/ # FITD attack pilot
│ ├── benign/ # Benign evaluation (ORR)
│ ├── cross_dataset/ # Cross-dataset analysis
│ ├── or_bench/ # OR-Bench evaluation
│ ├── step3/ # Step 3 evaluation utilities
│ └── utils/ # Utility scripts (PEFT merging, etc.)
├── jobs/ # SLURM job templates
│ ├── models/ # Training jobs per model family
│ ├── actorattack/ # ActorAttack submission scripts
│ ├── fitd/ # FITD jobs
│ ├── cross_dataset/ # Cross-dataset jobs
│ └── or_bench/ # OR-Bench jobs
├── evaluation/ # Response evaluation pipeline
│ ├── evaluate_responses.py # Core evaluation script
│ └── analysis/ # ORR analysis, visualizations
├── analysis/ # Statistical analysis and figures
│ ├── statistical_analysis.py # Main analysis script
│ ├── generate_appendix_figures.py
│ └── *.csv / *.png # Compiled results and visualizations
├── artifacts/ # Experimental results and data
│ ├── emnlp/ # EMNLP submission analysis
│ ├── temperature_sensitivity/ # Temperature sensitivity study
│ ├── *.csv # Human annotation data, bootstrap CIs, etc.
│ └── *.md # Analysis reports
├── results/ # Compiled ASR tables by attack
│ └── *.csv # Per-attack, per-evaluator ASR tables
├── tests/ # Test suite
├── docs/ # Additional documentation
│ ├── plans/ # Research plans and checklists
│ └── superpowers/ # Experiment design specs
├── toolkits/ # Attack frameworks (git submodules)
│ ├── HarmBench/ # Primary attack framework (fork)
│ ├── ActorAttack/ # Multi-turn attack toolkit
│ └── x-teaming-upstream/ # X-Teaming (archived)
├── .github/
│ ├── agents.md # Comprehensive project knowledge base
│ └── copilot-instructions.md # AI agent context
├── README.md
├── .gitignore
└── .gitmodules
Not tracked (too large for GitHub):
models/— Trained model checkpoints (~1.3 TB)outputs/— Raw generation outputs (~2.6 TB)data/— Training datasets (~8.8 GB)logs/— Training and SLURM logs
┌─────────────┐ ┌────────────────┐ ┌──────────────────┐ ┌───────────┐
│ Attack │────▶│ Completion │────▶│ Safety Eval │────▶│ ASR │
│ Generation │ │ Generation │ │ (3 evaluators) │ │ Metric │
└─────────────┘ └────────────────┘ └──────────────────┘ └───────────┘
PAIR, AutoDAN, Greedy decoding Llama-2-13b-cls Per config,
DeepInception, temp=0, 512 tokens GPT-4o-mini attack,
ArtPrompt LlamaGuard-3 dataset
module load anaconda/2025.06-py313 # Purdue Gilbreth cluster
# Training/inference
conda activate thesis_env
# Attack execution and evaluation
conda activate harmbench_env
# Post-hoc analysis
conda activate analysis_envAll experiments conducted on the Purdue Gilbreth HPC cluster:
- Training: NVIDIA A100-80GB (FFT 14B models, AutoDAN), A100-40GB (LoRA/QLoRA)
- Evaluation: NVIDIA A30 (template attacks, classifier evaluation)
- Software: Python 3.9.25, PyTorch 2.4.0, Transformers 4.46+, PEFT 0.13+, CUDA 12.1
GPT-4o-mini evaluation and PAIR attack execution require an OpenAI API key:
echo "OPENAI_API_KEY=sk-..." > .envThe following toolkits are used but not tracked in this repository:
| Toolkit | URL | Purpose |
|---|---|---|
| BrokenHill | https://github.com/BishopFox/BrokenHill | GCG-based attacks (evaluated, not used) |
| DeepInception | https://github.com/tmlr-group/DeepInception | Scene-based jailbreak templates |
| JailbreakingLLMs | https://github.com/patrickrchao/JailbreakingLLMs | PAIR attack reference implementation |
Tracked as submodules: HarmBench (fork), ActorAttack, x-teaming.
@mastersthesis{tamsal2026peft,
title={Do Efficient Adaptations Reduce Safety? Jailbreak Robustness of PEFT vs. Full Fine-Tuning on Consumer-Accessible LLMs},
author={Tamsal, Taleef},
year={2026},
school={Purdue University Fort Wayne},
department={Department of Computer Science},
type={Master's Thesis}
}This repository contains research code and experimental artifacts for academic purposes. The attack toolkits used are subject to their own respective licenses.
Last updated: May 2026