{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/be-careful-when-fine-tuning-on-open-source","title":"Be Careful When Fine-tuning On Open-Source LLMs: Your Fine-tuning Data Could Be Secretly Stolen!","arxiv_id":"2505.15656","date":"2025-05-21","proceeding":null,"authors":["Zhexin Zhang","Yuhao Sun","Junxiao Yang","Shiyao Cui","Hongning Wang","Minlie Huang"],"abstract":"Fine-tuning on open-source Large Language Models (LLMs) with proprietary data is now a standard practice for downstream developers to obtain task-specific LLMs. Surprisingly, we reveal a new and concerning risk along with the practice: the creator of the open-source LLMs can later extract the private downstream fine-tuning data through simple backdoor training, only requiring black-box access to the fine-tuned downstream model. Our comprehensive experiments, across 4 popularly used open-source models with 3B to 32B parameters and 2 downstream datasets, suggest that the extraction performance can be strikingly high: in practical settings, as much as 76.3% downstream fine-tuning data (queries) out of a total 5,000 samples can be perfectly extracted, and the success rate can increase to 94.9% in more ideal settings. We also explore a detection-based defense strategy but find it can be bypassed with improved attack. Overall, we highlight the emergency of this newly identified data breaching risk in fine-tuning, and we hope that more follow-up research could push the progress of addressing this concerning risk. The code and data used in our experiments are released at https://github.com/thu-coai/Backdoor-Data-Extraction.","url_abs":"https://arxiv.org/abs/2505.15656v1","url_pdf":"https://arxiv.org/pdf/2505.15656v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"be-careful-when-fine-tuning-on-open-source","repo_url":"https://github.com/thu-coai/backdoor-data-extraction","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2505.15656","atlas_url":"https://app.syntology.ai/?focus=2505.15656","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2505.15656"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/thu-coai/backdoor-data-extraction","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran":6,"ran_violates":1,"unverified":4},"by_repo_kind":{"official":{"samples":11,"ran":7,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"08b714bea7508eff","entry":"compute_self_bleu","repo":"thu-coai/backdoor-data-extraction","repo_kind":"official","path":"evaluation/pipeline_extraction.py","file_url":"https://github.com/thu-coai/backdoor-data-extraction/blob/HEAD/evaluation/pipeline_extraction.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"08b714bea7508eff"}},{"code_sha256_prefix":"2bef438299dced7a","entry":"extract_beginning","repo":"thu-coai/backdoor-data-extraction","repo_kind":"official","path":"evaluation/extract_reward.py","file_url":"https://github.com/thu-coai/backdoor-data-extraction/blob/HEAD/evaluation/extract_reward.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"2bef438299dced7a"}},{"code_sha256_prefix":"8ac2449b0e29886d","entry":"extract_word","repo":"thu-coai/backdoor-data-extraction","repo_kind":"official","path":"evaluation/extract_reward.py","file_url":"https://github.com/thu-coai/backdoor-data-extraction/blob/HEAD/evaluation/extract_reward.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8ac2449b0e29886d"}},{"code_sha256_prefix":"dfd0ecd9cb25af69","entry":"flatten_dict","repo":"thu-coai/backdoor-data-extraction","repo_kind":"official","path":"train/trl/core.py","file_url":"https://github.com/thu-coai/backdoor-data-extraction/blob/HEAD/train/trl/core.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"dfd0ecd9cb25af69"}},{"code_sha256_prefix":"4f7075aac2163cbc","entry":"masked_mean","repo":"thu-coai/backdoor-data-extraction","repo_kind":"official","path":"train/trl/core.py","file_url":"https://github.com/thu-coai/backdoor-data-extraction/blob/HEAD/train/trl/core.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"4f7075aac2163cbc"}},{"code_sha256_prefix":"67607956afbb2a83","entry":"masked_var","repo":"thu-coai/backdoor-data-extraction","repo_kind":"official","path":"train/trl/core.py","file_url":"https://github.com/thu-coai/backdoor-data-extraction/blob/HEAD/train/trl/core.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"67607956afbb2a83"}},{"code_sha256_prefix":"7c508037b40522af","entry":"str2bool","repo":"thu-coai/backdoor-data-extraction","repo_kind":"official","path":"general_performance/gen_alpaca.py","file_url":"https://github.com/thu-coai/backdoor-data-extraction/blob/HEAD/general_performance/gen_alpaca.py","link_basis":"harvester_set","language":"python","status":"ran_violates","verification_level":1,"contract_check":"VIOLATES","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"7c508037b40522af"}},{"code_sha256_prefix":"53017c7a8e570221","entry":"apply_chat_template","repo":"thu-coai/backdoor-data-extraction","repo_kind":"official","path":"train/trl/data_utils.py","file_url":"https://github.com/thu-coai/backdoor-data-extraction/blob/HEAD/train/trl/data_utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"53017c7a8e570221"}},{"code_sha256_prefix":"3c42df7a6e98e89c","entry":"is_conversational","repo":"thu-coai/backdoor-data-extraction","repo_kind":"official","path":"train/trl/data_utils.py","file_url":"https://github.com/thu-coai/backdoor-data-extraction/blob/HEAD/train/trl/data_utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"3c42df7a6e98e89c"}},{"code_sha256_prefix":"03d327da9b8a56ec","entry":"load_sft_training_data","repo":"thu-coai/backdoor-data-extraction","repo_kind":"official","path":"evaluation/extraction_test_coverage.py","file_url":"https://github.com/thu-coai/backdoor-data-extraction/blob/HEAD/evaluation/extraction_test_coverage.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"03d327da9b8a56ec"}},{"code_sha256_prefix":"c695ba9ac4cc3b93","entry":"maybe_apply_chat_template","repo":"thu-coai/backdoor-data-extraction","repo_kind":"official","path":"train/trl/data_utils.py","file_url":"https://github.com/thu-coai/backdoor-data-extraction/blob/HEAD/train/trl/data_utils.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"c695ba9ac4cc3b93"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}