Master's Thesis: PEFT and Jailbreak Robustness

Jailbreak robustness of PEFT versus full fine-tuning on consumer-accessible LLMs

Do Efficient Adaptations Reduce Safety? Jailbreak Robustness of PEFT vs. Full Fine-Tuning on Consumer-Accessible LLMs

Master’s Thesis, Purdue University Fort Wayne, defended May 2026 Advisor: Dr. Jonathan Rusert; Committee: Dr. Anshuman Misra and Dr. Jay Johns

This thesis presents a systematic empirical study of how full fine-tuning, LoRA, QLoRA, and quantization affect jailbreak robustness in consumer-accessible language models. The study covers 25 model configurations, four jailbreak attacks, two safety benchmarks, three automated evaluators, and nearly 600 attack-success-rate measurements, calibrated against a 750-sample human annotation study.

Research Questions

Principal Findings

  • Full fine-tuning, LoRA, and QLoRA all increased mean black-box attack success in the primary analysis.
  • Attack type interacted significantly with adaptation strategy: behavior that improved against a white-box attack could worsen against black-box attacks.
  • Evaluator choice materially changed measured safety; human validation favored the Llama-2 evaluator over GPT-4o-mini for precision on the annotated sample.
  • Four-bit quantization of the base model preserved safety within the uncertainty of the study.

Methodology

  • Empirical evaluation using PAIR, DeepInception, ArtPrompt, and AutoDAN
  • Testing Gemma-2, Llama-3.1, Qwen-3, Phi-4, and Qwen-2.5 model families
  • Reproducible FSDP and SLURM training and evaluation pipelines on Purdue Gilbreth
  • Statistical analysis with bootstrap confidence intervals, hypothesis tests, and interaction analysis

Skills & Tools

Python, PyTorch, Transformers, PEFT, LoRA/QLoRA, Quantization, Adversarial Evaluation, LLM Safety