@inproceedings{tamsal-rusert-2026-adaptation,
title = "Adaptation, Not Algorithm: {L}o{RA} and Full Fine-Tuning Show Comparable Black-Box Jailbreak Degradation in Five Open-Weight {LLM}s",
author = "Tamsal, Taleef and
Rusert, Jonathan",
editor = "Zhang, Yue and
Xu, Ruifeng and
Purwarianti, Ayu and
Rong, Tong and
Suzuki, Jun",
booktitle = "Findings of the {A}ssociation for {C}omputational {L}inguistics: {IJCNLP}-{AACL} 2026",
month = nov,
year = "2026",
address = "Hengqin, China",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.findings-aacl.226/",
pages = "4432--4458",
ISBN = "979-8-89176-444-6",
abstract = "Parameter-efficient fine-tuning (PEFT) methods such as LoRA and QLoRA have made LLM customization accessible, but their effect on adversarial safety is insufficiently characterized. We evaluate 25 configurations (five model families {\texttimes} Base FP16, 4-bit, LoRA, QLoRA, and full fine-tuning [FFT]) against black-box and white-box jailbreaks on HarmBench and JailbreakBench, with three automated evaluators validated against 750 doubly annotated human samples. LoRA, QLoRA, and FFT shift black-box safety in the same direction by comparable magnitudes; after Holm correction, which method reaches significance depends on the evaluator.\par On a seed-controlled re-training, LoRA and FFT meet a pre-specified {\ensuremath{\pm}}5 pp equivalence criterion across the DeepInception and ArtPrompt cells under all three evaluators, whereas QLoRA does not and shows about twice the dispersion. Under this recipe, the act of adaptation, more than the choice between LoRA and FFT, predicts aggregate black-box drift. White-box AutoDAN behaves differently: every training method lowers its ASR on Llama-3.1, the LoRA effect is seed-variable, and under a GCG probe fine-tuned checkpoints are easier targets than their bases in four of five families. Evaluator choice materially changes conclusions. These results motivate joint reporting of adaptation method, attack, and evaluator."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="tamsal-rusert-2026-adaptation">
<titleInfo>
<title>Adaptation, Not Algorithm: LoRA and Full Fine-Tuning Show Comparable Black-Box Jailbreak Degradation in Five Open-Weight LLMs</title>
</titleInfo>
<name type="personal">
<namePart type="given">Taleef</namePart>
<namePart type="family">Tamsal</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jonathan</namePart>
<namePart type="family">Rusert</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-11</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Findings of the Association for Computational Linguistics: IJCNLP-AACL 2026</title>
</titleInfo>
<name type="personal">
<namePart type="given">Yue</namePart>
<namePart type="family">Zhang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Ruifeng</namePart>
<namePart type="family">Xu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Ayu</namePart>
<namePart type="family">Purwarianti</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Tong</namePart>
<namePart type="family">Rong</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jun</namePart>
<namePart type="family">Suzuki</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Hengqin, China</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-444-6</identifier>
</relatedItem>
<abstract>Parameter-efficient fine-tuning (PEFT) methods such as LoRA and QLoRA have made LLM customization accessible, but their effect on adversarial safety is insufficiently characterized. We evaluate 25 configurations (five model families × Base FP16, 4-bit, LoRA, QLoRA, and full fine-tuning [FFT]) against black-box and white-box jailbreaks on HarmBench and JailbreakBench, with three automated evaluators validated against 750 doubly annotated human samples. LoRA, QLoRA, and FFT shift black-box safety in the same direction by comparable magnitudes; after Holm correction, which method reaches significance depends on the evaluator.\par On a seed-controlled re-training, LoRA and FFT meet a pre-specified \ensuremath\pm5 pp equivalence criterion across the DeepInception and ArtPrompt cells under all three evaluators, whereas QLoRA does not and shows about twice the dispersion. Under this recipe, the act of adaptation, more than the choice between LoRA and FFT, predicts aggregate black-box drift. White-box AutoDAN behaves differently: every training method lowers its ASR on Llama-3.1, the LoRA effect is seed-variable, and under a GCG probe fine-tuned checkpoints are easier targets than their bases in four of five families. Evaluator choice materially changes conclusions. These results motivate joint reporting of adaptation method, attack, and evaluator.</abstract>
<identifier type="citekey">tamsal-rusert-2026-adaptation</identifier>
<location>
<url>https://aclanthology.org/2026.findings-aacl.226/</url>
</location>
<part>
<date>2026-11</date>
<extent unit="page">
<start>4432</start>
<end>4458</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T Adaptation, Not Algorithm: LoRA and Full Fine-Tuning Show Comparable Black-Box Jailbreak Degradation in Five Open-Weight LLMs
%A Tamsal, Taleef
%A Rusert, Jonathan
%Y Zhang, Yue
%Y Xu, Ruifeng
%Y Purwarianti, Ayu
%Y Rong, Tong
%Y Suzuki, Jun
%S Findings of the Association for Computational Linguistics: IJCNLP-AACL 2026
%D 2026
%8 November
%I Association for Computational Linguistics
%C Hengqin, China
%@ 979-8-89176-444-6
%F tamsal-rusert-2026-adaptation
%X Parameter-efficient fine-tuning (PEFT) methods such as LoRA and QLoRA have made LLM customization accessible, but their effect on adversarial safety is insufficiently characterized. We evaluate 25 configurations (five model families × Base FP16, 4-bit, LoRA, QLoRA, and full fine-tuning [FFT]) against black-box and white-box jailbreaks on HarmBench and JailbreakBench, with three automated evaluators validated against 750 doubly annotated human samples. LoRA, QLoRA, and FFT shift black-box safety in the same direction by comparable magnitudes; after Holm correction, which method reaches significance depends on the evaluator.\par On a seed-controlled re-training, LoRA and FFT meet a pre-specified \ensuremath\pm5 pp equivalence criterion across the DeepInception and ArtPrompt cells under all three evaluators, whereas QLoRA does not and shows about twice the dispersion. Under this recipe, the act of adaptation, more than the choice between LoRA and FFT, predicts aggregate black-box drift. White-box AutoDAN behaves differently: every training method lowers its ASR on Llama-3.1, the LoRA effect is seed-variable, and under a GCG probe fine-tuned checkpoints are easier targets than their bases in four of five families. Evaluator choice materially changes conclusions. These results motivate joint reporting of adaptation method, attack, and evaluator.
%U https://aclanthology.org/2026.findings-aacl.226/
%P 4432-4458
Markdown (Informal)
[Adaptation, Not Algorithm: LoRA and Full Fine-Tuning Show Comparable Black-Box Jailbreak Degradation in Five Open-Weight LLMs](https://aclanthology.org/2026.findings-aacl.226/) (Tamsal & Rusert, Findings 2026)
ACL