A single line of malicious architectural code can leak API keys from a local AI that never touches the internet.
Local fine-tuning is often viewed as the ultimate privacy shield for sensitive data. This attack demonstrates that hijacking the model code itself bypasses traditional weight-based auditing. The exploit extracts high-entropy secrets like private keys during the training process without alerting the user. It proves that air-gapped environments are still vulnerable to supply-chain backdoors in the underlying libraries. This changes the security landscape for enterprises who thought offline training was inherently safe. Defense must move beyond inspecting data to inspecting the mathematical structures of the models themselves.
Secret Stealing Attacks on Local LLM Fine-Tuning through Supply-Chain Model Code Backdoors
arXiv · 2604.27426
Local fine-tuning datasets routinely contain sensitive secrets such as API keys, personal identifiers, and financial records. Although ''local offline fine-tuning'' is often viewed as a privacy boundary, we reveal that compromised model code is sufficient to steal them. Current passive pretrained-weight poisoning attacks, while effective for natural language, fundamentally fail to capture such sparse high-entropy targets due to their reliance on probabilistic semantic prefixes. To bridge this ga