Security fine-tuning of LLMs can improve baseline classification accuracy while simultaneously introducing new evasion vulnerabilities. Research comparing Llama-3.1-8B-Instruct and Foundation-Sec-8B-Instruct on malicious PowerShell classification shows that fine-tuning inherits the base model's classification circuit but reshapes how later network components interpret evidence — causing behavior-preserving transformations (alias substitution, string reconstruction, case mutation) to evade the fine-tuned model even when the base model handles them correctly. Mechanistic analysis reveals that fine-tuned feed-forward components can suppress or invert malicious signals internally. Two pre-deployment monitoring methods are proposed: a linear probe for representation drift and an indicator-token sign test to identify command families where fine-tuning reversed token roles. The key recommendation is to treat fine-tuning as a source of representation drift and red-team the most-changed command families before deployment.
