Defending against finetuning attacks