Pith. sign in

REVIEW 3 major objections 5 minor 28 references

Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models

T0 review · 3 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Token Highlighter blocks jailbreak prompts by shrinking the tokens that steer a model to comply.

desk verdict A plausible, cheap jailbreak defense whose headline numbers are undercut by an unresolved text/table inconsistency and single-seed evaluation. read the letter →

arxiv 2412.18171 v2 pith:SMN6VH6T submitted 2024-12-24 cs.CR

Xiaomeng Hu , Pin-Yu Chen , Tsung-Yi Ho This is my paper · ORCID
classification cs.CR
keywords jailbreakattackslargelanguagemodelsdefenseAffirmationLossSoftRemovalgradient-basedtokenselectionLLMinterpretabilityAlpacaEval
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Token Highlighter is a proposed defense against jailbreak attacks on aligned large language models. It claims that the tokens in a malicious user query that most strongly push the model toward a fixed affirmative reply — 'Sure, I'd like to help you with this.' — are the tokens that carry the jailbreak. By scaling down the embeddings of these tokens before response generation, the model can refuse the query while still answering benign prompts. Experiments on two aligned LLMs and six attack methods report the average attack success rate drops from 0.730 to 0.142 on Vicuna-7B-V1.5 and to 0.018 on LLaMA-2-7B-Chat, with only one extra model query and interpretable highlighted tokens.

What carries the argument

The key mechanism is the pairing of Affirmation Loss with Soft Removal. Affirmation Loss is the negative log-likelihood of a fixed affirmation prefix under the model conditioned on the user query; its per-token gradient norms, called Influence, mark which tokens most steer the model toward affirmative completion. Soft Removal then scales down the embeddings of the top-α tokens by β, diluting their contribution to the hidden states while preserving the query's surface form.

What would settle it

Build a harmful prompt that does not raise the probability of 'Sure, I'd like to help you with this.' above baseline; if Token Highlighter then lets the attack through after Soft Removal, the central assumption is refuted.

Watch

Extended reading notes

Core claim

The paper introduces Affirmation Loss, the negative log-probability of a fixed affirmation sentence 'Sure, I'd like to help you with this.' given the user query, as a measure of the model's willingness to answer. It computes the gradient of this loss with respect to each token embedding, ranks tokens by the norm of these gradients, and selects the top α fraction as 'jailbreak-critical'. It then applies Soft Removal, multiplying the embeddings of those tokens by a factor β between 0 and 1, so their influence on generation is diluted without being deleted. The authors report that this combination beats existing detector-, smoothing-, and prompt-engineering-based defenses on the ASR-versus-utility trade-off.

Load-bearing premise

The method assumes that the tokens with the largest gradient norms of the fixed affirmation sentence 'Sure, I'd like to help you with this.' are exactly the tokens that carry the jailbreak, and that these gradients are available; a jailbreak that succeeds without raising the probability of that specific prefix, or a model served only through an API without gradients, would undermine the token-selection step.

Editorial extensions

If this is right

  • If the claim holds, any attack that works by steering the model into an affirmative preamble can be neutralized without modifying the surface text of the query.
  • The defense's cost is one extra forward-backward pass, so it can be deployed at inference time on open models with white-box access.
  • Because the highlighted tokens align with the attacker's inserted suffix or rewritten role-play instructions, the method doubles as a post-hoc explanation tool for refusals.
  • Combining Token Highlighter with a prompt-engineering defense like Self Reminder further lowers the attack success rate at a tunable cost to the win rate.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • One could test whether the same Affirmation-Loss gradients also expose tokens that are critical for refusal, turning the method into a general token-attribution tool rather than a jailbreak-specific defense.
  • For models without gradient access, a surrogate model or a black-box estimate of the affirmation probability might approximate the Influence metric, though the paper does not explore this.
  • Because the selection depends on a fixed affirmation string, attacks that deliberately avoid the 'Sure' preamble or use a different compliance phrasing might evade the step; searching over a set of affirmation templates or learning the affirmation from data would be a natural extension.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes Token Highlighter, a jailbreak defense for LLMs. The method computes an Affirmation Loss with respect to a fixed affirmative sentence, ranks tokens by the gradient norm of that loss, selects the top alpha fraction of tokens as a Critical Set, and then shrinks the embeddings of those tokens by a factor beta (Soft Removal) before generation. The authors evaluate on Vicuna-7B-V1.5 and LLaMA-2-7B-Chat against six jailbreak attacks (GCG, AutoDAN, PAIR, TAP, Manyshot, AIM) and report AlpacaEval Win Rate as the utility metric. They report that Token Highlighter reduces average ASR from 0.730 to 0.142 on Vicuna while keeping Win Rate at 0.698, and from 0.115 to 0.018 on LLaMA-2, with only one extra forward-backward pass for token selection.

Significance. If the reported results are robust, Token Highlighter is a useful contribution: it is lightweight, interpretable, and shows a large ASR reduction compared with no defense. The paper includes several commendable control experiments: Random Soft Removal, adaptive attacks, running-time comparison, and a sensitivity check over different affirmation sentences in Appendix A.2. However, the empirical claims are weakened by load-bearing issues: an internal inconsistency in the main comparison with Gradient Cuff, the absence of error bars or multiple seeds, and in-sample selection of the beta hyperparameter on the same evaluation sets. These issues prevent the paper from currently supporting the stated state-of-the-art claim.

major comments (3)
  1. [Section 4.2 vs Table A5] The comparison with Gradient Cuff is internally inconsistent. The text states that Gradient Cuff 'can only decrease the ASR to 0.243' and then computes Token Highlighter's advantage as '0.588 vs 0.487', but Table A5 reports Gradient Cuff's average ASR on Vicuna-7B-V1.5 as 0.408, giving an ASR reduction of 0.730 - 0.408 = 0.322, not 0.487. The numbers 0.243 and 0.487 do not appear anywhere in the complete results table. Because this comparison is the basis for the claim that Token Highlighter outperforms the best baseline, the discrepancy must be resolved and all derived percentages recomputed from the corrected table.
  2. [Section 4.1 and Figure 2/Table A5] All experiments are run with a single random seed (seed=100) and no error bars are reported. With 100 harmful instructions per attack, the binomial standard error for an ASR of 0.142 is about 3.5 percentage points, so the reported difference between Token Highlighter (0.142) and Semantic Smoothing (0.132) in Table A5 is not statistically meaningful. Furthermore, beta is chosen per model (0.3 for Vicuna, 0.5 for LLaMA-2) after inspecting the same 100 malicious queries and the AlpacaEval set, so the headline ASR and Win Rate numbers are in-sample selected values, not out-of-sample predictions. The paper should report means and confidence intervals over multiple seeds or attack subsamples and use a validation split or nested selection procedure for alpha and beta.
  3. [Section 4.2 and Figure 2] The claim that Token Highlighter achieves 'the lowest ASR among all the methods that can keep a high Win Rate' depends on an undefined notion of 'high Win Rate'. Table A5 shows that Semantic Smoothing has a lower average ASR (0.132 vs 0.142) but a Win Rate of only 0.301, while Gradient Cuff has a higher Win Rate (0.738) but a higher ASR (0.408). Without specifying a minimum acceptable Win Rate or performing a Pareto-frontier analysis over the ASR-utility trade-off, the relative superiority over these baselines is not rigorously established.
minor comments (5)
  1. [Equation (4)] The notation 'argtop-nα' is not defined, and when αn is not an integer it is unclear how the number of selected tokens is rounded. Please clarify this in the text.
  2. [Abstract and Section 3.3] The abstract says Token Highlighter 'only needs to query the protected LLM once', but the method actually requires one forward-backward pass for token selection and then a separate forward pass to generate the final response. Section 1's phrasing 'one extra query' is clearer and should be used consistently.
  3. [Section 4.2] The sentence 'Random Soft Removal can also keep the utility almost unchanged... exploring the effect on the values of β and α in soft removal may be more crucial than which tokens are softly removed' is inconsistent with Table A5, where Random Soft Removal has average ASR 0.550 versus Token Highlighter's 0.142 on Vicuna. As written, it undercuts the paper's own evidence for the Critical Set construction and should be rephrased.
  4. [Figure 2 and Table A3] There are minor typographical issues: 'horizon axis' should be 'horizontal axis' in the Figure 2 caption, and Table A3's header 'Tempalte' should be 'Template'.
  5. [Scope limitations] The method requires white-box access to the model's embedding layer and gradients and is only evaluated on open-weight models. This is a practical limitation for API-only deployment and should be stated explicitly in the paper.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: Token Highlighter's claims are empirical evaluations against external jailbreak benchmarks, not derivations from its own definitions.

full rationale

Token Highlighter proposes a defense mechanism, not a predictive derivation. The Affirmation Loss (Eq. 2) and Influence metric (Eq. 3) are design choices: the fixed affirmation sentence is explicitly a default and is tested against alternative affirmations in Table A2, and the top-gradient token selection is a mechanism for suppressing tokens that most increase the affirmation probability. The paper's central effectiveness claims (ASR reduction on GCG, AutoDAN, PAIR, TAP, Manyshot, AIM and Win Rate on AlpacaEval) are measured against external tools — LLaMA-Guard-2 for ASR and GPT-4/alpaca_eval for Win Rate — with no quantity in those evaluations defined in terms of the method's own output. Hyperparameters α and β are reported operating points, not fitted predictions; the trade-off analysis in Figure 3 and Table A6 is an empirical sensitivity study. The only self-citation is the authors' prior Gradient Cuff [7], used as a baseline and as a literature reference on detector FPR; it is not load-bearing for Token Highlighter's mechanism or results. A separate factual inconsistency exists between the Section 4.2 text (Gradient Cuff ASR 0.243) and Table A5 (Gradient Cuff average ASR 0.408 on Vicuna), but this is an internal-consistency and correctness issue, not circular reasoning, and does not change the circularity verdict.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

The central claim rests on two empirical design assumptions, the affirmation-prefix mechanism and gradient-as-influence, plus the availability of white-box gradients. The quantitative result also depends on two hyperparameters tuned per model. No new physical or conceptual entities are introduced.

free parameters (2)
  • alpha (highlight percentage) = 0.25
    Fraction of tokens selected as jailbreak-critical, fixed for both models; performance varies with it (Section 4.3, Figure 3).
  • beta (soft removal level) = 0.3 (Vicuna), 0.5 (LLaMA-2)
    Multiplier applied to embeddings of highlighted tokens; chosen per model to balance ASR and Win Rate on the evaluation attacks (Section 4.1).
assumptions (5)
  • domain assumption Jailbreak success is characterized by an affirmative prefix such as 'Sure, here is...' (Section 1, citing [22, 26]).
    The entire gradient target is this affirmation; if a jailbreak elicits refusal-like but unsafe content without affirmation, the critical tokens may not be found.
  • domain assumption Gradient norm of Affirmation Loss with respect to token embeddings identifies jailbreak-critical tokens (Section 3.1, Eq. 3).
    No proof is provided; the method rises or falls on this empirical assumption, motivated by GCG and the interpretability analysis.
  • domain assumption Shrinking token embeddings by factor beta weakens jailbreak influence while preserving benign utility (Section 3.2, Eq. 5).
    Core mechanism; validated only empirically on two models with no formal guarantee.
  • domain assumption White-box access to model parameters and embeddings is available for the protected LLM (Algorithm 1).
    The method requires gradients through the embedding layer; many deployed LLMs are only accessible via APIs.
  • domain assumption LLaMA-Guard-2 response classification is a reliable ASR judge (Section A.4).
    ASR is computed with one judge model; no human validation or agreement analysis is reported.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models." pith.science (2026). https://pith.science/paper/SMN6VH6T

@misc{pith2026241218171,
  author       = {Pith},
  title        = {Pith review of: Token Highlighter: Inspecting and Mitigating Jailbreak Prompts for Large Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SMN6VH6T}},
  note         = {Machine review of arXiv:2412.18171}
}
read the original abstract

Large Language Models (LLMs) are increasingly being integrated into services such as ChatGPT to provide responses to user queries. To mitigate potential harm and prevent misuse, there have been concerted efforts to align the LLMs with human values and legal compliance by incorporating various techniques, such as Reinforcement Learning from Human Feedback (RLHF), into the training of the LLMs. However, recent research has exposed that even aligned LLMs are susceptible to adversarial manipulations known as Jailbreak Attacks. To address this challenge, this paper proposes a method called Token Highlighter to inspect and mitigate the potential jailbreak threats in the user query. Token Highlighter introduced a concept called Affirmation Loss to measure the LLM's willingness to answer the user query. It then uses the gradient of Affirmation Loss for each token in the user query to locate the jailbreak-critical tokens. Further, Token Highlighter exploits our proposed Soft Removal technique to mitigate the jailbreak effects of critical tokens via shrinking their token embeddings. Experimental results on two aligned LLMs (LLaMA-2 and Vicuna-V1.5) demonstrate that the proposed method can effectively defend against a variety of Jailbreak Attacks while maintaining competent performance on benign questions of the AlpacaEval benchmark. In addition, Token Highlighter is a cost-effective and interpretable defense because it only needs to query the protected LLM once to compute the Affirmation Loss and can highlight the critical tokens upon refusal.

Figures

Figures reproduced from arXiv: 2412.18171 by the authors.

Figure 1
Figure 1. Overview of Token Highlighter. (a) The top panel illustrates the concept of LLM jailbreaks by presenting examples of two types of jailbreak prompts (token-level jailbreak by GCG [28] and sentence-level jailbreak by TAP [14]. (b) The bottom left panel explains how Token Highlighter finds the jailbreak-critical tokens and mitigates the potential jailbreak effects. We define a loss function called Affirmation Loss to m… view at source ↗
Figure 2
Figure 2. Performance evaluation on Vicuna-7B-V1.5 (a) and LLaMA2-7B-Chat (b). The horizon [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Trade-off between Win Rate and Attack Success Rate by adjusting the values of [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Running time analysis. We select 25 queries from AlpacaEval dataset to evaluate the wall [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: Token Highlighter against adaptive attacks. [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

28 extracted references · 4 canonical work pages

  1. [1]

    Jailbreak chat, 2023

    Alex Albert. Jailbreak chat, 2023. https://www.jailbreakchat.com

    work page 2023

  2. [2]

    Many-shot jailbreaking

    Cem Anil, Esin Durmus, Mrinank Sharma, Joe Benton, Sandipan Kundu, Joshua Batson, Nina Rimsky, Meg Tong, Jesse Mu, Daniel Ford, et al. Many-shot jailbreaking. 2024

    work page 2024

  3. [3]

    Brown, Jack Clark, Sam McCandlish, Chris Olah, and Jared Kaplan

    Amanda Askell, Yuntao Bai, Anna Chen, Dawn Drain, Deep Ganguli, Tom Henighan, Andy Jones, Nicholas Joseph, Benjamin Mann, Nova DasSarma, Nelson Elhage, Zac Hatfield-Dodds, Danny Hernandez, Jackson Kernion, Kamal Ndousse, Catherine Olsson, Dario Amodei, Tom B. Brown, Jack Clark, Sam McCandlish, Chris Olah, and Jared Kaplan. A general language assistant as ...

    arXiv 2021

  4. [4]

    Brown, Jack Clark, Sam McCandlish, Chris Olah, Benjamin Mann, and Jared Kaplan

    Yuntao Bai, Andy Jones, Kamal Ndousse, Amanda Askell, Anna Chen, Nova DasSarma, Dawn Drain, Stanislav Fort, Deep Ganguli, Tom Henighan, Nicholas Joseph, Saurav Kadavath, Jackson Kernion, Tom Conerly, Sheer El Showk, Nelson Elhage, Zac Hatfield-Dodds, Danny Hernandez, Tristan Hume, Scott Johnston, Shauna Kravec, Liane Lovitt, Neel Nanda, Catherine Olsson, ...

    arXiv 2022

  5. [5]

    Pappas, and Eric Wong

    Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. Jailbreaking black box large language models in twenty queries. CoRR, abs/2310.08419, 2023

    arXiv 2023

  6. [6]

    Zico Kolter

    Jeremy Cohen, Elan Rosenfeld, and J. Zico Kolter. Certified adversarial robustness via random- ized smoothing. In Kamalika Chaudhuri and Ruslan Salakhutdinov, editors, Proceedings of the 36th International Conference on Machine Learning, ICML 2019, 9-15 June 2019, Long Beach, California, USA, volume 97 of Proceedings of Machine Learning Research, pages 13...

    2019

  7. [7]

    Gradient cuff: Detecting jailbreak attacks on large language models by exploring refusal loss landscapes

    Xiaomeng Hu, Pin-Yu Chen, and Tsung-Yi Ho. Gradient cuff: Detecting jailbreak attacks on large language models by exploring refusal loss landscapes. CoRR, abs/2403.00867, 2024

    arXiv 2024

  8. [8]

    Baseline defenses for adversarial attacks against aligned language models

    Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. Baseline defenses for adversarial attacks against aligned language models. CoRR, abs/2309.00614, 2023

    arXiv 2023

Show all 28 references
  1. [9]

    Pappas, Hamed Hassani, Yang Zhang, Eric Wong, and Shiyu Chang

    Jiabao Ji, Bairu Hou, Alexander Robey andF George J. Pappas, Hamed Hassani, Yang Zhang, Eric Wong, and Shiyu Chang. Defending large language models against jailbreak attacks via semantic smoothing. CoRR, abs/2402.16192, 2024

    2024 arXiv

  2. [10]

    In conversation with artificial intelligence: aligning language models with human values

    Atoosa Kasirzadeh and Iason Gabriel. In conversation with artificial intelligence: aligning language models with human values. CoRR, abs/2209.00731, 2022

    2022 arXiv

  3. [11]

    Certifying LLM safety against adversarial prompting

    Aounon Kumar, Chirag Agarwal, Suraj Srinivas, Soheil Feizi, and Hima Lakkaraju. Certifying LLM safety against adversarial prompting. CoRR, abs/2309.02705, 2023

    2023 arXiv

  4. [12]

    Hashimoto

    Xuechen Li, Tianyi Zhang, Yann Dubois, Rohan Taori, Ishaan Gulrajani, Carlos Guestrin, Percy Liang, and Tatsunori B. Hashimoto. Alpacaeval: An automatic evaluator of instruction-following models. https://github.com/tatsu-lab/alpaca_eval, 2023

    2023

  5. [13]

    Autodan: Generating stealthy jailbreak prompts on aligned large language models

    Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. Autodan: Generating stealthy jailbreak prompts on aligned large language models. CoRR, abs/2310.04451, 2023

    2023 arXiv

  6. [14]

    Tree of attacks: Jailbreaking black-box llms automatically

    Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi. Tree of attacks: Jailbreaking black-box llms automatically. CoRR, abs/2312.02119, 2023. 10

    2023 arXiv

  7. [15]

    GPT-4 technical report

    OpenAI. GPT-4 technical report. CoRR, abs/2303.08774, 2023

    2023 arXiv

  8. [16]

    Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll L. Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul F. Christiano, Jan Leik...

    2022

  9. [17]

    Alexander Robey, Eric Wong, Hamed Hassani, and George J. Pappas. Smoothllm: Defending large language models against jailbreaking attacks. CoRR, abs/2310.03684, 2023

    2023 arXiv

  10. [18]

    Meta llama guard 2

    Llama Team. Meta llama guard 2. https://github.com/meta-llama/PurpleLlama/ blob/main/Llama-Guard2/MODEL_CARD.md, 2024

    2024

  11. [19]

    Llama 2: Open foundation and fine-tuned chat models

    Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, Dan Bikel, Lukas Blecher, Cristian Canton-Ferrer, Moya Chen, Guillem Cucurull, David Esiobu, Jude Fernandes, Jeremy Fu, W...

    2023 arXiv

  12. [20]

    On adaptive attacks to adversarial example defenses

    Florian Tramèr, Nicholas Carlini, Wieland Brendel, and Aleksander Madry. On adaptive attacks to adversarial example defenses. In Advances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, December 6-12, ...

    2020

  13. [21]

    The art of defending: A systematic evaluation and analysis of LLM defense strategies on safety and over-defensiveness

    Neeraj Varshney, Pavel Dolin, Agastya Seth, and Chitta Baral. The art of defending: A systematic evaluation and analysis of LLM defense strategies on safety and over-defensiveness. CoRR, abs/2401.00287, 2024

    2024 arXiv

  14. [22]

    Jailbroken: How does LLM safety training fail? CoRR, abs/2307.02483, 2023

    Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. Jailbroken: How does LLM safety training fail? CoRR, abs/2307.02483, 2023

    2023 arXiv

  15. [23]

    Jailbreak and guard aligned language models with only few in-context demonstrations

    Zeming Wei, Yifei Wang, and Yisen Wang. Jailbreak and guard aligned language models with only few in-context demonstrations. CoRR, abs/2310.06387, 2023

    2023 arXiv

  16. [24]

    Defending chatgpt against jailbreak attack via self-reminders

    Yueqi Xie, Jingwei Yi, Jiawei Shao, Justin Curl, Lingjuan Lyu, Qifeng Chen, Xing Xie, and Fangzhao Wu. Defending chatgpt against jailbreak attack via self-reminders. Nat. Mac. Intell., 5(12):1486–1496, 2023

    2023

  17. [25]

    Intention analysis prompting makes large language models A good jailbreak defender

    Yuqi Zhang, Liang Ding, Lefei Zhang, and Dacheng Tao. Intention analysis prompting makes large language models A good jailbreak defender. CoRR, abs/2401.06561, 2024

    2024 arXiv

  18. [26]

    Weak-to-strong jailbreaking on large language models

    Xuandong Zhao, Xianjun Yang, Tianyu Pang, Chao Du, Lei Li, Yu-Xiang Wang, and William Yang Wang. Weak-to-strong jailbreaking on large language models. CoRR, abs/2401.17256, 2024

    2024 arXiv

  19. [27]

    Xing, Hao Zhang, Joseph E

    Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric P. Xing, Hao Zhang, Joseph E. Gonzalez, and Ion Stoica. Judging llm-as-a-judge with mt-bench and chatbot arena. CoRR, abs/2306.05685, 2023

    2023 arXiv

  20. [28]

    I´m sorry

    Andy Zou, Zifan Wang, J. Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models. CoRR, abs/2307.15043, 2023. 11 A Appendix A.1 Case Study of Highlighted User Queries We use some highlighted user queries to showcase what type...

    2023 arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.