Pith. sign in

REVIEW 3 major objections 5 minor 52 references

Adaptive Detoxification: Safeguarding General Capabilities of LLMs through Toxicity-Aware Knowledge Editing

T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read ToxEdit detoxifies LLMs by routing only toxic prompts through an edited feed-forward path, preserving normal answers.

desk verdict ToxEdit is a plausible conditional-detoxification method; its capability-preservation headline is mostly the router's false-positive rate, and the paper needs an OOD classifier test and a real instruction-following benchmark before the claim holds. read the letter →

arxiv 2505.22298 v1 pith:BVNHNHO6 submitted 2025-05-28 cs.CL

Yifan Lu , Jing Li , Yigeng Zhou , Yihui Zhang , Wenya Wang , Xiucheng Li , Meishan Zhang , Fangming Liu
show 2 more authors
Jun Yu Min Zhang
This is my paper
classification cs.CL
keywords LLMdetoxificationtoxicity-awareknowledgeeditingjailbreakdefenseover-editinghidden-stateclassifieradaptiveroutingSafeEdit
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

ToxEdit proposes a way to make LLM detoxification input-conditional, so that editing the model to refuse harmful prompts does not make it refuse harmless ones. It trains a lightweight classifier on the hidden state at a selected middle layer to distinguish harmful prompts, including jailbreak variants, from safe ones, and uses that signal to route each input through either the original feed-forward network or a separately edited copy. The paper argues that this routing addresses the over-editing problem: previous detoxification methods often left harmless queries refused or degraded into repetitive text, whereas ToxEdit reports high defense success while keeping the edited model's answers to harmless queries semantically close to the original model's answers. It also extends the SafeEdit benchmark with instruction-following and fluency metrics that expose over-editing.

What carries the argument

The load-bearing object is the adaptive router formed by the Semantic Profiling classifier and the Anti-Toxic Feed-Forward module. The classifier is a linear SVM over the last-position hidden state $h^{(n)}_l$ of layer $l$; the router uses its +1/-1 output to select between the original feed-forward value matrix $W^V_{l'}$ and the edited copy $W^{V*}_{l'}$ at layer $l'$, where $l'$ is the layer with the best validation F1. The edited copy is created by copying $W^V_{l'}$ and running $T$ gradient steps to maximize the log-likelihood of a safe response under a system safety prompt, with no need to constrain harmless inputs because the router is supposed to keep them on the original path.

What would settle it

Run ToxEdit on a held-out set of jailbreak templates that are absent from SafeEdit and from the classifier's 4,000 harmful training prompts, and record whether each prompt is routed to the edited feed-forward matrix and whether the resulting output passes the safety classifier; if the SVM's F1 on those held-out hidden states drops well below the reported near-1 values, or if a false negative yields a classifier-safe toxic response, the separability assumption fails out of distribution.

Watch

Extended reading notes

Core claim

The paper's central claim is that toxicity is readable in the model's own hidden states, and that a single weight-matrix edit becomes sufficient and safe when it is gated by that reading. Concretely, a linear-kernel SVM is trained on the last-token hidden state at a chosen layer, the layer with highest validation F1 is selected, and a duplicate of the value matrix $W^V_{l'}$ is fine-tuned on harmful-prompt/safe-response pairs while the original parameters stay frozen. At inference, the router sends each input through the original matrix if the classifier says safe and through the edited matrix if it says unsafe. Reported results on three 7B instruction-tuned chat models show higher detoxification success and generalization than FT-L, WISE, and DINM on the SafeEdit benchmark, with defense-locality scores near 95% indicating that harmless instruction-following behavior is mostly preserved.

Load-bearing premise

The load-bearing premise is that a single linear classifier reading the last-token hidden state at one middle layer separates harmful prompts, including jailbreaks, from harmless prompts almost perfectly; if that separation fails on an unseen attack, the router either lets toxic content through or routes harmless queries through the edited network.

Editorial extensions

If this is right

  • ToxEdit can detoxify prompts that contain no named entity, so it does not require the entity-specific localization that the paper argues blocks ROME-style methods on adversarial inputs.
  • The same edited weight copy can switch on and off per input, so harmless instruction-following, QA, and summarization behavior can remain close to the original model.
  • The method's training data requirement is small: the paper finds classifier F1 stays high with a few hundred samples, and a separately sourced dataset gives comparable defense.
  • The new instruction-following and semantic-similarity evaluation metrics give the community a way to measure over-editing directly.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper, the near-perfect SVM separation reported at middle layers suggests those hidden states contain a stable toxicity direction; one could attempt to read off that direction from the SVM weight vector and compare it with steering-vector interventions, which the paper does not do.
  • The paper explicitly limits itself to 7B models, an SVM classifier, and notes occasional repetition; extending the router to larger models, to other classifier architectures, or to adversarial attacks that fool the SVM would clarify how much of the result depends on the classifier's near-perfect separability.
  • A false-negative/false-positive analysis of the router, rather than aggregate defense success, would show whether the residual risk is toxic leakage or over-editing; the paper's new DL metric measures the latter but not the former.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes ToxEdit, a knowledge-editing method for LLM detoxification that trains a linear SVM on the last-position hidden state of a chosen layer to classify prompts as harmful or harmless. During inference, the classifier's output controls a router that sends the FFN computation at that layer either through the original weights (for safe prompts) or through a separately fine-tuned edited FFN (for unsafe prompts). The edited FFN is trained on harmful-prompt/safe-response pairs while all other parameters are frozen. The paper also introduces a new evaluation metric, DL (Defense Locality), which measures the semantic similarity between the edited and original models' responses to harmless queries, and augments the SafeEdit benchmark with this metric. Experiments on LLaMA3-8B-Instruct, LLaMA2-7B-Chat, and Mistral-7B-Instruct-v0.2 compare ToxEdit with FT-L, WISE, and DINM, reporting higher detoxification success and higher DL scores, along with ablations and a cross-dataset robustness test.

Significance. If the method's performance holds, ToxEdit would be a practical approach to detoxification that avoids full-model retraining and preserves helpful behavior on harmless queries. The architecture is simple and the paper contains useful analyses of classifier layer placement, training-data requirements, and cross-dataset robustness. However, the headline capability-preservation metric DL is structurally tied to the router's false-positive rate rather than to an independent measure of instruction-following ability, so the central claim that ToxEdit 'safeguards general capabilities' is not yet established by the reported experiments. The absence of released code and the lack of variance estimates for the three reported runs further limit the strength of the empirical conclusions. The methodology is sound and the weaknesses are addressable with additional evaluation, making the paper a plausible candidate after major revision.

major comments (3)
  1. [Section 2.3 (Eq. 5) and Section 3.1 (Eq. 6)] The DL metric is, by construction, a measure of the router's false-positive rate rather than an independent measure of preserved instruction-following. For any harmless query qn that the SVM classifies as safe, Eq. (5) routes the computation through the original FFN, so fW'([S; qn]) = fW([S; qn]) exactly, making the semantic similarity in Eq. (6) equal to 1. The observed DL of 95.36 on LLaMA3-8B-Instruct therefore reflects that the SVM misclassifies roughly 4–5% of harmless queries, not that the edited module retains instruction-following ability; indeed, the edited FFN is never exercised on correctly-routed safe queries. This circularity undermines the abstract's claim that ToxEdit ``safeguards general capabilities'' beyond the classifier's accuracy. Please report the SVM false-positive rate on the harmless query set, and add a task-based instruction-following evaluation (e.g., IFEval or AlpacaEval) that scores the quality of responses to safe instructions rather than their similarity to the original model's outputs.
  2. [Section 2.2 (Eq. 1) and Figure 3] The claim that ``the model inherently has the ability to discern whether a user's prompt is malicious'' is only supported for in-distribution prompts. The SVM is trained on 4,000 harmful and 2,000 harmless prompts sampled from SafeEdit's training split, and Figure 3 reports F1 on the validation split of the same dataset. No evaluation is provided for held-out jailbreak families or adversarially perturbed prompts. Because the router is a hard gate—any false negative sends a harmful prompt to the original FFN and any false positive over-edits a harmless prompt—the method's practical safety and capability preservation both hinge on this classifier's out-of-distribution accuracy. The cross-dataset experiment in Section 3.4 (Fig. 4) already shows fragility: training on To drops DL from 95.36 to 65.6 while DS stays near 98.7. Please add an OOD evaluation that holds out entire attack categories or uses newer jailbreak methods, and report false-positive and false-negative rates separately.
  3. [Section A.5 and Tables 1–2] The appendix states ``we ran the experiments three times on the test set and reported the average results,'' but no standard deviations or confidence intervals are shown anywhere in the paper. Since Table 2 reports extremely large differences (e.g., DL drops from 95.36 to 6.71 when the toxicity detection module is removed), the absence of variance information makes it impossible to tell whether the remaining differences between ToxEdit and the baselines are significant. Please report per-run numbers or error bars for the three runs, and release the code to allow reproducibility.
minor comments (5)
  1. [Section 2.1] The phrase ``Yunsaf ethat'' appears to be a typo for ``Yunsafe that''; please correct it.
  2. [Figure 4] The y-axis label ``Accuracy (%)'' is used for DL, which is a semantic similarity score rather than an accuracy; please use a metric-specific label or clarify the meaning in the caption.
  3. [Throughout] The paper alternates between ``TOXEDIT'' and ``ToxEdit''; please standardize the spelling across the text, figures, and tables.
  4. [Section 3.4] The sentence ``we are surprised to observe'' is informal for a journal; consider replacing it with a neutral reporting style while keeping the content.
  5. [Equations (6) and (12)] The definition of DL is given twice, once in Section 3.1 and again in Appendix A.4; please consolidate the two definitions to avoid redundancy and potential confusion about which equation number is authoritative.

Circularity Check

2 steps flagged · score 4.0 of 10

TOXEDIT's DL-based capability-preservation claim is largely the SVM router's false-positive rate by construction; held-out detoxification and KQA/CSum provide independent grounding, so the circularity is partial.

  1. self definitional [Section 2.3 Eq. (5) and Section 3.1 Eq. (6); Table 1]
    "Based on the classifier’s output s, the router dynamically directs data flows to different FFN layers, thereby achieving adaptive detoxification of user inputs: hl′+1 = ( hdown l′ W V l′, if s is safe; hdown l′ W V∗l′, if s is unsafe. ... DL = Eqn∼Qn{Sim(fW ′([S; qn]), fW ([S; qn]))}"

    For TOXEDIT, any harmless query labeled safe by the SVM is passed through the original W_V by Eq. (5), so fW'([S;qn]) = fW([S;qn]) and the Sim term in Eq. (6) equals 1 by construction. Only SVM false positives (harmless queries routed as unsafe) can reduce DL. Thus TOXEDIT's DL is essentially a monotone transform of the classifier's false-positive rate on the harmless-query distribution; it is a router-accuracy score, not independent evidence of preserved instruction-following. Comparing this DL (95.36) with DLs of methods that always use edited parameters (FT-L 64.65, WISE 61.41, DINM 3.92) is therefore an apples-to-oranges comparison. The paper's own cross-dataset experiment (Fig.

  2. self definitional [Section 3.3 Ablation Study, Table 2]
    "we removed the toxicity detection module and replaced the original FFN with modified FFN layers. This change slightly improved detoxification performance by 0–2%. However, it greatly damaged the model’s general capabilities. Instruction-following capability dropped by 88.65% (DL metric), text fluency decreased by 5.6 points, and QA as well as summarization abilities also declined moderately."

    Removing the toxicity detection module makes every harmless query use the edited FFN. Since DL is defined as semantic similarity between the edited and original model outputs on harmless queries, any non-identity change at W_V necessarily lowers DL even if the edited FFN were still fluent and helpful. The 88.65-point DL collapse is therefore a definitional consequence of the ablation and the metric, not by itself evidence of catastrophic forgetting. The KQA and CSum declines in the same ablation provide independent, though weaker, evidence of real degradation, but the paper presents the DL drop as the primary demonstration of capability loss.

full rationale

The core circularity is metric-definitional rather than statistical: TOXEDIT routes harmless inputs around the edited FFN, so any metric that compares the edited model to the original on harmless inputs (DL, and to a large extent KQA/CSum) mostly measures whether the SVM router misclassifies harmless inputs as unsafe. This makes the headline 'safeguarding general capabilities' claim partially a restatement of the in-distribution false-positive rate of the trained SVM, and it explains the apples-to-oranges DL comparison against baselines that always route through edited parameters. The paper's own cross-dataset experiment (Fig. 4) exposes this dependence: with a different training distribution, DL drops from 95.36 to 65.6 while DS remains near 98.7. However, the method is not wholly circular: DS and all four DG metrics evaluate held-out harmful queries and jailbreak templates with an external safety classifier, providing independent evidence of detoxification efficacy and generalization; KQA and CSum are external tasks that would also be affected by router false positives but are not definitionally equal to identity; and the limitations section honestly notes that only an SVM classifier was tested. There is no load-bearing self-citation chain or imported uniqueness theorem. The finding is therefore partial structural circularity in the evaluation of general-capability preservation, not a fully degenerate derivation.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The method rests on (1) linear separability of toxicity in hidden states, (2) correctness of the external safety classifier, (3) sufficiency of editing one value matrix, and (4) validity of a semantic-similarity proxy for instruction following. No new physical or conceptual entities are introduced.

free parameters (3)
  • Classifier insertion layer l' = chosen per model via validation F1 (Figure 3 suggests layers 10-15)
    The layer at which the SVM reads hidden states is selected as the one with highest F1 on a validation set, so it is a data-fitted design choice.
  • Editing steps T = 10
    Number of gradient steps for the edited FFN copy, chosen by the authors (Appendix A.5, Table 4).
  • Learning rate = 5e-4
    Optimization hyperparameter for the edited FFN, listed in Appendix A.5.
assumptions (4)
  • domain assumption Hidden states at some middle layer encode prompt toxicity in a linearly separable way (SVM achieves F1 near 1).
    Section 2.2 and Figure 3; relies on prior observations from Zhou et al. (2024) that middle layers contain safety-relevant representations.
  • domain assumption The SafeEdit safety classifier C (RoBERTa-large) provides a correct ground-truth label for whether model output is safe.
    All DS and DG metrics are computed with C; if C is biased, the reported detoxification gains are biased. See Appendix A.3.
  • domain assumption Editing only W_V at layer l' is sufficient to redirect toxic generation toward safe responses.
    Borrowed from ROME/DINM line of work; stated in Section 2.3.
  • domain assumption all-MiniLM-L6-v2 semantic similarity between original and edited outputs on harmless queries is a valid proxy for preserved instruction-following ability.
    Used to define DL in Eq. (6); this is not an actual instruction-following benchmark.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Adaptive Detoxification: Safeguarding General Capabilities of LLMs through Toxicity-Aware Knowledge Editing." pith.science (2026). https://pith.science/paper/BVNHNHO6

@misc{pith2026250522298,
  author       = {Pith},
  title        = {Pith review of: Adaptive Detoxification: Safeguarding General Capabilities of LLMs through Toxicity-Aware Knowledge Editing},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BVNHNHO6}},
  note         = {Machine review of arXiv:2505.22298}
}
read the original abstract

Large language models (LLMs) exhibit impressive language capabilities but remain vulnerable to malicious prompts and jailbreaking attacks. Existing knowledge editing methods for LLM detoxification face two major challenges. First, they often rely on entity-specific localization, making them ineffective against adversarial inputs without explicit entities. Second, these methods suffer from over-editing, where detoxified models reject legitimate queries, compromising overall performance. In this paper, we propose ToxEdit, a toxicity-aware knowledge editing approach that dynamically detects toxic activation patterns during forward propagation. It then routes computations through adaptive inter-layer pathways to mitigate toxicity effectively. This design ensures precise toxicity mitigation while preserving LLMs' general capabilities. To more accurately assess over-editing, we also enhance the SafeEdit benchmark by incorporating instruction-following evaluation tasks. Experimental results on multiple LLMs demonstrate that our ToxEdit outperforms previous state-of-the-art methods in both detoxification performance and safeguarding general capabilities of LLMs.

Figures

Figures reproduced from arXiv: 2505.22298 by the authors.

Figure 1
Figure 1. (a) Demonstrates an example where the model [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Our proposed TOXEDIT, a knowledge editing method for LLM detoxification, consisting of two modules: the Semantic Profiling for Toxicity Detection Module and the Anti-Toxic Feed-Forward Module. Given that auto-regressive LLMs generate the next token based on the last position of the last hidden states, we use the hidden state h (n) l at the last po￾sition n of the l-th layer as the input to the binary classifier. Thi… view at source ↗
Figure 4
Figure 4. Performance of TOXEDIT on the SafeEdit test set when trained on different datasets. The model used is LLaMA3-8B-Instruct. Semantic profiling in the toxicity detection module is essential to maintain the model’s over￾all abilities. In our experiments, we removed the toxicity detection module and replaced the origi￾nal FFN with modified FFN layers. This change slightly improved detoxification performance by 0–2%. Howe… view at source ↗
Figures from the paper (1 more)
Figure 3
Figure 3. Figure 3: Performance of the classifier across different [PITH_FULL_IMAGE:figures/full_fig_p006_3.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

52 extracted references · 30 canonical work pages

  1. [1]

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. 2023. Gpt-4 technical report. arXiv preprint arXiv:2303.08774

    arXiv 2023

  2. [2]

    Amanda Askell, Yuntao Bai, Anna Chen, Dawn Drain, Deep Ganguli, Tom Henighan, Andy Jones, Nicholas Joseph, Ben Mann, Nova DasSarma, et al. 2021. A general language assistant as a laboratory for alignment. arXiv preprint arXiv:2112.00861

    arXiv 2021

  3. [3]

    Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J Pappas, Florian Tramer, et al. 2024. Jailbreakbench: An open robustness benchmark for jailbreaking large language models. arXiv preprint arXiv:2404.01318

    arXiv 2024

  4. [4]

    OpenCompass Contributors. 2023. Opencompass: A universal evaluation platform for foundation models. https://github.com/open-compass/opencompass

    2023

  5. [5]

    Corinna Cortes. 1995. Support-vector networks. Machine Learning

    1995

  6. [6]

    Guodong Du, Zitao Fang, Jing Li, Junlin Li, Runhua Jiang, Shuyang Yu, Yifei Guo, Yangneng Chen, Sim Kuan Goh, Ho-Kin Tang, Daojing He, Honghai Liu, and Min Zhang. 2025 a . Neural parameter search for slimmer fine-tuned models and better transfer. arXiv preprint arXiv:2505.18713

    work page Pith review arXiv 2025

  7. [7]

    Guodong Du, Junlin Lee, Jing Li, Runhua Jiang, Yifei Guo, Shuyang Yu, Hanting Liu, Sim Kuan Goh, Ho-Kin Tang, Daojing He, and Min Zhang. 2024 a . Parameter competition balancing for model merging. In The Thirty-eighth Annual Conference on Neural Information Processing Systems (NeurIPS)

    work page 2024

  8. [8]

    Guodong Du, Jing Li, Hanting Liu, Runhua Jiang, Shuyang Yu, Yifei Guo, Sim Kuan Goh, and Ho-Kin Tang. 2024 b . Knowledge fusion by evolving weights of language models. In Proceedings of Findings of the Association for Computational Linguistics: ACL 2024

    work page 2024

Show all 52 references
  1. [9]

    Guodong Du, Xuanning Zhou, Junlin Li, Zhuo Li, Zesheng Shi, Wanyu Lin, Ho-Kin Tang, Xiucheng Li, Fangming Liu, Wenya Wang, Min Zhang, and Jing Li. 2025 b . Knowledge grafting of large language models. arXiv preprint arXiv:2505.18502

    2025

  2. [10]

    Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. 2024. The llama 3 herd of models. arXiv preprint arXiv:2407.21783

    2024 arXiv

  3. [11]

    Junfeng Fang, Houcheng Jiang, Kun Wang, Yunshan Ma, Xiang Wang, Xiangnan He, and Tat-seng Chua. 2024. Alphaedit: Null-space constrained knowledge editing for language models. arXiv preprint arXiv:2410.02355

    2024 arXiv

  4. [12]

    Mor Geva, Roei Schuster, Jonathan Berant, and Omer Levy. 2021. Transformer feed-forward layers are key-value memories. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 5484--5495

    2021

  5. [13]

    Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, et al. 2025. Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning. arXiv preprint arXiv:2501.12948

    2025 arXiv

  6. [14]

    Skyler Hallinan, Alisa Liu, Yejin Choi, and Maarten Sap. 2023. Detoxifying text with marco: Controllable revision with experts and anti-experts. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 2: Short Papers) (ACL), pages 228--242

    2023

  7. [15]

    Xinshuo Hu, Dongfang Li, Baotian Hu, Zihao Zheng, Zhenyu Liu, and Min Zhang. 2024. Separate the wheat from the chaff: Model deficiency unlearning via parameter-efficient module operation. In Proceedings of the AAAI Conference on Artificial Intelligence (AAAI), volume 38, pages...

    2024

  8. [16]

    Xiaowei Huang, Wenjie Ruan, Wei Huang, Gaojie Jin, Yi Dong, Changshun Wu, Saddek Bensalem, Ronghui Mu, Yi Qi, Xingyu Zhao, et al. 2024 a . A survey of safety and trustworthiness of large language models through the lens of verification and validation. Artificial Intelligence R...

    2024

  9. [17]

    Yue Huang, Lichao Sun, Haoran Wang, Siyuan Wu, Qihui Zhang, Yuan Li, Chujie Gao, Yixin Huang, Wenhan Lyu, Yixuan Zhang, et al. 2024 b . Trustllm: Trustworthiness in large language models. arXiv preprint arXiv:2401.05561

    2024 arXiv

  10. [18]

    Zeyu Huang, Yikang Shen, Xiaofeng Zhang, Jie Zhou, Wenge Rong, and Zhang Xiong. 2023. Transformer-patcher: One mistake worth one neuron. In Proceedings of the Eleventh International Conference on Learning Representations (ICLR)

    2023

  11. [19]

    Albert Q Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, et al. 2023. Mistral 7b. arXiv preprint arXiv:2310.06825

    2023 arXiv

  12. [20]

    Mandar Joshi, Eunsol Choi, Daniel Weld, and Luke Zettlemoyer. 2017. Triviaqa: A large scale distantly supervised challenge dataset for reading comprehension. In Proceedings of the 55th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) (ACL)

    2017

  13. [21]

    Bill Yuchen Lin, Abhilasha Ravichander, Ximing Lu, Nouha Dziri, Melanie Sclar, Khyathi Chandu, Chandra Bhagavatula, and Yejin Choi. 2023. The unlocking spell on base llms: Rethinking alignment via in-context learning. In Proceedings of the Twelfth International Conference on L...

    2023

  14. [22]

    Nicholas Meade, Spandana Gella, Devamanyu Hazarika, Prakhar Gupta, Di Jin, Siva Reddy, Yang Liu, and Dilek Hakkani-Tur. 2023. Using in-context learning to improve dialogue safety. In Proceedings of the Findings of the Association for Computational Linguistics: EMNLP 2023, page...

    2023

  15. [23]

    Kevin Meng, David Bau, Alex Andonian, and Yonatan Belinkov. 2022. Locating and editing factual associations in gpt. Proceedings of the Advances in Neural Information Processing Systems (NeurIPS), 35:17359--17372

    2022

  16. [24]

    Kevin Meng, Arnab Sen Sharma, Alex J Andonian, Yonatan Belinkov, and David Bau. 2023. Mass-editing memory in a transformer. In Proceedings of the Eleventh International Conference on Learning Representations (ICLR)

    2023

  17. [25]

    Eric Mitchell, Charles Lin, Antoine Bosselut, Chelsea Finn, and Christopher D Manning. 2022 a . Fast model editing at scale. In Proceedings of the International Conference on Learning Representations (ICLR)

    2022

  18. [26]

    Eric Mitchell, Charles Lin, Antoine Bosselut, Christopher D Manning, and Chelsea Finn. 2022 b . Memory-based model editing at scale. In Proceedings of the International Conference on Machine Learning (ICML), pages 15817--15831

    2022

  19. [27]

    Shashi Narayan, Shay B Cohen, and Mirella Lapata. 2018. Don’t give me the details, just the summary! topic-aware convolutional neural networks for extreme summarization. In Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing (EMNLP). Associat...

    2018

  20. [28]

    Fabian Pedregosa, Ga \"e l Varoquaux, Alexandre Gramfort, Vincent Michel, Bertrand Thirion, Olivier Grisel, Mathieu Blondel, Peter Prettenhofer, Ron Weiss, Vincent Dubourg, et al. 2011. Scikit-learn: Machine learning in python. the Journal of machine Learning research, 12:2825--2830

    2011

  21. [29]

    Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. 2024. Direct preference optimization: Your language model is secretly a reward model. Proceedings of the Advances in Neural Information Processing Systems (NeurIPS), 36

    2024

  22. [30]

    Zesheng Shi, Yucheng Zhou, and Jing Li. 2025. https://arxiv.org/abs/2505.18588 Safety alignment via constrained knowledge unlearning . Preprint, arXiv:2505.18588

    2025 arXiv

  23. [31]

    Alexandra Souly, Qingyuan Lu, Dillon Bowen, Tu Trinh, Elvis Hsieh, Sana Pandey, Pieter Abbeel, Justin Svegliato, Scott Emmons, Olivia Watkins, et al. 2024. A strongreject for empty jailbreaks. In ICLR 2024 Workshop on Reliable and Responsible Foundation Models

    2024

  24. [32]

    Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. 2023. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288

    2023 arXiv

  25. [33]

    Binghai Wang, Rui Zheng, Lu Chen, Yan Liu, Shihan Dou, Caishuang Huang, Wei Shen, Senjie Jin, Enyu Zhou, Chenyu Shi, et al. 2024 a . Secrets of rlhf in large language models part ii: Reward modeling. arXiv preprint arXiv:2401.06080

    2024 arXiv

  26. [34]

    Mengru Wang, Ningyu Zhang, Ziwen Xu, Zekun Xi, Shumin Deng, Yunzhi Yao, Qishen Zhang, Linyi Yang, Jindong Wang, and Huajun Chen. 2024 b . Detoxifying large language models via knowledge editing. In Proceedings of the 62nd Annual Meeting of the Association for Computational Lin...

    2024

  27. [35]

    Peng Wang, Zexi Li, Ningyu Zhang, Ziwen Xu, Yunzhi Yao, Yong Jiang, Pengjun Xie, Fei Huang, and Huajun Chen. 2024 c . Wise: Rethinking the knowledge memory for lifelong model editing of large language models. arXiv preprint arXiv:2405.14768

    2024 arXiv

  28. [36]

    Peng Wang, Ningyu Zhang, Xin Xie, Yunzhi Yao, Bozhong Tian, Mengru Wang, Zekun Xi, Siyuan Cheng, Kangwei Liu, Guozhou Zheng, et al. 2023. Easyedit: An easy-to-use knowledge editing framework for large language models. arXiv preprint arXiv:2308.07269

    2023 arXiv

  29. [37]

    Song Wang, Yaochen Zhu, Haochen Liu, Zaiyi Zheng, Chen Chen, and Jundong Li. 2024 d . Knowledge editing for large language models: A survey. ACM Computing Surveys, 57(3):1--37

    2024

  30. [38]

    Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2024. Jailbroken: How does llm safety training fail? Proceedings of the Advances in Neural Information Processing Systems (NeurIPS), 36

    2024

  31. [39]

    Xinwei Wu, Junzhuo Li, Minghui Xu, Weilong Dong, Shuangzhi Wu, Chao Bian, and Deyi Xiong. 2023. Depn: Detecting and editing privacy neurons in pretrained language models. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 2...

    2023

  32. [40]

    Yifan Yao, Jinhao Duan, Kaidi Xu, Yuanfang Cai, Zhibo Sun, and Yue Zhang. 2024. A survey on large language model (llm) security and privacy: The good, the bad, and the ugly. High-Confidence Computing, page 100211

    2024

  33. [41]

    Yunzhi Yao, Peng Wang, Bozhong Tian, Siyuan Cheng, Zhoubo Li, Shumin Deng, Huajun Chen, and Ningyu Zhang. 2023. Editing large language models: Problems, methods, and opportunities. In Proceedings of the Conference on Empirical Methods in Natural Language Processing (EMNLP), pa...

    2023

  34. [42]

    Longhui Zhang, Yanzhao Zhang, Dingkun Long, Pengjun Xie, Meishan Zhang, and Min Zhang. 2024 a . A two-stage adaptation of large language models for text ranking. In Proceedings of Findings of the Association for Computational Linguistics: ACL 2024, pages 11880--11891

    2024

  35. [43]

    Ningyu Zhang, Yunzhi Yao, Bozhong Tian, Peng Wang, Shumin Deng, Mengru Wang, Zekun Xi, Shengyu Mao, Jintian Zhang, Yuansheng Ni, et al. 2024 b . A comprehensive study of knowledge editing for large language models. arXiv preprint arXiv:2401.01286

    2024 arXiv

  36. [44]

    Xu Zhang and Xiaojun Wan. 2023. Mil-decoding: Detoxifying language models at token-level via multiple instance learning. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) (ACL), pages 190--202

    2023

  37. [45]

    Zhexin Zhang, Jiale Cheng, Hao Sun, Jiawen Deng, and Minlie Huang. 2023. Instructsafety: A unified framework for building multidimensional and explainable safety detector through instruction tuning. In Proceedings of the Findings of the Association for Computational Linguistic...

    2023

  38. [46]

    Zhexin Zhang, Junxiao Yang, Pei Ke, Fei Mi, Hongning Wang, and Minlie Huang. 2024 c . Defending large language models against jailbreaking attacks through goal prioritization. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1:...

    2024

  39. [47]

    Ce Zheng, Lei Li, Qingxiu Dong, Yuxuan Fan, Zhiyong Wu, Jingjing Xu, and Baobao Chang. 2023. Can we edit factual knowledge by in-context learning? In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 4862--4876

    2023

  40. [48]

    Chujie Zheng, Fan Yin, Hao Zhou, Fandong Meng, Jie Zhou, Kai-Wei Chang, Minlie Huang, and Nanyun Peng. 2025. On prompt-driven safeguarding for large language models. In Proceedings of the 41st International Conference on Machine Learning (ICML)

    2025

  41. [49]

    Zhenhong Zhou, Haiyang Yu, Xinghua Zhang, Rongwu Xu, Fei Huang, and Yongbin Li. 2024. How alignment and jailbreak work: Explain LLM safety through intermediate hidden states. In Proceedings of the Findings of the Association for Computational Linguistics: EMNLP 2024, pages 2461--2488

    2024

  42. [50]

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043

    2023 arXiv

  43. [51]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list...

  44. [52]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.