Pith. sign in

REVIEW 4 major objections 3 minor 30 references

SafeTy Reasoning Elicitation Alignment for Multi-Turn Dialogues

T0 review · 4 major / 3 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A fine-tuned safety reasoning moderator reduces multi-turn jailbreak attack success by over half while preserving the target LLM's core capabilities, according to this paper.

desk verdict Real dataset, flawed headline: the 51.2% ASR reduction is driven by attacks that overlap the training set, while the one held-out attack improves only ~10% relative. read the letter →

arxiv 2506.00668 v1 pith:3CDPA7ZZ submitted 2025-05-31 cs.CL

Martin Kuo , Jianyi Zhang , Aolin Ding , Louis DiValentin , Amin Hass , Benjamin F Morris , Isaac Jacobson , Randolph Linderman
show 7 more authors
James Kiessling Nicolas Ramos Bhavna Gopal Maziyar Baran Pouyan Changwei Liu Hai Li Yiran Chen
This is my paper
classification cs.CL
keywords multi-turnjailbreaksafetyreasoningmoderatorchain-of-thoughtannotationattacksuccessrateplug-and-playdefensefine-tuningLLMmoderation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to show that a small, plug-and-play moderator can defend large language models against multi-turn jailbreak attacks without sacrificing their usefulness. The key claim is that fine-tuning a reasoning model on human-annotated dialogues with explicit safety reasoning lets it detect hidden malicious intent and warn the target model, cutting average attack success rates from 83.3% to 40.7% on GPT-4.1. The authors argue this beats existing moderation systems and transfers across open- and closed-source models, including o4-mini and an 8B open-source model, with only minor drops in MMLU and GSM8K scores. If true, STREAM would give organizations a practical defense that does not require retraining the protected LLM.

What carries the argument

The central object is the safety reasoning moderator, a fine-tuned DeepSeek-R1-Distill-Qwen-1.5B model that, given a conversation history, outputs a binary #Alert decision and a concise #Warning message. The mechanism that carries the argument is the appended warning prompt: instead of modifying the target LLM, STREAM injects a textual warning that influences the LLM's next response. This plug-and-play design is what makes the defense transferable across different models without retraining them.

What would settle it

Evaluate STREAM against a multi-turn jailbreak family that was not represented in the training dialogues (e.g., a strategy that builds harm through unsupported hypotheticals rather than actor or chain-of-attack decomposition); if the attack success rate stays near the no-defense baseline, as it does for X-Teaming, then the 51% reduction is specific to the trained attack styles.

Watch

Extended reading notes

Core claim

STREAM works by placing a safety reasoning moderator between the user and the target LLM. The moderator is trained on the Safety Reasoning Multi-Turn Dialogue dataset, which contains 2,177 dialogues derived from ActorAttack and Chain of Attack, each turn annotated by humans for malicious intent, severity, and category, plus chain-of-thought safety reasoning generated by Claude 3.7 Sonnet. At inference time, when the moderator detects risk, it appends a #Warning prompt to the user query, alerting the LLM before it answers. In experiments on the Malicious-Educator benchmark, STREAM reduces the average Attack Success Rate for GPT-4.1 by 51.2% compared with no defense, by 38.2% versus Granite Guardian, by 47.4% versus LlamaGuard 3, by 47.9% versus Omni-Moderation, and by 48.7% versus GPT-4.1-mini and DeepSeek-R1-Distill-Qwen-1.5B, while keeping MMLU and GSM8K accuracy close to baseline levels.

Load-bearing premise

The defense's measured effectiveness depends on evaluating it against attack families that overlap with its training data, so the reported reduction may reflect memorized patterns rather than transferable safety reasoning.

Editorial extensions

If this is right

  • Deploying STREAM before GPT-4.1 lowers average multi-turn attack success from 83.3% to 40.7%, with Crescendo falling from 88% to 18% and ActorAttack from 62% to 14%.
  • The defense transfers to o4-mini, reducing average ASR from 84.7% to 58.0%, and to the open-source Llama-3.1-Nemotron-Nano-8B-v1, from 80.7% to 57.3%.
  • STREAM outperforms all five tested moderation baselines on both closed- and open-source target models, with the next-best baseline (Granite Guardian) leaving GPT-4.1 average ASR at 66.0% versus STREAM's 40.7%.
  • Capability losses are modest: GPT-4.1 MMLU drops from 91.3 to 87.2 and GSM8K from 93.3 to 92.4, while the 8B model's GSM8K actually improves from 80.7 to 83.3.
  • Because the moderator is a lightweight 1.5B model, the defense can be inserted into a deployment pipeline without fine-tuning the protected LLM.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The headline gain is partly a function of training-test overlap: the moderator's training dialogues come from ActorAttack and Chain of Attack, and ActorAttack is also one of the three evaluated attacks, so the reported reduction on that family is not strong evidence of generalization to unseen attack tactics.
  • The near-zero X-Teaming gains (ASR still 86%–92% across all target models) suggest the moderator learned surface patterns from the training attack families rather than acquiring a general ability to recognize evolving malicious intent.
  • Treating the moderator as an input filter means an attacker who anticipates the warning could craft turns that evade the #Alert threshold; combining STREAM with output-side checking or latent-space steering might close that gap.
  • The capability metric relies on small subsets (20 MMLU items per task, the GSM8K test set), so the 'comparable capability' claim should be read as a coarse indication, not a fine-grained equivalence.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 3 minor

Summary. The paper proposes STREAM, a plug-and-play safety moderator for multi-turn dialogues. A 2,177-dialogue dataset is human-annotated for malicious intent, category, and severity, and Claude 3.7 Sonnet is used to add chain-of-thought safety reasoning; a DeepSeek-R1-Distill-Qwen-1.5B model is supervised fine-tuned on this dataset. At inference, the moderator inspects each user turn and, if risk is detected, appends a warning to the query before the target LLM responds. The paper claims that STREAM reduces attack success rate (ASR) by 51.2% for GPT-4.1, 31.5% for o4-mini, and 28.9% for Llama-3.1-Nemotron-Nano-8B-v1 relative to no defense, while keeping MMLU and GSM8K performance comparable. Evaluation covers three multi-turn attacks (Crescendo, ActorAttack, X-Teaming) and five baseline moderators.

Significance. If the transfer claims held, this would be a practically valuable contribution: a small moderator that can be inserted in front of both closed- and open-source LLMs, together with a released human-annotated multi-turn safety dataset with fine-grained labels. The paper is also notable for attempting to elicit and use explicit safety reasoning rather than only category labels. However, the central evidence is weakened by a training/evaluation overlap and by the absence of statistical analysis. The dataset release and the general idea of reasoning-based moderation are the strongest assets; the quantitative claim of a 51.2% average ASR reduction is not yet supported as evidence of generalizable multi-turn safety reasoning.

major comments (4)
  1. [Section 3.1 and Section 5.1, Table 1] The training set is constructed from known attack strategies explicitly including ActorAttack and Chain of Attack (Section 3.1), and the evaluation in Section 5.1 includes ActorAttack not only as a test attack but also presumably Crescendo, whose inclusion in the training set is left open by the word 'including.' The one attack not named in the training description, X-Teaming, shows only a small improvement: for GPT-4.1, ASR drops from 100 to 90 under STREAM, a 10% relative reduction, whereas Crescendo drops from 88 to 18 and ActorAttack from 62 to 14, i.e., roughly 79.5% and 77.4% relative reductions. The headline 51.2% average ASR reduction is therefore dominated by attacks that are inside, or possibly inside, the training distribution. To support the claim of transferable multi-turn safety reasoning, the authors should report per-attack results on attack families that are disjoint from the training set, or at minimum disclose the exact composition of the 2,177 training dialogues by attack family.
  2. [Section 5.1 and Tables 1-2] No error bars, confidence intervals, or significance tests are reported, and the ASR values in Tables 1 and 2 are all multiples of two, which indicates 50 trials per condition. With n=50, the 95% confidence interval for a proportion near 0.5 is approximately plus-or-minus 14 percentage points, so differences such as 88 vs 82, 90 vs 92, or 48 vs 44 are within sampling noise. The paper should report the number of trials per condition, number of independent runs or seeds, and either confidence intervals or a paired significance test for both ASR and capability metrics.
  3. [Section 4.2, Section 5.1, and Table 1] The contribution of the chain-of-thought safety reasoning is not isolated. STREAM is a supervised fine-tuned version of DeepSeek-R1-Distill-Qwen-1.5B on reasoning-augmented dialogues, while the DeepSeek-R1-Distill-Qwen-1.5B baseline moderator uses a different prompt template and no fine-tuning. The observed ASR gain could come from the supervised fine-tuning itself, from the warning-format difference between the baseline and STREAM, or from the CoT reasoning specifically. An ablation training the same moderator on the same dialogues without the CoT reasoning, and using the same prompt/warning protocol as STREAM, is needed to support the 'safety reasoning elicitation' claim.
  4. [Table 1 and Section 5.3] The claim of 'maintaining comparable LLM capability' is not quantitatively supported. For GPT-4.1, MMLU drops from 91.3 without defense to 87.2 with STREAM, a 4.1-point decrease; o4-mini drops from 92.1 to 88.9. No variance, statistical test, or predefined tolerance for 'comparable' is provided. The authors should either report confidence intervals for these capability numbers or define a concrete threshold below which capability loss is considered acceptable.
minor comments (3)
  1. [Section 5.2] The sentence 'Our primary attack success metric metric is the Attack Success Rate' contains a duplicated word; please correct it.
  2. [Section 3, contributions list] The sentence 'We construct a dataset called Safety Reasoning Multi-turn Dialogue, in which has 2,177 Multi-turn Dialogues and it's each turn safety reasoning and it's human labeled malicious categories and severity level' is grammatically incomplete and should be rewritten for clarity.
  3. [References] The citation 'Zhang et al.' appears without a year in both the introduction and the related work; please add the full reference with the year.

Circularity Check

1 steps flagged · score 6.0 of 10

The 51.2% ASR reduction is not an independent prediction: ActorAttack is both a training source and a test attack, and the clearly held-out X-Teaming attack improves only from 100 to 90 ASR on GPT-4.1.

  1. fitted input called prediction [Section 3.1 (dataset construction) vs. Section 5.1 and Table 1 (evaluation)]
    "We compile a dataset of 2,177 multi-turn dialogue instances derived from a range of known attack strategies, including Actor Attack (Ren et al., 2024) and Chain of Attack (Yang et al., 2024), targeting GPT-4 series models. ... Multi-turn Attack Methods We implemented three representative multi-turn attack methods. X-Teaming ... Crescendo ... ActorAttack (Ren et al., 2024) ... GPT-4.1 88.0 62.0 100.0 83.3 ... + STREAM 18.0 14.0 90.0 40.7"

    The training set is explicitly built from 'Actor Attack' dialogues, and ActorAttack is also one of the three evaluation attacks, with no disclosure of the exact composition of the 2,177 instances. The reported ASR reductions on ActorAttack (GPT-4.1: 62 to 14; o4-mini: 66 to 30; Llama-3.1-Nemotron-Nano-8B-v1: 60 to 32) are therefore in-distribution performance rather than evidence of transferable safety reasoning. The phrase 'including' also leaves open whether Crescendo contributed training dialogues, so the only attack clearly not named in the training description is X-Teaming, whose ASR drops only from 100 to 90 on GPT-4.1 (86 on o4-mini, 92 on Llama).

full rationale

The paper is not a definitional derivation: the 51.2% claim is an empirical ASR measurement, and the method is fully specified and reproducible from a public dataset. The central circularity concern is the train/eval overlap. Section 3.1 states that the 2,177 training dialogues were 'derived from a range of known attack strategies, including Actor Attack and Chain of Attack,' and Section 5.1 evaluates ActorAttack as one of the three test attacks. Because the paper does not disclose whether Crescendo or X-Teaming dialogues also appear in training, only X-Teaming is clearly held out, and its improvement is small (e.g., GPT-4.1: 100 to 90). This makes the reported gain on ActorAttack, and possibly Crescendo, partly a fit to the training distribution rather than evidence of general multi-turn safety reasoning. The Malicious-Educator benchmark is from the authors' prior work (Kuo et al., 2025a), but it is a benchmark resource rather than a load-bearing theorem or fitted parameter, so it does not independently raise the circularity score. Overall, score 6 reflects partial circularity: the method has independent content and beats several baselines, but the central generalization claim is weakened by the training/evaluation attack overlap.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The central claim rests on the reliability of human annotations, the quality of Claude-generated reasoning targets, the judge's harmfulness scores, and the assumption that training on two attack strategies transfers to held-out attacks. No classic numeric free parameters are fitted to the evaluation data; the model weights are learned by SFT on the constructed dataset.

assumptions (4)
  • domain assumption A harmfulness score of exactly 1 from the ChatGPT API judge is a correct measure of a successful attack.
    Section 5.2 defines attack success solely by the judge score; no calibration, human agreement, or sensitivity analysis is reported.
  • domain assumption Claude 3.7 Sonnet's CoT explanations, conditioned on human labels, provide correct safety reasoning for training the moderator.
    Section 3.2 uses Claude 3.7 to generate the reasoning targets; the paper assumes these explanations are high-quality without evaluating them.
  • domain assumption Human raters, informed of the attacker's objective, reliably label attack intent, category, and severity.
    Section 3.1 describes human annotation; no inter-annotator agreement or annotation quality checks are reported.
  • ad hoc to paper Training on dialogues from ActorAttack and Chain of Attack is representative of general multi-turn attacks.
    Section 3.1 builds the dataset only from these two strategies, while evaluation includes Crescendo and X-Teaming; the paper assumes transfer without demonstrating it.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SafeTy Reasoning Elicitation Alignment for Multi-Turn Dialogues." pith.science (2026). https://pith.science/paper/3CDPA7ZZ

@misc{pith2026250600668,
  author       = {Pith},
  title        = {Pith review of: SafeTy Reasoning Elicitation Alignment for Multi-Turn Dialogues},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/3CDPA7ZZ}},
  note         = {Machine review of arXiv:2506.00668}
}
read the original abstract

Malicious attackers can exploit large language models (LLMs) by engaging them in multi-turn dialogues to achieve harmful objectives, posing significant safety risks to society. To address this challenge, we propose a novel defense mechanism: SafeTy Reasoning Elicitation Alignment for Multi-Turn Dialogues (STREAM). STREAM defends LLMs against multi-turn attacks while preserving their functional capabilities. Our approach involves constructing a human-annotated dataset, the Safety Reasoning Multi-turn Dialogues dataset, which is used to fine-tune a plug-and-play safety reasoning moderator. This model is designed to identify malicious intent hidden within multi-turn conversations and alert the target LLM of potential risks. We evaluate STREAM across multiple LLMs against prevalent multi-turn attack strategies. Experimental results demonstrate that our method significantly outperforms existing defense techniques, reducing the Attack Success Rate (ASR) by 51.2%, all while maintaining comparable LLM capability.

Figures

Figures reproduced from arXiv: 2506.00668 by the authors.

Figure 1
Figure 1. The flowchart illustrates the application of our method, STREAM, using real examples from the GPT-4.1 [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. The flowchart illustrates our method, SafeTy Reasoning Elicitation Alignment for Multi-Turn Dialogues [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Distribution of the Safety Reasoning Multi [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Human labeled multi-turn dialogue questionnaire [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

30 extracted references · 8 canonical work pages

  1. [1]

    Anthropic . 2025. Claude 3.7 sonnet and claude code. https://www.anthropic.com/news/claude-3-7-sonnet

    work page 2025

  2. [2]

    Akhiad Bercovich, Itay Levy, Izik Golan, Mohammad Dabbah, Ran El-Yaniv, Omri Puny, Ido Galil, Zach Moshe, Tomer Ronen, Najeeb Nabwani, Ido Shahaf, Oren Tropp, Ehud Karpas, Ran Zilberstein, Jiaqi Zeng, Soumye Singhal, Alexander Bukharin, Yian Zhang, Tugrul Konuk, Gerald Shen, Ameya Sunil Mahabaleshwarkar, Bilal Kartal, Yoshi Suhara, Olivier Delalleau, Ziji...

    arXiv 2025

  3. [3]

    Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, et al. 2021. Training verifiers to solve math word problems. arXiv preprint arXiv:2110.14168

    arXiv 2021

  4. [4]

    Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. 2020. Measuring massive multitask language understanding. arXiv preprint arXiv:2009.03300

    arXiv 2020

  5. [5]

    Kai Hu, Weichen Yu, Yining Li, Tianjun Yao, Xiang Li, Wenhe Liu, Lijun Yu, Zhiqiang Shen, Kai Chen, and Matt Fredrikson. 2024. Efficient llm jailbreak via adaptive dense-to-sparse constrained optimization. Advances in Neural Information Processing Systems, 37:23224--23245

    2024

  6. [6]

    Aaron Hurst, Adam Lerer, Adam P Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Ostrow, Akila Welihinda, Alan Hayes, Alec Radford, et al. 2024. Gpt-4o system card. arXiv preprint arXiv:2410.21276

    arXiv 2024

  7. [7]

    Aaron Jaech, Adam Kalai, Adam Lerer, Adam Richardson, Ahmed El-Kishky, Aiden Low, Alec Helyar, Aleksander Madry, Alex Beutel, Alex Carney, et al. 2024. Openai o1 system card. arXiv preprint arXiv:2412.16720

    arXiv 2024

  8. [8]

    Ian Kivlichan, Justyn Harriman, Cameron Raymond, Meghan Shah, Shraman Ray Chaudhuri, and Keren Gu-Lemberg. 2024. https://openai.com/index/upgrading-the-moderation-api-with-our-new-multimodal-moderation-model/ Upgrading the moderation api with our new multimodal moderation model

    work page 2024

Show all 30 references
  1. [9]

    Martin Kuo, Jianyi Zhang, Aolin Ding, Qinsi Wang, Louis DiValentin, Yujia Bao, Wei Wei, Hai Li, and Yiran Chen. 2025 a . H-cot: Hijacking the chain-of-thought safety reasoning mechanism to jailbreak large reasoning models, including openai o1/o3, deepseek-r1, and gemini 2.0 fl...

    2025 arXiv

  2. [10]

    Martin Kuo, Jingyang Zhang, Jianyi Zhang, Minxue Tang, Louis DiValentin, Aolin Ding, Jingwei Sun, William Chen, Amin Hass, Tianlong Chen, Yiran Chen, and Hai Li. 2025 b . https://openreview.net/forum?id=io8uRPYktn Proactive privacy amnesia for large language models: Safeguardi...

    2025

  3. [11]

    Nathaniel Li, Ziwen Han, Ian Steneker, Willow Primack, Riley Goodside, Hugh Zhang, Zifan Wang, Cristina Menghini, and Summer Yue. 2024. Llm defenses are not robust to multi-turn human jailbreaks yet. arXiv preprint arXiv:2408.15221

    2024 arXiv

  4. [12]

    Genglin Liu, Xingyao Wang, Lifan Yuan, Yangyi Chen, and Hao Peng. 2023. Examining llms' uncertainty expression towards questions outside parametric knowledge. arXiv preprint arXiv:2311.09731

    2023 arXiv

  5. [13]

    AI @ Meta Llama Team. 2024. https://arxiv.org/abs/2407.21783 The llama 3 herd of models . Preprint, arXiv:2407.21783

    2024 arXiv

  6. [14]

    OpenAI. 2024. https://openai.com/index/gpt-4-1/ Gpt-4.1

    2024

  7. [15]

    OpenAI . 2025. o3 and o4 mini system card. https://cdn.openai.com/pdf/2221c875-02dc-4789-800b-e7758f3722c1/o3-and-o4-mini-system-card.pdf

    2025

  8. [16]

    Daly, Michael Hind, Werner Geyer, Ambrish Rawat, Kush R

    Inkit Padhi, Manish Nagireddy, Giandomenico Cornacchia, Subhajit Chaudhury, Tejaswini Pedapati, Pierre Dognin, Keerthiram Murugesan, Erik Miehling, Martín Santillán Cooper, Kieran Fraser, Giulio Zizzo, Muhammad Zaid Hameed, Mark Purcell, Michael Desmond, Qian Pan, Zahra Ashkto...

    2024 arXiv

  9. [17]

    Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. 2023. Fine-tuning aligned language models compromises safety, even when users do not intend to! arXiv preprint arXiv:2310.03693

    2023 arXiv

  10. [18]

    Salman Rahman, Liwei Jiang, James Shiffer, Genglin Liu, Sheriff Issaka, Md Rizwan Parvez, Hamid Palangi, Kai-Wei Chang, Yejin Choi, and Saadia Gabriel. 2025. X-teaming: Multi-turn jailbreaks and defenses with adaptive multi-agents. arXiv preprint arXiv:2504.13203

    2025 arXiv

  11. [19]

    Qibing Ren, Hao Li, Dongrui Liu, Zhanxu Xie, Xiaoya Lu, Yu Qiao, Lei Sha, Junchi Yan, Lizhuang Ma, and Jing Shao. 2024. Derail yourself: Multi-turn llm jailbreak attack through self-discovered clues. arXiv preprint arXiv:2410.10700

    2024

  12. [20]

    Mark Russinovich, Ahmed Salem, and Ronen Eldan. 2024. Great, now write an article about that: The crescendo multi-turn llm jailbreak attack. arXiv preprint arXiv:2404.01833

    2024 arXiv

  13. [21]

    Gregory Schraw. 1998. Promoting general metacognitive awareness. Instructional science, 26(1):113--125

    1998

  14. [22]

    Xikang Yang, Xuehai Tang, Songlin Hu, and Jizhong Han. 2024. Chain of attack: a semantic-driven contextual multi-turn attacker for llm. arXiv preprint arXiv:2405.05610

    2024 arXiv

  15. [23]

    Sangyoon Yu. 2025. Automated-Multi-Turn-Jailbreaks . https://github.com/AIM-Intelligence/Automated-Multi-Turn-Jailbreaks

    2025

  16. [24]

    Youliang Yuan, Wenxiang Jiao, Wenxuan Wang, Jen-tse Huang, Pinjia He, Shuming Shi, and Zhaopeng Tu. 2023. Gpt-4 is too smart to be safe: Stealthy chat with llms via cipher. arXiv preprint arXiv:2308.06463

    2023 arXiv

  17. [25]

    R-tuning: Instructing large language models to say ‘i don’t know’

    Hanning Zhang, Shizhe Diao, Yong Lin, Yi Ren Fung, Qing Lian, Xingyao Wang, Yangyi Chen, Heng Ji, and Tong Zhang. R-tuning: Instructing large language models to say ‘i don’t know’. 2023. URL https://api. semanticscholar. org/CorpusID, 265220839

    2023

  18. [26]

    Jianyi Zhang, Saeed Vahidian, Martin Kuo, Chunyuan Li, Ruiyi Zhang, Tong Yu, Guoyin Wang, and Yiran Chen. 2024. Towards building the federatedgpt: Federated instruction tuning. In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP...

    2024

  19. [27]

    Xuandong Zhao, Xianjun Yang, Tianyu Pang, Chao Du, Lei Li, Yu-Xiang Wang, and William Yang Wang. 2024. https://arxiv.org/abs/2401.17256 Weak-to-strong jailbreaking on large language models . Preprint, arXiv:2401.17256

    2024 arXiv

  20. [28]

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043

    2023 arXiv

  21. [29]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list...

  22. [30]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.