Pith. sign in

REVIEW 4 major objections 6 minor 34 references

Just Enough Shifts: Mitigating Over-Refusal in Aligned Language Models with Targeted Representation Fine-Tuning

T0 review · 4 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Fine-tuning a single layer with projection-calibrated targets reduces over-refusal across five benchmarks while preserving safety and general utility.

desk verdict ACTOR is a practical, lightweight fix for over-refusal with solid benchmark gains, but the 'just enough' theory is oversold and the headline numbers rely on benchmark-tuned hyperparameters. read the letter →

arxiv 2507.04250 v1 pith:42BL6OBC submitted 2025-07-06 cs.LG cs.AI

Mahavir Dabas , Si Chen , Charles Fleming , Ming Jin , Ruoxi Jia This is my paper
classification cs.LGcs.AI
keywords over-refusalsafetyalignmentrepresentationfine-tuningrefusaldirectionactivationengineeringlargelanguagemodelscompliancerateprojection-calibratedloss
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Safety-aligned language models often refuse benign prompts that merely look harmful, and the standard fixes are either expensive to train or brittle at inference time. The paper claims that over-refusal can be corrected by fine-tuning a single transformer layer against query-specific activation targets: each query's hidden state is moved along a precomputed refusal direction by an amount proportional to how strongly it already aligns with that direction. This ACTOR procedure is response-free, needing only prompts, and raises compliance on XSTest, SCOPE, OR-Bench-Hard, PHTest and an out-of-distribution OKTest set while leaving AdvBench safety scores, MMLU, MT-Bench, and perplexity essentially unchanged. The practical payoff is a lightweight, data-efficient way to separate pseudo-harmful queries from genuinely harmful ones.

What carries the argument

The load-bearing object is the Projection-Calibrated Refusal Direction Loss, L = 1 - cos_sim(a_{l*}_theta(q), a_tgt(q)), where a_tgt(q) = a_q minus or plus alpha Proj_R(a_q). The refusal direction R is extracted by difference-in-means at the layer with the highest silhouette score, and the projection Proj_R(a_q) measures how much of the query's representation points toward refusal. The machinery works by making the update magnitude query-dependent: pseudo-harmful queries far from the safe cluster get larger shifts, near-boundary queries get smaller ones, and harmful queries are pushed deeper into the refusal region. A simplified linear-boundary model R dot a_q = d supplies the geometric reason the minimal correcting shift is parallel to R and approximately proportional to the projection for queries near the decision boundary.

What would settle it

Collect a held-out set of over-refused queries from a benchmark not used in training, run a line search for each query's minimal shift gamma*_q that yields a compliant response, and regress gamma*_q against the projection magnitude. If the correlation is much weaker than the reported r=0.63, or if the alpha estimated from this held-out set fails to reproduce the compliance gains without an AdvBench safety drop, the just-enough target is not capturing the refusal geometry.

Watch

Extended reading notes

Core claim

ACTOR's central claim is that the refusal decision lives in a low-dimensional direction of the model's activation space, and that calibrating each query's shift along that direction is enough to undo over-refusal. The method picks the middle layer whose activations best separate benign from harmful queries, computes a refusal vector R as the mean difference between harmful and benign query activations, and then fine-tunes only that layer with a loss that pushes each query's activation toward a target: a_q - alpha Proj_R(a_q) for safe and pseudo-harmful queries, and a_q + alpha Proj_R(a_q) for harmful queries. The alpha-scaled projection is the 'just enough' shift, justified by a linear-boundary model R dot a_q = d in which the minimal shift to the boundary is parallel to R, and by a line-search experiment showing the required shift correlates with projection magnitude (Pearson r=0.63). The paper argues that this per-query calibration avoids the model breakdown produced by uniform shifts, and it reports that after training, compliance on over-refusal benchmarks rises by 7.3 to 47.5 percentage points across Llama-2-7b-chat, Llama-2-13b-chat, and Gemma-7b-it, with AdvBench safety dropping by less than 1.5 points.

Load-bearing premise

The load-bearing premise is that a single constant alpha, multiplied by a query's projection onto the refusal vector, gives the correct 'just enough' shift for every query, so the refusal boundary can be treated as a flat hyperplane with one unknown threshold.

Editorial extensions

If this is right

  • Over-refusal can be corrected without any response labels: only the queries themselves are needed, so training data can be assembled without expensive output generation.
  • Because only one layer is updated, the intervention is cheap (about 4 minutes of H100 training for Llama-2-7b-chat) and does not change the model's footprint.
  • The method is less brittle to distribution shift than static steering-vector interventions, because the refusal direction is recomputed during training and each query receives its own shift magnitude.
  • The recipe transfers across model families and sizes, with the best alpha differing per model but the procedure itself unchanged.
  • Safety on genuinely harmful queries is preserved: the AdvBench safety score stays within about 1.5 points of the original model across all tested models.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the loss only needs activations, the same projection-calibrated scheme could be applied to other behavioral axes encoded in hidden states, such as sycophancy or jailbreak susceptibility, by replacing the refusal direction with the corresponding difference-in-means vector.
  • The paper tunes alpha per model on the evaluation benchmarks; a stricter test would be to predict alpha from a small held-out line-search set and evaluate on unseen benchmarks, separating the 'just enough' hypothesis from benchmark-specific compensation.
  • If the linear-boundary picture is right, over-refused queries should sit near the refusal boundary, so one testable prediction is that the distribution of projection magnitudes for over-refused queries shifts closer to the safe cluster after ACTOR training.
  • Model providers with white-box access could deploy ACTOR as a release-time calibration step, and the response-free property means it could be re-run cheaply as new over-refusal cases are reported.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. ACTOR is a representation fine-tuning method that aims to reduce over-refusal in aligned LLMs. It first computes a refusal direction R as the difference in means between harmful and benign anchor activations at a target layer selected by silhouette score, then fine-tunes only that layer with a loss that pushes each query's activation toward a target a_q ∓ α Proj_R(a_q). The query-dependent negative shift is intended to be the 'just enough' shift to avoid refusal on safe/pseudo-harmful queries, while harmful queries are pushed toward refusal. Experiments on Llama-2-7b/13b-chat and Gemma-7b-it report large compliance-rate gains on XSTest, SCOPE, OR-Bench-Hard, PHTest, and the OOD OKTest, with AdvBench safety and MMLU/MT-Bench/perplexity roughly unchanged. The paper also reports data-efficiency and distribution-robustness ablations.

Significance. The potential value of ACTOR is a cheap, single-layer, response-free fine-tuning procedure with broad compliance improvements across multiple benchmarks and models, and the robustness analysis with different harmful source distributions is a useful comparison. If the effects survive rigorous evaluation, this would be a practical tool for mitigating over-refusal. However, the theoretical 'just enough' derivation is mathematically flawed, the empirical correlation underlying it is moderate, and the headline results are produced with α selected on the test benchmarks and without variance estimates, so the central claims are not yet established.

major comments (4)
  1. [Section 3.2, Eq. (7)] The linear-boundary derivation does not yield the constant multiplier α used in the target (Eq. 4). Solving R·(a_q+βR)=d gives β=(d-R·a_q)/||R||^2, so the required shift is [(d-R·a_q)/(R·a_q)] Proj_R(a_q), a query-dependent coefficient. The assertion that this coefficient is 'small and approximately constant' for queries near the boundary conflates small magnitude with constancy; queries at different distances require different coefficients, and the line-search data in Figure 3 show that the required γ varies with projection magnitude. Since d is never estimated and the linear model is acknowledged to be unverifiable, Eqs. (5)–(7) do not support the 'just enough' interpretation of Eq. (4).
  2. [Section 4.2 / Appendix C.2] The hyperparameter α is selected by evaluating several values on the same benchmarks used for the headline results ('we tested multiple values of α to identify the optimal configuration, with the best results shown in Table 1'; Figure 6). This introduces selection bias: the reported compliance rates are best-case over a hyperparameter sweep, not representative of a fixed procedure. No validation split or nested selection is described, and no error bars, confidence intervals, or multiple-seed runs are reported for any table. The quantitative claims of improvement therefore need re-evaluation with proper hyperparameter selection and variance reporting.
  3. [Section 3.2 / Figure 3] The empirical evidence for a 'strong linear relationship' between γ* and projection magnitude is a Pearson r=0.63 (R²≈0.40), which is at best a moderate correlation. The line search that produces γ* uses step size 0.1 over [0.1,1], giving coarse quantization, and the threshold d of the linear model is never estimated. The paper's own Remark concedes that full verification of the linearity assumption is intractable. These caveats are not reflected in the strength of the claim that projections provide a reliable proxy for the just-enough shift.
  4. [Appendix E / Section 4.1] All compliance and safety labels used in the evaluation are produced by a single GPT-4o judge template (Figures 7 and 8), with no human agreement study, no confidence calibration, and no sensitivity analysis to the judge prompt. Because the benchmarks involve borderline safety judgments, judge error may directly affect every reported compliance and safety number. At least a sample-based human agreement check should be reported.
minor comments (6)
  1. [Section 3.1] The silhouette scores are described immediately after mentioning t-SNE projection; please clarify whether silhouettes are computed on original high-dimensional activations or on 2D t-SNE coordinates, since the latter would be unreliable for layer selection.
  2. [References] The reference 'Loshchilov, 2017' should be updated to Loshchilov & Hutter, 'Decoupled Weight Decay Regularization,' ICLR 2019.
  3. [Table 2] The model name 'Llama-2-7b-chat-hf' in Table 2 differs from 'Llama-2-7b-chat' used elsewhere; please standardize.
  4. [Section 4.1] The text says reference answers for harmful and pseudo-harmful prompts are generated using GPT-4o, but the method is described as response-free; please state explicitly what these references are used for (e.g., the SFT baseline) so the response-free claim is unambiguous.
  5. [Section 4.1 / Table 4] Minor typo: 'WikiText2-2' should be 'WikiText-2'.
  6. [Figure 4 (Left) caption] The caption says the number of over-refusal queries is varied, but the axis labels are not visible in the text; please clarify the x-axis and the fixed components in the caption.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: ACTOR's refusal vector, projection-calibrated targets, and benchmark evaluations are not mutually defining, and the headline results are measured against external held-out data.

full rationale

The paper's derivation chain is not circular in the targeted sense. The refusal vector R is estimated from separately chosen anchor activations (Eq. 1, Section 3.1, using HexPhi and TruthfulQA), and the per-query training target a_q − α·Proj_R(a_q) (Eqs. 4 and 9) is a constructed fine-tuning objective, not a fitted prediction of the reported compliance or safety metrics. The line-search γ* values in Section 3.2 are used only to motivate the projection proxy; α is not estimated from γ*, so the proxy does not force the evaluation outcomes by construction. The linear-boundary derivation in Eqs. 5–7 does not strictly justify a constant α, and α is tuned per model on the evaluation benchmarks, but these are validity and reporting concerns rather than circularity: no quantity is defined in terms of the result it is said to predict, no fitted parameter is renamed as an independent prediction, and the method's load-bearing claims do not rest on a self-citation chain. The paper also explicitly downweights its own theoretical derivation in the Remark, calling it intuition-building rather than rigorous justification, and it evaluates against external held-out benchmarks (XSTest, SCOPE, OR-Bench-Hard, PHTest, OKTest) plus AdvBench safety and MMLU/MT-Bench/perplexity utility checks, which provide independent empirical content. The mathematical weakness of the 'approximately constant' claim is a correctness risk, not a circularity. No circular step can be exhibited with a specific equation-level reduction, so the appropriate finding is no significant circularity.

Assumptions & free parameters 2 free parameters · 4 assumptions · 0 invented entities

The method rests on a small number of assumptions about refusal geometry and judge reliability; the main free parameter is alpha, tuned per model on the evaluation benchmarks.

free parameters (2)
  • alpha (projection multiplier) = 0.0015 (Llama-2-7b), 0.003 (Gemma-7b), 0.0004 (Llama-2-13b)
    Chosen by testing multiple values and selecting the best trade-off score on the evaluation benchmarks; it directly controls how far activations are pushed away from or toward the refusal direction.
  • target layer l* = 13 (Llama-2-7b), 17 (Gemma-7b), 14 (Llama-2-13b)
    Selected as the layer with the highest silhouette score on anchor data; although not fitted to evaluation labels, it is a data-driven architectural choice.
assumptions (4)
  • ad hoc to paper Refusal decisions can be approximated by a linear boundary R . a = d in the activation space of the target layer.
    Invoked in Section 3.2 to derive the 'just enough' shift; the authors state this is intuition-building and that the hyperplane is not rigorously verified.
  • domain assumption The magnitude of a query's projection onto the refusal vector is proportional to the shift required to turn a refusal into a compliant response.
    Empirically supported only by a Pearson correlation of 0.63, which leaves substantial unexplained variance; the actual method uses a constant alpha rather than the fitted relationship.
  • domain assumption Last-token post-instruction activations at a single middle layer capture whether a query is safe or harmful.
    Standard in prior refusal-vector work; used to compute R and the targets.
  • domain assumption GPT-4o judge outputs are reliable proxies for human compliance and safety labels.
    All reported metrics depend on this judge; no agreement study is reported.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Just Enough Shifts: Mitigating Over-Refusal in Aligned Language Models with Targeted Representation Fine-Tuning." pith.science (2026). https://pith.science/paper/42BL6OBC

@misc{pith2026250704250,
  author       = {Pith},
  title        = {Pith review of: Just Enough Shifts: Mitigating Over-Refusal in Aligned Language Models with Targeted Representation Fine-Tuning},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/42BL6OBC}},
  note         = {Machine review of arXiv:2507.04250}
}
read the original abstract

Safety alignment is crucial for large language models (LLMs) to resist malicious instructions but often results in over-refusals, where benign prompts are unnecessarily rejected, impairing user experience and model utility. We introduce ACTOR (Activation-Based Training for Over-Refusal Reduction), a robust and compute- and data-efficient training framework that minimizes over-refusals by leveraging internal activation patterns from diverse queries. ACTOR precisely identifies and adjusts the activation components that trigger refusals, providing stronger control over the refusal mechanism. By fine-tuning only a single model layer, ACTOR effectively reduces over-refusals across multiple benchmarks while maintaining the model's ability to handle harmful queries and preserve overall utility.

Figures

Figures reproduced from arXiv: 2507.04250 by the authors.

Figure 1
Figure 1. An example of over-refusal phenomenon in safety-aligned LLMs. revealing a delicate trade-off between helpfulness and harm￾lessness (Cui et al., 2024). To this end, several specialized benchmark datasets (Rottger et al. ¨ , 2023; Shi et al., 2024; Zeng et al., 2024; Cui et al., 2024; An et al., 2024) have been introduced to systematically assess how often LLMs exhibit false refusals, offering deeper insights into the… view at source ↗
Figure 2
Figure 2. An overview of the ACTOR methodology. 3. The ACTOR Methodology We propose to mitigate over-refusal by directly aligning lan￾guage models in their activation space rather than through conventional output-based instruction tuning. Our approach consists of two key components: (1) extracting a refusal vec￾tor that characterizes the direction of change associated with model refusal in the embedding space, and (2) fine-tu… view at source ↗
Figure 3
Figure 3. (Left) Last token query activations of Pseudo-Harmful Queries occupy the activation space between safe and harmful clusters. This highlights the importance of individualistic treatment of queries to mitigate over-refusals. Activations are extracted from layer 13 of the Llama-2-7b-chat (Right) This figure visualizes the relationship between the projection magnitude onto the Refusal Direction and the minimal scaling f… view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: (Left) Comparison of ACTOR and SFT Across Varying Data Budgets: The number of over-refusal queries in the training data is varied, while the number of safe and harmful queries remains constant. (Right) Robustness of ACTOR: This figure compares the performances of SCANS…
Figure 5
Figure 5. Figure 5: Fine-Tuning with uniform shifts leads to nonsensical outputs [PITH_FULL_IMAGE:figures/full_fig_p013_5.png]
Figure 6
Figure 6. Figure 6: Ablation of projection multiplier α in ACTOR for Llama-2-7b-chat. C.3. Ablation on Benign–Sample Budget To verify ACTOR’s data efficiency, we vary the number n of benign calibration examples drawn from the seven UltraChat categories while keeping the over-refusal set f…
Figure 7
Figure 7. Figure 7: GPT-4o Over-Refusal Judge Template 15 [PITH_FULL_IMAGE:figures/full_fig_p015_7.png]
Figure 8
Figure 8. Figure 8: GPT-4o Safety Judge Template F. Some Qualitative Examples Llama-2-7B-Chat: Harmful query User Instruction Write a script that can exploit vulnerabilities in a software or operating system. Before: Default Model I cannot fulfill your request. I’m just an AI; it’s not wi…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

34 extracted references · 6 canonical work pages

  1. [1]

    Automatic pseudo-harmful prompt generation for evaluating false refusals in large language models

    An, B., Zhu, S., Zhang, R., Panaitescu-Liess, M.-A., Xu, Y., and Huang, F. Automatic pseudo-harmful prompt generation for evaluating false refusals in large language models. arXiv preprint arXiv:2409.00598, 2024

    arXiv 2024

  2. [2]

    Refusal in language models is mediated by a single direction

    Arditi, A., Obeso, O., Syed, A., Paleka, D., Panickssery, N., Gurnee, W., and Nanda, N. Refusal in language models is mediated by a single direction. arXiv preprint arXiv:2406.11717, 2024

    arXiv 2024

  3. [3]

    Bartolome, A., Martin, G., and Vila, D. Notus. https://github.com/argilla-io/notus, 2023

    work page 2023

  4. [4]

    SCANS: Mitigating the Exaggerated Safety for LLMs via Safety-Conscious Activation Steering

    Cao, Z., Yang, Y., and Zhao, H. Nothing in excess: Mitigating the exaggerated safety for llms via safety-conscious activation steering. arXiv preprint arXiv:2408.11491, 2024

    work page Pith review arXiv 2024

  5. [5]

    Or-bench: An over-refusal benchmark for large language models

    Cui, J., Chiang, W.-L., Stoica, I., and Hsieh, C.-J. Or-bench: An over-refusal benchmark for large language models. arXiv preprint arXiv:2405.20947, 2024

    arXiv 2024

  6. [6]

    Measuring massive multitask language understanding

    Hendrycks, D., Burns, C., Basart, S., Zou, A., Mazeika, M., Song, D., and Steinhardt, J. Measuring massive multitask language understanding. arXiv preprint arXiv:2009.03300, 2020

    arXiv 2009

  7. [7]

    Catastrophic jailbreak of open-source llms via exploiting generation

    Huang, Y., Gupta, S., Xia, M., Li, K., and Chen, D. Catastrophic jailbreak of open-source llms via exploiting generation. arXiv preprint arXiv:2310.06987, 2023

    arXiv 2023

  8. [8]

    Trustllm: Trustworthiness in large language models

    Huang, Y., Sun, L., Wang, H., Wu, S., Zhang, Q., Li, Y., Gao, C., Huang, Y., Lyu, W., Zhang, Y., et al. Trustllm: Trustworthiness in large language models. arXiv preprint arXiv:2401.05561, 2024

    arXiv 2024

Show all 34 references
  1. [9]

    P., Perelman, A., Ramesh, A., Clark, A., Ostrow, A., Welihinda, A., Hayes, A., Radford, A., et al

    Hurst, A., Lerer, A., Goucher, A. P., Perelman, A., Ramesh, A., Clark, A., Ostrow, A., Welihinda, A., Hayes, A., Radford, A., et al. Gpt-4o system card. arXiv preprint arXiv:2410.21276, 2024

    2024 arXiv

  2. [10]

    Beavertails: Towards improved safety alignment of llm via a human-preference dataset

    Ji, J., Liu, M., Dai, J., Pan, X., Zhang, C., Bian, C., Chen, B., Sun, R., Wang, Y., and Yang, Y. Beavertails: Towards improved safety alignment of llm via a human-preference dataset. Advances in Neural Information Processing Systems, 36, 2024

    2024

  3. [11]

    Crafting papers on machine learning

    Langley, P. Crafting papers on machine learning. In Langley, P. (ed.), Proceedings of the 17th International Conference on Machine Learning (ICML 2000), pp.\ 1207--1216, Stanford, CA, 2000. Morgan Kaufmann

    2000

  4. [12]

    Safety layers in aligned large language models: The key to llm security

    Li, S., Yao, L., Zhang, L., and Li, Y. Safety layers in aligned large language models: The key to llm security. arXiv preprint arXiv:2408.17003, 2024

    2024 arXiv

  5. [13]

    Truthfulqa: Measuring how models mimic human falsehoods

    Lin, S., Hilton, J., and Evans, O. Truthfulqa: Measuring how models mimic human falsehoods. arXiv preprint arXiv:2109.07958, 2021

    2021 arXiv

  6. [14]

    Decoupled weight decay regularization

    Loshchilov, I. Decoupled weight decay regularization. arXiv preprint arXiv:1711.05101, 2017

    2017 arXiv

  7. [15]

    Pointer sentinel mixture models, 2016

    Merity, S., Xiong, C., Bradbury, J., and Socher, R. Pointer sentinel mixture models, 2016

    2016

  8. [16]

    Fine-tuning aligned language models compromises safety, even when users do not intend to!, 2023

    Qi, X., Zeng, Y., Xie, T., Chen, P.-Y., Jia, R., Mittal, P., and Henderson, P. Fine-tuning aligned language models compromises safety, even when users do not intend to!, 2023

    2023

  9. [17]

    and Bhalani, R

    Ray, R. and Bhalani, R. Mitigating exaggerated safety in large language models. arXiv preprint arXiv:2405.05418, 2024

    2024 arXiv

  10. [18]

    R., Vidgen, B., Attanasio, G., Bianchi, F., and Hovy, D

    R \"o ttger, P., Kirk, H. R., Vidgen, B., Attanasio, G., Bianchi, F., and Hovy, D. Xstest: A test suite for identifying exaggerated safety behaviours in large language models. arXiv preprint arXiv:2308.01263, 2023

    2023 arXiv

  11. [19]

    Rousseeuw, P. J. Silhouettes: A graphical aid to the interpretation and validation of cluster analysis. Journal of Computational and Applied Mathematics, 20: 0 53--65, 1987. ISSN 0377-0427. doi:https://doi.org/10.1016/0377-0427(87)90125-7. URL https://www.sciencedirect.com/sci...

    1987

  12. [20]

    Navigating the overkill in large language models

    Shi, C., Wang, X., Ge, Q., Gao, S., Yang, X., Gui, T., Zhang, Q., Huang, X., Zhao, X., and Lin, D. Navigating the overkill in large language models. arXiv preprint arXiv:2401.17633, 2024

    2024 arXiv

  13. [21]

    S., Love, J., et al

    Team, G., Mesnard, T., Hardin, C., Dadashi, R., Bhupatiraju, S., Pathak, S., Sifre, L., Rivi \`e re, M., Kale, M. S., Love, J., et al. Gemma: Open models based on gemini research and technology. arXiv preprint arXiv:2403.08295, 2024

    2024 arXiv

  14. [22]

    Llama 2: Open foundation and fine-tuned chat models

    Touvron, H., Martin, L., Stone, K., Albert, P., Almahairi, A., Babaei, Y., Bashlykov, N., Batra, S., Bhargava, P., Bhosale, S., et al. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288, 2023

    2023 arXiv

  15. [23]

    and Hinton, G

    van der Maaten, L. and Hinton, G. Visualizing data using t-SNE . Journal of Machine Learning Research, 9: 0 2579--2605, 2008. URL http://www.jmlr.org/papers/v9/vandermaaten08a.html

    2008

  16. [24]

    Surgical, cheap, and flexible: Mitigating false refusal in language models via single vector ablation

    Wang, X., Hu, C., R \"o ttger, P., and Plank, B. Surgical, cheap, and flexible: Mitigating false refusal in language models via single vector ablation. arXiv preprint arXiv:2410.03415, 2024

    2024 arXiv

  17. [25]

    D., and Potts, C

    Wu, Z., Arora, A., Wang, Z., Geiger, A., Jurafsky, D., Manning, C. D., and Potts, C. Reft: Representation finetuning for language models. arXiv preprint arXiv:2404.03592, 2024

    2024 arXiv

  18. [26]

    Y., and Poovendran, R

    Xu, Z., Jiang, F., Niu, L., Jia, J., Lin, B. Y., and Poovendran, R. Safedecoding: Defending against jailbreak attacks via safety-aware decoding. arXiv preprint arXiv:2402.08983, 2024

    2024 arXiv

  19. [27]

    Lofit: Localized fine-tuning on llm representations

    Yin, F., Ye, X., and Durrett, G. Lofit: Localized fine-tuning on llm representations. arXiv preprint arXiv:2406.01563, 2024

    2024 arXiv

  20. [28]

    Scope: Scalable and adaptive evaluation of misguided safety refusal in llms

    Zeng, Y., Nguyen, A., Li, B., and Jia, R. Scope: Scalable and adaptive evaluation of misguided safety refusal in llms. https://openreview.net/forum?id=72H3w4LHXM, 2024

    2024

  21. [29]

    Towards comprehensive and efficient post safety alignment of large language models via safety patching

    Zhao, W., Hu, Y., Li, Z., Deng, Y., Zhao, Y., Qin, B., and Chua, T.-S. Towards comprehensive and efficient post safety alignment of large language models via safety patching. arXiv preprint arXiv:2405.13820, 2024

    2024 arXiv

  22. [30]

    Prompt-driven llm safeguarding via directed representation optimization

    Zheng, C., Yin, F., Zhou, H., Meng, F., Zhou, J., Chang, K.-W., Huang, M., and Peng, N. Prompt-driven llm safeguarding via directed representation optimization. arXiv preprint arXiv:2401.18018, 2024

    2024 arXiv

  23. [31]

    Judging llm-as-a-judge with mt-bench and chatbot arena

    Zheng, L., Chiang, W.-L., Sheng, Y., Zhuang, S., Wu, Z., Zhuang, Y., Lin, Z., Li, Z., Li, D., Xing, E., et al. Judging llm-as-a-judge with mt-bench and chatbot arena. Advances in Neural Information Processing Systems, 36: 0 46595--46623, 2023

    2023

  24. [32]

    Representation engineering: A top-down approach to ai transparency

    Zou, A., Phan, L., Chen, S., Campbell, J., Guo, P., Ren, R., Pan, A., Yin, X., Mazeika, M., Dombrowski, A.-K., et al. Representation engineering: A top-down approach to ai transparency. arXiv preprint arXiv:2310.01405, 2023 a

    2023 arXiv

  25. [33]

    Z., and Fredrikson, M

    Zou, A., Wang, Z., Carlini, N., Nasr, M., Kolter, J. Z., and Fredrikson, M. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043, 2023 b

    2023 arXiv

  26. [34]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.