Pith. sign in

REVIEW 3 major objections 4 minor 1 cited by

Pretraining with switchable modules gives one model many capability profiles

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · glm-5.2

2026-07-10 00:25 UTC pith:3VJ56QKX

load-bearing objection GRAM is a genuinely interesting idea—pretrain auxiliary modules, ablate them at inference to remove capabilities, and get something that approximates data filtering at a fraction of the cost. The scaling analysis is the real contribution. But the fine-tuning resistance claim is doing a lot of load-bearing work and the abstract doesn't give us enough to evaluate it. the 3 major comments →

arxiv 2607.08077 v1 pith:3VJ56QKX submitted 2026-07-09 cs.LG

Modular Pretraining Enables Access Control

Ethan Roland , Murat Cubuktepe , Erick Martinez , Stijn Servaes , Keenan Pepper , Mike Vaiana , Diogo Schwerz de Lucena , Judd Rosenblatt
show 3 more authors
Addie Foote Cem Anil Alex Cloud
This is my paper
classification cs.LG
keywords gramcapabilitiesdataaccesscapabilitycontroldual-usemodels
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper introduces Gradient-Routed Auxiliary Modules (GRAM), a pretraining method that attaches specialized modules to a neural network and selectively updates them during training so that each module carries a distinct capability. At inference time, removing a module disables the corresponding capability while leaving the rest of the model intact, approximating the effect of having trained on filtered data. The authors evaluate GRAM on synthetic and realistic dual-use data (virology, cybersecurity, nuclear physics, code) and conduct a Chinchilla-optimal scaling analysis from 50M to 5B parameters. They find that GRAM closely tracks data-filtered models: the gap between GRAM and data-filtering stays small on retained capabilities while widening on removed ones as scale increases. The training cost is independent of the number of capability profiles, yielding a 5x cost reduction over data filtering in a 5-profile setting. The central claim is that a single pretrained model with ablatable modules can serve as a practical access-control mechanism for dual-use AI, sidestepping the expense of training and deploying separate models for each user group.

Core claim

The core discovery is that gradient-routed auxiliary modules, installed during pretraining and ablated at inference, can selectively remove targeted capabilities from a language model while preserving others, and that this approximation to data-filtered models improves with scale. The scaling analysis from 50M to 5B parameters shows the gap between GRAM and data-filtered models widening on removed capabilities (good — removal is effective) and staying small on retained ones (good — other skills survive), suggesting the method becomes more faithful as models grow. The cost structure is also central: because one training run produces a model whose modules can be independently toggled, the cost

What carries the argument

Gradient-Routed Auxiliary Modules (GRAM): auxiliary modules added to a neural network during pretraining, selectively updated via gradient routing to induce specialization, and removable at inference to disable the associated capability.

Load-bearing premise

The claim that GRAM resists recovery of ablated capabilities under fine-tuning is load-bearing for the access-control promise. The abstract does not specify the fine-tuning budget, number of steps, or threat model assumed, so it is unclear whether this resistance would hold against a determined adversary with substantial compute.

What would settle it

If fine-tuning a GRAM model with an ablated module for a modest number of steps recovers the removed capability to a level comparable to the unablated model, the access-control guarantee collapses and GRAM offers no meaningful advantage over post-hoc unlearning methods.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • A single pretrained model could be deployed with different capability profiles to different users, reducing the infrastructure cost of access control for dual-use AI by a factor proportional to the number of profiles.
  • The scaling trend suggests that larger models may be better candidates for module-based access control, since the fidelity of GRAM relative to data filtering improves with scale.
  • If module ablation is genuinely resistant to fine-tuning recovery, this method could serve as a regulatory compliance tool, allowing auditors to verify that a deployed model lacks a specific capability by inspecting which modules are present.
  • The cost-independence property means that supporting many capability profiles (e.g., for many organizations with different clearance levels) adds no marginal training cost beyond the initial GRAM pretraining run.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The resistance-to-recovery claim is critical for the access-control use case but the abstract does not specify the fine-tuning budget, number of steps, or threat model. An adversary with sufficient fine-tuning compute may recover ablated capabilities, which would collapse the access-control guarantee. The strength of this claim under realistic adversarial conditions remains the key open question.
  • If GRAM modules encode capabilities in a sufficiently separable manner, one could potentially compose modules in novel combinations not seen during training (e.g., granting virology but not cybersecurity to a user who needs neither), creating capability profiles that were never explicitly trained. Whether this compositional generalization holds is not addressed in the abstract.
  • The method's success at the Chinchilla-optimal scaling frontier (up to 5B) raises the question of whether the favorable scaling trends continue at frontier-model scales (100B+), where training dynamics and module interactions may differ qualitatively.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The manuscript proposes gradient-routed auxiliary modules (GRAM), a pretraining method that adds auxiliary modules to a neural network and selectively updates them to induce capability specialization. At inference time, ablating a module is claimed to remove the corresponding capability, approximating a model trained on filtered data. The paper evaluates GRAM on synthetic stories and four realistic dual-use domains (virology, cybersecurity, nuclear physics, specialized code), with a Chinchilla-optimal scaling analysis from 50M to 5B parameters across five capability profiles. The central claims are: (1) GRAM disables targeted capabilities while preserving others; (2) GRAM resists capability recovery under fine-tuning better than post-hoc unlearning; (3) GRAM closely tracks data filtering across scales, with the gap between data-filtered and full-data models widening on removed capabilities but remaining small on retained ones; and (4) GRAM's training cost is independent of the number of capability profiles, yielding a 5x reduction over data filtering in the 5-profile setting. This review is based on the abstract only, as the full text was not available for evaluation.

Significance. The paper addresses a practically important problem—access control for dual-use AI capabilities—and proposes a pretraining-time solution rather than a post-hoc intervention, which is a meaningful architectural contribution. The experimental scope is substantial: four realistic dual-use domains, five capability profiles, and a scaling analysis from 50M to 5B parameters following Chinchilla-optimal compute. The claim that training cost is independent of the number of profiles is a strong efficiency result if it holds. The fine-tuning resistance comparison against post-hoc unlearning is the right empirical test for the access-control use case. However, this assessment is necessarily limited by the absence of the full manuscript; the methodological details, statistical significance, and quantitative gap sizes cannot be verified.

major comments (3)
  1. The fine-tuning resistance claim is load-bearing for the paper's central thesis. The abstract states that GRAM 'resists their recovery under finetuning better than post-hoc unlearning' but does not specify the fine-tuning budget, number of steps, learning rate, dataset size, or threat model. Without these details, the reader cannot assess whether the resistance is practically meaningful or an artifact of a weak fine-tuning attack. This matters in two ways: (a) directly, for the access-control use case where adversaries may fine-tune with substantial compute and data; (b) indirectly, as the strongest available test of whether gradient routing actually localizes capability in the auxiliary modules rather than leaving partial knowledge in shared base parameters. If the base network retains latent capability, fine-tuning would recover it, and the 'tracks data filtering' result would be qualt
  2. The claim that GRAM 'closely tracks data filtering' is central but the abstract provides no quantitative threshold for what constitutes 'closely.' The scaling analysis reportedly shows the gap between data-filtered and full-data models widens on removed capabilities and stays small on retained ones, but without seeing the actual gap magnitudes, confidence intervals, or the metric definitions, it is impossible to judge whether the tracking is practically sufficient for access control. The full manuscript must report per-domain and per-scale gap sizes with error bars.
  3. The localization assumption—that gradient routing during pretraining confines capability-relevant knowledge to auxiliary modules rather than distributing it across shared base parameters—is the architectural foundation of the method. The abstract does not describe how gradient routing thresholds are set, what architecture the auxiliary modules use, or what happens when localization is imperfect. If the base network retains partial knowledge of an ablated capability, standard benchmarks might show removal while latent capability persists. The full manuscript should include probing experiments or representation analyses that directly test localization, beyond the behavioral fine-tuning test.
minor comments (4)
  1. The abstract does not specify the model architecture (transformer, MLP, etc.), the auxiliary module design, or how gradient routing is implemented. These details are needed to assess generality.
  2. The five capability profiles are not enumerated in the abstract. A brief listing would help readers understand the scope of the access-control evaluation.
  3. The 5x cost reduction claim should specify whether this accounts for inference cost (serving multiple module configurations) or only training cost, since inference-time overhead from auxiliary modules could affect the practical comparison.
  4. The relationship between GRAM and existing modular/mixture-of-experts architectures is not discussed in the abstract. A brief positioning would clarify novelty.

Circularity Check

0 steps flagged

No circularity detected in the available text

full rationale

Based on the abstract, GRAM's central claim—that ablating a module at inference approximates a model trained on filtered data—is evaluated against externally trained baselines (data-filtered models, post-hoc unlearning) across multiple domains and scales (50M–5B). No step in the described derivation chain reduces to its own inputs by construction: the method (gradient-routed auxiliary modules) is an architectural/training proposal, not a definition that entails the evaluation outcome. No fitted parameter is renamed as a prediction, no uniqueness theorem is invoked, and no self-citation chain is visible in the abstract. The scaling analysis compares GRAM to independently trained data-filtered and full-data models, which is an external benchmark. While the full text is unavailable and self-citation patterns cannot be fully ruled out, there is no evidence of circularity in what can be assessed. This is a standard empirical-methods paper evaluated against external baselines.

Axiom & Free-Parameter Ledger

2 free parameters · 2 axioms · 1 invented entities

See above.

free parameters (2)
  • Module architecture/hyperparameters = unknown
    The number, size, and placement of auxiliary modules are design choices that likely affect performance. Cannot assess from abstract.
  • Gradient routing thresholds = unknown
    The method 'selectively updates' modules, implying routing decisions or thresholds that control which modules receive gradients. These are free parameters.
axioms (2)
  • domain assumption Data filtering is the gold standard for capability removal
    The paper frames data-filtered models as the benchmark GRAM approximates. This is a reasonable but unproven assumption—data filtering may not fully remove capabilities if related knowledge is retained through other training data.
  • domain assumption Fine-tuning resistance is a meaningful security metric
    The claim that GRAM resists recovery under fine-tuning assumes that fine-tuning is the primary threat vector. Other attack vectors (prompt injection, activation steering, distillation) are not mentioned.
invented entities (1)
  • Gradient-routed auxiliary modules (GRAM) independent evidence
    purpose: Selective capability specialization during pre-training
    The modules are evaluated against external baselines (data-filtered models) and tested on realistic dual-use data across 4 domains with scaling analysis. Falsifiable: if ablation does not remove capability or if retained capabilities degrade, the method fails.

pith-pipeline@v1.1.0-glm · 3761 in / 1946 out tokens · 105081 ms · 2026-07-10T00:25:52.775064+00:00 · methodology

0 comments
read the original abstract

AI developers face a dual-use dilemma. An AI capability that helps one user cure a disease can help another synthesize one. This dilemma could be resolved with access control, limiting dual-use AI capabilities to trusted deployments with a legitimate need. A gold standard for access control would be to serve separate models with different capabilities to different users. However, training and deploying multiple models is prohibitively expensive. To address this challenge, we propose gradient-routed auxiliary modules (GRAM), a pre-training method that adds modules to a neural network and selectively updates them to induce specialization. Ablating a module at inference time removes its capability from the network, approximating a model trained on filtered data. We evaluate GRAM on synthetic stories and realistic dual-use data spanning virology, cybersecurity, nuclear physics, and specialized code. These experiments show that GRAM disables targeted capabilities while preserving the rest, and resists their recovery under finetuning better than post-hoc unlearning. Most importantly, a Chinchilla-optimal scaling analysis from 50M to 5B parameters shows that the gap between data-filtered and full-data models widens with scale on removed capabilities but stays small on retained ones, and that GRAM closely tracks data filtering. GRAM's training cost is independent of the number of supported capability profiles, yielding a 5x reduction over data filtering in our 5-profile setting.

Figures

Figures reproduced from arXiv: 2607.08077 by Addie Foote, Alex Cloud, Cem Anil, Diogo Schwerz de Lucena, Erick Martinez, Ethan Roland, Judd Rosenblatt, Keenan Pepper, Mike Vaiana, Murat Cubuktepe, Stijn Servaes.

Figure 1
Figure 1. Figure 1: Overview of GRAM training. In a decoder-only Transformer, GRAM modifies each MLP block (“Core”) by introducing additional auxiliary modules, one per dual-use capability. Left: On auxiliary data, the core MLP and corresponding auxiliary module are active in the forward pass. Gradients always update the auxiliary module and update the non-auxiliary parameters with probability pas, enabling tunable capability… view at source ↗
Figure 2
Figure 2. Figure 2: GRAM approximates five separate models trained with data filtering. Each group of bars corresponds to a model or model configuration, and each bar within a group shows the performance, in terms of compute ratio, on a different evaluation dataset. The top row shows data filtering, where each model is trained on the core dataset plus at most one auxiliary dataset. The bottom row shows GRAM, where the core ML… view at source ↗
Figure 3
Figure 3. Figure 3: GRAM scales to many auxiliary categories. As the number of auxiliary categories increases from 4 to 20, retain per￾formance remains near baseline and core stays roughly constant, while forget and elicited-forget performance remain substantially lower. Forget and elicited-forget rise modestly with more cate￾gories, but a clear separation persists across the full range. Shaded regions show 90% CIs for the me… view at source ↗
Figure 4
Figure 4. Figure 4: GRAM matches data filtered performance in a realistic setting. Left: Compute ratio per method and data class. Each bar shows the mean performance over the five capability profiles produced by that method. For example, the value of Core for filtering (0.99) is the mean compute ratio across five training runs that used data filtering with different retain sets. Right: Training costs and parameter counts rela… view at source ↗
Figure 6
Figure 6. Figure 6: GRAM achieves better modularization than alter￾natives under partial labeling. With only 50% of training data labeled, GRAM reaches an aggregate forget compute ratio sub￾stantially below data filtering and FT-LoRA, while maintaining competitive core performance. Error bars show 90% CIs for the mean over N = 3 independent training runs. because, at small scale, most of the baseline’s loss reduction on any d… view at source ↗
Figure 5
Figure 5. Figure 5: GRAM improves capability composability over FT￾LoRA. Compute ratios for GRAM and FT-LoRA when only vi￾rology is retained compared to when all auxiliary capabilities are retained. GRAM has a high virology compute ratio in both cases, whereas FT-LoRA achieves worse compute ratios in all categories when all adapters are active. Error bars show 90% CIs for the mean over N = 3 independent training runs. 6. Capa… view at source ↗
Figure 7
Figure 7. Figure 7: GRAM and FT-LoRA approximate data filtering performance across scales. Compute ratio versus model size for GRAM, FT-LoRA, and filtering, for the configuration that retains only core and virology. Larger models are trained on larger datasets according to Chinchilla-optimal scaling. Both GRAM and FT-LoRA closely track the capability profile of the data filtered model, despite only requiring a single training… view at source ↗
Figure 8
Figure 8. Figure 8: Aggregate compute ratios on Simple Stories. Compute ratio for each method, averaged over capabilities within each metric class (core, retain, forget, and elicited forget); the visual companion to [PITH_FULL_IMAGE:figures/full_fig_p015_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Comparison of GRAM via MLP, GRAM via LoRA, branched training via LoRA finetuning, and branched training via auxiliary MLP finetuning. Black bars show 90% CIs for the mean over N = 3 independent training runs. Within a given training method, models achieve similar capability profiles regardless of auxiliary module architecture. F. Hyperparameter Appendix GRAM exposes two routing hyperparameters — auxiliary … view at source ↗
Figure 10
Figure 10. Figure 10: GRAM core robustness sweep (pcr, with pas = 0.3). We split the aggregate Core compute ratio (the mean over all five retain configurations) into its two components: Core-Partial (yellow) is the mean over the four configurations that retain core plus a single auxiliary module, and Core-Full (purple) is the core-only configuration with all auxiliary modules ablated. 0 0.2 0.4 0.6 0.8 1 0.7 0.8 0.9 1 Aux Spre… view at source ↗
Figure 11
Figure 11. Figure 11: GRAM auxiliary spread sweep (pas, with pcr = 0.5). Core is the mean core compute ratio over all five retain configurations. 20 [PITH_FULL_IMAGE:figures/full_fig_p020_11.png] view at source ↗
Figure 12
Figure 12. Figure 12: FT-LoRA core:auxiliary ratio sweep (pca). Increasing the ratio shifts parameter budget from the auxiliary adapters to the frozen core-only model. Core is the mean core compute ratio over all five retain configurations. Auxiliary spread (pas). For an auxiliary batch from Di>1, the forward pass activates the core MLP and auxiliary module Ei ; in the backward pass Ei is always updated, while core parameters … view at source ↗
Figure 13
Figure 13. Figure 13: Partial labeling, with the perfectly labeled filtering reference. The three partially labeled methods (GRAM, filtering, FT-LoRA, all with 50% of tokens labeled) alongside perfectly labeled filtering (100%). Error bars show 90% CIs for the mean over N = 3 independent training runs. Discussion. Results indicate the isolation capabilities of GRAM significantly outperform both filtering and FT-LoRA in the par… view at source ↗
Figure 14
Figure 14. Figure 14: Response contours per parameter count, learning rate, and batch size. Assessment over four model sizes: 50M, 100M, 200M, 400M. Each model size and seed trains for 12 combinations of LR and BS. Combinations are determined as elements in a grid, each dimension in the grid varying by a power of two. Mean validation cross entropy loss on the core and auxiliary datasets determine the response value for a given… view at source ↗
Figure 15
Figure 15. Figure 15: Per scale optimal LR and BS are well approximated by power laws. Observed and predicted optimal learning rate and batch sizes for each model size: 50M, 100M, 200M, 400M. Bars indicate the curvature of the fit quadratic surface and show the span of values around the fit optima that attain a predicted cross entropy loss equal to 0.1% higher or less than the reported optimal loss value. K. Sample Outputs Fro… view at source ↗
Figure 16
Figure 16. Figure 16: Auxiliary capabilities in GRAM and FT-LoRA models admit continuous control. Compute ratio versus module weight t for each auxiliary capability (columns), for the 800M realistic-setting models. Top row: compute ratio on the scaled capability’s own domain, which rises toward one as t → 1. Bottom row: compute ratio on core, which is unaffected by scaling any auxiliary module. Lines are means over N = 3 seeds… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Safeguards Based on Copyable Context Cannot Provide Reliable Safety for LLMs

    cs.CR 2026-07 conditional novelty 7.0

    With copyable pre-release evidence, any dual-use release rule that keeps legitimate utility q must leave worst-case attacker assistance at least Γ(q)>0, so useful capability, reliable safety, and open access cannot coexist.

Reference graph

Works this paper leans on

97 extracted references · 97 canonical work pages · cited by 1 Pith paper · 6 internal anchors

  1. [1]

    Biderman, Dan and Portes, Jacob and Ortiz, Jose Javier Gonzalez and Paul, Mansheej and Greengard, Philip and Jennings, Connor and King, Daniel and Havens, Sam and Chiley, Vitaliy and Frankle, Jonathan and others , journal=

    work page

  2. [2]

    and Stoica, Ion , booktitle=

    Sheng, Ying and Cao, Shiyi and Li, Dacheng and Hooper, Coleman and Lee, Nicholas and Yang, Shuo and Chou, Christopher and Zhu, Banghua and Zheng, Lianmin and Keutzer, Kurt and Gonzalez, Joseph E. and Stoica, Ion , booktitle=

    work page

  3. [3]

    International Conference on Learning Representations (ICLR) , year=

    Editing Models with Task Arithmetic , author=. International Conference on Learning Representations (ICLR) , year=

    work page

  4. [4]

    Advances in Neural Information Processing Systems (NeurIPS) , year=

    Composing Parameter-Efficient Modules with Arithmetic Operation , author=. Advances in Neural Information Processing Systems (NeurIPS) , year=

    work page

  5. [5]

    1991 , publisher=

    Jacobs, Robert A and Jordan, Michael I and Nowlan, Steven J and Hinton, Geoffrey E , journal=. 1991 , publisher=

    work page 1991

  6. [6]

    Zhou, Yanqi and Lei, Tao and Liu, Hanxiao and Du, Nan and Huang, Yanping and Zhao, Vincent and Dai, Andrew M and Le, Quoc V and Laudon, James and others , journal=

    work page

  7. [7]

    Thinking Machines Lab: Connectionism , year =

    John Schulman and Thinking Machines Lab , title =. Thinking Machines Lab: Connectionism , year =

    work page

  8. [8]

    Greenblatt, Ryan and Roger, Fabien and Krasheninnikov, Dmitrii and Krueger, David , journal=

    work page

  9. [9]

    Gradient Routing: Masking Gradients to Localize Computation in Neural Networks

    Cloud, Alex and Goldman-Wetzler, Jacob and Wybitul, Ev. Gradient. arXiv preprint arXiv:2410.04332 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  10. [10]

    Science and engineering ethics , volume=

    Ethical and philosophical consideration of the dual-use dilemma in the biological sciences , author=. Science and engineering ethics , volume=. 2007 , publisher=

    work page 2007

  11. [11]

    ICML Workshop on Technical AI Governance (TAIG) , year=

    Access Controls Will Solve the Dual-Use Dilemma , author=. ICML Workshop on Technical AI Governance (TAIG) , year=

    work page

  12. [12]

    2025 , url=

    Chen, Yanda and Tucker, Mycal and Panickssery, Nina and Wang, Tony and Mosconi, Francesco and Gopal, Anjali and Denison, Carson and Petrini, Linda and Leike, Jan and Perez, Ethan and others , journal=. 2025 , url=

    work page 2025

  13. [13]

    Stranisci, Marco Antonio and Hardmeier, Christian , journal=

    work page

  14. [14]

    Guo, Yiduo and Fu, Jie and Zhang, Huishuai and Zhao, Dongyan , booktitle=

    work page

  15. [15]

    2023 , url=

    Lialin, Vladislav and Deshpande, Vijeta and Rumshisky, Anna , journal=. 2023 , url=

    work page 2023

  16. [16]

    Han, Zeyu and Gao, Chao and Liu, Jinyang and Zhang, Jeff and Zhang, Sai Qian , journal=

    work page

  17. [17]

    Xie, Yong and Aggarwal, Karan and Ahmad, Aitzaz , booktitle=

    work page

  18. [18]

    Longpre, Shayne and Yauney, Gregory and Reif, Emily and Lee, Katherine and Roberts, Adam and Zoph, Barret and Zhou, Denny and Wei, Jason and Robinson, Kevin and Mimno, David and others , booktitle=

    work page

  19. [19]

    2023 , url=

    Birhane, Abeba and Prabhu, Vinay and Han, Sang and Boddeti, Vishnu Naresh , journal=. 2023 , url=

    work page 2023

  20. [20]

    Forty-second International Conference on Machine Learning , year=

    Li, Kenneth and Chen, Yida and Vi. Forty-second International Conference on Machine Learning , year=

    work page

  21. [21]

    Reuel, Anka and Bucknall, Ben and Casper, Stephen and Fist, Tim and Soder, Lisa and Aarne, Onni and Hammond, Lewis and Ibrahim, Lujain and Chan, Alan and Wills, Peter and others , journal=

    work page

  22. [22]

    Touvron, Hugo and others , journal =

    work page

  23. [23]

    2024 , eprint =

    The. 2024 , eprint =

    work page 2024

  24. [24]

    Beyond Data Filtering: Knowledge Localization for Capability Removal in

    Shilov, Igor and Cloud, Alex and Gema, Aryo Pradipta and Goldman-Wetzler, Jacob and Panickssery, Nina and Sleight, Henry and Jones, Erik and Anil, Cem , journal =. Beyond Data Filtering: Knowledge Localization for Capability Removal in

    work page

  25. [25]

    Glukhov, David and Han, Ziwen and Shumailov, Ilia and Papyan, Vardan and Papernot, Nicolas , journal=

    work page

  26. [26]

    Russinovich, Mark and Salem, Ahmed and Eldan, Ronen , booktitle=

    work page

  27. [27]

    Jin, Haibo and Zhou, Andy and Menke, Joe and Wang, Haohan , journal=

    work page

  28. [28]

    Glukhov, David and Shumailov, Ilia and Gal, Yarin and Papernot, Nicolas and Papyan, Vardan , booktitle=

    work page

  29. [29]

    2025 , URL=

    Sharma, Mrinank and Tong, Meg and Mu, Jesse and Wei, Jerry and Kruthoff, Jorrit and Goodfriend, Scott and Ong, Euan and Peng, Alwin and Agarwal, Raj and Anil, Cem and others , journal=. 2025 , URL=

    work page 2025

  30. [30]

    Mallya, Arun and Lazebnik, Svetlana , booktitle=

    work page

  31. [31]

    Mallya, Arun and Davis, Dillon and Lazebnik, Svetlana , booktitle=

    work page

  32. [32]

    2018 , organization=

    Serra, Joan and Suris, Didac and Miron, Marius and Karatzoglou, Alexandros , booktitle=. 2018 , organization=

    work page 2018

  33. [33]

    2016 , url=

    Rusu, Andrei A and Rabinowitz, Neil C and Desjardins, Guillaume and Soyer, Hubert and Kirkpatrick, James and Kavukcuoglu, Koray and Pascanu, Razvan and Hadsell, Raia , journal=. 2016 , url=

    work page 2016

  34. [34]

    Yoon, Jaehong and Yang, Eunho and Lee, Jeongtae and Hwang, Sung Ju , booktitle=

    work page

  35. [35]

    International Conference on Learning Representations , year=

    von Oswald, Johannes and Henning, Christian and Grewe, Benjamin F and Sacramento, Jo. International Conference on Learning Representations , year=

    work page

  36. [36]

    Aljundi, Rahaf and Chakravarty, Punarjay and Tuytelaars, Tinne , booktitle=

    work page

  37. [37]

    Razdaibiedina, Anastasia and Mao, Yuning and Hou, Rui and Khabsa, Madian and Lewis, Mike and Almahairi, Amjad , booktitle=

    work page

  38. [38]

    The Thirteenth International Conference on Learning Representations , year=

    A Closer Look at Machine Unlearning for Large Language Models , author=. The Thirteenth International Conference on Learning Representations , year=

    work page

  39. [39]

    Bohao, Peng and Tian, Zhuotao and Liu, Shu and Yang, Ming-Chang and Jia, Jiaya , booktitle=

    work page

  40. [40]

    2025 , publisher=

    Liu, Sijia and Yao, Yuanshun and Jia, Jinghan and Casper, Stephen and Baracaldo, Nathalie and Hase, Peter and Yao, Yuguang and Liu, Chris Yuhao and Xu, Xiaojun and Li, Hang and others , journal=. 2025 , publisher=

    work page 2025

  41. [41]

    Lee, Bruce W and Foote, Addie and Infanger, Alex and Shor, Leni and Kamath, Harish and Goldman-Wetzler, Jacob and Woodworth, Bryce and Cloud, Alex and Turner, Alexander Matt , booktitle=

    work page

  42. [42]

    The Elicitation Game: Evaluating Capability Elicitation Techniques

    Hofst. arXiv preprint arXiv:2502.02180 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  43. [43]

    Lynch, Aengus and Guo, Phillip and Ewart, Aidan and Casper, Stephen and Hadfield-Menell, Dylan , journal=

    work page

  44. [44]

    2024 , url=

    Deeb, Aghyad and Roger, Fabien , journal=. 2024 , url=

    work page 2024

  45. [45]

    Transactions on Machine Learning Research , year=

    work page

  46. [46]

    Barez, Fazl and Fu, Tingchen and Prabhu, Ameya and Casper, Stephen and Sanyal, Amartya and Bibi, Adel and O'Gara, Aidan and Kirk, Robert and Bucknall, Ben and Fist, Tim and others , journal=

    work page

  47. [47]

    Gadre, Samir Yitzhak and Smyrnis, Georgios and Shankar, Vaishaal and Gururangan, Suchin and Wortsman, Mitchell and Shao, Rulin and Mercat, Jean and Fang, Alex and Li, Jeffrey and Keh, Sedrick and others , booktitle=

    work page

  48. [48]

    Chen, Yangyi and Huang, Binxuan and Gao, Yifan and Wang, Zhengyang and Yang, Jingfeng and Ji, Heng , journal=

    work page

  49. [49]

    O'Brien, Kyle and Casper, Stephen and Anthony, Quentin Gregory and Korbak, Tomek and Kirk, Robert and Davies, Xander and Mishra, Ishan and Irving, Geoffrey and Gal, Yarin and Biderman, Stella , booktitle=

    work page

  50. [50]

    2024 , organization=

    Li, Nathaniel and Pan, Alexander and Gopal, Anjali and Yue, Summer and Berrios, Daniel and Gatti, Alice and Li, Justin D and Dombrowski, Ann-Kathrin and Goel, Shashwat and Mukobi, Gabriel and others , booktitle=. 2024 , organization=

    work page 2024

  51. [51]

    Yuan, Xiaojian and Pang, Tianyu and Du, Chao and Chen, Kejiang and Zhang, Weiming and Lin, Min , booktitle=

    work page

  52. [52]

    2021 , publisher=

    AJIL Unbound , author=. 2021 , publisher=

    work page 2021

  53. [53]

    2020 , publisher=

    Truong, Thanh Cong and Diep, Quoc Bao and Zelinka, Ivan , journal=. 2020 , publisher=

    work page 2020

  54. [54]

    2022 , publisher=

    Sandbrink, Jonas B and Koblentz, Gregory D , journal=. 2022 , publisher=

    work page 2022

  55. [55]

    2017 , publisher=

    Drew, Trevor W and Mueller-Doblies, Uwe Ulex , journal=. 2017 , publisher=

    work page 2017

  56. [56]

    2025 , url=

    Maini, Pratyush and Goyal, Sachin and Sam, Dylan and Robey, Alex and Savani, Yash and Jiang, Yiding and Zou, Andy and Fredrikson, Matt and Lipton, Zacharcy C and Kolter, J Zico , journal=. 2025 , url=

    work page 2025

  57. [57]

    Hu, Edward J and Shen, Yelong and Wallis, Phillip and Allen-Zhu, Zeyuan and Li, Yuanzhi and Wang, Shean and Wang, Lu and Chen, Weizhu , booktitle=

    work page

  58. [58]

    Hubinger, Evan and Denison, Carson and Mu, Jesse and Lambert, Mike and Tong, Meg and MacDiarmid, Monte and Lanham, Tamera and Ziegler, Daniel M and Maxwell, Tim and Cheng, Newton and others , journal=

    work page

  59. [59]

    Shazeer, Noam and Mirhoseini, Azalia and Maziarz, Krzysztof and Davis, Andy and Le, Quoc and Hinton, Geoffrey and Dean, Jeff , booktitle=

    work page

  60. [60]

    Gururangan, Suchin and Lewis, Mike and Holtzman, Ari and Smith, Noah A and Zettlemoyer, Luke , booktitle=

    work page

  61. [61]

    Eldan, Ronen and Li, Yuanzhi , journal=

    work page

  62. [62]

    Advances in Neural Information Processing Systems , volume=

    Penedo, Guilherme and Kydl. Advances in Neural Information Processing Systems , volume=

    work page

  63. [63]

    Advances in Neural Information Processing Systems , volume=

    Vaswani, Ashish and Shazeer, Noam and Parmar, Niki and Uszkoreit, Jakob and Jones, Llion and Gomez, Aidan N and Kaiser,. Advances in Neural Information Processing Systems , volume=

    work page

  64. [64]

    2019 , url=

    Ilya Loshchilov and Frank Hutter , booktitle=. 2019 , url=

    work page 2019

  65. [65]

    2025 , url=

    Finke, Lennart and Sreedhara, Chandan and Dooms, Thomas and Allen, Mat and Zhang, Emerald and Rodriguez, Juan Diego and Nabeshima, Noa and Marshall, Thomas and Braun, Dan , journal=. 2025 , url=

    work page 2025

  66. [66]

    Hoffmann, Jordan and Borgeaud, Sebastian and Mensch, Arthur and Buchatskaya, Elena and Cai, Trevor and Rutherford, Eliza and Casas, Diego de Las and Hendricks, Lisa Anne and Welbl, Johannes and Clark, Aidan and others , journal=

    work page

  67. [67]

    Zhao, Yanli and Gu, Andrew and Varma, Rohan and Luo, Liang and Huang, Chien-Chin and Xu, Min and Wright, Less and Shojanazeri, Hamid and Ott, Myle and Shleifer, Sam and others , journal=

    work page

  68. [68]

    Geva, Mor and Schuster, Roei and Berant, Jonathan and Levy, Omer , booktitle=

    work page

  69. [69]

    Meng, Kevin and Bau, David and Andonian, Alex and Belinkov, Yonatan , booktitle=

    work page

  70. [70]

    The Malicious Use of Artificial Intelligence: Forecasting, Prevention, and Mitigation

    Brundage, Miles and Avin, Shahar and Clark, Jack and Toner, Helen and Eckersley, Peter and Garfinkel, Ben and Dafoe, Allan and Scharre, Paul and Zeitzoff, Thomas and Filar, Bobby and Anderson, Hyrum and Roff, Heather and Allen, Gregory C and Steinhardt, Jacob and Flynn, Carrick and. arXiv preprint arXiv:1802.07228 , year=

    work page internal anchor Pith review Pith/arXiv arXiv

  71. [71]

    2024 , url=

    Cottier, Ben and Rahman, Robi and Fattorini, Loredana and Maslej, Nestor and Besiroglu, Tamay and Owen, David , journal=. 2024 , url=

    work page 2024

  72. [72]

    1975 , publisher=

    Saltzer, Jerome H and Schroeder, Michael D , journal=. 1975 , publisher=

    work page 1975

  73. [73]

    Wei, Alexander and Haghtalab, Nika and Steinhardt, Jacob , booktitle=

    work page

  74. [74]

    2023 , URL=

    Zou, Andy and Wang, Zifan and Carlini, Nicholas and Nasr, Milad and Kolter, J Zico and Fredrikson, Matt , journal=. 2023 , URL=

    work page 2023

  75. [75]

    , booktitle=

    Wang, Zihan and Chen, Deli and Dai, Damai and Xu, Runxin and Li, Zhuoshu and Wu, Y. , booktitle=

    work page

  76. [76]

    Studying Cross-cluster Modularity in Neural Networks

    Golechha, Satvik and Chaudhary, Maheep and Velja, Joan and Abate, Alessandro and Schoots, Nandi , year=. 2502.02470 , archivePrefix=

    work page internal anchor Pith review Pith/arXiv arXiv

  77. [77]

    Golechha, Satvik and Cope, Dylan and Schoots, Nandi , booktitle=

    work page

  78. [78]

    2024 , url=

    Liu, Aixin and Feng, Bei and Xue, Bing and Wang, Bingxuan and Wu, Bochao and Lu, Chengda and Zhao, Chenggang and Deng, Chengqi and Zhang, Chenyu and Ruan, Chong and others , journal=. 2024 , url=

    work page 2024

  79. [79]

    Transactions on Machine Learning Research , year=

    Pfeiffer, Jonas and Ruder, Sebastian and Vuli. Transactions on Machine Learning Research , year=

    work page

  80. [80]

    Pfeiffer, Jonas and Goyal, Naman and Lin, Xi Victoria and Li, Xian and Cross, James and Riedel, Sebastian and Artetxe, Mikel , booktitle=

    work page

Showing first 80 references.