Pith. sign in

REVIEW 4 major objections 5 minor 20 references

HoloAegis: Frozen Representation, Topological Inference: Minimally Parametric Safety Manifolds for Zero-Shot LLM Guardrails

T0 review · 4 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that text safety can be decided with zero fine-tuning by computing a Gibbs-Boltzmann energy difference against K-means anchor centroids over a frozen encoder.

desk verdict The anchor-based guardrail idea is genuinely new and cheap, but the paper's own Table 2 contradicts its state-of-the-art accuracy claim, and the theoretical conjecture does not prove what it claims. read the letter →

arxiv 2608.08485 v1 pith:NVR4GYAH submitted 2026-08-09 cs.AI cs.CLcs.LG

Tak Ho Alex Li , Kaijie Liu , Lik-Hang Lee , Kin Chung Ho , Ping Shum , Michael K. Ng This is my paper · ORCID
classification cs.AIcs.CLcs.LG
keywords LLMsafetyguardrailszero-shotmoderationfrozenembeddingsGibbs-BoltzmannfreeenergyK-meansanchorbanktopologicalboundarystabilitymulti-turnsemanticdriftcross-lingualtransfer
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that LLM safety moderation does not require fine-tuning a classifier or running a large generative judge. It proposes computing, over a frozen text encoder, the difference between Gibbs-Boltzmann free energies toward precomputed K-means anchor banks of safe and unsafe prompts, and treating that energy difference as a safety score. The authors report state-of-the-art AUC on several benchmarks with sub-millisecond CPU latency, zero cold-start data, and zero-shot cross-lingual transfer. Their central theoretical claim, the Topological Boundary Stability Conjecture, is that sparse anchor centroids make the decision boundary less sensitive to high-frequency lexical perturbations than full-space estimators do. If the claim holds, safety guardrails could run at negligible cost without distorting the representations of the underlying model.

What carries the argument

The load-bearing object is the System Topology Anchor Bank: two sets of K-means++ centroids over large corpora of safe and unsafe prompts, obtained with a frozen encoder. The decision function is the difference of Gibbs-Boltzmann potentials (log-sum-exp over the $k$ nearest anchors with temperature $\tau$), which the paper interprets as a free-energy computation over the two manifolds. The theoretical anchor is the Topological Boundary Stability Conjecture, which bounds the expected boundary shift of the anchor estimator by $\frac{\epsilon}{\tau}(1+\sqrt{K/N}) + O(K^{-2/d'})$ versus $\frac{\epsilon}{\tau}(1+1/\sqrt{N})$ for the full-space estimator, arguing that K-means centroid noise compresses as $\mathcal{N}(0,\sigma^2 K/N I)$ and that Gersho's conjecture makes the quantization bias decay quickly for low intrinsic dimension $d'\in[3,8]$. The Dual Time-Scale EMA and the graph Laplacian Dirichlet energy are auxiliary mechanisms for multi-turn drift detection and policy auditing.

What would settle it

Measure the empirical intrinsic dimension of the safety embeddings and the actual noise correlation of K-means anchors: if the intrinsic dimension exceeds 8 substantially, or if adversarial perturbations aligned with the anchor directions produce boundary shifts larger than the full-space estimator's, the conjecture's bound is violated.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that a safety decision can be reduced to a deterministic geometric computation: map text to a unit sphere with an un-fine-tuned encoder, then compute $\Delta U(q)=U(q;\mathcal{A}^-)-U(q;\mathcal{A}^+)$ where each $U$ is a Gibbs-Boltzmann potential over the $k$ nearest anchors of a precomputed K-means anchor bank. The decision rule is entirely non-neural after encoding, with only the anchor count $K$ and temperature $\tau$ fixed at construction. The paper adds a Dual Time-Scale Exponential Moving Average to catch multi-turn semantic drift before the instantaneous score crosses the threshold, and a Graph Laplacian Dirichlet energy for auditable compliance checks. The headline empirical results are 1.0000 AUC on AuthenHallu, 0.9802 on HarmBench, and 0.9758 zero-shot AUC on Chinese CHIFRAUD with English anchors, at a static footprint under 3.5 MB and 0.8 ms CPU latency.

Load-bearing premise

The stability bound rests on unmeasured assumptions: that K-means centroids reduce sample noise to independent Gaussian noise $\mathcal{N}(0,\sigma^2 K/N I)$ within clusters, that Gersho's conjecture applies to K-Means++ so the quantization bias is $O(K^{-2/d'})$, and that semantic safety manifolds have intrinsic dimension $d'\in[3,8]$; if any of these fails, the anchor estimator's boundary stability is not guaranteed.

Editorial extensions

If this is right

  • Safety moderation can run on CPU with sub-millisecond latency and a static footprint under 3.5 MB, removing the GPU requirement of generative judges.
  • A single English anchor bank transfers zero-shot to other languages, as shown by 0.9758 AUC on Chinese CHIFRAUD.
  • Multi-turn adversarial drift can be detected before the per-turn safety score crosses its threshold, via the Dual Time-Scale EMA mechanism.
  • The decision procedure is deterministic and auditable: the compliance energy $E(x)=x^T L x$ provides a transparent measure of policy tension.
  • The anchor estimator degrades less than full-space methods under 25% Leetspeak perturbation, with an 8.90% versus 10.9% AUC drop.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the low-intrinsic-dimension assumption survives measurement, the same anchor-energy recipe could apply to other classification tasks with scarce labels, such as fraud or misinformation detection, without per-task fine-tuning.
  • The paper's own limitation on white-box adversaries suggests a concrete stress test: an attacker who recovers anchor positions could craft queries that sit in the geometric gaps between anchors, and measuring that attack's success rate would bound the bank's robustness.
  • The $\sqrt{K/N}$ noise compression term predicts a scaling law: boundary shift should shrink as the anchor-to-sample ratio grows, which could be tested by plotting measured shift against $K/N$ across corpus sizes.
  • The near-perfect AuthenHallu and HarmBench numbers with tiny test sets (400 and 320 samples) invite a matched test on larger held-out sets before treating those AUC values as settled.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes HoloAegis, a guardrail framework that maps text to a unit sphere with a frozen encoder, pre-computes K-means centroids (anchors) for safe and unsafe prompts, and makes safety decisions by comparing Gibbs-Boltzmann free-energy potentials against these anchors. A dual time-scale EMA mechanism is added for multi-turn drift detection. The authors claim state-of-the-art accuracy with sub-millisecond latency, zero cold-start data, and cross-lingual transfer, and they introduce a 'Topological Boundary Stability Conjecture' to justify why anchor-based decision boundaries are more stable than full-space estimators.

Significance. If the claims held, the framework would be practically attractive: it avoids fine-tuning, has a very small footprint, runs at low latency, and provides a deterministic, auditable decision rule. The paper has strengths: it evaluates across several benchmarks, includes ablations over anchor counts and hyperparameters, and attempts a formal statement of why sparse anchors could stabilize decision boundaries. However, the central empirical claim is contradicted by the paper's own Table 2, the theoretical comparison in Appendix A.4 is logically incomplete, and the 'minimally parametric' characterization is not supported by the number of hyperparameters actually tuned. These issues are load-bearing for the paper's main contributions.

major comments (4)
  1. [Abstract and Table 2] The abstract's claim of 'state-of-the-art accuracy' is directly contradicted by Table 2: HoloAegis (K=300) has an average AUC of 0.8757, which is the lowest among the listed methods (KNN 0.9476, WildGuard 0.9480, Llama-Guard 0.9510). The seven per-benchmark values in Table 1 for K=300 indeed average to about 0.8758, so the aggregate is internally consistent. Since Table 2 reports only averages and no per-benchmark baseline numbers, the abstract's parenthetical examples (1.0000 on AuthenHallu, 0.9802 on HarmBench) are not backed by any baseline comparison. Please either revise the SOTA claim to a cost-accuracy trade-off statement and provide per-benchmark comparisons, or explicitly define and defend a metric on which HoloAegis is state-of-the-art.
  2. [Appendix A.4 and Conjecture 1] The claimed comparison in Conjecture 1 does not follow from Eqs. (9) and (10). The upper bound for the anchor estimator is 1 + sqrt(K/N) + O(K^{-2/d'}), while the lower bound for the full-space estimator is 1 + 1/sqrt(N). For any K > 1, sqrt(K/N) > 1/sqrt(N), and the O(K^{-2/d'}) term is positive, so the anchor upper bound can be strictly larger than the full-space lower bound. No ordering of the expected shifts is established. In addition, the derivation depends on assumptions stated without measurement or citation: i.i.d. within-cluster noise compressing to N(0, sigma^2 K/N I), Gersho's Conjecture applied to K-Means++, and intrinsic dimension d' in [3,8]. The theoretical contribution must be repaired, or explicitly presented as a heuristic with the incomparability acknowledged.
  3. [Abstract and Sections 3.2, 4.4] The term 'minimally parametric' is not supported by the paper's own configuration. The abstract says the only free parameters are the anchor count K and temperature tau, but the method also involves top-k (tuned in Table 4), margin scaling gamma, EMA decays beta_f and beta_s, drift threshold tau_drift, and decision threshold eta. Section 3.2's practical decision function includes gamma, lambda, and beta. These are all selected or calibrated, so the claim that the system is 'minimally parametric' in the stated sense needs to be re-scoped or supported by a full sensitivity analysis over all of these parameters.
  4. [Section 4.2 and Table 2] The head-to-head evaluation is not sufficiently auditable to support the empirical contribution. Table 2 reports only average AUC across seven benchmarks, with no per-benchmark baseline results, no standard deviations or repeated runs, and no hardware/software details for the latency numbers. It is also unclear why the eight datasets listed in Section 4.1 are reduced to seven benchmarks in Table 2 and whether CHIFRAUD is excluded from the average. Please provide per-benchmark tables for all baselines, confidence intervals, and exact evaluation protocols.
minor comments (5)
  1. [Appendix A.4] Gersho's Conjecture is a conjecture and not a theorem; the paper should phrase the O(K^{-2/d'}) term conditionally and ideally test the assumed intrinsic dimension d' empirically.
  2. [Figure 1] The claimed Pareto frontier is presented without error bars, point labels, or a description of how the envelope was computed, which makes the visual claim hard to verify.
  3. [Section 3.2] The practical decision function S(q) = sigma(gamma * (U_- - lambda U_+) + beta) is said to be 'exactly equivalent' to the energy-difference formulation, but lambda and beta are not defined in the theoretical equations; please spell out the mapping.
  4. [Reproducibility Statement] The reproducibility statement says code and data will be released after acceptance; for review, please provide exact hyperparameter settings for each benchmark, anchor corpus sizes, and the random split seed so the experiments can be checked.
  5. [Table 8] The Dual EMA result of 0.7270 AUC on multi-turn HarmBench is still far from reliable detection; the text should discuss this as an open limitation rather than only emphasizing the improvement over weak baselines.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the core decision rule is a fixed geometric function of held-out anchors, the evaluations are split-separated, and the theoretical stability claim is presented as a conjecture rather than a derivation; the paper's main defects are an internally contradicted SOTA claim and an invalid bound comparison, which are correctness issues, not circularity.

full rationale

The claimed derivation chain is not circular. Section 4.1 states "we employ a stratified random split with a fixed seed to ensure strict separation between anchor construction and evaluation," so the AUC numbers do not reuse the fitted anchor data. The decision function (Eqs. 2-3) is a deterministic log-sum-exp potential difference over precomputed K-Means anchors and a frozen encoder; unlike the 'fitted input called prediction' pattern, no parameter is fitted to the reported target metric and then renamed as a prediction. There are no load-bearing self-citations: the cited external works (K-Means, Prototypical Networks, Laplacian Eigenmaps, Gersho's Conjecture) are standard and independent, and the paper does not rely on an author-only uniqueness theorem. The closest candidate is Conjecture 1, whose Appendix A compares an upper bound (Eq. 9) with a lower bound (Eq. 10) and concludes the anchor shift is smaller; that inference is mathematically invalid, and the paper itself labels the result a theoretically grounded conjecture rather than a formal proof. That is a proof gap or correctness risk, not a definitional equivalence or a prediction equal to its input by construction. Separately, the abstract's 'state-of-the-art accuracy' is contradicted by Table 2's own average AUC (0.8757 vs. 0.9476-0.9510 for baselines), but this is an internal-consistency/correctness issue, not circularity. Under the circularity rubric, the honest finding is no significant circularity.

Assumptions & free parameters 7 free parameters · 5 assumptions · 0 invented entities

The framework's central claim rests on a small number of tuned scalar parameters and a set of unproven geometric assumptions. The free parameter count is larger than the paper's 'only K and tau' statement. The key theoretical assumption, centroid noise compression plus Gersho quantization with d' in [3,8], is the most fragile part because it is both uncited and unmeasured. No new physical entities are introduced; the anchor bank is a data artifact.

free parameters (7)
  • Anchor count K = K=300 in final experiments; ablation over 30, 100, 200, 300
    Selected via anchor capacity ablation (Table 1); a free parameter despite the paper's 'minimally parametric' claim.
  • Top-k nearest anchors k = k=15
    Selected on LMSYS ToxicChat in Table 4; not counted in the paper's two-parameter accounting.
  • Temperature tau = 0.125 via gamma=8.0 in experiments; 0.05 recommended in Table 4
    Chosen by ablation; values in text are inconsistent (Section 3.2 vs Table 4).
  • Margin scaling gamma = 8.0
    Equivalent to tau=0.125 as inverse temperature, but reported as a separate implementation constant.
  • EMA decays beta_f and beta_s = not reported
    Required by Eqs. (5)-(6); values are not given in the paper, yet they control drift detection.
  • Drift threshold tau_drift = 0.5 in Figure 2
    Alert threshold chosen by hand; not included in the free-parameter accounting.
  • Decision threshold eta = 0 or calibrated on a tiny validation set
    Decision rule Eq. (4) requires eta; paper allows validation calibration, which is a fitted parameter.
assumptions (5)
  • domain assumption Frozen encoder maps safety-relevant text to a unit sphere where cosine geometry preserves safety structure.
    Section 3.1 states f_theta maps text to S^{d-1} and that all reasoning operates in this metric space; the entire method relies on this.
  • domain assumption K-Means++ centroids over a large corpus provide discrete bases for the safe and unsafe manifolds.
    Eq. (1) and Section 3.2 assume anchor centroids capture the two manifolds without fine-tuning.
  • ad hoc to paper Within-cluster noise is sufficiently independent that centroid noise compresses to N(0, sigma^2 K/N I).
    Appendix A.3 invokes CLT with 'relative independence within clusters' to derive the compressed centroid noise.
  • ad hoc to paper Gersho's Conjecture holds for K-Means++, giving O(K^{-2/d'}) quantization bias.
    Appendix A.4 uses Gersho's Conjecture without a citation and applies it to K-Means++, which is not an optimal quantizer.
  • ad hoc to paper Semantic safety manifolds have intrinsic dimension d' in [3,8].
    Appendix A.4 asserts d' in [3,8] without measurement or citation; this is needed for the claimed fast decay of the quantization term.

how reviews work

0 comments
Cite this review

Pith. "Pith review of HoloAegis: Frozen Representation, Topological Inference: Minimally Parametric Safety Manifolds for Zero-Shot LLM Guardrails." pith.science (2026). https://pith.science/paper/NVR4GYAH

@misc{pith2026260808485,
  author       = {Pith},
  title        = {Pith review of: HoloAegis: Frozen Representation, Topological Inference: Minimally Parametric Safety Manifolds for Zero-Shot LLM Guardrails},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NVR4GYAH}},
  note         = {Machine review of arXiv:2608.08485}
}
read the original abstract

Current LLM safety guardrails face a fundamental tension: fine-tuning distorts pre-trained representations while generative judges incur prohibitive inference costs. We challenge the prevailing paradigm by asking: can safety be achieved through pure geometric reasoning over frozen semantic representations? We present HoloAegis, a minimally parametric topological inference framework that decouples representation from reasoning. We term our approach minimally parametric because the only free parameters are the anchor count K and the temperature tau, both fixed after construction and requiring no gradient-based training. An un-fine-tuned encoder maps text to a unit sphere, after which all decisions are purely geometric. We formalize safety evaluation as a Gibbs-Boltzmann Free Energy computation over a pre-computed System Topology Anchor Bank, and we introduce Dual Time-Scale Exponential Moving Averages to detect progressive multi-turn semantic drift. Our key theoretical insight is a Topological Boundary Stability Conjecture: we provide theoretical motivation and strong empirical evidence that sparse anchor centroids stabilize the decision boundary against high-frequency lexical perturbations far better than full vector space methods. Evaluated across 8 benchmarks, HoloAegis achieves state-of-the-art accuracy (1.0000 AUC on AuthenHallu, 0.9802 on HarmBench) with sub-millisecond latency, zero cold-start data, and cross-lingual transfer (0.9758 AUC on Chinese CHIFRAUD).

Figures

Figures reproduced from arXiv: 2608.08485 by the authors.

Figure 1
Figure 1. End-to-end latency vs. ROC-AUC on LMSYS ToxicChat. HoloAegis occupies a previously [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Semantic drift trajectory ∆Dt across a 5-turn jailbreak. HoloAegis triggers an alert at Turn 2, three turns before the attack fully manifests at Turn 5. 8 Conclusion We presented HoloAegis, a minimally parametric topological inference framework that strictly decouples semantic representation from decision reasoning. By replacing fine-tuning with geometric evaluation over frozen embeddings, we avert representation co… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

20 extracted references · 15 canonical work pages

  1. [1]

    WildGuard: Open-Source Guardrails for Safety Evaluation and Moderation of LLMs.arXiv preprint arXiv:2406.18495, 2024

    Seungju Han, Binhang Yuan, et al. WildGuard: Open-Source Guardrails for Safety Evaluation and Moderation of LLMs.arXiv preprint arXiv:2406.18495, 2024

    arXiv 2024

  2. [2]

    Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations.arXiv preprint arXiv:2312.06674, 2023

    Hakan Inan, Kartikeya Upasani, et al. Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations.arXiv preprint arXiv:2312.06674, 2023

    arXiv 2023

  3. [3]

    Llama Guard 2: Technical Report and Model Specifications.Meta AI Research Technical Report, 2024

    Meta AI. Llama Guard 2: Technical Report and Model Specifications.Meta AI Research Technical Report, 2024

    work page 2024

  4. [4]

    ShieldLM: Empowering Large Language Models with Safety Alignment for Moderation.arXiv preprint arXiv:2402.06919, 2024

    Zhexin Zhang, Leqi Lei, et al. ShieldLM: Empowering Large Language Models with Safety Alignment for Moderation.arXiv preprint arXiv:2402.06919, 2024. 9 Table 9: CHIFRAUD Chinese fraud detection. Zero-shot cross-lingual transfer using English anchors. Dataset Samples AUC CHIFRAUD 192,267 0.9758 Table 10: Engineering advantages of HoloAegis over Full Vector...

    arXiv 2024

  5. [5]

    Aegis: Online Guardrails for Large Language Models in Enterprise Deployments.arXiv preprint arXiv:2404.05993, 2024

    Shaona Ghosh, Christopher Parisien, et al. Aegis: Online Guardrails for Large Language Models in Enterprise Deployments.arXiv preprint arXiv:2404.05993, 2024

    arXiv 2024

  6. [6]

    ToxicChat: Unveiling Hidden Toxicity in Real-World User-AI Conversations.Proceedings of EMNLP, pages 4694–4702, 2023

    Ziwei Lin, Jingyu Zhang, et al. ToxicChat: Unveiling Hidden Toxicity in Real-World User-AI Conversations.Proceedings of EMNLP, pages 4694–4702, 2023

    work page 2023

  7. [7]

    BeaverTails: Towards Improved Safety Alignment of LLM via Multi- Dimensional Preference Dataset.Advances in Neural Information Processing Systems (NeurIPS), 36, 2023

    Jiaming Ji, Mickel Liu, et al. BeaverTails: Towards Improved Safety Alignment of LLM via Multi- Dimensional Preference Dataset.Advances in Neural Information Processing Systems (NeurIPS), 36, 2023

    work page 2023

  8. [8]

    Safe RLHF: Constrained Reinforcement Learning from Human Feedback.International Conference on Learning Representations (ICLR), 2024

    Josef Dai, Xuehai Pan, Ruiyang Sun, et al. Safe RLHF: Constrained Reinforcement Learning from Human Feedback.International Conference on Learning Representations (ICLR), 2024

    work page 2024

Show all 20 references
  1. [9]

    XSTest: A Benchmark for Identifying Exaggerated Safety Behaviors in Large Language Models.Proceedings of NAACL, 2024

    Paul R¨ottger, Hannah Rose Kirk, et al. XSTest: A Benchmark for Identifying Exaggerated Safety Behaviors in Large Language Models.Proceedings of NAACL, 2024

    2024

  2. [10]

    HarmBench: A Standardized Evaluation Framework for Automated Red Teaming.arXiv preprint arXiv:2402.04249, 2024

    Mantas Mazeika, Long Phan, et al. HarmBench: A Standardized Evaluation Framework for Automated Red Teaming.arXiv preprint arXiv:2402.04249, 2024

    2024 arXiv

  3. [11]

    AuthenHallu: A Benchmark for Hallucination Detection in LLM-Generated Content

    Yujie-AI et al. AuthenHallu: A Benchmark for Hallucination Detection in LLM-Generated Content. arXiv preprint, 2024

    2024

  4. [12]

    HaluBench: Comprehensive Hallucination Evaluation Benchmark.Patronus AI Technical Report, 2024

    Patronus AI. HaluBench: Comprehensive Hallucination Evaluation Benchmark.Patronus AI Technical Report, 2024

    2024

  5. [13]

    CHIFRAUD: A Long-term Web Text Dataset for Chinese Fraud Detection.Proceedings of COLING, 2025

    Tang et al. CHIFRAUD: A Long-term Web Text Dataset for Chinese Fraud Detection.Proceedings of COLING, 2025

    2025

  6. [14]

    Toxicity Detection for Free: Benchmarking and Optimizing Commercial Safety APIs.arXiv preprint arXiv:2404.03152, 2024

    Jingyu Zhang, Ziwei Lin, et al. Toxicity Detection for Free: Benchmarking and Optimizing Commercial Safety APIs.arXiv preprint arXiv:2404.03152, 2024

    2024 arXiv

  7. [15]

    On Estimation of a Probability Density Function and Mode.The Annals of Mathematical Statistics, 33(3):1065–1076, 1962

    Emanuel Parzen. On Estimation of a Probability Density Function and Mode.The Annals of Mathematical Statistics, 33(3):1065–1076, 1962

    1962

  8. [16]

    Prototypical Networks for Few-shot Learning

    Jake Snell, Kevin Swersky, and Richard Zemel. Prototypical Networks for Few-shot Learning. Advances in Neural Information Processing Systems (NeurIPS), 30, 2017

    2017

  9. [17]

    Laplacian Eigenmaps for Dimensionality Reduction and Data Representation.Neural Computation, 15(6):1373–1396, 2003

    Mikhail Belkin and Partha Niyogi. Laplacian Eigenmaps for Dimensionality Reduction and Data Representation.Neural Computation, 15(6):1373–1396, 2003. 10

    2003

  10. [18]

    Tenenbaum, Vin De Silva, and John C

    Joshua B. Tenenbaum, Vin De Silva, and John C. Langford. A Global Geometric Framework for Nonlinear Dimensionality Reduction.Science, 290(5500):2319–2323, 2000

    2000

  11. [19]

    Perspective API: Automated Moderation for Online Conversations

    Google Jigsaw. Perspective API: Automated Moderation for Online Conversations. https: //www.perspectiveapi.com/, 2020

    2020

  12. [20]

    OpenAI Moderation API: Usage, Taxonomy, and Safety Standards

    OpenAI. OpenAI Moderation API: Usage, Taxonomy, and Safety Standards. https:// platform.openai.com/docs/guides/moderation, 2024. Appendix A: Derivation Sketch for Conjecture 1 (Topological Boundary Stability) In this section, we provide the theoretical motivation for Conjectur...

    2024

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.