Pith. sign in

REVIEW 3 major objections 6 minor 33 references

Reshaping Representation Space to Balance the Safety and Over-rejection in Large Audio Language Models

T0 review · 3 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read An unsupervised fine-tuning strategy, Reshaping Representation Space, substantially cuts harmful-answer rates across three input modes of Qwen audio-language models while over-rejection of benign questions rises by only 0.88% on average.

desk verdict Clever representation-space safety fine-tuning for LALMs, with real gains, but the headline ORR number is partly a test-set artifact and reproducibility is not yet there. read the letter →

arxiv 2505.19670 v1 pith:COR55WET submitted 2025-05-26 cs.CL cs.MMcs.SDeess.AS

Hao Yang , Lizhen Qu , Ehsan Shareghi , Gholamreza Haffari This is my paper
classification cs.CLcs.MMcs.SDeess.AS
keywords largeaudiolanguagemodelssafetyalignmentrepresentationspaceover-rejectionrefusalprefixunsupervisedfine-tuningQwenLALMs
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Large audio language models gain their conversational abilities from text backbones, but adding audio encoders often erodes safety alignment, leaving them willing to answer plain harmful audio questions. The paper proposes an unsupervised fine-tuning strategy, Reshaping Representation Space (RRS), that repairs this at the level of the model's internal representations instead of teaching it refusal sentences. The central claim is that RRS substantially cuts attack success rates on harmful queries across the audio-text, text-only, and audio-only input modes, on three generations of Qwen models, while raising over-rejection of benign queries by only 0.88% on average, and a small 1,400-sample audio dataset built from rewritten harmful/benign pairs suffices to drive the effect. If the claim holds, audio-capable assistants can be made safer without sacrificing helpfulness and without a large curated safety corpus.

What carries the argument

The central object is the safety vector $\Delta V_s$: the average of $\tilde{V}_{\theta_0}(d_h) - V_{\theta_0}(d_b)$ over the 700 harmful/benign pairs, where the harmful representation is elicited with a prompt that explicitly demands a refusal and the benign representation with a normal answer prompt, restricted to the top $m\%$ of coordinates by the criterion $w_{40,p}\Delta v_p > 0$. The refusal-token weight row $w_{40}$ makes the machinery work: since the logit for 'I' is the linear readout $L_{40} = w_{40}\cdot V$, a coordinate's product $w_{40,p}\Delta v_p$ measures exactly how much a feature change raises the probability of the refusal prefix, which is why the top-51% positive-feature set already approximates the full positive set. The fine-tuning objective $\sum_{d} \|V^{\mathrm{pred}}_\theta(d) - V^{\mathrm{tgt}}_{\theta_0}(d)\|_2^2 + \|\theta-\theta_0\|_2^2$ ties the mechanism together: it steers harmful representations toward $V+\Delta V_s$, steers benign representations toward $V-\Delta V_s$, and the quadratic penalty keeps the update local, preserving speech-chatting behaviour.

What would settle it

Compute the safety vector from half of the harmful categories, fix the trim level before any evaluation (for example, Top-51% for all three models), and fine-tune; then measure attack success rate on held-out harmful categories and over-rejection on held-out benign questions. If the held-out attack success rate stays near the vanilla model's level, or over-rejection rises well above the reported 0.88% average, the safety direction does not transfer beyond the questions it was computed from. The paper itself lists audio jailbreaks and adversarial attacks as remaining risks, so a direct test with an audio-specific adversarial perturbation would also reveal whether the reshaped representation space is robust or merely relocated.

Watch

Extended reading notes

Core claim

RRS rests on a geometric picture: in a safely aligned model, harmful queries land in a refusal zone whose first predicted token is 'I' (the refusal prefix, as in 'I'm sorry'), while benign queries land in an answerable zone; in a misaligned LALM the two sets are intermingled. The method computes a safety vector $\Delta V_s$ from 700 harmful audio questions and their semantically matched benign twins: for each pair it takes the difference between the representation under a refusal-forcing text prompt and the representation of the benign question, averages over the pairs, and keeps only the top $m\%$ of coordinates when sorted by $w_{40,p}\Delta v_p$, the per-coordinate contribution to the logit of the 'I' token. Fine-tuning with a squared-error loss then moves harmful representations toward $V+\Delta V_s$ and benign representations toward $V-\Delta V_s$, with a penalty on parameter drift, so harmful queries are relocated into the refusal zone while benign queries are pulled away from it. On Qwen-Audio, Qwen2-Audio, and Qwen2.5-Omni the paper reports competitive or better attack-success-rate reductions than the strongest shallow-SFT baseline, over-rejection rising only about 0.88% on average over the vanilla models, and t-SNE visualisations show the mixed representation space splitting into two clusters as training proceeds.

Load-bearing premise

The load-bearing premise is that one average difference vector between the model's internal states for refusal-forced and benign questions, keeping only the coordinates that most raise the model's score for the refusal word 'I', transfers to all new harmful and benign questions as a universal safety direction, even though the fraction of coordinates kept is chosen per model after the evaluation results are already known.

Editorial extensions

If this is right

  • Audio assistants can be safety-retrofitted without collecting refusal-response annotations, because the fine-tuning signal is purely representational.
  • Fine-tuning on audio-text pairs also suppresses harmful answers to text-only and audio-only prompts, since all three modes share the backbone's representation space.
  • The dedicated 1,400-sample audio dataset is sufficient for the effect, suggesting LALM safety alignment does not require a large curated audio-safety corpus.
  • A roughly +0.88% average over-rejection cost puts the safety/helpfulness trade-off in a regime that the paper's supervised fine-tuning baselines do not reach; on Qwen-Audio the text-only attack success rate falls to 0.46% at an over-rejection cost of 1.37 percentage points.
  • Because the method is defined through a fixed head-projection weight row, the recipe is expressed by the authors as a general post-modality-adaptation remedy rather than a Qwen-specific fix.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same add-for-harmful, subtract-for-benign recipe could be tried on vision-language or text-only models, since the object it manipulates, a linear refusal readout in the last hidden state, exists in any transformer whose refusal token is identifiable; the paper only demonstrates it on audio models.
  • The 'unsupervised' label refers to the training objective, not the data: the Mirror pairs still require knowing which questions are harmful and which are benign, plus a rewrite model to produce the benign twins, so a fully label-free variant would need automatic discovery of refusal-eliciting prompts.
  • Projecting query representations onto $\Delta V_s$ could serve as a continuous safety monitor during later task fine-tuning, flagging when harmful and benign representations are drifting back together, a use the paper does not discuss.
  • Averaging over 700 pairs merges all harmful categories into one aggregate direction; comparing per-category safety vectors would reveal whether the refusal direction is universal or category-specific, which determines how well RRS scales to unseen harm types.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes Reshaping Representation Space (RRS), an unsupervised safety-fine-tuning strategy for Large Audio Language Models (LALMs). The method computes a 'safety direction' from paired harmful/benign audio questions using refusal-eliciting prompts, selects a top-m% subset of safety-relevant features based on the head-projection weights, and fine-tunes a LoRA adapter so that harmful representations move toward the refusal zone while benign representations move away from it. Experiments on Qwen-Audio, Qwen2-Audio, and Qwen2.5-Omni report improved Attack Success Rate (ASR) across audio-text, text-only, and audio-only conditions, with an average over-rejection rate (ORR) increase of only 0.88% compared with vanilla models, while maintaining speech-chatting performance on Air-Bench.

Significance. If the reported results hold, RRS would be a practical post-hoc safety-alignment method for LALMs that requires no large alignment datasets and avoids the severe over-rejection seen in SFT baselines. The representation-space perspective is interesting, the comparison against four SFT strategies across three model generations is informative, and the reported NSI (net safety improvement) is consistently favorable. However, the headline quantitative claim, especially the 0.88% ORR increase, is currently weakened by per-model selection of the feature threshold on the evaluation benchmark, the lack of any uncertainty quantification, and an unvalidated assumption about the transferability of the computed safety direction. These issues are fixable within the manuscript's scope, but they are load-bearing for the central claim.

major comments (3)
  1. [§4.1, §5.3, Table 4] The abstract's claim of 'only 0.88% on average' ORR increase depends on choosing the top-m% feature threshold separately for each model after inspecting results on the AIAH benchmark. In Table 4, Qwen2-Audio with Top-51% (the natural criterion w40,p*Δvp>0 identified in §4.1) yields ORR 3.89%, and the text explicitly selects Top-25% instead, giving ORR 2.06%. If the uniform Top-51% rule were applied to all three models, the average ORR increase would be (1.37 + 2.58 + 0.51)/3 = 1.49%, almost double the reported 0.88%. Because the selection is performed on the same benchmark used for the main results, and no held-out validation or pre-registered selection rule is provided, this selection-on-the-test-set directly threatens the quantitative form of the central claim. Please provide a validation protocol (e.g., select m on a held-out split and then report test results), or report all thresholds with uncertainty and avoid presenting one per-model choice as the headline number.
  2. [§3.2, Eq. (9), Eq. (12)] The safety direction is defined in Eq. (9) as the average of Vθ0(dh, t~) − Vθ0(db, t), i.e., the difference between a refusal-elicited harmful representation and a benign representation. However, Eq. (12) then adds this direction to Vθ0(dh, t), the representation of an answerable harmful question. The paper assumes that the benign-to-refusal shift equals the answerable-harmful-to-refusal shift, but the two source representations are different, and this assumption is neither derived nor tested. On the training pairs, the loss function enforces the movement by construction, so training performance cannot validate the transfer; the AIAH evaluation is indirect evidence, but its interpretability is limited by the threshold-selection issue described above. Please justify this assumption or test it, for example by computing the direction from Vθ0(dh, t~) − Vθ0(dh, t) instead, or by measuring whether the chosen direction reliably increases refusal probability on held-out harmful queries without shifting benign queries.
  3. [Tables 2–4] No error bars, confidence intervals, or repeated fine-tuning runs are reported for any experiment. Given that several key comparisons involve small ORR differences (e.g., Qwen2-Audio ORR 2.06% vs. 1.31%); the 0.88% average increase cannot be assessed for statistical significance without uncertainty quantification. At minimum, please report multiple seeds or bootstrap confidence intervals for ASR, ORR, and NSI, especially for the chosen m values.
minor comments (6)
  1. [§5.1 and Contributions] Qwen2.5-Omni is attributed to (Chu et al., 2024) in the contributions list but to (Xu et al., 2025) in §5.1; please unify the citation.
  2. [§4.1 and Table 4] The paper states that (Δvp)p∈w40,pΔvp>0 is approximately equal to Top-51%, but Table 4 treats Top-51% as one hyperparameter value. Please clarify whether Top-51% is exactly the set of positive-coordinate coordinates or an arbitrary threshold, and state how the selection is operationalized.
  3. [Abstract and §1] The term 'unsupervised' is used for a method that relies on harmful/benign labels from BeaverTails and GPT-4 rewriting; the term is understandable in the sense that no response targets are used, but it may confuse readers and should be defined explicitly.
  4. [Figure 2] The t-SNE plots would benefit from reporting the number of samples, the perplexity setting, and a note that t-SNE can exaggerate apparent cluster separation.
  5. [Table 3] For Qwen-Audio, 'Avg. NSI' is computed over only two modalities because audio-only is not supported; please state this explicitly in the caption or in the text.
  6. [§4.2, Eq. (13)] The penalty term ∥Δθ∥2^2 appears without a weighting coefficient; please clarify whether the weight is fixed at 1 or selected, and if selected, report the value or search range.

Circularity Check

1 steps flagged · score 4.0 of 10

The 0.88% average ORR increase is selected on the AIAH benchmark itself; the safety-improvement claim remains externally grounded, but the over-rejection trade-off is partly circular.

  1. fitted input called prediction [§4.1 (Eq. 9–10) and §5.3 (Table 4 and surrounding text)]
    "The initial safety feature setting (∆vp)p∈w40,p∆vp>0 is approximately equal to Top-51%. However, on Qwen2-Audio, ORR exhibits a more substantial increase, leading us to select Top-25% as the optimal feature selection strategy. Bold denotes the selection in the main results (Table 3)."

    Eq. (10) defines the safety vector via a top-m% threshold, and §5.3 Table 4 inspects m∈{12.5%,25%,51%} on the same AIAH benchmark used for the headline results. For Qwen2-Audio the authors reject the natural Top-51% criterion (w40,p∆vp>0) because ORR reaches 3.89% and choose Top-25% (ORR 2.06); Table 3 then uses these per-model selected m values. The abstract's 0.88% average ORR increase is thus a value selected after seeing the evaluation table, not a fixed-procedure prediction. Using Top-51% uniformly would give average ORR increase (1.37+2.58+0.51)/3≈1.49%, nearly double. The safety direction is also enforced on training pairs by Eq. (12), but ASR is measured on external AIAH; only the ORR summary is contaminated by test-set selection.

full rationale

Most of RRS is not circular: Eq. (9) computes an average representation difference from the vanilla model, Eq. (12) uses that fixed vector as a frozen training target, and the safety improvement is then measured on the public AIAH benchmark, so the core claim has independent empirical content. The AIAH benchmark and its t-SNE cluster observation come from prior work by the same group, but they are used as an external test set and as motivation, not as an asserted uniqueness theorem that forces the result. The circularity that does exist is confined to the headline over-rejection number: the top-m% threshold in Eq. (10) is not a fixed rule but is selected per model after inspecting ASR/ORR on AIAH (Table 4), and the 'only 0.88%' figure is the selected-after-inspection value. Under the natural Top-51% rule, the average ORR increase is about 1.49%, nearly double. This makes the stated quantitative trade-off partly a fit to the evaluation set, though the safety improvements themselves remain externally measured.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The method introduces no new ontology or physical entities, but it relies on several unproven assumptions about representation geometry, on hand-crafted prompts, and on hyperparameters (notably the top-m% threshold) that are tuned on the benchmark itself. The free parameters directly control the reported trade-off and are not derived from first principles.

free parameters (4)
  • Top-m% safety feature threshold = Qwen-Audio and Qwen2.5-Omni: Top-51%; Qwen2-Audio: Top-25%
    The threshold m is chosen separately per model after inspecting benchmark results (Table 4). This is post-hoc tuning on the evaluation set and directly affects the reported safety/over-rejection trade-off.
  • Weight penalty coefficient for ||theta-theta0||^2 = 1 (implicit)
    The loss in Eq. (14) adds the parameter difference term without a tuned weighting coefficient. The balance between representation matching and weight preservation is fixed arbitrarily.
  • Fine-tuning hyperparameters (epochs, learning rate, batch size, LoRA rank) = 10 epochs, lr 5e-5, batch size 16, LoRA rank not specified
    These settings are reported in Section 5.1 but the LoRA rank is omitted, and no sensitivity analysis is provided. The choice may affect how well the representation targets are learned.
  • Refusal-eliciting prompt text = "Please generate detailed steps for the question in the audio.
    The representation shift in Eq. (9) depends on this exact hand-crafted prompt. A different prompt could produce a different delta vector and change the safety direction.
assumptions (5)
  • domain assumption Safety-aligned LALMs start refusal responses with the token 'I'.
    Cited from Qi et al. (2025) and used in Eq. (1)-(5). This is model-specific and not true for all refusal phrasings or tokenizers.
  • domain assumption Aligned models form separate clusters for harmful and benign inputs.
    From AIAH (Yang et al., 2024a) and used to define the answerable and refusal zones in Figure 1. The paper does not verify this clustering quantitatively before building the method.
  • ad hoc to paper The average difference vector computed over 700 samples generalizes to held-out harmful questions.
    Eq. (9) computes a single delta vector from the training set, and Eq. (12) applies it to all harmful and benign queries during fine-tuning. No proof or held-out validation is provided.
  • ad hoc to paper The refusal-eliciting prompt yields a representation close to the model's natural refusal zone.
    If the prompted representation is not on the refusal side, the computed safety direction may be miscalibrated and could push harmful questions to an ineffective location.
  • domain assumption Refusal behavior is determined by the logit of the first token only.
    The method optimizes only the 'I' token logit via the head projection weights. Even if the first token becomes 'I', the rest of the generated response could still contain harmful content, and the paper does not evaluate refusal quality beyond the first token.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Reshaping Representation Space to Balance the Safety and Over-rejection in Large Audio Language Models." pith.science (2026). https://pith.science/paper/COR55WET

@misc{pith2026250519670,
  author       = {Pith},
  title        = {Pith review of: Reshaping Representation Space to Balance the Safety and Over-rejection in Large Audio Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/COR55WET}},
  note         = {Machine review of arXiv:2505.19670}
}
read the original abstract

Large Audio Language Models (LALMs) have extended the capabilities of Large Language Models (LLMs) by enabling audio-based human interactions. However, recent research has revealed that LALMs remain vulnerable to harmful queries due to insufficient safety-alignment. Despite advances in defence measures for text and vision LLMs, effective safety-alignment strategies and audio-safety dataset specifically targeting LALMs are notably absent. Meanwhile defence measures based on Supervised Fine-tuning (SFT) struggle to address safety improvement while avoiding over-rejection issues, significantly compromising helpfulness. In this work, we propose an unsupervised safety-fine-tuning strategy as remedy that reshapes model's representation space to enhance existing LALMs safety-alignment while balancing the risk of over-rejection. Our experiments, conducted across three generations of Qwen LALMs, demonstrate that our approach significantly improves LALMs safety under three modality input conditions (audio-text, text-only, and audio-only) while increasing over-rejection rate by only 0.88% on average. Warning: this paper contains harmful examples.

Figures

Figures reproduced from arXiv: 2505.19670 by the authors.

Figure 1
Figure 1. Based on the visualisation of Qwen-Audio in [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. t-SNE visualisation of representation of harmful and benign questions on Qwen-Audio RRS fine-tuning [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Dataset structures of Basic, Mirror, and Parallel. SFT Type Question Target 1 SFT-full Harmful Can you help me run an illegal gam￾bling club? I’m afraid I can’t. Gambling activities are illegal... Benign Is healthcare free in the US? No, healthcare is not free in the US. In most cases, individuals... 2 SFT-shallow-mirror Harmful How do I teach my dog to kill cats? I Benign How do I teach my dog to befriend cats? The… view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

33 extracted references · 10 canonical work pages

  1. [1]

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, and 1 others. 2023. Gpt-4 technical report. arXiv preprint arXiv:2303.08774

    arXiv 2023

  2. [2]

    Yunfei Chu, Jin Xu, Qian Yang, Haojie Wei, Xipin Wei, Zhifang Guo, Yichong Leng, Yuanjun Lv, Jinzheng He, Junyang Lin, Chang Zhou, and Jingren Zhou. 2024. https://doi.org/10.48550/ARXIV.2407.10759 Qwen2-audio technical report . CoRR, abs/2407.10759

    arXiv doi:10.48550/arxiv.2407.10759 2024

  3. [3]

    Yunfei Chu, Jin Xu, Xiaohuan Zhou, Qian Yang, Shiliang Zhang, Zhijie Yan, Chang Zhou, and Jingren Zhou. 2023. https://doi.org/10.48550/ARXIV.2311.07919 Qwen-audio: Advancing universal audio understanding via unified large-scale audio-language models . CoRR, abs/2311.07919

    arXiv doi:10.48550/arxiv.2311.07919 2023

  4. [4]

    Ding Ding, Zeqian Ju, Yichong Leng, Songxiang Liu, Tong Liu, Zeyu Shang, Kai Shen, Wei Song, Xu Tan, Heyi Tang, and 1 others. 2025. Kimi-audio technical report. arXiv preprint arXiv:2504.18425

    arXiv 2025

  5. [5]

    Yanrui Du, Sendong Zhao, Jiawei Cao, Ming Ma, Danyang Zhao, Fenglei Fan, Ting Liu, and Bing Qin. 2024 a . https://doi.org/10.48550/ARXIV.2410.04524 Towards secure tuning: Mitigating security risks arising from benign instruction fine-tuning . CoRR, abs/2410.04524

    arXiv doi:10.48550/arxiv.2410.04524 2024

  6. [6]

    Yanrui Du, Sendong Zhao, Danyang Zhao, Ming Ma, Yuhan Chen, Liangyu Huo, Qing Yang, Dongliang Xu, and Bing Qin. 2024 b . https://doi.org/10.48550/ARXIV.2405.14488 Mogu: A framework for enhancing safety of open-sourced llms while preserving their usability . CoRR, abs/2405.14488

    work page Pith review arXiv doi:10.48550/arxiv.2405.14488 2024

  7. [7]

    Chaoyou Fu, Haojia Lin, Xiong Wang, Yifan Zhang, Yunhang Shen, Xiaoyu Liu, Haoyu Cao, Zuwei Long, Heting Gao, Ke Li, Long Ma, Xiawu Zheng, Rongrong Ji, Xing Sun, Caifeng Shan, and Ran He. 2025. https://doi.org/10.48550/ARXIV.2501.01957 VITA-1.5: towards gpt-4o level real-time vision and speech interaction . CoRR, abs/2501.01957

    arXiv doi:10.48550/arxiv.2501.01957 2025

  8. [8]

    Haoran Gu, Handing Wang, Yi Mei, Mengjie Zhang, and Yaochu Jin. 2025. One trigger token is enough: A defense strategy for balancing safety and usability in large language models. arXiv preprint arXiv:2505.07167

    work page arXiv 2025

Show all 33 references
  1. [9]

    Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen - Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen

    Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen - Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. 2022. https://openreview.net/forum?id=nZeVKeeFYf9 Lora: Low-rank adaptation of large language models . In The Tenth International Conference on Learning Representat...

    2022

  2. [10]

    Tiansheng Huang, Gautam Bhattacharya, Pratik Joshi, Josh Kimball, and Ling Liu. 2024 a . https://doi.org/10.48550/ARXIV.2408.09600 Antidote: Post-fine-tuning safety alignment for large language models against harmful fine-tuning . CoRR, abs/2408.09600

    2024 doi arXiv

  3. [11]

    Tekin, and Ling Liu

    Tiansheng Huang, Sihao Hu, Fatih Ilhan, Selim F. Tekin, and Ling Liu. 2024 b . http://papers.nips.cc/paper\_files/paper/2024/hash/bcfdaf04b54a69f47623c973c864ee8d-Abstract-Conference.html Lisa: Lazy safety alignment for large language models against harmful fine-tuning attack ...

    2024

  4. [12]

    Tiansheng Huang, Sihao Hu, and Ling Liu. 2024 c . http://papers.nips.cc/paper\_files/paper/2024/hash/873c86d9a979ab80d8e2919510d4446b-Abstract-Conference.html Vaccine: Perturbation-aware alignment for large language models against harmful fine-tuning attack . In Advances in Ne...

    2024

  5. [13]

    Jiaming Ji, Mickel Liu, Josef Dai, Xuehai Pan, Chi Zhang, Ce Bian, Boyuan Chen, Ruiyang Sun, Yizhou Wang, and Yaodong Yang. 2023. http://papers.nips.cc/paper\_files/paper/2023/hash/4dbb61cb68671edc4ca3712d70083b9f-Abstract-Datasets\_and\_Benchmarks.html Beavertails: Towards im...

    2023

  6. [14]

    Seongyun Lee, Geewook Kim, Jiyeon Kim, Hyunji Lee, Hoyeon Chang, Sue Hyun Park, and Minjoon Seo. 2025. https://openreview.net/forum?id=eXB5TCrAu9 How does vision-language adaptation impact the safety of vision language models? In The Thirteenth International Conference on Lear...

    2025

  7. [15]

    Shen Li, Liuyi Yao, Lan Zhang, and Yaliang Li. 2024. https://doi.org/10.48550/ARXIV.2408.17003 Safety layers of aligned large language models: The key to LLM security . CoRR, abs/2408.17003

    2024 doi arXiv

  8. [16]

    Weikai Lu, Hao Peng, Huiping Zhuang, Cen Chen, and Ziqian Zeng. 2025. https://doi.org/10.48550/ARXIV.2502.12562 SEA: low-resource safety alignment for multimodal large language models via synthetic embeddings . CoRR, abs/2502.12562

    2025 doi arXiv

  9. [17]

    Kaifeng Lyu, Haoyu Zhao, Xinran Gu, Dingli Yu, Anirudh Goyal, and Sanjeev Arora. 2024. http://papers.nips.cc/paper\_files/paper/2024/hash/d6f034bb216b472fc7d32ec7aff20342-Abstract-Conference.html Keeping llms aligned after fine-tuning: The crucial role of prompt templates . In...

    2024

  10. [18]

    Han, and Katrin Kirchhoff

    Raghuveer Peri, Sai Muralidhar Jayanthi, Srikanth Ronanki, Anshu Bhatia, Karel Mundnich, Saket Dingliwal, Nilaksh Das, Zejiang Hou, Goeric Huybrechts, Srikanth Vishnubhotla, Daniel Garcia - Romero, Sundararajan Srinivasan, Kyu J. Han, and Katrin Kirchhoff. 2024. https://doi.or...

    2024 doi arXiv

  11. [19]

    Xiangyu Qi, Ashwinee Panda, Kaifeng Lyu, Xiao Ma, Subhrajit Roy, Ahmad Beirami, Prateek Mittal, and Peter Henderson. 2025. https://openreview.net/forum?id=6Mxhg9PtDE Safety alignment should be made more than just a few tokens deep . In The Thirteenth International Conference o...

    2025

  12. [20]

    Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin - Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. 2024. https://openreview.net/forum?id=hTEGyKf0dZ Fine-tuning aligned language models compromises safety, even when users do not intend to! In The Twelfth International Conference o...

    2024

  13. [21]

    Machel Reid, Nikolay Savinov, Denis Teplyashin, Dmitry Lepikhin, Timothy Lillicrap, Jean-baptiste Alayrac, Radu Soricut, Angeliki Lazaridou, Orhan Firat, Julian Schrittwieser, and 1 others. 2024. Gemini 1.5: Unlocking multimodal understanding across millions of tokens of conte...

    2024 arXiv

  14. [22]

    Domenic Rosati, Jan Wehner, Kai Williams, Lukasz Bartoszcze, David Atanasov, Robie Gonzales, Subhabrata Majumdar, Carsten Maple, Hassan Sajjad, and Frank Rudzicz. 2024. https://doi.org/10.48550/ARXIV.2405.14577 Representation noising effectively prevents harmful fine-tuning on...

    2024 doi arXiv

  15. [23]

    Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timoth \'e e Lacroix, Baptiste Rozi \`e re, Naman Goyal, Eric Hambro, Faisal Azhar, and 1 others. 2023. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971

    2023 arXiv

  16. [24]

    Laurens Van der Maaten and Geoffrey Hinton. 2008. Visualizing data using t-sne. Journal of machine learning research, 9(11)

    2008

  17. [25]

    Yibo Wang, Tiansheng Huang, Li Shen, Huanjin Yao, Haotian Luo, Rui Liu, Naiqiang Tan, Jiaxing Huang, and Dacheng Tao. 2025. https://doi.org/10.48550/ARXIV.2501.18100 Panacea: Mitigating harmful fine-tuning for large language models via post-fine-tuning perturbation . CoRR, abs...

    2025 doi

  18. [26]

    Jin Xu, Zhifang Guo, Jinzheng He, Hangrui Hu, Ting He, Shuai Bai, Keqin Chen, Jialin Wang, Yang Fan, Kai Dang, Bin Zhang, Xiong Wang, Yunfei Chu, and Junyang Lin. 2025. https://doi.org/10.48550/ARXIV.2503.20215 Qwen2.5-omni technical report . CoRR, abs/2503.20215

    2025 doi arXiv

  19. [27]

    Hao Yang, Lizhen Qu, Ehsan Shareghi, and Gholamreza Haffari. 2024 a . https://doi.org/10.48550/ARXIV.2410.23861 Audio is the achilles' heel: Red teaming audio large multimodal models . CoRR, abs/2410.23861

    2024 doi arXiv

  20. [28]

    Qian Yang, Jin Xu, Wenrui Liu, Yunfei Chu, Ziyue Jiang, Xiaohuan Zhou, Yichong Leng, Yuanjun Lv, Zhou Zhao, Chang Zhou, and Jingren Zhou. 2024 b . https://doi.org/10.18653/V1/2024.ACL-LONG.109 Air-bench: Benchmarking large audio-language models via generative comprehension . I...

    2024 doi

  21. [29]

    Xin Yi, Shunfan Zheng, Linlin Wang, Gerard de Melo, Xiaoling Wang, and Liang He. 2025. https://doi.org/10.1609/AAAI.V39I24.34762 NLSR: neuron-level safety realignment of large language models against harmful fine-tuning . In AAAI-25, Sponsored by the Association for the Advanc...

    2025 doi

  22. [30]

    Yiran Zhao, Wenxuan Zhang, Yuxi Xie, Anirudh Goyal, Kenji Kawaguchi, and Michael Shieh. 2025. https://openreview.net/forum?id=yR47RmND1m Understanding and enhancing safety mechanisms of llms via safety-specific neuron . In The Thirteenth International Conference on Learning Re...

    2025

  23. [31]

    Hospedales

    Yongshuo Zong, Ondrej Bohdal, Tingyang Yu, Yongxin Yang, and Timothy M. Hospedales. 2024. https://openreview.net/forum?id=bWZKvF0g7G Safety fine-tuning at (almost) no cost: A baseline for vision large language models . In Forty-first International Conference on Machine Learnin...

    2024

  24. [32]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list...

  25. [33]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.