Pith. sign in

REVIEW 4 major objections 6 minor 1 cited by

Strategic Deflection: Defending LLMs from Logit Manipulation

T0 review · 4 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Training LLMs to deflect instead of refuse cuts attack success to ~9%.

desk verdict A genuinely new defense idea with clean experiments, but the evaluation attack sits inside the training distribution, so the headline ASR gains are not yet evidence of general logit-manipulation robustness. read the letter →

arxiv 2507.22160 v1 pith:MVG2FPZM submitted 2025-07-29 cs.CR cs.AIcs.CL

Yassine Rachidy , Jihad Rbaiti , Youssef Hmamouche , Faissal Sehbaoui , Amal El Fallah Seghrouchni This is my paper · ORCID
classification cs.CRcs.AIcs.CL
keywords strategicdeflectionlogitmanipulationattacksjailbreakdefensepreferenceoptimizationcontrastiveattacksuccessrateLLMsafetyadversarialrobustness
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that the standard LLM safety strategy—refusing harmful requests—is structurally vulnerable to logit manipulation attacks that suppress refusal tokens during generation. It introduces Strategic Deflection (SDeflection), a fine-tuning method that teaches models to respond to malicious prompts with semantically related but benign content, appearing compliant while withholding harmful information. On AdvBench, SDeflection drives Attack Success Rate under the LogitsTrap attack from 92.63% to 34.94% for Llama-2-7B-chat-hf, from 89.29% to 8.53% for Llama-3.2-3B-Instruct, and from 94.74% to 13.14% for Mistral-7B-Instruct-v0.2. The paper also reports that the defense preserves refusal behavior on direct harmful prompts and keeps performance on standard capability benchmarks essentially unchanged. A sympathetic reader would care because it proposes a defensible alternative to refusal-based alignment when the attacker controls the decoding loop.

What carries the argument

The machinery is a preference dataset of triplets (p, y+, y−) in which the chosen and rejected responses share the identical compliant prefix (one of 34 affirmation templates), so the model cannot distinguish them by prefix and must learn to continue with benign content. Training uses Contrastive Preference Optimization (CPO), a DPO variant whose loss combines a preference term over y+ vs y− with an NLL regularizer, applied via LoRA. The attack model is LogitsTrap, which enforces the prefix "Absolutely, here's a step-by-step guide:\nStep 1:" while penalizing a hand-curated list of refusal-token variants, including the EOS token, to force continued generation. This combination isolates the question of whether the model's safety behavior survives when refusal is blocked.

What would settle it

Run the same SDeflection-finetuned models against an EnDec-style attack that actively boosts harmful tokens (e.g., increasing logits of tokens following the harmful instruction) or that reverses negation tokens, without suppressing the specific refusal-token list LogitsTrap uses; if ASR rises back above roughly 60% for any of the three models, the defense is specific to LogitsTrap rather than to logit manipulation in general.

Watch

Extended reading notes

Core claim

The central claim is that a model can be made robust to logit manipulation by training it to prefer a strategically deflected response over a harmful one when both share the same forced compliant prefix. SDeflection constructs preference triplets (p, y+, y−) from MaliciousInstruct prompts: y+ answers a harmless rephrasing of the harmful prompt, y− answers the original harmful prompt, and both begin with the same affirmation template. Fine-tuning with Contrastive Preference Optimization makes the model assign higher probability to the deflected continuation even when decoding is manipulated, so under the LogitsTrap attack (affirmative prefix enforcement plus refusal-token suppression) the model produces safe content instead of harmful instructions. The authors report ASR reductions on AdvBench from 92.63% to 34.94% (Llama-2-7B-chat-hf), 89.29% to 8.53% (Llama-3.2-3B-Instruct), and 94.74% to 13.14% (Mistral-7B-Instruct-v0.2), with a Deep Alignment baseline only reaching 59.42% on Llama-2. They also claim the fine-tuning keeps explicit refusal rates nearly intact on direct harmful prompts (e.g., 99.62% vs 97.95% for Llama-2) and leaves tinyMMLU, tinyTruthfulQA, tinyGSM8k, and tinyHellaSwag scores broadly stable.

Load-bearing premise

The LogitsTrap attack—a fixed affirmative prefix with a hand-curated refusal-token penalty list—is assumed to represent the whole class of logit-manipulation attacks, but it omits techniques such as negation reversing and forced token boosting used by earlier attacks like EnDec and NBW.

Editorial extensions

If this is right

  • Under LogitsTrap, SDeflection reduces ASR on AdvBench to single digits for Llama-3.2-3B-Instruct (8.53%) and Mistral-7B-Instruct-v0.2 (13.14%), and to 34.94% for Llama-2-7B-chat-hf.
  • SDeflection-finetuned models refuse direct harmful prompts at nearly the same rate as the original models, so the defense does not trade away standard safety behavior.
  • General capability benchmarks (tinyMMLU, tinyTruthfulQA, tinyGSM8k, tinyHellaSwag) show no significant degradation after CPO fine-tuning, and TinyTruthfulQA even improves.
  • CPO produces substantially lower ASR than DPO (8.53% vs 72.63% on Llama-3.2-3B-Instruct) while training faster, so the choice of preference optimizer matters for defense.
  • Deep alignment, which trains models to recover refusals, still leaves 59.42% ASR on Llama-2, suggesting that deeper refusals remain suppressible.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If deflection works because refusal tokens are a shallow surface, then attacks that do more than suppress refusal—such as EnDec's negation reversing or boosting harmful continuations—may be a stronger test; the paper does not evaluate these.
  • The deflection idea could extend beyond logit attacks to API-level defenses where the model's final layer is inspected, since the defense changes the model's own generative distribution rather than filtering outputs.
  • A likely failure mode is that the benign adjacent content still leaks information for some prompts, so measuring semantic harmfulness per category (e.g., weapons vs. cyber) would test whether deflection is uniformly safe.
  • Because the training data uses GPT-4o rephrasings and only 100 MaliciousInstruct instructions expanded to 3,400 triplets, the coverage of harmful topics is thin; broader and adversarial data might be needed for production use.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper proposes Strategic Deflection (SDeflection), a fine-tuning defense against logit-manipulation attacks. Instead of relying on explicit refusals, which logit manipulation can suppress, SDeflection trains models via Contrastive Preference Optimization (CPO) to produce safe, topic-adjacent 'deflected' responses when a harmful prompt is accompanied by forced affirmative prefixes and refusal-token suppression. Experiments on three open instruction-tuned LLMs (Llama-2-7B-chat-hf, Llama-3.2-3B-Instruct, Mistral-7B-Instruct-v0.2) report large reductions in Attack Success Rate (ASR) under a custom attack called LogitsTrap (Table 1), while performance on 'tiny' benchmarks remains roughly stable (Table 3). An ablation compares CPO against DPO and finds CPO substantially more effective (Table 4). The manuscript includes hyperparameters, the evaluation prompt, and a link to code, so the empirical protocol is largely reproducible.

Significance. The central idea of training 'evasive compliance' rather than brittle refusal is a plausible and potentially valuable response to the shallow-safety-alignment failure mode identified in prior work (Qi et al., 2025; Zhang et al., 2024). If the reported ASR reductions hold under a broader range of logit-manipulation attacks, the method would be a meaningful step beyond refusal-only defenses. The paper is also transparent in reporting training dynamics, per-benchmark results with standard deviations, and a baseline comparison to deep alignment. However, the significance is currently limited by the fact that the only attack evaluated (LogitsTrap) is constructed from the same type of affirmative-prefix conditioning used to build the SDeflection training data, and the safety metric rests on a single automated judge. These issues make the results suggestive rather than conclusive evidence for a general defense against logit manipulation.

major comments (4)
  1. [§4.1 and §4.3.1, Table 1] The evaluation attack lies essentially inside the training distribution. The training set in §4.1 is built from 34 affirmation templates (affirmative prefixes) and each chosen response y+ starts with one of these templates; LogitsTrap (§4.3.1, App. A.2) enforces a fixed affirmative prefix of the same form ('Absolutely, here's a step-by-step guide: Step 1:') while suppressing refusal tokens. Thus the model is directly optimized to behave benignly after exactly the kind of forced prefix used in the test. The large ASR reductions in Table 1 may reflect memorization of the template-conditioned deflection behavior rather than a general capability to deflect under arbitrary logit manipulation. To support the central claim, the authors should evaluate with held-out affirmation prefixes (templates not among the 34), with paraphrased prefixes, and with adaptive attacks that search over prefixes; they should also report the list of the 34 templates so readers can assess the degree of overlap.
  2. [§2.2, §4.3.1, Table 1] Only one custom attack is tested, despite the paper's broader claim of defending 'against logit manipulation attacks.' The related-work section (§2.2) describes EnDec's negation-reversing component as a key mechanism that makes EnDec stronger than simple prefix enforcement, yet LogitsTrap omits negation reversing and is neither EnDec nor NBW as published. No results are reported for EnDec, for NBW, or for a LogitsTrap variant with negation reversing. The conclusion in §6 that SDeflection defends against logit manipulation is therefore an overgeneralization of the current evidence. Please add evaluations against these existing attacks, or at least a version of LogitsTrap that includes negation reversing, before claiming general robustness.
  3. [§4.3.1, Appendix A.4] The only safety metric is a binary score assigned by a single LLM judge (Gemini-2.5-flash), with no human validation, no inter-annotator agreement, and no sensitivity analysis. Because SDeflection outputs are deliberately evasive and semantically adjacent to the request, the judge's classification is the critical measurement instrument for all ASR numbers in Tables 1 and 4. To establish that the reported reductions are not an artifact of a single judge's calibration, the authors should either report agreement with human labels on a subsample, compare multiple judges, or provide a manual categorization of a random subset of responses.
  4. [§4.1, §5.2] The relationship between the training data and evaluation data needs clarification. The training set is derived from 100 MaliciousInstruct prompts, while safety evaluation uses 520 AdvBench prompts; the paper does not state whether there is topic overlap or prompt overlap between the two. Since the ASR reductions under LogitsTrap could in part reflect the model having seen similar instructions during fine-tuning, please report the overlap and, if possible, evaluate on a disjoint set of harmful prompts that is also disjoint in topic categories.
minor comments (6)
  1. [§4.1] The data generation procedure is ambiguous: the text first says the safe queries were rewritten using GPT-4o, but then says 'Conditioning Mistral-7B-Instruct-v0.2 on each of these templates, we construct preference triplets.' Please clarify which model generates the chosen and rejected responses, and whether the same model is used for both.
  2. [§5.1] The claim that there are 'no significant signs of overfitting' is based on a qualitative inspection of the reward-margin and loss curves. Please provide a quantitative criterion or a measured gap between training and evaluation metrics.
  3. [Table 2 and §5.2] For Llama-3.2-3B-Instruct, the explicit refusal rate drops from 95.77% to 85.64% after SDeflection fine-tuning. The text acknowledges this but does not discuss whether this drop is acceptable or whether it might indicate a partial shift away from refusal behavior even in the direct (non-attack) setting.
  4. [§4.3.1 and Appendix A.2] The paper introduces LogitsTrap without citing a source, which is fine as a new attack, but the main text should more explicitly state its relationship to EnDec and NBW (which is only described in the appendix). Also, the appendix lists broad token categories but not the actual token list; please include the complete penalty list or a link to it for reproducibility.
  5. [Appendix A.2] The description of token variants is helpful, but the sentence 'we removed the token IDs of standalone punctuation marks from the penalty list' would be easier to verify if the actual code were included in the appendix or the repository.
  6. [Throughout] Minor naming inconsistency: 'TinyMMLU' in the text of §4.3.2 and 'tinyMMLU' in Table 3; please pick one capitalization style. Also, the table captions and figure captions would benefit from a short mention of the error bars (mean ± std across 3 runs).

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the defense result is an empirical fine-tuning outcome, not a derivation that reduces to its own inputs.

full rationale

The paper contains no formal derivation that could reduce to its inputs. The central result is an empirical attack-success-rate comparison: models are fine-tuned with CPO on preference triplets built from MaliciousInstruct and 34 affirmation templates, then evaluated on the disjoint AdvBench set under LogitsTrap. Although LogitsTrap's fixed prefix ('Absolutely, here's a step-by-step guide:\nStep 1:') belongs to the same family of affirmation templates used to construct the y+ training responses, the training and evaluation prompts are different, and the defense is not fitted to the evaluation set. This is a generalizability limitation—the paper does not test other logit-manipulation attacks such as EnDec's negation reversing or NBW—but it is not circularity: no equation is equivalent by construction, no fitted parameter is renamed as a prediction, and no load-bearing self-citation or imported uniqueness theorem is present. The Table 1 results are therefore an independent empirical measurement within one attack family.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claim rests on training-data and evaluation-design choices (free parameters) plus several domain assumptions about the efficacy of CPO, the reliability of the LLM judge, and the representativeness of the custom attack.

free parameters (3)
  • LogitsTrap affirmative prefix = Absolutely, here's a step-by-step guide: Step 1:
    Hand-picked prefix used in the evaluation attack; the training data also uses 34 hand-picked affirmation templates, so the attack prefix resembles training conditions (Section 4.1 and A.2).
  • LogitsTrap refusal-token penalty list
    Hand-curated list of refusal-related tokens and variants (Appendix A.2) determines how strongly refusals are suppressed in the attack; this directly shapes the measured ASR.
  • Training affirmation templates = 34 templates
    The preference dataset is constructed by conditioning on 34 hand-selected affirmation templates (Section 4.1), which defines the distribution of prefixes the defense is expected to handle safely.
assumptions (4)
  • domain assumption Preference optimization with CPO can teach a policy to prefer safe deflected responses over harmful ones even when decoding-time logits are manipulated.
    The paper's method assumes the learned preference behavior transfers to the attack scenario; this is the core mechanism but not proven beyond the custom attack test.
  • domain assumption The Gemini-2.5-flash evaluator provides accurate binary safety labels for model responses, including deflected content.
    All ASR numbers depend on this LLM judge (Section 4.3.1, Appendix A.4); no human agreement or external validation is provided.
  • ad hoc to paper The custom LogitsTrap attack is representative of logit-manipulation attacks that the defense claims to counter.
    The attack is introduced in this paper (Section 4.3.1) and is the only attack tested; the claim of defending against logit manipulation assumes it generalizes to EnDec, NBW, and others.
  • standard math Standard probability and statistical math used in the loss functions and evaluation is correct.
    Equations (1)-(5) use standard softmax, sigmoid, and log-likelihood operations; no new mathematical claims.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Strategic Deflection: Defending LLMs from Logit Manipulation." pith.science (2026). https://pith.science/paper/MVG2FPZM

@misc{pith2026250722160,
  author       = {Pith},
  title        = {Pith review of: Strategic Deflection: Defending LLMs from Logit Manipulation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/MVG2FPZM}},
  note         = {Machine review of arXiv:2507.22160}
}
read the original abstract

With the growing adoption of Large Language Models (LLMs) in critical areas, ensuring their security against jailbreaking attacks is paramount. While traditional defenses primarily rely on refusing malicious prompts, recent logit-level attacks have demonstrated the ability to bypass these safeguards by directly manipulating the token-selection process during generation. We introduce Strategic Deflection (SDeflection), a defense that redefines the LLM's response to such advanced attacks. Instead of outright refusal, the model produces an answer that is semantically adjacent to the user's request yet strips away the harmful intent, thereby neutralizing the attacker's harmful intent. Our experiments demonstrate that SDeflection significantly lowers Attack Success Rate (ASR) while maintaining model performance on benign queries. This work presents a critical shift in defensive strategies, moving from simple refusal to strategic content redirection to neutralize advanced threats.

Figures

Figures reproduced from arXiv: 2507.22160 by the authors.

Figure 1
Figure 1. Conceptual overview of SDeflection. A malicious query sent to a standard LLM (without SDeflection) with [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. CPO dynamics for SDeflection fine-tuning on three instruction-tuned LLMs. Evaluation metrics display mean [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Ablation Study: Comparing training dynamics of CPO (left) versus DPO (right) for SDeflection fine-tuning [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗
Figures from the paper (9 more)
Figure 4
Figure 4. Figure 4: Comparison of Llama 2 responses (Original vs. Deep alignment vs. SDeflection) to a malicious query under a [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]
Figure 5
Figure 5. Figure 5: Comparison of refusal responses from Llama 2 (Original vs. SDeflection) when presented with a direct [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 6
Figure 6. Figure 6: Responses from Llama-2, Llama-3, and Mistral models after SDeflection fine-tuning to a benign Python [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 7
Figure 7. Figure 7: Comparison between Llama-3.2-3B-Instruct responses (Original vs. SDeflection) to a malicious query under [PITH_FULL_IMAGE:figures/full_fig_p018_7.png]
Figure 8
Figure 8. Figure 8: Comparison between Mistral-7B-Instruct-v0.2 responses (Original vs. SDeflection) to a malicious query [PITH_FULL_IMAGE:figures/full_fig_p018_8.png]
Figure 9
Figure 9. Figure 9: Comparison between Llama-3.2-3B-Instruct refusal responses (Original vs. SDeflection) when presented [PITH_FULL_IMAGE:figures/full_fig_p019_9.png]
Figure 10
Figure 10. Figure 10: Comparison between Mistral-7B-Instruct-v0.2 refusal responses (Original vs. SDeflection) when presented [PITH_FULL_IMAGE:figures/full_fig_p019_10.png]
Figure 11
Figure 11. Figure 11: Responses from SDeflection-fine-tuned models (Llama [PITH_FULL_IMAGE:figures/full_fig_p019_11.png]
Figure 12
Figure 12. Figure 12: Responses from SDeflection-fine-tuned models (Llama [PITH_FULL_IMAGE:figures/full_fig_p020_12.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Safety Alignment of LMs via Non-cooperative Games

    cs.AI 2025-12 conditional novelty 7.0 of 10

    Jointly training an Attacker and Defender LLM in a non-zero-sum game with pairwise preference judges produces a defender with much lower jailbreak success while preserving general utility.

Reference graph

Works this paper leans on

33 extracted references · 20 canonical work pages · cited by 1 Pith paper

  1. [1]

    Training language models to follow instructions with human feedback

    Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feedback. In Advances in neural information processing systems , volume 35, pages 27730–27744, 2022

    work page 2022

  2. [2]

    Deep reinforcement learning from human preferences

    Paul F Christiano, Jan Leike, Tom Brown, Miljan Martic, Shane Legg, and Dario Amodei. Deep reinforcement learning from human preferences. In Advances in neural information processing systems , volume 30, 2017

    work page 2017

  3. [3]

    Mistral 7b

    Albert Q Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, et al. Mistral 7b. arXiv preprint arXiv:2310.06825, 2023

    arXiv

  4. [4]

    The llama 3 herd of models

    Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. The llama 3 herd of models. arXiv e-prints, pages arXiv–2407, 2024

    2024

  5. [5]

    On large language models’ resilience to coercive interrogation

    Zhuo Zhang, Guangyu Shen, Guanhong Tao, Siyuan Cheng, and Xiangyu Zhang. On large language models’ resilience to coercive interrogation. In 2024 IEEE Symposium on Security and Privacy (SP) , pages 826–844. IEEE, 2024

    work page 2024

  6. [6]

    Universal and transferable adversarial attacks on aligned language models

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043, 2023

    arXiv 2023

  7. [7]

    Jailbreak open-sourced large language models via enforced decoding

    Hangfan Zhang, Zhimeng Guo, Huaisheng Zhu, Bochuan Cao, Lu Lin, Jinyuan Jia, Jinghui Chen, and Dinghao Wu. Jailbreak open-sourced large language models via enforced decoding. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (V olume 1: Long Papers) , pages 5475–5493, 2024

    work page 2024

  8. [8]

    Safety alignment should be made more than just a few tokens deep

    Xiangyu Qi, Ashwinee Panda, Kaifeng Lyu, Xiao Ma, Subhrajit Roy, Ahmad Beirami, Prateek Mittal, and Peter Henderson. Safety alignment should be made more than just a few tokens deep. In The Thirteenth International Conference on Learning Representations, 2025

    work page 2025

Show all 33 references
  1. [9]

    Jailbroken: How does llm safety training fail? In Advances in Neural Information Processing Systems , volume 36, pages 80079–80110, 2023

    Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. Jailbroken: How does llm safety training fail? In Advances in Neural Information Processing Systems , volume 36, pages 80079–80110, 2023

    2023

  2. [10]

    do anything now

    Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. " do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , pages 167...

    2024

  3. [11]

    A cross-language investigation into jailbreak attacks in large language models

    Jie Li, Yi Liu, Chongyang Liu, Ling Shi, Xiaoning Ren, Yaowen Zheng, Yang Liu, and Yinxing Xue. A cross-language investigation into jailbreak attacks in large language models. arXiv preprint arXiv:2401.16765, 2024

    2024 arXiv

  4. [12]

    Protecting your llms with information bottleneck

    Zichuan Liu, Zefan Wang, Linjie Xu, Jinyu Wang, Lei Song, Tianchun Wang, Chunlin Chen, Wei Cheng, and Jiang Bian. Protecting your llms with information bottleneck. In Advances in Neural Information Processing Systems, volume 37, pages 29723–29753, 2024

    2024

  5. [13]

    Llama 2: Open foundation and fine-tuned chat models

    Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288, 2023

    2023 arXiv

  6. [14]

    Jailbreaking black box large language models in twenty queries

    Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong. Jailbreaking black box large language models in twenty queries. In 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), pages 23–42. IEEE, 2025

    2025

  7. [15]

    Fuzzllm: A novel and universal fuzzing framework for proactively discovering jailbreak vulnerabilities in large language models

    Dongyu Yao, Jianshu Zhang, Ian G Harris, and Marcel Carlsson. Fuzzllm: A novel and universal fuzzing framework for proactively discovering jailbreak vulnerabilities in large language models. In ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Proc...

    2024

  8. [16]

    Catastrophic jailbreak of open-source LLMs via exploiting generation

    Yangsibo Huang, Samyak Gupta, Mengzhou Xia, Kai Li, and Danqi Chen. Catastrophic jailbreak of open-source LLMs via exploiting generation. In The Twelfth International Conference on Learning Representations , 2024. 13 A PREPRINT - S EPTEMBER 23, 2025

    2024

  9. [17]

    Baseline defenses for adversarial attacks against aligned language models

    Neel Jain, Avi Schwarzschild, Yuxin Wen, Gowthami Somepalli, John Kirchenbauer, Ping-yeh Chiang, Micah Goldblum, Aniruddha Saha, Jonas Geiping, and Tom Goldstein. Baseline defenses for adversarial attacks against aligned language models. arXiv preprint arXiv:2309.00614, 2023

    2023 arXiv

  10. [18]

    Certifying llm safety against adversarial prompting

    Aounon Kumar, Chirag Agarwal, Suraj Srinivas, Aaron Jiaxun Li, Soheil Feizi, and Himabindu Lakkaraju. Certifying llm safety against adversarial prompting. arXiv preprint arXiv:2309.02705, 2023

    2023 arXiv

  11. [19]

    Detecting language model attacks with perplexity

    Gabriel Alon and Michael Kamfonas. Detecting language model attacks with perplexity. arXiv preprint arXiv:2308.14132, 2023

    2023 arXiv

  12. [20]

    Safety at scale: A comprehensive survey of large model safety

    Xingjun Ma, Yifeng Gao, Yixu Wang, Ruofan Wang, Xin Wang, Ye Sun, Yifan Ding, Hengyuan Xu, Yunhao Chen, Yunhan Zhao, et al. Safety at scale: A comprehensive survey of large model safety. arXiv preprint arXiv:2502.05206, 2025

    2025 arXiv

  13. [21]

    Robust safety classifier against jailbreaking attacks: Adversarial prompt shield

    Jinhwa Kim, Ali Derakhshan, and Ian Harris. Robust safety classifier against jailbreaking attacks: Adversarial prompt shield. In Proceedings of the 8th Workshop on Online Abuse and Harms (WOAH 2024) , pages 159–170, 2024

    2024

  14. [22]

    Jailbreaking leading safety-aligned LLMs with simple adaptive attacks

    Maksym Andriushchenko, Francesco Croce, and Nicolas Flammarion. Jailbreaking leading safety-aligned LLMs with simple adaptive attacks. In The Thirteenth International Conference on Learning Representations , 2025

    2025

  15. [23]

    Contrastive preference optimization: pushing the boundaries of llm performance in machine translation

    Haoran Xu, Amr Sharaf, Yunmo Chen, Weiting Tan, Lingfeng Shen, Benjamin Van Durme, Kenton Murray, and Young Jin Kim. Contrastive preference optimization: pushing the boundaries of llm performance in machine translation. In Proceedings of the 41st International Conference on Ma...

    2024

  16. [24]

    Direct preference optimization: Your language model is secretly a reward model

    Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. Direct preference optimization: Your language model is secretly a reward model. In Advances in neural information processing systems, volume 36, pages 53728–53741, 2023

    2023

  17. [25]

    Gpt-4o system card

    Aaron Hurst, Adam Lerer, Adam P Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Ostrow, Akila Welihinda, Alan Hayes, Alec Radford, et al. Gpt-4o system card. arXiv preprint arXiv:2410.21276, 2024

    2024 arXiv

  18. [26]

    LoRA: Low-rank adaptation of large language models

    Edward J Hu, yelong shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. LoRA: Low-rank adaptation of large language models. In International Conference on Learning Represen- tations, 2022

    2022

  19. [27]

    Trl: Transformer reinforcement learning

    Leandro von Werra, Younes Belkada, Lewis Tunstall, Edward Beeching, Tristan Thrush, Nathan Lambert, Shengyi Huang, Kashif Rasul, and Quentin Gallouédec. Trl: Transformer reinforcement learning. https: //github.com/huggingface/trl, 2020

    2020

  20. [28]

    Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities

    Gheorghe Comanici, Eric Bieber, Mike Schaekermann, Ice Pasupat, Noveen Sachdeva, Inderjit Dhillon, Marcel Blistein, Ori Ram, Dan Zhang, Evan Rosen, et al. Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabil...

    2025 arXiv

  21. [29]

    tinybench- marks: evaluating llms with fewer examples

    Felipe Maia Polo, Lucas Weber, Leshem Choshen, Yuekai Sun, Gongjun Xu, and Mikhail Yurochkin. tinybench- marks: evaluating llms with fewer examples. In Proceedings of the 41st International Conference on Machine Learning, pages 34303–34326, 2024

    2024

  22. [30]

    Measuring massive multitask language understanding

    Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. Measuring massive multitask language understanding. In International Conference on Learning Representations , 2021

    2021

  23. [31]

    Hellaswag: Can a machine really finish your sentence? In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics , pages 4791–4800, 2019

    Rowan Zellers, Ari Holtzman, Yonatan Bisk, Ali Farhadi, and Yejin Choi. Hellaswag: Can a machine really finish your sentence? In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics , pages 4791–4800, 2019

    2019

  24. [32]

    Truthfulqa: Measuring how models mimic human falsehoods

    Stephanie Lin, Jacob Hilton, and Owain Evans. Truthfulqa: Measuring how models mimic human falsehoods. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (V olume 1: Long Papers), pages 3214–3252, 2022

    2022

  25. [33]

    I”, “am”, “AI

    Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, et al. Training verifiers to solve math word problems. arXiv preprint arXiv:2110.14168, 2021. 14 A PREPRINT - S EPTEMBER 23, 2...

    arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.