Lightweight Safety Classification Using Pruned Language Models

Jim Brown; Mason Sawtell; Sandi Besen; Tula Masterman

REVIEW 3 major objections 8 minor 1 cited by

Lightweight Safety Classification Using Pruned Language Models

T0 review · 3 major / 8 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A 769-parameter classifier on a small LLM's middle layer beats GPT-4o at safety checks, the paper claims.

desk verdict Useful incremental result on intermediate-layer linear classifiers for content safety, but the 'beats GPT-4o with 15 examples' numbers are test-set-selected upper bounds, not expected performance. read the letter →

arxiv 2412.13435 v1 pith:ZKR4Q6OL submitted 2024-12-18 cs.CL cs.AIcs.LG

Mason Sawtell , Tula Masterman , Sandi Besen , Jim Brown This is my paper · ORCID

classification cs.CLcs.AIcs.LG

keywords LayerEnhancedClassificationcontentsafetypromptinjectiondetectionpenalizedlogisticregressionintermediatetransformerlayersmodelpruningfew-shottextsmalllanguagemodels

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that the expensive final layers of a language model are unnecessary for safety classification: the hidden state of an intermediate transformer layer already contains enough task-relevant information for a simple linear classifier to beat GPT-4o and fine-tuned safety models. The method, Layer Enhanced Classification (LEC), trains an L2-penalized logistic regression on the chosen layer's output vector, adding only a few hundred to a few thousand new parameters. If true, a 0.5B model could simultaneously generate text and check its own inputs and outputs for unsafe content or prompt injections, or be pruned down to a fast standalone feature extractor. It would also mean fewer than 100 labeled examples can yield a state-of-the-art classifier, which matters for custom moderation use cases with scarce data.

What carries the argument

The central object is the hidden-state vector at a chosen intermediate transformer layer. LEC prunes the model at that layer, removing the LM head and later layers, and feeds the vector into an L2-penalized logistic regression (a Ridge classifier with alpha set to 10), so the classifier has exactly the hidden-state width plus a bias term — 769 parameters for DeBERTa and 897 for Qwen 0.5B. The load-bearing selection is the layer choice: the authors find that classification performance across layers follows a right-skewed concave curve with a maximum near 50-75% of the model's layers, which is where they say the task-relevant features are best separated.

What would settle it

Run the same LEC pipeline on the same datasets, but choose the layer and the number of training examples using only a separate validation split, repeat over at least 10 random seeds, and report the mean test F1. If the mean no longer exceeds GPT-4o's 0.82 on content safety and 0.92 on prompt injection, then the reported advantage came from test-set selection. A second check: average the F1 over all layers of a model; if that average falls below GPT-4o, then intermediate layers as a class are not better feature extractors.

Watch

Extended reading notes

Core claim

The paper's central claim is that LEC — training a penalized logistic regression on the hidden state of one intermediate transformer layer — produces classifiers that surpass GPT-4o and task-specific fine-tuned models on both content safety and prompt injection classification. The authors report that a classifier with as few as 769 trainable parameters, the hidden-state width of DeBERTa, reaches weighted F1 scores of 0.98 on prompt injection and 0.96 on binary content safety, beating GPT-4o in as few as 15 to 55 training examples. They also report that intermediate layers outperform the final layer in nearly every model tested, and that pruned special-purpose models outperform their own non-pruned baselines on their respective tasks. Because the pattern holds across Qwen 2.5, Llama Guard 3, and DeBERTa architectures, the authors infer that robust intermediate-layer feature extraction is an inherent capability of transformer LLMs generally.

Load-bearing premise

The headline numbers assume the best layer and the smallest training size were chosen on a held-out validation set rather than by looking at test performance, and the paper does not describe such a validation step.

Editorial extensions

If this is right

LEC can be fused into an LLM's forward pass: the hidden state used for classification is already computed during token generation, so content safety and prompt-injection checks add almost no inference cost.
Small models pruned to an optimal intermediate layer (roughly 30-65% of the full model) serve as standalone feature extractors that beat both the full model and GPT-4o on the tested tasks.
A few dozen high-quality examples are enough: Qwen 2.5 0.5B beats GPT-4o on binary content safety with 15 examples and on prompt injection with 55 examples.
Special-purpose safety models (Llama Guard 3 and DeBERTa prompt-injection) improve their own task performance when their intermediate hidden states are used instead of their final prediction head.
Because the effect appears across several transformer architectures, the authors conclude that robust feature extraction in intermediate layers is a general property of transformer LLMs, not a quirk of one model family.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Editorial inference: if the layer and training-size selection were moved to a strict held-out validation set, the method would likely still beat the baselines, but the especially striking "15 examples" numbers are probably optimistic; the paper's own cross-validation appendix shows single-split results are noisy.
Editorial inference: the same recipe should transfer to other text classification tasks with scarce labels, such as sentiment or topic classification, but the paper only demonstrates content safety and prompt injection, so that general claim is unverified.
Editorial inference: because the classifier is linear and the features are fixed, LEC also works as a cheap diagnostic probe for what information each layer encodes, potentially useful for tracking when safety-relevant features degrade during fine-tuning.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Marcus,

Here's my take on 2412.13435. The paper is a practical application of linear probing to content safety and prompt injection, and the core finding—intermediate transformer layers give better features than the final layer for these tasks—is consistent with prior work by Skean et al. and D K et al. The specific contribution is a recipe: prune to a single intermediate layer, train a penalized logistic regression on its hidden state, and you get a few-thousand-parameter classifier that does well on these tasks. The evaluation across Qwen 2.5 sizes, Llama Guard 1B/8B, and DeBERTa on SALAD/LMSYS and SPML is useful and mostly well-designed. I think the phenomenon is real.

What the paper does well: it compares multiple architectures and sizes, uses a non-trivial prompt injection dataset, includes a cross-validation appendix that shows performance stabilizes, and is honest about the GPT-4o safety-filter blocking. The limitations section is straightforward, and the related work is on point.

The soft spot is the one that matters. The headline numbers are built on post hoc selection. The best layer and the training size at which a baseline is first beaten are chosen from the same 1,700-example test set used to compute the baselines. There are no error bars on the main learning curves, and the appendix documents large variability at small sample sizes—exactly the regime where 'beats GPT-4o in 15 examples' is claimed. Selecting the max from noisy curves inflates both the F1 and the apparent data efficiency. So the abstract's 'fewer than 100 examples' claim is an upper bound, not an expected-performance statement. The GPT-4o baseline also has a small missing-data issue from safety filters; the paper mentions it, but the treatment of those missing responses isn't described. And there's a typo in Table 2: the last row says 'Llama Guard 3 1B' with 32 layers and 7.5B parameters, which is clearly the 8B model.

None of this kills the method. The central argument that intermediate layers are robust feature extractors is defensible and consistent with prior work. The fix is straightforward: isolate layer and training-size selection via nested cross-validation or a pre-registered layer rule, and report variability. I suspect the qualitative conclusion—LEC beats strong baselines with modest data—would survive, but the margins over GPT-4o would shrink.

Who is this for? Practitioners building lightweight guardrails who want a concrete recipe will get value. Researchers working on layer-wise features or linear probing might cite it as supporting evidence. It deserves a serious referee, but it needs revision to either present the test-set-selected results as upper bounds or re-run with proper held-out selection and repeated sampling. I'd send it out.

Marcus

Referee Report

3 major / 8 minor

Summary. This paper introduces Layer Enhanced Classification (LEC), which trains a penalized logistic regression (Ridge) classifier on the hidden state of a selected intermediate transformer layer of a small language model for content safety and prompt injection detection. The authors evaluate LEC using Qwen 2.5 Instruct (0.5B, 1.5B, 3B), Llama Guard 3 (1B, 8B), and a DeBERTa v3 prompt-injection model, comparing against GPT-4o and the unmodified special-purpose baselines. The headline claims are that a classifier with only 769-4097 trainable parameters can surpass GPT-4o and task-specific models on weighted F1 while training on fewer than 100 examples, and that intermediate layers are better feature extractors than final layers for these tasks.

Significance. If the performance claims were established by an unbiased evaluation, this would be a practically significant result: it would show that extremely lightweight linear classifiers on intermediate representations can serve as effective guardrails, with trivial deployment cost. The paper's strengths include systematic layer-wise comparisons across six models, two tasks, and three difficulty levels; reproducible experimental setup using public datasets and models; and an appendix that acknowledges variability and demonstrates cross-validation on one model. However, the reported headline numbers are not yet supported because the evaluation selects the best layer and training set size from the test set and reports single runs without error bars, so the claimed margins over GPT-4o may be upper bounds. The broader claim that robust feature extraction is inherent to 'most, if not all, LLMs' is an extrapolation from a small model family and two special-purpose models.

major comments (3)

[§4.1, Tables 2–4] The summary tables report the maximum weighted F1 and the training size at which the chosen layer beats GPT-4o, but the layer and training size are selected after inspecting learning curves computed on the same 1,700-example test set used for the baseline comparison. This selection on the test set inflates both the maximum F1 and the apparent data efficiency; Appendix 7.1 documents 'large variations in performance, especially on a very small number of training examples' and shows that cross-validation stabilizes performance for only the DeBERTa model on prompt injection. The central 'fewer than 100 examples' and 'surpasses GPT-4o' claims require nested cross-validation or a pre-registered held-out validation split for layer and training-size selection, plus repeated runs with reported standard errors.
[§6, Table 4] The GPT-4o baseline is incomplete because the API often returned no output when content was blocked by safety filters. The authors state this affected 'less than 1% of our dataset in all cases' but do not describe how missing responses were scored; if they are counted as errors, the baseline F1 is artificially lowered, shrinking the apparent advantage of LEC. The paper should specify the scoring rule for blocked outputs and provide a sensitivity analysis by scoring them as correct, incorrect, and excluded.
[Abstract and Contributions] The first contribution states 'We prove the intermediate hidden state between transformer layers are robust feature extractors,' but the paper provides empirical measurements, not a proof, and the extrapolation to 'most, if not all, LLMs' is based on three Qwen sizes, two Llama Guard sizes, and one DeBERTa model. The language should be softened to 'demonstrate' and the scope explicitly limited to the tested architectures, or additional evidence (e.g., diverse model families) should be supplied.

minor comments (8)

[Table 2] In the content safety binary results table, the row 'Llama Guard 3 1B 32 7.5 100.0' appears under the Llama Guard 3 8B group and should likely be labeled 'Llama Guard 3 8B 32' given the parameter count and layer count.
[§4.1] The phrase 'smallest layer that achieves similar performance to the full model' should be defined with a quantitative criterion, such as a specific F1 tolerance, to make the layer-selection rule reproducible.
[§7.2] The layer-concatenation experiment is described only qualitatively; the text should state the numerical F1 differences or a table so that 'little to no effect' is supported by data.
[§3.2] The random sampling of training sets is not accompanied by random seeds or repeated runs, which is important given the variability documented in Appendix 7.1.
[§4.2] The term 'weighted F1-score' should specify whether the weights are class supports or a custom weighting scheme.
[Abstract] The sentence 'We prove the intermediate hidden state between transformer layers are robust feature extractors' has a subject-verb agreement issue; consider 'states are' or 'state is'.
[References] The citation for the AI Secure LLM Safety Leaderboard is a blog URL rather than a stable publication; consider citing the underlying benchmark paper if available.
[§6] The statement 'Regardless of GPT-4o's performance on these examples, our results are conclusive enough to show that our method outperforms it' is not supported by the reported analysis and should be replaced with a quantitative sensitivity check.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: LEC's claims are empirical measurements, not derivations that reduce to their inputs.

full rationale

The paper contains no derivation in which an output is defined in terms of an input. LEC trains a penalized logistic regression on fixed transformer-layer hidden states and reports test-set F1 against baselines; the 'optimal intermediate layer' is selected by inspecting the same test-set results, which creates a selection-bias risk rather than definitional circularity. The paper's own Appendix 7.1 acknowledges 'large variations in performance, especially on a very small number of training examples,' which bears on reliability but not on circularity. The method explicitly builds on externally cited linear-probing and layer-pruning work, and there are no self-citations or imported uniqueness theorems that force the conclusions. The word 'prove' is rhetorical; the support is a suite of measurements, and no claim is equivalent to its inputs by construction.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claims rest on a handful of experimental design choices: the selected layer index, the training size reported for baseline-beating, and the L2 penalty. None of these are derived from theory, and the optimal layer is chosen post hoc from test results. The generalization claim to all LLMs is an ad hoc extrapolation from four model families.

free parameters (3)

Optimal layer index = varies per model (e.g., Qwen 0.5B layer 12, DeBERTa layer 10)
The best-performing layer is selected per model based on test-set F1; all headline 'beats baseline' numbers depend on this selection.
Reporting training sample size = e.g., 5, 15, 55, 75 examples
The 'F1 at # examples to beat' is selected post hoc as the smallest training size where the classifier (for the chosen layer) exceeds the baseline; this is a selected statistic, not a pre-registered threshold.
Ridge regularization alpha = 10
Fixed for all experiments without reported tuning or ablation; it may affect small-sample results.

assumptions (4)

domain assumption The weighted F1 on the 1700-example test set is a reliable and unbiased estimate of generalization.
All headline comparisons to GPT-4o and special-purpose baselines rely on this single test set; no confidence intervals are reported for the main results.
domain assumption LMSYS first-turn messages not flagged as unsafe are a valid proxy for 'safe' content.
The content safety dataset labels safety based on the absence of flags in a different dataset, which may contain false negatives; this labeling enters the training and test labels.
domain assumption The l3prune package correctly implements layer pruning and hidden-state extraction.
The entire method depends on l3prune [17] to remove the LM head and capture hidden states at intermediate layers; the paper does not verify the implementation.
ad hoc to paper Results on Qwen 2.5 (0.5B, 1.5B, 3B), Llama Guard 3 (1B, 8B), and DeBERTa v3 support the inference that robust feature extraction is inherent to most, if not all, LLMs.
The universal claim extends beyond the tested architectures and tasks; no argument is given that these models are representative.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Lightweight Safety Classification Using Pruned Language Models." pith.science (2026). https://pith.science/paper/ZKR4Q6OL

@misc{pith2026241213435,
  author       = {Pith},
  title        = {Pith review of: Lightweight Safety Classification Using Pruned Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ZKR4Q6OL}},
  note         = {Machine review of arXiv:2412.13435}
}

read the original abstract

In this paper, we introduce a novel technique for content safety and prompt injection classification for Large Language Models. Our technique, Layer Enhanced Classification (LEC), trains a Penalized Logistic Regression (PLR) classifier on the hidden state of an LLM's optimal intermediate transformer layer. By combining the computational efficiency of a streamlined PLR classifier with the sophisticated language understanding of an LLM, our approach delivers superior performance surpassing GPT-4o and special-purpose models fine-tuned for each task. We find that small general-purpose models (Qwen 2.5 sizes 0.5B, 1.5B, and 3B) and other transformer-based architectures like DeBERTa v3 are robust feature extractors allowing simple classifiers to be effectively trained on fewer than 100 high-quality examples. Importantly, the intermediate transformer layers of these models typically outperform the final layer across both classification tasks. Our results indicate that a single general-purpose LLM can be used to classify content safety, detect prompt injections, and simultaneously generate output tokens. Alternatively, these relatively small LLMs can be pruned to the optimal intermediate layer and used exclusively as robust feature extractors. Since our results are consistent on different transformer architectures, we infer that robust feature extraction is an inherent capability of most, if not all, LLMs.

Figures

Figures reproduced from arXiv: 2412.13435 by the authors.

**Figure 1.** Visualization of a hybrid black-box model. Mechanistic interpretability is a global analysis technique that seeks to explain behaviors of machine learning models’ internal components. In their work, Wang et al. mechanistically interpret how GPT-2 small implements a natural language task by iteratively tracing important components back from logits, projecting the embedding space, performing attention pattern analysis… view at source ↗

**Figure 2.** LEC performance of select layers on binary content safety classification for Qwen 2.5 0.5B Instruct, Llama Guard 3 1B, and Llama Guard 3 8B. Model Name Layers Parameter Count (B) % of Full Size Max Weighted F1-Score F1 at # Examples to Beat Llama Guard 3 1B F1 at # Examples to Beat Llama Guard 3 8B F1 at # Examples to Beat GPT-4o Qwen 2.5 0.5B Instruct 5 0.21 42.65 0.95 0.74 (5) 0.74 (5) 0.84 (15) Qwen 2.5 0.5B Inst… view at source ↗

**Figure 3.** LEC performance of Qwen 2.5 0.5B Instruct on all three levels of the multi-class content safety dataset. For the binary classification task, all models trained using LEC outperformed the three baseline models. The hidden state of the middle layers provided the highest weighted F1-score across all general and special-purpose models. Notably, Qwen 2.5 0.5B Instruct outperformed both Llama Guard 3 baselines within 5 ex… view at source ↗

Figures from the paper (10 more)

**Figure 4.** Figure 4: Performance of select layers on prompt injection classification for both general-purpose Qwen 2.5 0.5B Instruct and DeBERTa-v3-Prompt-Injection-v2. In this section, we present our results for the prompt injection classification task. We find that both general-purpose a…

**Figure 5.** Figure 5: LEC performance at each layer of the DeBERTa-v3-Prompt-Injection-v2 model for the prompt injection task. 9 [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]

**Figure 6.** Figure 6: Performance graph of cross-validated DeBERTa LEC models on the prompt injection task. 7.2 Layer Concatenation Since the layer representation of text can be significantly different between layers as the number of layers between them increases, we performed experiments o…

**Figure 7.** Figure 7: Performance graphs of Qwen 2.5 0.5B Instruct LEC models using concatenated layers and with a singular layer. Model Task System Prompt User Prompt Qwen 2.5 0.5- 3B Content Safety You are Qwen, created by Alibaba Cloud. You are a helpful assistant. {User Prompt} Qwen 2.5…

**Figure 8.** Figure 8: Full performance of each Qwen 2.5 Instruct LEC model on all 3 levels of the content safety binary classification dataset. 15 [PITH_FULL_IMAGE:figures/full_fig_p015_8.png]

**Figure 9.** Figure 9: Full performance of each Llama Guard 3 LEC model on all 3 levels of the content safety binary classification dataset. 16 [PITH_FULL_IMAGE:figures/full_fig_p016_9.png]

**Figure 10.** Figure 10: Full performance of each Qwen 2.5 Instruct LEC model on all 3 levels of the content safety multi-class classification dataset. 17 [PITH_FULL_IMAGE:figures/full_fig_p017_10.png]

**Figure 11.** Figure 11: Full performance of each Llama Guard 3 LEC model on all 3 levels of the content safety multi-class classification dataset [PITH_FULL_IMAGE:figures/full_fig_p018_11.png]

**Figure 12.** Figure 12: Full performance of each Qwen 2.5 Instruct LEC model on the prompt injection classification dataset [PITH_FULL_IMAGE:figures/full_fig_p018_12.png]

**Figure 13.** Figure 13: Full performance of the DeBERTa v3 Base Prompt Injection v2 LEC models on the prompt injection dataset. 18 [PITH_FULL_IMAGE:figures/full_fig_p018_13.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

PUMA: Layer-Pruned Language Model for Efficient Unified Multimodal Retrieval with Modality-Adaptive Learning
cs.MM 2025-07 conditional novelty 6.0 of 10

Keeping only the first 12 layers of Qwen2-VL plus self-distillation and a modality-aware contrastive loss yields a 3B unified multimodal retriever within 1.8 points of the 7B model on M-BEIR.

Reference graph

Works this paper leans on

35 extracted references · 7 canonical work pages · cited by 1 Pith paper

[1]

Understanding intermediate layers using linear classifier probes

Guillaume Alain and Yoshua Bengio. Understanding intermediate layers using linear classifier probes . arXiv:1610.01644 [stat]. Nov. 2018. DOI: 10 . 48550 / arXiv . 1610 . 01644. URL: http : / / arxiv . org / abs/1610.01644 (visited on 12/08/2024)

arXiv doi:10.48550/arxiv.1610.01644 2018
[2]

An Introduction to AI Secure LLM Safety Leaderboard . en-US. URL: https://huggingface.co/blog/ leaderboard-decodingtrust (visited on 12/13/2024)

work page 2024
[3]

Explainable Artificial Intelligence (XAI): Concepts, Taxonomies, Opportunities and Challenges toward Responsible AI

Alejandro Barredo Arrieta et al. Explainable Artificial Intelligence (XAI): Concepts, Taxonomies, Opportunities and Challenges toward Responsible AI. arXiv:1910.10045 [cs]. Dec. 2019.DOI: 10.48550/arXiv.1910.10045. URL: http://arxiv.org/abs/1910.10045 (visited on 12/12/2024)

arXiv doi:10.48550/arxiv.1910.10045 1910
[4]

Extending Knowledge Graphs with Subjective Influence Networks for Personalized Fashion

Kurt Bollacker, Natalia Díaz-Rodríguez, and Xian Li. “Extending Knowledge Graphs with Subjective Influence Networks for Personalized Fashion”. en. In: Designing Cognitive Cities. Ed. by Edy Portmann et al. Cham: Springer International Publishing, 2019, pp. 203–233. ISBN : 978-3-030-00317-3. DOI: 10.1007/978-3-030- 00317-3_9. URL: https://doi.org/10.1007/9...

doi:10.1007/978-3-030- 2019
[5]

tens- of-shot

Marcus Buckmann and Edward Hill. Logistic Regression makes small LLMs strong and explainable "tens- of-shot" classifiers. arXiv:2408.03414 [cs]. Oct. 2024. DOI: 10.48550/arXiv.2408.03414 . URL: http: //arxiv.org/abs/2408.03414 (visited on 12/06/2024)

arXiv doi:10.48550/arxiv.2408.03414 2024
[6]

MINI-LLM: Memory-Efficient Structured Pruning for Large Language Models

Hongrong Cheng, Miao Zhang, and Javen Qinfeng Shi. MINI-LLM: Memory-Efficient Structured Pruning for Large Language Models. arXiv:2407.11681 [cs]. July 2024. DOI: 10.48550/arXiv.2407.11681 . URL: http://arxiv.org/abs/2407.11681 (visited on 12/08/2024)

arXiv doi:10.48550/arxiv.2407.11681 2024
[7]

Prompt-Augmented Linear Probing: Scaling beyond the Limit of Few-shot In-Context Learners

Hyunsoo Cho et al. Prompt-Augmented Linear Probing: Scaling beyond the Limit of Few-shot In-Context Learners. arXiv:2212.10873 [cs]. June 2023. DOI: 10.48550/arXiv.2212.10873 . URL: http://arxiv. org/abs/2212.10873 (visited on 12/08/2024)

work page Pith review arXiv doi:10.48550/arxiv.2212.10873 2023
[8]

Evolutionary Fuzzy Systems for Explainable Artificial Intelligence: Why, When, What for, and Where to?

Alberto Fernandez et al. “Evolutionary Fuzzy Systems for Explainable Artificial Intelligence: Why, When, What for, and Where to?” en. In: IEEE Computational Intelligence Magazine 14.1 (Feb. 2019), pp. 69–81. ISSN : 1556-603X, 1556-6048. DOI: 10.1109/MCI.2018.2881645. URL: https://ieeexplore.ieee.org/ document/8610271/ (visited on 12/12/2024)

arXiv 2019

Show all 35 references

[9]

Model Explainability in Deep Learning Based Natural Language Processing

Shafie Gholizadeh and Nengfeng Zhou. Model Explainability in Deep Learning Based Natural Language Processing. arXiv:2106.07410 [cs]. June 2021. DOI: 10.48550/arXiv.2106.07410 . URL: http://arxiv. org/abs/2106.07410 (visited on 12/11/2024)

2021 doi arXiv
[10]

AEGIS: Online Adaptive AI Content Safety Moderation with Ensemble of LLM Experts

Shaona Ghosh et al. AEGIS: Online Adaptive AI Content Safety Moderation with Ensemble of LLM Experts . arXiv:2404.05993 [cs]. Sept. 2024. DOI: 10.48550/arXiv.2404.05993 . URL: http://arxiv.org/abs/ 2404.05993 (visited on 12/16/2024)

2024 doi arXiv
[11]

The Llama 3 Herd of Models

Aaron Grattafiori et al. The Llama 3 Herd of Models. arXiv:2407.21783 [cs]. Nov. 2024. DOI: 10.48550/arXiv. 2407.21783. URL: http://arxiv.org/abs/2407.21783 (visited on 12/06/2024)

2024 doi arXiv
[12]

The Unreasonable Ineffectiveness of the Deeper Layers

Andrey Gromov et al. The Unreasonable Ineffectiveness of the Deeper Layers. arXiv:2403.17887 [cs]. Mar. 2024. DOI: 10.48550/arXiv.2403.17887. URL: http://arxiv.org/abs/2403.17887 (visited on 12/09/2024)

2024 doi arXiv
[13]

exBERT: A Visual Analysis Tool to Explore Learned Representations in Transformers Models

Benjamin Hoover, Hendrik Strobelt, and Sebastian Gehrmann. exBERT: A Visual Analysis Tool to Explore Learned Representations in Transformers Models. arXiv:1910.05276 [cs]. Oct. 2019. DOI: 10.48550/arXiv. 1910.05276. URL: http://arxiv.org/abs/1910.05276 (visited on 12/11/2024)

1910 doi arXiv
[14]

Attention Tracker: Detecting Prompt Injection Attacks in LLMs

Kuo-Han Hung et al. Attention Tracker: Detecting Prompt Injection Attacks in LLMs. arXiv:2411.00348 [cs]. Nov. 2024. DOI: 10.48550/arXiv.2411.00348 . URL: http://arxiv.org/abs/2411.00348 (visited on 12/13/2024)

2024 doi arXiv
[15]

Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations

Hakan Inan et al. Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations . arXiv:2312.06674 [cs]. Dec. 2023. DOI: 10 . 48550 / arXiv . 2312 . 06674. URL: http : / / arxiv . org / abs/2312.06674 (visited on 12/09/2024)

2023 doi arXiv
[16]

Prompt Packer: Deceiving LLMs through Compositional Instruction with Hidden Attacks

Shuyu Jiang, Xingshu Chen, and Rui Tang. Prompt Packer: Deceiving LLMs through Compositional Instruction with Hidden Attacks. arXiv:2310.10077 [cs]. Oct. 2023. DOI: 10.48550/arXiv.2310.10077 . URL: http: //arxiv.org/abs/2310.10077 (visited on 12/16/2024)

2023 doi arXiv
[17]

K, Tim Fischer, and Chris Biemann

Thennal D. K, Tim Fischer, and Chris Biemann. Large Language Models Are Overparameterized Text Encoders. arXiv:2410.14578 [cs]. Oct. 2024. DOI: 10.48550/arXiv.2410.14578 . URL: http://arxiv.org/abs/ 2410.14578 (visited on 12/06/2024)

2024 doi arXiv
[18]

original-date: 2024-03-27T19:04:05Z

lakeraai/pint-benchmark. original-date: 2024-03-27T19:04:05Z. Dec. 2024. URL: https://github.com/ lakeraai/pint-benchmark (visited on 12/13/2024). 11

2024
[19]

Interactive Visualization and Manipulation of Attention- based Neural Machine Translation

Jaesong Lee, Joong-Hwi Shin, and Jun-Seok Kim. “Interactive Visualization and Manipulation of Attention- based Neural Machine Translation”. In: Proceedings of the 2017 Conference on Empirical Methods in Natural Language Processing: System Demonstrations. Ed. by Lucia Specia, M...

2017 doi
[20]

SALAD-Bench: A Hierarchical and Comprehensive Safety Benchmark for Large Language Models

Lijun Li et al. SALAD-Bench: A Hierarchical and Comprehensive Safety Benchmark for Large Language Models. arXiv:2402.05044 [cs]. June 2024. DOI: 10.48550/arXiv.2402.05044 . URL: http://arxiv.org/abs/ 2402.05044 (visited on 12/06/2024)

2024 doi arXiv
[21]

A Unified Approach to Interpreting Model Predictions

Scott Lundberg and Su-In Lee. A Unified Approach to Interpreting Model Predictions. arXiv:1705.07874 [cs]. Nov. 2017. DOI: 10.48550/arXiv.1705.07874 . URL: http://arxiv.org/abs/1705.07874 (visited on 12/11/2024)

2017 doi arXiv
[22]

From Understanding to Utilization: A Survey on Explainability for Large Language Models

Haoyan Luo and Lucia Specia. From Understanding to Utilization: A Survey on Explainability for Large Language Models. arXiv:2401.12874 [cs]. Feb. 2024. DOI: 10 . 48550 / arXiv . 2401 . 12874. URL: http : //arxiv.org/abs/2401.12874 (visited on 12/12/2024)

2024 doi arXiv
[23]

LLM-Pruner: On the Structural Pruning of Large Language Models

Xinyin Ma, Gongfan Fang, and Xinchao Wang. LLM-Pruner: On the Structural Pruning of Large Language Models. arXiv:2305.11627 [cs]. Sept. 2023. DOI: 10.48550/arXiv.2305.11627. URL: http://arxiv.org/ abs/2305.11627 (visited on 12/08/2024)

2023 doi arXiv
[24]

Towards Agile Text Classifiers for Everyone

Maximilian Mozes et al. Towards Agile Text Classifiers for Everyone. arXiv:2302.06541 [cs]. Oct. 2023. DOI: 10.48550/arXiv.2302.06541. URL: http://arxiv.org/abs/2302.06541 (visited on 12/13/2024)

2023 doi arXiv
[25]

Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learning

Nicolas Papernot and Patrick McDaniel. Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learning . arXiv:1803.04765 [cs]. Mar. 2018. DOI: 10 . 48550 / arXiv . 1803 . 04765. URL: http://arxiv.org/abs/1803.04765 (visited on 12/12/2024)

2018 doi arXiv
[26]

deberta-v3-base-prompt-injection

Protect AI. “deberta-v3-base-prompt-injection”. In: (). Publisher: Hugging Face Version Number: 7e5dcc7. DOI: 10.57967/HF/2739 . URL: https://huggingface.co/protectai/deberta- v3- base- prompt- injection (visited on 12/09/2024)

doi
[27]

Sharma, Vinayak Gupta, and Dan Grossman

Reshabh K. Sharma, Vinayak Gupta, and Dan Grossman. SPML: A DSL for Defending Language Models Against Prompt Attacks . arXiv:2402.11755 [cs]. Feb. 2024. DOI: 10 . 48550 / arXiv . 2402 . 11755. URL: http://arxiv.org/abs/2402.11755 (visited on 12/06/2024)

2024 doi arXiv
[28]

Does Representation Matter? Exploring Intermediate Layers in Large Language Models

Oscar Skean, Md Rifat Arefin, and Ravid Shwartz-Ziv. “Does Representation Matter? Exploring Intermediate Layers in Large Language Models”. In: Workshop on Machine Learning and Compression, NeurIPS 2024. 2024. URL: https://openreview.net/forum?id=FN0tZ9pVLz

2024
[29]

Seq2Seq-Vis: A Visual Debugging Tool for Sequence-to-Sequence Models

Hendrik Strobelt et al. Seq2Seq-Vis: A Visual Debugging Tool for Sequence-to-Sequence Models . arXiv:1804.09299 [cs]. Oct. 2018. DOI: 10 . 48550 / arXiv . 1804 . 09299. URL: http : / / arxiv . org / abs/1804.09299 (visited on 12/11/2024)

2018 doi arXiv
[30]

The geometry of hidden representations of large transformer models

Lucrezia Valeriani et al. The geometry of hidden representations of large transformer models. arXiv:2302.00294 [cs]. Oct. 2023. DOI: 10.48550/arXiv.2302.00294. URL: http://arxiv.org/abs/2302.00294 (visited on 12/13/2024)

2023 doi arXiv
[31]

Visualizing Attention in Transformer-Based Language Representation Models

Jesse Vig. Visualizing Attention in Transformer-Based Language Representation Models. arXiv:1904.02679 [cs]. Apr. 2019. DOI: 10.48550/arXiv.1904.02679 . URL: http://arxiv.org/abs/1904.02679 (visited on 12/11/2024)

1904 doi arXiv
[32]

Interpretability in the Wild: a Circuit for Indirect Object Identification in GPT-2 small

Kevin Wang et al. Interpretability in the Wild: a Circuit for Indirect Object Identification in GPT-2 small . arXiv:2211.00593 [cs]. Nov. 2022. DOI: 10.48550/arXiv.2211.00593 . URL: http://arxiv.org/abs/ 2211.00593 (visited on 12/13/2024)

2022 doi arXiv
[33]

arXiv:2401.17139 [cs]

Lai Wei et al.Diff-eRank: A Novel Rank-Based Metric for Evaluating Large Language Models. arXiv:2401.17139 [cs]. Oct. 2024. DOI: 10.48550/arXiv.2401.17139. URL: http://arxiv.org/abs/2401.17139 (visited on 12/11/2024)

2024 doi arXiv
[34]

LMSYS-Chat-1M: A Large-Scale Real-World LLM Conversation Dataset

Lianmin Zheng et al. LMSYS-Chat-1M: A Large-Scale Real-World LLM Conversation Dataset. arXiv:2309.11998 [cs]. Mar. 2024. DOI: 10.48550/arXiv.2309.11998. URL: http://arxiv.org/abs/2309.11998 (visited on 12/07/2024)

2024 doi arXiv
[35]

On the Explainability of Natural Language Processing Deep Models

Julia El Zini and Mariette Awad. “On the Explainability of Natural Language Processing Deep Models”. In: ACM Computing Surveys 55.5 (May 2023). arXiv:2210.06929 [cs], pp. 1–31. ISSN : 0360-0300, 1557-7341. DOI: 10.1145/3529755. URL: http://arxiv.org/abs/2210.06929 (visited on ...

2023 arXiv

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [1]

Understanding intermediate layers using linear classifier probes

Guillaume Alain and Yoshua Bengio. Understanding intermediate layers using linear classifier probes . arXiv:1610.01644 [stat]. Nov. 2018. DOI: 10 . 48550 / arXiv . 1610 . 01644. URL: http : / / arxiv . org / abs/1610.01644 (visited on 12/08/2024)

arXiv doi:10.48550/arxiv.1610.01644 2018

[2] [2]

An Introduction to AI Secure LLM Safety Leaderboard . en-US. URL: https://huggingface.co/blog/ leaderboard-decodingtrust (visited on 12/13/2024)

work page 2024

[3] [3]

Explainable Artificial Intelligence (XAI): Concepts, Taxonomies, Opportunities and Challenges toward Responsible AI

Alejandro Barredo Arrieta et al. Explainable Artificial Intelligence (XAI): Concepts, Taxonomies, Opportunities and Challenges toward Responsible AI. arXiv:1910.10045 [cs]. Dec. 2019.DOI: 10.48550/arXiv.1910.10045. URL: http://arxiv.org/abs/1910.10045 (visited on 12/12/2024)

arXiv doi:10.48550/arxiv.1910.10045 1910

[4] [4]

Extending Knowledge Graphs with Subjective Influence Networks for Personalized Fashion

Kurt Bollacker, Natalia Díaz-Rodríguez, and Xian Li. “Extending Knowledge Graphs with Subjective Influence Networks for Personalized Fashion”. en. In: Designing Cognitive Cities. Ed. by Edy Portmann et al. Cham: Springer International Publishing, 2019, pp. 203–233. ISBN : 978-3-030-00317-3. DOI: 10.1007/978-3-030- 00317-3_9. URL: https://doi.org/10.1007/9...

doi:10.1007/978-3-030- 2019

[5] [5]

tens- of-shot

Marcus Buckmann and Edward Hill. Logistic Regression makes small LLMs strong and explainable "tens- of-shot" classifiers. arXiv:2408.03414 [cs]. Oct. 2024. DOI: 10.48550/arXiv.2408.03414 . URL: http: //arxiv.org/abs/2408.03414 (visited on 12/06/2024)

arXiv doi:10.48550/arxiv.2408.03414 2024

[6] [6]

MINI-LLM: Memory-Efficient Structured Pruning for Large Language Models

Hongrong Cheng, Miao Zhang, and Javen Qinfeng Shi. MINI-LLM: Memory-Efficient Structured Pruning for Large Language Models. arXiv:2407.11681 [cs]. July 2024. DOI: 10.48550/arXiv.2407.11681 . URL: http://arxiv.org/abs/2407.11681 (visited on 12/08/2024)

arXiv doi:10.48550/arxiv.2407.11681 2024

[7] [7]

Prompt-Augmented Linear Probing: Scaling beyond the Limit of Few-shot In-Context Learners

Hyunsoo Cho et al. Prompt-Augmented Linear Probing: Scaling beyond the Limit of Few-shot In-Context Learners. arXiv:2212.10873 [cs]. June 2023. DOI: 10.48550/arXiv.2212.10873 . URL: http://arxiv. org/abs/2212.10873 (visited on 12/08/2024)

work page Pith review arXiv doi:10.48550/arxiv.2212.10873 2023

[8] [8]

Evolutionary Fuzzy Systems for Explainable Artificial Intelligence: Why, When, What for, and Where to?

Alberto Fernandez et al. “Evolutionary Fuzzy Systems for Explainable Artificial Intelligence: Why, When, What for, and Where to?” en. In: IEEE Computational Intelligence Magazine 14.1 (Feb. 2019), pp. 69–81. ISSN : 1556-603X, 1556-6048. DOI: 10.1109/MCI.2018.2881645. URL: https://ieeexplore.ieee.org/ document/8610271/ (visited on 12/12/2024)

arXiv 2019