{"id":"7c355236-2576-4b4e-8a5c-ee99dc388c36","arxiv_id":"2505.19670","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"A representation-space reshaping method improves LALM safety against harmful audio queries while keeping over-rejection low.","lead":"This paper proposes an unsupervised fine-tuning method that reshapes the internal representation space of audio-language models so they refuse harmful audio queries without over-rejecting safe ones. The authors report large safety gains on three Qwen audio models with only a 0.88% average increase in over-rejection rate.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 0.88% average ORR increase is partly an artifact of choosing the top-m% threshold per model on the evaluation benchmark itself; with the natural Top-51% rule the increase is ~1.49%.","rationale":"The paper proposes a plausible unsupervised representation-level fine-tuning method. The core idea — computing a safety direction from refusal-elicited vs benign representations and pushing harmful/benign representations apart — is well motivated by prior observations (Qi et al., 2025; Yang et al., 2024a), and the t-SNE visualization in Figure 2 shows the intended cluster separation emerging during training. The ablation with the penalty term (Table 3, 'w/o Penalty Term') confirms that the regularization is important for controlling ORR and preserving Air-Bench scores. These are genuine strengths. However, the most load-bearing problem is the selection of the top-m% threshold. The natural criterion w40,p Δvp > 0 is stated to correspond to Top-51%, but Table 4 explores three thresholds on the same benchmark used for the main results. The authors then choose Top-25% for Qwen2-Audio specifically because the ORR is lower. This is selection on the test set. If Top-51% is used uniformly, the average ORR increase is 1.49% rather than 0.88%, which changes the headline claim materially. Furthermore, the absence of error bars means we cannot tell whether the differences between thresholds are even significant. The reported numbers are therefore not a reliable estimate of the method's true safety/over-rejection trade-off. The reader's verdict of CONDITIONAL is appropriate: the method may well work, but the paper must either pre-register the threshold selection, use a held-out validation set, provide multi-seed variance, and release code/data before the central quantitative claim can be accepted. Our concern does not move the verdict; it sharpens the condition.","tokens_in":13376,"tokens_out":7964,"duration_ms":84507,"concrete_test":"Re-run the RRS pipeline on all three models with a fixed threshold: either m=51% for every model, or m chosen on a held-out split of AIAH (e.g., half the query categories) before evaluating on the remaining half. Repeat each configuration with at least 3 random seeds and report mean ± std for ASR and ORR. If the average ORR increase over vanilla remains ≈0.88% and the ASR reductions are within noise of Table 3, the concern is resolved; if the ORR increase becomes ≈1.5% or the ASR gains shrink, the headline 'only 0.88%' is unsupported.","verdict_should_be":"UNCHANGED","load_bearing_attack":"Section 4.1 defines the safety vector ΔVs by thresholding w40,p Δvp at the top m%. Section 5.3 (Table 4) then evaluates m ∈ {12.5%, 25%, 51%} on the same AIAH benchmark used for the main results, and for Qwen2-Audio the authors explicitly 'select Top-25% as the optimal feature selection strategy' because Top-51% (the natural criterion w40,p Δvp > 0) increases ORR to 3.89%. For Qwen-Audio and Qwen2.5-Omni, Top-51% is used. Thus the headline claim of only a 0.88% average ORR increase (from Table 3) is the result of per-model threshold selection on the test set. If the natural criterion Top-51% were applied uniformly, the average ORR increase would be (1.37 + 2.58 + 0.51)/3 = 1.49%, nearly double. No held-out validation or pre-registered selection rule is provided, and results are from a single run without error bars. This selection-on-the-test-set directly threatens the quantitative form of the central claim; the safety improvements themselves may also be partially inflated.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes Reshaping Representation Space (RRS), an unsupervised safety-fine-tuning strategy for Large Audio Language Models (LALMs). The method computes a 'safety direction' from paired harmful/benign audio questions using refusal-eliciting prompts, selects a top-m% subset of safety-relevant features based on the head-projection weights, and fine-tunes a LoRA adapter so that harmful representations move toward the refusal zone while benign representations move away from it. Experiments on Qwen-Audio, Qwen2-Audio, and Qwen2.5-Omni report improved Attack Success Rate (ASR) across audio-text, text-only, and audio-only conditions, with an average over-rejection rate (ORR) increase of only 0.88% compared with vanilla models, while maintaining speech-chatting performance on Air-Bench.","tokens_in":13681,"tokens_out":5985,"duration_ms":61825,"significance":"If the reported results hold, RRS would be a practical post-hoc safety-alignment method for LALMs that requires no large alignment datasets and avoids the severe over-rejection seen in SFT baselines. The representation-space perspective is interesting, the comparison against four SFT strategies across three model generations is informative, and the reported NSI (net safety improvement) is consistently favorable. However, the headline quantitative claim, especially the 0.88% ORR increase, is currently weakened by per-model selection of the feature threshold on the evaluation benchmark, the lack of any uncertainty quantification, and an unvalidated assumption about the transferability of the computed safety direction. These issues are fixable within the manuscript's scope, but they are load-bearing for the central claim.","major_comments":[{"comment":"The abstract's claim of 'only 0.88% on average' ORR increase depends on choosing the top-m% feature threshold separately for each model after inspecting results on the AIAH benchmark. In Table 4, Qwen2-Audio with Top-51% (the natural criterion w40,p*Δvp>0 identified in §4.1) yields ORR 3.89%, and the text explicitly selects Top-25% instead, giving ORR 2.06%. If the uniform Top-51% rule were applied to all three models, the average ORR increase would be (1.37 + 2.58 + 0.51)/3 = 1.49%, almost double the reported 0.88%. Because the selection is performed on the same benchmark used for the main results, and no held-out validation or pre-registered selection rule is provided, this selection-on-the-test-set directly threatens the quantitative form of the central claim. Please provide a validation protocol (e.g., select m on a held-out split and then report test results), or report all thresholds with uncertainty and avoid presenting one per-model choice as the headline number.","section":"§4.1, §5.3, Table 4"},{"comment":"The safety direction is defined in Eq. (9) as the average of Vθ0(dh, t~) − Vθ0(db, t), i.e., the difference between a refusal-elicited harmful representation and a benign representation. However, Eq. (12) then adds this direction to Vθ0(dh, t), the representation of an answerable harmful question. The paper assumes that the benign-to-refusal shift equals the answerable-harmful-to-refusal shift, but the two source representations are different, and this assumption is neither derived nor tested. On the training pairs, the loss function enforces the movement by construction, so training performance cannot validate the transfer; the AIAH evaluation is indirect evidence, but its interpretability is limited by the threshold-selection issue described above. Please justify this assumption or test it, for example by computing the direction from Vθ0(dh, t~) − Vθ0(dh, t) instead, or by measuring whether the chosen direction reliably increases refusal probability on held-out harmful queries without shifting benign queries.","section":"§3.2, Eq. (9), Eq. (12)"},{"comment":"No error bars, confidence intervals, or repeated fine-tuning runs are reported for any experiment. Given that several key comparisons involve small ORR differences (e.g., Qwen2-Audio ORR 2.06% vs. 1.31%); the 0.88% average increase cannot be assessed for statistical significance without uncertainty quantification. At minimum, please report multiple seeds or bootstrap confidence intervals for ASR, ORR, and NSI, especially for the chosen m values.","section":"Tables 2–4"}],"minor_comments":[{"comment":"Qwen2.5-Omni is attributed to (Chu et al., 2024) in the contributions list but to (Xu et al., 2025) in §5.1; please unify the citation.","section":"§5.1 and Contributions"},{"comment":"The paper states that (Δvp)p∈w40,pΔvp>0 is approximately equal to Top-51%, but Table 4 treats Top-51% as one hyperparameter value. Please clarify whether Top-51% is exactly the set of positive-coordinate coordinates or an arbitrary threshold, and state how the selection is operationalized.","section":"§4.1 and Table 4"},{"comment":"The term 'unsupervised' is used for a method that relies on harmful/benign labels from BeaverTails and GPT-4 rewriting; the term is understandable in the sense that no response targets are used, but it may confuse readers and should be defined explicitly.","section":"Abstract and §1"},{"comment":"The t-SNE plots would benefit from reporting the number of samples, the perplexity setting, and a note that t-SNE can exaggerate apparent cluster separation.","section":"Figure 2"},{"comment":"For Qwen-Audio, 'Avg. NSI' is computed over only two modalities because audio-only is not supported; please state this explicitly in the caption or in the text.","section":"Table 3"},{"comment":"The penalty term ∥Δθ∥2^2 appears without a weighting coefficient; please clarify whether the weight is fixed at 1 or selected, and if selected, report the value or search range.","section":"§4.2, Eq. (13)"}],"recommendation":"major_revision","confidential_remarks":"The selection-on-the-test-set issue is the main obstacle: the headline 0.88% ORR increase is a direct consequence of choosing different top-m% thresholds per model after seeing AIAH results, and the uniform Top-51% baseline gives 1.49%. The underlying method and the safety improvements are promising, and the requested fixes (held-out threshold selection, uncertainty quantification, and a validation of the direction-transfer assumption) are within the scope of a revision. I recommend major revision rather than rejection, provided the authors can supply the missing validation and report results for all thresholds transparently."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The core idea is genuinely new: use the refusal-token weight vector to isolate safety-critical coordinates in representation space, then fine-tune so harmful queries move toward the refusal zone and benign queries move away. The authors also build a sensible paired harmful-benign audio dataset and define a useful Net Safety Improvement metric. On three Qwen LALMs, the safety gains are large and the over-rejection trade-off looks plausible. That is a contribution worth taking seriously.\n\nThe soft spots are real but not fatal. The stress-test note is correct: Table 4 shows the top-m% threshold was chosen per model after looking at the benchmark numbers. For Qwen2-Audio they explicitly switch from Top-51% to Top-25% because Top-51% pushes ORR to 3.89%. So the headline \"only 0.88% ORR increase\" is a selected number, not a principled average. Using the natural Top-51% rule uniformly gives about 1.49% average ORR increase, nearly double. The qualitative story survives — safety still improves a lot — but the quantitative claim overstates how cheap the safety gain is.\n\nOther issues: single-run results with no error bars; code/data availability is inconsistent (abstract says available, ethics statement says will release upon acceptance); and calling it \"unsupervised\" is generous since it still needs a harmful/benign question set. The safety-direction derivation is heuristic, but the t-SNE and held-out AIAH evaluation suggest it generalizes, so I would not call it circular in a damaging way.\n\nThis is a paper for LALM and multimodal safety researchers. The method is simple enough to try and the negative results on SFT baselines are informative. It deserves serious peer review, but the authors should be asked to pre-register or hold out the threshold choice, report variance across seeds, and actually ship the code and data before the headline numbers are trusted.\n\nI would bring this to a reading group as a case study in both a promising method and how test-set hyperparameter selection can inflate results.","headline":"Clever representation-space safety fine-tuning for LALMs, with real gains, but the headline ORR number is partly a test-set artifact and reproducibility is not yet there.","tokens_in":14157,"tokens_out":2853,"would_cite":false,"duration_ms":32171,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"An unsupervised fine-tuning strategy, Reshaping Representation Space, substantially cuts harmful-answer rates across three input modes of Qwen audio-language models while over-rejection of benign questions rises by only 0.88% on average.","keywords":["large audio language models","safety alignment","representation space","over-rejection","refusal prefix","unsupervised fine-tuning","audio safety","Qwen LALMs"],"falsifier":"Compute the safety vector from half of the harmful categories, fix the trim level before any evaluation (for example, Top-51% for all three models), and fine-tune; then measure attack success rate on held-out harmful categories and over-rejection on held-out benign questions. If the held-out attack success rate stays near the vanilla model's level, or over-rejection rises well above the reported 0.88% average, the safety direction does not transfer beyond the questions it was computed from. The paper itself lists audio jailbreaks and adversarial attacks as remaining risks, so a direct test with an audio-specific adversarial perturbation would also reveal whether the reshaped representation space is robust or merely relocated.","tokens_in":13185,"feed_emoji":"🛡️","tokens_out":15367,"duration_ms":114411,"temperature":0.7,"pith_summary":"Large audio language models gain their conversational abilities from text backbones, but adding audio encoders often erodes safety alignment, leaving them willing to answer plain harmful audio questions. The paper proposes an unsupervised fine-tuning strategy, Reshaping Representation Space (RRS), that repairs this at the level of the model's internal representations instead of teaching it refusal sentences. The central claim is that RRS substantially cuts attack success rates on harmful queries across the audio-text, text-only, and audio-only input modes, on three generations of Qwen models, while raising over-rejection of benign queries by only 0.88% on average, and a small 1,400-sample audio dataset built from rewritten harmful/benign pairs suffices to drive the effect. If the claim holds, audio-capable assistants can be made safer without sacrificing helpfulness and without a large curated safety corpus.","feed_headline":"Audio language models get safer without refusing good questions","feed_subtitle":"Rewriting internal representations cuts harmful replies while over-rejection rises just 0.88% on average.","key_machinery":"The central object is the safety vector $\\Delta V_s$: the average of $\\tilde{V}_{\\theta_0}(d_h) - V_{\\theta_0}(d_b)$ over the 700 harmful/benign pairs, where the harmful representation is elicited with a prompt that explicitly demands a refusal and the benign representation with a normal answer prompt, restricted to the top $m\\%$ of coordinates by the criterion $w_{40,p}\\Delta v_p > 0$. The refusal-token weight row $w_{40}$ makes the machinery work: since the logit for 'I' is the linear readout $L_{40} = w_{40}\\cdot V$, a coordinate's product $w_{40,p}\\Delta v_p$ measures exactly how much a feature change raises the probability of the refusal prefix, which is why the top-51% positive-feature set already approximates the full positive set. The fine-tuning objective $\\sum_{d} \\|V^{\\mathrm{pred}}_\\theta(d) - V^{\\mathrm{tgt}}_{\\theta_0}(d)\\|_2^2 + \\|\\theta-\\theta_0\\|_2^2$ ties the mechanism together: it steers harmful representations toward $V+\\Delta V_s$, steers benign representations toward $V-\\Delta V_s$, and the quadratic penalty keeps the update local, preserving speech-chatting behaviour.","core_discovery":"RRS rests on a geometric picture: in a safely aligned model, harmful queries land in a refusal zone whose first predicted token is 'I' (the refusal prefix, as in 'I'm sorry'), while benign queries land in an answerable zone; in a misaligned LALM the two sets are intermingled. The method computes a safety vector $\\Delta V_s$ from 700 harmful audio questions and their semantically matched benign twins: for each pair it takes the difference between the representation under a refusal-forcing text prompt and the representation of the benign question, averages over the pairs, and keeps only the top $m\\%$ of coordinates when sorted by $w_{40,p}\\Delta v_p$, the per-coordinate contribution to the logit of the 'I' token. Fine-tuning with a squared-error loss then moves harmful representations toward $V+\\Delta V_s$ and benign representations toward $V-\\Delta V_s$, with a penalty on parameter drift, so harmful queries are relocated into the refusal zone while benign queries are pulled away from it. On Qwen-Audio, Qwen2-Audio, and Qwen2.5-Omni the paper reports competitive or better attack-success-rate reductions than the strongest shallow-SFT baseline, over-rejection rising only about 0.88% on average over the vanilla models, and t-SNE visualisations show the mixed representation space splitting into two clusters as training proceeds.","pith_inferences":["The same add-for-harmful, subtract-for-benign recipe could be tried on vision-language or text-only models, since the object it manipulates, a linear refusal readout in the last hidden state, exists in any transformer whose refusal token is identifiable; the paper only demonstrates it on audio models.","The 'unsupervised' label refers to the training objective, not the data: the Mirror pairs still require knowing which questions are harmful and which are benign, plus a rewrite model to produce the benign twins, so a fully label-free variant would need automatic discovery of refusal-eliciting prompts.","Projecting query representations onto $\\Delta V_s$ could serve as a continuous safety monitor during later task fine-tuning, flagging when harmful and benign representations are drifting back together, a use the paper does not discuss.","Averaging over 700 pairs merges all harmful categories into one aggregate direction; comparing per-category safety vectors would reveal whether the refusal direction is universal or category-specific, which determines how well RRS scales to unseen harm types."],"forward_implications":["Audio assistants can be safety-retrofitted without collecting refusal-response annotations, because the fine-tuning signal is purely representational.","Fine-tuning on audio-text pairs also suppresses harmful answers to text-only and audio-only prompts, since all three modes share the backbone's representation space.","The dedicated 1,400-sample audio dataset is sufficient for the effect, suggesting LALM safety alignment does not require a large curated audio-safety corpus.","A roughly +0.88% average over-rejection cost puts the safety/helpfulness trade-off in a regime that the paper's supervised fine-tuning baselines do not reach; on Qwen-Audio the text-only attack success rate falls to 0.46% at an over-rejection cost of 1.37 percentage points.","Because the method is defined through a fixed head-projection weight row, the recipe is expressed by the authors as a general post-modality-adaptation remedy rather than a Qwen-specific fix."],"supporting_citations":[{"why":"Supplies the AIAH benchmark with its three-mode red-teaming protocol, the ASR/ORR metrics, vanilla baseline numbers, and the representation-cluster observation that motivates RRS.","marker":"(Yang et al., 2024a)"},{"why":"Provides the refusal-prefix 'I' observation, the shallow-versus-deep safety fine-tuning framing, and the SFT-deep baseline that RRS is compared against.","marker":"Qi et al. (2025)"},{"why":"Documents that safety-SFT during modality adaptation improves safety at the cost of rapid over-rejection, the exact dilemma RRS targets.","marker":"Lee et al. (2025)"},{"why":"BeaverTails is the source of the harmful and benign text samples that are voiced into the audio alignment datasets.","marker":"Ji et al. (2023)"},{"why":"GPT-4-Turbo rewrites harmful questions into semantically matched benign twins for the Mirror dataset and generates the prompt pool.","marker":"Achiam et al. (2023)"},{"why":"Qwen-Audio is one of the three fine-tuned models, the safety-misaligned case that most clearly shows the intermingled representation space.","marker":"(Chu et al., 2023)"},{"why":"Qwen2-Audio is one of the three fine-tuned models, representing a moderate safety-alignment level.","marker":"(Chu et al., 2024)"},{"why":"Qwen2.5-Omni is one of the three fine-tuned models, representing a competitive safety-alignment level.","marker":"(Xu et al., 2025)"},{"why":"LoRA is the low-rank adapter loaded on the LLM modules during all fine-tuning runs, with audio encoders frozen.","marker":"(Hu et al., 2022)"},{"why":"Air-Bench supplies the Helpfulness Score used to verify that RRS preserves speech-chatting ability.","marker":"(Yang et al., 2024b)"}],"fun_headline_variants":["Audio LLMs: safer without refusing good questions","Reshaping representation space cuts audio LLM harm, not help","Tiny 0.88% over-rejection rise buys big audio LLM safety","Unsupervised audio LLM fix: move harmful queries to refusal zone","Audio LLMs balance safety and helpfulness via space reshaping"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that one average difference vector between the model's internal states for refusal-forced and benign questions, keeping only the coordinates that most raise the model's score for the refusal word 'I', transfers to all new harmful and benign questions as a universal safety direction, even though the fraction of coordinates kept is chosen per model after the evaluation results are already known.","fun_headline_variants_meta":{"raw":{"variants":["Audio LLMs: safer without refusing good questions","Reshaping representation space cuts audio LLM harm, not help","Tiny 0.88% over-rejection rise buys big audio LLM safety","Unsupervised audio LLM fix: move harmful queries to refusal zone","Audio LLMs balance safety and helpfulness via space reshaping"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000421,"raw_usage":{"total_tokens":2203,"prompt_tokens":1019,"completion_tokens":1184,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":635,"completion_tokens_details":{"reasoning_tokens":1094}},"tokens_in":635,"tokens_out":1184,"duration_ms":9919,"temperature":1.0,"reasoning_tokens":1094,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T14:08:47.575626+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Compute the safety vector from half of the harmful categories, fix the trim level before any evaluation (for example, Top-51% for all three models), and fine-tune; then measure attack success rate on held-out harmful categories and over-rejection on held-out benign questions. If the held-out attack success rate stays near the vanilla model's level, or over-rejection rises well above the reported 0.88% average, the safety direction does not transfer beyond the questions it was computed from. The paper itself lists audio jailbreaks and adversarial attacks as remaining risks, so a direct test with an audio-specific adversarial perturbation would also reveal whether the reshaped representation space is robust or merely relocated.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Documents that safety-SFT during modality adaptation improves safety at the cost of rapid over-rejection, the exact dilemma RRS targets."}],"review_version":1}