Pith. sign in

REVIEW 3 major objections 5 minor 1 cited by

Look Before You Leap: Enhancing Attention and Vigilance Regarding Harmful Content with GuidelineLLM

T0 review · 3 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper proposes that a small, separately fine-tuned model, GuidelineLLM, can prepend query-specific safety guidelines to cut jailbreak attack success rates by an average of 34.17% across five datasets and three LLMs, without retraining…

desk verdict The learned guideline generator is genuinely new and the AutoDAN results are strong, but the headline 34.17% ASR reduction rests on a token metric the paper itself shows overreports harm; the qualitative finding likely holds, the magnitude does not. read the letter →

arxiv 2412.10423 v2 pith:O2QSQXCV submitted 2024-12-10 cs.CL cs.AI

Shaoqing Zhang , Zhuosheng Zhang , Kehai Chen , Rongxiang Weng , Muyun Yang , Tiejun Zhao , Min Zhang This is my paper · ORCID
classification cs.CLcs.AI
keywords jailbreakdefenseguidelinegenerationattacksuccessrateLLMsafetyinference-timeredteamingpromptaugmentationparameter-efficientfine-tuning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes GuidelineLLM, a defensive front-end that inspects each incoming query before the main LLM sees it, summarizes the query's risks into a short set of guideline suggestions, and prepends those guidelines to the prompt. The central claim is that this simple addition lowers the average jailbreak attack success rate by 34.17% across three target models and five jailbreak datasets, while keeping helpfulness scores above 3.3 on benign queries. Because the target LLM is never fine-tuned and only the small GuidelineLLM is trained, the defense is portable across different LLMs and cheaper to deploy than safety retraining of the model itself. The paper also introduces T-Jailbreak, a template-based dataset built from seven known jailbreak techniques, and an iterative loop in which a companion JailbreakLLM generates new attack queries to keep the guideline data current. A sympathetic reader would care because jailbreak attacks keep evolving, and a defense that can be updated without retraining the deployed model addresses a real deployment bottleneck.

What carries the argument

The load-bearing object is GuidelineLLM itself: a small language model fine-tuned with LoRA that maps a user query to a list of risk-focused guidelines, which are then prepended to the query before the responding LLM generates an answer. It is trained on a dataset that pairs jailbreak queries and benign queries with guideline outputs, produced initially by gpt-3.5-turbo-0125 using the safety policies of Llama3-Guard and DAN as seed content. The companion mechanism is T-Jailbreak, a template-generated collection of 1,137 attack queries organized around seven techniques: role play, rule determine, logical reasoning, text continuation, program execution, simulate mode, and superior model. In each iteration, JailbreakLLM generates new attacks, a rule-based filter keeps the ones that elicit harmful output, GuidelineLLM writes guidelines for them, and both models are re-fine-tuned on the enlarged sets; this is the machinery that lets the defense be extended to new jailbreak styles without touching the target model's weights.

What would settle it

Systematically replace the token-based ASR with human judgments or a strong judge model on all five datasets and three target models, and compare the before/after reduction; if the average ASR drop falls materially below 34.17%, the central magnitude is a measurement artifact. A second independent check is to hold out a newly invented jailbreak technique outside the seven T-Jailbreak templates and see whether guideline prepending still lowers its ASR.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that alignment behavior can be triggered externally: before answering, an LLM can be given a small, query-specific warning paragraph, and this warning is enough to make the model's existing safety training engage. GuidelineLLM is a fine-tuned 7B-class model that performs risk identification and summarization; its output is not a refusal but a set of guidelines such as 'be mindful of the content' and 'avoid promoting harmful content,' which are prepended to the original query. Across DAN, SAP200, JailbreakChatGPT, AutoDAN, and the authors' T-Jailbreak set, the token-based ASR drops from 19.34% to 1.53% on Llama2-7B-Chat, from 63.18% to 8.96% on Vicuna-7B, and from 42.10% to 11.63% on Vicuna-13B, for an average reduction of 34.17% ASR. The same mechanism leaves helpfulness largely intact: benign-query scores stay above 3.3 on a 0-4 scale, with false refusal rates rising noticeably only on Llama2-7B-Chat, from 1.83% to 7.31%. The authors further show that the defense holds against AutoDAN, a strong optimization-based attack, with 0% ASR on Llama2-7B-Chat.

Load-bearing premise

The claim's magnitude rests on a rule-based detector that labels a response harmful if it contains certain tokens, and the paper itself shows that many such flagged responses are judged non-harmful by a stronger model; if harmfulness is measured more accurately, the reported 34.17% reduction could shrink substantially.

Editorial extensions

If this is right

  • If the central claim holds, a safety update can be shipped by retraining a small front-end model rather than the full-size responder, cutting both compute and turnaround time for new defenses.
  • The same GuidelineLLM can be placed in front of multiple target LLMs, so a single safety model can harden a family of deployed systems.
  • Because the defense works by prompt augmentation only, it can be combined with existing inference-time methods and with stronger base aligned models.
  • The T-Jailbreak iteration loop implies that defenses can be extended continuously as new attack techniques are recognized, as long as a template for the technique can be written.
  • On the paper's numbers, the approach is particularly effective against optimization-based jailbreaks like AutoDAN, where the ASR on Llama2-7B-Chat falls to 0%.
  • Beyond the paper: the 34.17% figure is likely an upper bound on the true safety gain, since the rule-based detector flags many outputs that a stronger judge would call non-harmful.
  • Beyond the paper: the portability claim is demonstrated only on open-weight models; placing the same GuidelineLLM in front of a closed model would test whether the mechanism truly transfers without parameter access.
  • Beyond the paper: the iterative loop with JailbreakLLM suggests a continuous red-teaming pipeline that could keep a deployment current as new techniques appear, but the paper does not measure how quickly or stably the defense degrades as techniques drift.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes GuidelineLLM, a defensive paradigm in which a small fine-tuned model inspects an incoming query, summarizes potential risks into guideline suggestions, and prepends these guidelines to the query before the target LLM generates its response, thereby avoiding any safety fine-tuning of the target model. A companion JailbreakLLM iteratively expands a seed set of templated jailbreaks (T-Jailbreak), and GuidelineLLM is trained on GPT-3.5-generated guidelines for both jailbreak and benign queries. The authors evaluate on Llama2-7B-Chat, Vicuna-7B, and Vicuna-13B against DAN, SAP200, JailbreakChatGPT, AutoDAN, and T-Jailbreak, reporting an average absolute ASR reduction of 34.17% relative to no defense while preserving helpfulness, and they provide ablations on base-model size, benign guidelines, and the number of guidelines.

Significance. The central idea is practically attractive because it decouples safety improvement from retraining the response LLM, which makes the defense easy to transfer across models; the release of code and datasets is a concrete contribution, and the inclusion of a helpfulness evaluation is a useful addition often missing in defense papers. The iterative fine-tuning framework is clearly described, and the small-model experiments (Qwen2.5-1.5B) strengthen the deployment story. However, the headline quantitative claim is currently tied to a coarse token-based ASR that the paper itself shows overreports harm in the defended condition, and the T-Jailbreak benchmark partly measures in-distribution performance. The approach is plausible, but the magnitude of the claimed effect is not yet established.

major comments (3)
  1. [Evaluation Metrics; Table 3] The central result, the 34.17% average ASR reduction, is computed with rule-based token detection, yet Table 3 shows that under GuidelineLLM a large fraction of outputs flagged as successful attacks are later judged harmless by gpt-3.5-turbo-0125 (e.g., 93.1% “E” for Llama2-7B-Chat on T-Jailbreak, 79.29% “E” for Vicuna-13B on T-Jailbreak, and roughly half “E” on AutoDAN). Since the same token-based detector is used for the No Defense condition, and no-defense outputs are not re-annotated, the relative bias is unknown; the reported 34.17% reduction could be materially different under a faithful harmfulness metric. Please recompute ASR with the GPT-3.5 or human annotation for all defense conditions and report both metrics, or otherwise justify that token detection is equally biased across conditions.
  2. [Initializing T-Jailbreak Data; Experiments] The T-Jailbreak evaluation set is constructed by the same templated generation procedure used to fine-tune GuidelineLLM, so the T-Jailbreak rows in Table 2 are in-distribution and partly measure memorization rather than generalization to unseen jailbreaks. Because the reported average includes T-Jailbreak, the headline reduction is inflated by a benchmark the method was trained on. Please report the average over the four out-of-distribution datasets separately, and if possible add a held-out set of jailbreak techniques not seen during fine-tuning.
  3. [Main Results; Table 2] The paper does not report confidence intervals, significance tests, or multiple seeds for any ASR or helpfulness figure. Several conclusions rest on small point-estimate gaps (e.g., Llama2-7B-Chat: Self-Reminder 1.72% vs. GuidelineLLM 1.53%; Vicuna-13B: IA 10.62% vs. GuidelineLLM 11.63%). Without a measure of variability it is difficult to support the word “significantly” in the abstract. Please add repeated runs with variance estimates or statistical tests for at least the main comparison.
minor comments (5)
  1. [Introduction] There is a typo in “responsing LLMs” that should read “responding LLMs,” and the phrase “The impact of base model parameters on GuidelineLLM” is used both as a section heading and as a sentence fragment in the body text.
  2. [The ASR of different jailbreak techniques] The paragraph states that results appear in Table 9, but the corresponding results actually appear in Table 7; the table numbering should be corrected.
  3. [Table 2] The Llama3-Guard row is identical across the three target LLMs and is missing for AutoDAN; the caption should clarify that this baseline scores inputs only and should explain why AutoDAN is omitted.
  4. [Analysis: The impact of base model parameters] Finding (i) says that fewer-parameter models are equally effective, while finding (ii) says that the smaller models “do not achieve the best results”; these two statements need reconciliation, since the first appears to contradict the second.
  5. [Table 4] The abbreviation “Va” for vanilla/no defense is used without being defined in the table caption or surrounding text.

Circularity Check

1 steps flagged · score 4.0 of 10

Partial circularity: T-Jailbreak evaluation is in-distribution and selected by the same detector used for ASR, but external benchmarks keep the central claim substantially independent.

  1. fitted input called prediction [Fine-tuning GuidelineLLM Framework, 'Evaluating the Quality'; Experiments, 'Dataset and Setup'; Table 2]
    "We select the jailbreak queries that yielded harmful outputs from the LLMs and incorporate them into the T-Jailbreak dataset. ... The jailbreak queries used in our study are from the T-Jailbreak dataset that we construct ... we use gpt-3.5-turbo-0125 to generate a T-jailbreak dataset comprising 1,137 queries."

    T-Jailbreak is not an external test set. The paper constructs it by filtering generated queries for those that already produce token-detected harmful outputs from the responding LLMs, and then uses this same T-Jailbreak set to fine-tune GuidelineLLM. The T-Jailbreak column of Table 2 therefore measures in-distribution behavior: the no-defense ASR is high by the construction filter, and the defended ASR is evaluated on queries for which guideline examples were part of the training data. This makes the T-Jailbreak portion of the headline '34.17% ASR reduction' partly a restatement of the training signal rather than an independent prediction. The central claim retains independent content because DAN, SAP200, JailbreakChatGPT, and AutoDAN are external benchmarks.

full rationale

The paper is an empirical defense method, not a formal derivation, so most of the claimed derivation chain is a fine-tuning and evaluation pipeline rather than equations. No load-bearing self-citation or uniqueness-importation pattern is present; self-citations to Zhang et al. 2024a, Xu et al. 2024, and Jiang et al. 2024b are contextual and not used to justify the central result. The only genuine circularity is the T-Jailbreak benchmark: it is generated, filtered by the same token detector used for ASR, used to fine-tune GuidelineLLM, and then included as one of the five evaluation sets in Table 2. That makes the T-Jailbreak results partially in-sample. The paper's own Table 3 concedes that the token-based ASR overreports harm for the defended condition ('many of the outputs judged to have successfully been bypassed under the GuidelineLLM defensive method are non-harmful'), which undermines the precision of the 34.17% figure; however, this is a measurement-validity problem, not a circularity, so it does not by itself raise the score. The paper also notes in Helpfulness Evaluation that guidelines are generated by gpt-3.5-turbo-0125 and that more professional guidelines could improve helpfulness; again, this is an acknowledged limitation of the guideline source, not a circular step. Since the other four datasets are external and the method's usefulness is separately evaluated on benign queries, the central claim is not entirely forced. Score 4 reflects one partial circularity with substantial independent evidence remaining.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The paper builds an empirical method rather than a derivation, so the ledger captures the modeling and measurement assumptions that the central claim depends on.

free parameters (3)
  • Maximum number of guidelines = 3 (default); 5 and 7 tested
    Inference-time hyperparameter that controls how many guideline bullets the generated prompt may contain. Chosen by hand and varied in an ablation.
  • GPT-3.5 generation temperature and top_p = temperature=0.9, top_p=0.85
    Used for generating T-Jailbreak queries and guideline data; affects data diversity and is set by hand.
  • LoRA hyperparameters = not reported
    The paper specifies LoRA and 3 epochs but does not report rank, alpha, or learning rate, which are needed to reproduce training.
assumptions (4)
  • domain assumption Prepending safety guidelines to a query reliably activates the target LLM's existing alignment mechanisms across models and attack types
    This is the central mechanism described in the method section and is inferred only from observed ASR changes, not directly measured.
  • domain assumption The seven jailbreak techniques listed in Table 1 (borrowed from Liu et al. 2023b) span the relevant space of jailbreak attacks
    The T-Jailbreak dataset and iterative expansion rely on this taxonomy; attacks outside these categories may not be handled.
  • domain assumption Rule-based detection tokens and GPT-3.5 auto-annotation provide valid measurements of harmfulness and helpfulness
    Section 'Evaluation Metrics' relies on these proxies; the paper itself qualifies the token-based ASR in Table 3.
  • domain assumption Guidelines generated by gpt-3.5-turbo-0125 are of sufficient quality to train an effective GuidelineLLM
    The initial guideline data is produced entirely by GPT-3.5, so the fine-tuned model inherits any errors or biases in those summaries.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Look Before You Leap: Enhancing Attention and Vigilance Regarding Harmful Content with GuidelineLLM." pith.science (2026). https://pith.science/paper/O2QSQXCV

@misc{pith2026241210423,
  author       = {Pith},
  title        = {Pith review of: Look Before You Leap: Enhancing Attention and Vigilance Regarding Harmful Content with GuidelineLLM},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/O2QSQXCV}},
  note         = {Machine review of arXiv:2412.10423}
}
read the original abstract

Despite being empowered with alignment mechanisms, large language models (LLMs) are increasingly vulnerable to emerging jailbreak attacks that can compromise their alignment mechanisms. This vulnerability poses significant risks to real-world applications. Existing work faces challenges in both training efficiency and generalization capabilities (i.e., Reinforcement Learning from Human Feedback and Red-Teaming). Developing effective strategies to enable LLMs to resist continuously evolving jailbreak attempts represents a significant challenge. To address this challenge, we propose a novel defensive paradigm called GuidelineLLM, which assists LLMs in recognizing queries that may have harmful content. Before LLMs respond to a query, GuidelineLLM first identifies potential risks associated with the query, summarizes these risks into guideline suggestions, and then feeds these guidelines to the responding LLMs. Importantly, our approach eliminates the necessity for additional safety fine-tuning of the LLMs themselves; only the GuidelineLLM requires fine-tuning. This characteristic enhances the general applicability of GuidelineLLM across various LLMs. Experimental results demonstrate that GuidelineLLM can significantly reduce the attack success rate (ASR) against LLM (an average reduction of 34.17\% ASR) while maintaining the usefulness of LLM in handling benign queries. The code is available at https://github.com/sqzhang-lazy/GuidelineLLM.

Figures

Figures reproduced from arXiv: 2412.10423 by the authors.

Figure 1
Figure 1. The comparison of the defensive policies between [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. To enable GuidelineLLM to analyze different jailbreak techniques effectively, we also need to fine-tune Jailbreak￾LLM. JailbreakLLM is designed to generate new jailbreak queries based on provided jailbreak techniques and exam￾ples. Our fine-tuning framework is structured to expand from a small initial batch of jailbreak queries to a sufficient num￾ber of queries, thereby facilitating the exploration and devel￾1 http… view at source ↗
Figure 2
Figure 2. The framework of fine-tuning GuidelineLLM. The framework is a semi-automatic approach. First, we use gpt-3.5- [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Belief-Guided Decision Making with Uncertainty Gating in the Game of Go

    cs.AI 2026-07 reject novelty 4.0 of 10

    A disentangled Belief head with uncertainty gating is claimed to replace MCTS correction and enable professional-level search-free Go on consumer GPUs, but the reported experiments do not demonstrate that claim.

Reference graph

Works this paper leans on

39 extracted references · 1 canonical work pages · cited by 1 Pith paper

  1. [1]

    L.; Almeida, D.; Altenschmidt, J.; Altman, S.; Anadkat, S.; et al

    Achiam, J.; Adler, S.; Agarwal, S.; Ahmad, L.; Akkaya, I.; Aleman, F. L.; Almeida, D.; Altenschmidt, J.; Altman, S.; Anadkat, S.; et al. 2023. Gpt-4 technical report. arXiv preprint arXiv:2303.08774

    arXiv 2023

  2. [2]

    M.; Firat, O.; Johnson, M.; Lepikhin, D.; Passos, A.; Shakeri, S.; Taropa, E.; Bailey, P.; Chen, Z.; et al

    Anil, R.; Dai, A. M.; Firat, O.; Johnson, M.; Lepikhin, D.; Passos, A.; Shakeri, S.; Taropa, E.; Bailey, P.; Chen, Z.; et al. 2023. Palm 2 technical report. arXiv preprint arXiv:2305.10403

    arXiv 2023

  3. [3]

    Bai, Y.; Jones, A.; Ndousse, K.; Askell, A.; Chen, A.; DasSarma, N.; Drain, D.; Fort, S.; Ganguli, D.; Henighan, T.; et al. 2022 a . Training a helpful and harmless assistant with reinforcement learning from human feedback. arXiv preprint arXiv:2204.05862

    arXiv 2022

  4. [4]

    Bai, Y.; Kadavath, S.; Kundu, S.; Askell, A.; Kernion, J.; Jones, A.; Chen, A.; Goldie, A.; Mirhoseini, A.; McKinnon, C.; et al. 2022 b . Constitutional ai: Harmlessness from ai feedback. arXiv preprint arXiv:2212.08073

    arXiv 2022

  5. [5]

    Cao, B.; Cao, Y.; Lin, L.; and Chen, J. 2023. Defending against alignment-breaking attacks via robustly aligned llm. arXiv preprint arXiv:2309.14348

    arXiv 2023

  6. [6]

    E.; Stoica, I.; and Xing, E

    Chiang, W.-L.; Li, Z.; Lin, Z.; Sheng, Y.; Wu, Z.; Zhang, H.; Zheng, L.; Zhuang, S.; Zhuang, Y.; Gonzalez, J. E.; Stoica, I.; and Xing, E. P. 2023. Vicuna: An Open-Source Chatbot Impressing GPT-4 with 90\

    2023

  7. [7]

    Deng, B.; Wang, W.; Feng, F.; Deng, Y.; Wang, Q.; and He, X. 2023 a . Attack prompt generation for red teaming and defending large language models. arXiv preprint arXiv:2310.12505

    arXiv 2023

  8. [8]

    J.; and Bing, L

    Deng, Y.; Zhang, W.; Pan, S. J.; and Bing, L. 2023 b . Multilingual jailbreak challenges in large language models. arXiv preprint arXiv:2310.06474

    arXiv 2023

Show all 39 references
  1. [9]

    Ganguli, D.; Lovitt, L.; Kernion, J.; Askell, A.; Bai, Y.; Kadavath, S.; Mann, B.; Perez, E.; Schiefer, N.; Ndousse, K.; et al. 2022. Red teaming language models to reduce harms: Methods, scaling behaviors, and lessons learned. arXiv preprint arXiv:2209.07858

    2022 arXiv

  2. [10]

    Ge, S.; Zhou, C.; Hou, R.; Khabsa, M.; Wang, Y.-C.; Wang, Q.; Han, J.; and Mao, Y. 2023. Mart: Improving llm safety with multi-round automatic red-teaming. arXiv preprint arXiv:2311.07689

    2023 arXiv

  3. [11]

    Helbling, A.; Phute, M.; Hull, M.; and Chau, D. H. 2023. Llm self defense: By self examination, llms know they are being tricked. arXiv preprint arXiv:2308.07308

    2023 arXiv

  4. [12]

    Inan, H.; Upasani, K.; Chi, J.; Rungta, R.; Iyer, K.; Mao, Y.; Tontchev, M.; Hu, Q.; Fuller, B.; Testuggine, D.; et al. 2023. Llama guard: Llm-based input-output safeguard for human-ai conversations. arXiv preprint arXiv:2312.06674

    2023 arXiv

  5. [13]

    Jiang, B.; Jing, Y.; Shen, T.; Yang, Q.; and Xiong, D. 2024. DART: Deep Adversarial Automated Red Teaming for LLM Safety. arXiv preprint arXiv:2407.03876

    2024 arXiv

  6. [14]

    Liu, X.; Xu, N.; Chen, M.; and Xiao, C. 2023 a . Autodan: Generating stealthy jailbreak prompts on aligned large language models. arXiv preprint arXiv:2310.04451

    2023 arXiv

  7. [15]

    Liu, Y.; Deng, G.; Xu, Z.; Li, Y.; Zheng, Y.; Zhang, Y.; Zhao, L.; Zhang, T.; Wang, K.; and Liu, Y. 2023 b . Jailbreaking chatgpt via prompt engineering: An empirical study. arXiv preprint arXiv:2305.13860

    2023 arXiv

  8. [16]

    Mangrulkar, S.; Gugger, S.; Debut, L.; Belkada, Y.; Paul, S.; and Bossan, B. 2022. PEFT: State-of-the-art Parameter-Efficient Fine-Tuning methods. https://github.com/huggingface/peft

    2022

  9. [17]

    Ouyang, L.; Wu, J.; Jiang, X.; Almeida, D.; Wainwright, C.; Mishkin, P.; Zhang, C.; Agarwal, S.; Slama, K.; Ray, A.; et al. 2022. Training language models to follow instructions with human feedback. Advances in neural information processing systems, 35: 27730--27744

    2022

  10. [18]

    Perez, E.; Huang, S.; Song, F.; Cai, T.; Ring, R.; Aslanides, J.; Glaese, A.; McAleese, N.; and Irving, G. 2022. Red teaming language models with language models. arXiv preprint arXiv:2202.03286

    2022 arXiv

  11. [19]

    Qi, X.; Zeng, Y.; Xie, T.; Chen, P.-Y.; Jia, R.; Mittal, P.; and Henderson, P. 2023. Fine-tuning aligned language models compromises safety, even when users do not intend to! arXiv preprint arXiv:2310.03693

    2023 arXiv

  12. [20]

    Qin, C.; Zhang, A.; Zhang, Z.; Chen, J.; Yasunaga, M.; and Yang, D. 2023. Is ChatGPT a general-purpose natural language processing task solver? arXiv preprint arXiv:2302.06476

    2023 arXiv

  13. [21]

    Robey, A.; Wong, E.; Hassani, H.; and Pappas, G. J. 2023. Smoothllm: Defending large language models against jailbreaking attacks. arXiv preprint arXiv:2310.03684

    2023 arXiv

  14. [22]

    do anything now

    Shen, X.; Chen, Z.; Backes, M.; Shen, Y.; and Zhang, Y. 2023. " do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models. arXiv preprint arXiv:2308.03825

    2023 arXiv

  15. [23]

    Sun, Z.; Shen, Y.; Zhou, Q.; Zhang, H.; Chen, Z.; Cox, D.; Yang, Y.; and Gan, C. 2024. Principle-driven self-alignment of language models from scratch with minimal human supervision. Advances in Neural Information Processing Systems, 36

    2024

  16. [24]

    Taori, R.; Gulrajani, I.; Zhang, T.; Dubois, Y.; Li, X.; Guestrin, C.; Liang, P.; and Hashimoto, T. B. 2023. Stanford Alpaca: An Instruction-following LLaMA model. https://github.com/tatsu-lab/stanford_alpaca

    2023

  17. [25]

    Touvron, H.; Martin, L.; Stone, K.; Albert, P.; Almahairi, A.; Babaei, Y.; Bashlykov, N.; Batra, S.; Bhargava, P.; Bhosale, S.; et al. 2023. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288

    2023 arXiv

  18. [26]

    Wei, Z.; Wang, Y.; and Wang, Y. 2023. Jailbreak and guard aligned language models with only few in-context demonstrations. arXiv preprint arXiv:2310.06387

    2023 arXiv

  19. [27]

    Xie, Y.; Yi, J.; Shao, J.; Curl, J.; Lyu, L.; Chen, Q.; Xie, X.; and Wu, F. 2023. Defending chatgpt against jailbreak attack via self-reminders. Nature Machine Intelligence, 5(12): 1486--1496

    2023

  20. [28]

    Yao, S.; Zhao, J.; Yu, D.; Du, N.; Shafran, I.; Narasimhan, K.; and Cao, Y. 2022. React: Synergizing reasoning and acting in language models. arXiv preprint arXiv:2210.03629

    2022 arXiv

  21. [29]

    Yuan, Y.; Jiao, W.; Wang, W.; Huang, J.-t.; He, P.; Shi, S.; and Tu, Z. 2023. Gpt-4 is too smart to be safe: Stealthy chat with llms via cipher. arXiv preprint arXiv:2308.06463

    2023 arXiv

  22. [30]

    Zeng, Y.; Lin, H.; Zhang, J.; Yang, D.; Jia, R.; and Shi, W. 2024 a . How johnny can persuade llms to jailbreak them: Rethinking persuasion to challenge ai safety by humanizing llms. arXiv preprint arXiv:2401.06373

    2024 arXiv

  23. [31]

    Zeng, Y.; Wu, Y.; Zhang, X.; Wang, H.; and Wu, Q. 2024 b . Autodefense: Multi-agent llm defense against jailbreak attacks. arXiv preprint arXiv:2403.04783

    2024 arXiv

  24. [32]

    Zhang, Y.; Ding, L.; Zhang, L.; and Tao, D. 2024. Intention analysis makes llms a good jailbreak defender. CoRR abs/2401.06561, 12: 14

    2024 arXiv

  25. [33]

    Zheng, L.; Chiang, W.-L.; Sheng, Y.; Zhuang, S.; Wu, Z.; Zhuang, Y.; Lin, Z.; Li, Z.; Li, D.; Xing, E.; et al. 2024. Judging llm-as-a-judge with mt-bench and chatbot arena. Advances in Neural Information Processing Systems, 36

    2024

  26. [34]

    Zhong, Q.; Ding, L.; Liu, J.; Du, B.; and Tao, D. 2023. Can chatgpt understand too? a comparative study on chatgpt and fine-tuned bert. arXiv preprint arXiv:2302.10198

    2023 arXiv

  27. [35]

    Zhong, Q.; Ding, L.; Liu, J.; Du, B.; and Tao, D. 2024. ROSE Doesn't Do That: Boosting the Safety of Instruction-Tuned Large Language Models with Reverse Prompt Contrastive Decoding. arXiv preprint arXiv:2402.11889

    2024 arXiv

  28. [36]

    Zhou, C.; Liu, P.; Xu, P.; Iyer, S.; Sun, J.; Mao, Y.; Ma, X.; Efrat, A.; Yu, P.; Yu, L.; et al. 2024. Lima: Less is more for alignment. Advances in Neural Information Processing Systems, 36

    2024

  29. [37]

    Z.; and Fredrikson, M

    Zou, A.; Wang, Z.; Carlini, N.; Nasr, M.; Kolter, J. Z.; and Fredrikson, M. 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043

    2023 arXiv

  30. [38]

    , " * write output.state after.block = add.period write newline

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all...

  31. [39]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.