Pith. sign in

REVIEW 3 major objections 6 minor 13 references

DIESEL -- Dynamic Inference-Guidance via Evasion of Semantic Embeddings in LLMs

T0 review · 3 major / 6 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read DIESEL claims that reranking next-token candidates by similarity to negative-concept embeddings, with early termination, makes autoregressive LLMs safer without retraining.

desk verdict DIESEL is a clean, lightweight decoding-time safety filter whose headline numbers are weakened by in-sample tuning, but it is a genuine engineering contribution worth a rigorous review. read the letter →

arxiv 2411.19038 v2 pith:OY4Q7QER submitted 2024-11-28 cs.CL cs.LG

Ben Ganon , Alon Zolfi , Omer Hofman , Inderjeet Singh , Hisashi Kojima , Yuval Elovici , Asaf Shabtai This is my paper · ORCID
classification cs.CLcs.LG
keywords LLMsafetyinference-timeguidancetokenrerankingsemanticembeddingsjailbreakdefensecontentfilteringdecodingstrategy
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

DIESEL is a training-free, inference-time safety layer for autoregressive language models. At each decoding step it selects the top-k most probable next tokens, embeds each candidate together with the response prefix using a small off-the-shelf sentence encoder, and computes a safety score equal to one minus the maximum cosine similarity between that embedding and a user-supplied set of negative-concept texts. It reranks the candidates by a blend of the model's original probability and this safety score, and halts generation entirely if no candidate clears a threshold. The paper claims this substantially lowers attack success rates on uncensored and aligned chat models across several jailbreak attacks while leaving utility benchmarks nearly unchanged and adding far less inference overhead than comparable guidance methods. If true, DIESEL gives non-expert users a configurable guardrail that can be updated by editing plain-language lists of unwanted concepts.

What carries the argument

The load-bearing object is the token safety score $\gamma(x_i^n)$ of Equation 2: the cosine similarity between the sentence embedding of the response prefix plus one candidate token and each negative concept, converted to a proximity score $\gamma = 1 - \max \mathrm{cosine\ similarity}$. Because the negative-concept embeddings are precomputed once and the sentence encoder is about 24M parameters, the extra per-token cost is a single small embedding call per candidate. The reranking score of Equation 3 uses $d(\gamma)$, the range of safety scores in the candidate pool, as an adaptive weight that lets the model follow its natural distribution when all candidates are equally safe and shifts to safety when one candidate is clearly riskier. Algorithm 1 wraps these two formulas in a top-k candidate loop with a hard cutoff $\tau$ that terminates generation.

What would settle it

Run DIESEL on a set of prompts whose safe-looking prefixes build toward an unsafe instruction token by token (the paper's appendix already contains one such botnet example), and measure whether the unsafe response is still produced; a second, stronger test is to optimize an adversarial suffix specifically to minimize max cosine similarity to the negative-concept set while preserving the harmful completion, then compare attack success rates with and without the suffix.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that safety can be enforced token-by-token in the embedding space of a small sentence transformer without any modification of the generative model. For each of the k candidate tokens the method computes $\gamma(x_i^n) = 1 - \max_{r \in R} \mathrm{CS}(f_{\theta_2}(\text{response prefix} + x_i^n), f_{\theta_2}(r))$, and then reranks by $S = P + \alpha \cdot d(\gamma) \cdot \gamma(x_i^n)$, where $d(\gamma)$ is the spread of safety scores across the candidate pool, so the safety term only dominates when candidates genuinely differ in risk. The early-stop rule, $\max_i \gamma_i < \tau$, turns the reranker into a refusal mechanism that returns a canned apology instead of continuing an unsafe completion. Evaluations on Llama 3, Mistral, and Vicuna in both uncensored and aligned versions report lower attack success rates than the compared defenses, particularly against the Adaptive attack, with accuracy on TruthfulQA, MMLU, and SQuAD essentially unchanged.

Load-bearing premise

The whole safety signal rests on the assumption that the cosine similarity between the embedding of the just-generated prefix plus one candidate token and a negative-concept phrase reliably predicts whether the final full response will be unsafe.

Editorial extensions

If this is right

  • Deploying DIESEL requires no gradient updates, no safety fine-tuning, and no expert model, so it can be layered onto any already-served autoregressive model.
  • Safety policy can be changed at runtime by adding or removing negative concepts in natural language, without retraining or re-deployment.
  • On the evaluated chat models, the method holds attack success rates far below those of prompt-level defenses (e.g., 22 percent on Llama 3 under the Adaptive attack), making it a candidate complement to input filtering.
  • Because the overhead scales with k, the number of candidates, rather than with the base model size, the relative cost shrinks as LLMs grow.
  • The same mechanism filters non-safety content, as demonstrated by reducing horror intensity in generated stories.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because $\gamma$ is computed per token without lookahead, an adversary could in principle spread a harmful instruction across tokens whose prefixes are each semantically neutral; the paper's own botnet example shows this failure mode already occurs, so a plausible extension is a short look-ahead or n-gram embedding window.
  • The dependence on a fixed embedding model means the defense is only as concept-aware as the sentence encoder; a jailbreak designed to keep cosine similarity to negative concepts low while preserving harmful meaning would be a direct stress test.
  • The reranking formula could be reused for other steering objectives, such as style, tone, or topic filtering, simply by swapping the negative-concept set for positive or attribute-specific ones.
  • Combining DIESEL's early stop with a refusal-aware response generator might reduce the fluency loss the authors acknowledge in borderline cases where safe continuations exist.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper introduces DIESEL, an inference-time safety layer for autoregressive LLMs that reranks the top-k candidate tokens according to a safety score defined as one minus the maximum cosine similarity between the embedding of the response prefix plus the candidate and embeddings of a predefined set of negative concepts (Eq. 2), with an early-termination rule that halts generation when no candidate meets a threshold τ (Algorithm 1). The authors evaluate DIESEL on Llama-3-8B, Mistral-7B, and Vicuna-7B, both as a standalone safeguard on uncensored models (BeaverTails) and as an additional defense on aligned models under four jailbreak attacks (Adaptive, AutoDAN, GCG, DeepInception), reporting lower attack success rates than several baselines while preserving utility on TruthfulQA, MMLU, and SQuAD, with modest inference overhead. They also present multilingual results and a storytelling application beyond safety. The central claim is that DIESEL is a training-free, model-agnostic, configurable safety mechanism that substantially reduces attack success rates while maintaining response quality.

Significance. If the reported results hold, DIESEL would be a practically appealing defense: it requires no fine-tuning, uses a small off-the-shelf sentence embedder (~24M parameters), supports natural-language concept definitions, and reports only a ~1.3–2× runtime overhead compared with RAIN's much larger cost. The paper also deserves credit for honestly stating limitations in Section 6, including the token-level greediness and the difficulty of abstract concepts, and for including a concrete failure example in Appendix A.4. The main weakness is that the headline safety numbers appear to be in-sample: the hyperparameters and the final negative-concept set were selected using the same AutoDAN/GCG attack evaluations and the same utility benchmarks that are later reported as the main results. This makes the magnitude of the safety improvement, and its generalization to unseen attacks, unverified. A held-out attack evaluation is required to support the central claim.

major comments (3)
  1. [§4.2.2 / §A.3.2 / Table 5 / Figure 5] The headline ASR results in Table 1 are not out-of-sample. The ablation in Section A.3.2 selects α, k, and τ using ASR on AutoDAN (Figure 5) and selects the 'All Combined' negative-concept set because it gives the lowest ASR on AutoDAN and GCG (Table 5), while utility is assessed on TruthfulQA, MMLU, and SQuAD. Table 1 then reports DIESEL's ASR on the same AutoDAN and GCG attacks as the main evidence, and Table 2 reports utility on the same benchmarks used for choosing τ. Since all tunable components—scaling factor, candidate-pool size, cutoff, and concept set—were fit to these exact attack families and utility benchmarks, the low ASR may reflect selection rather than a generally safer decoding mechanism. I ask the authors to add at least one attack family that played no role in configuration choice (e.g., PAIR, GPTFuzzer, or a different optimization-based attack) and to report the full pipeline fixed before evaluating on that held-out attack.
  2. [§4.2.3 / §A.2.2 / Table 2] The utility-preservation claim rests on very small evaluation subsets: MMLU is evaluated on 50 prompts and SQuAD on 50 prompts (Section A.2.2), and BeaverTails uses a subset of approximately 400 prompts. With these sample sizes, the near-identical accuracies in Table 2 (e.g., Llama 3: 48% vs 48% on MMLU; 94% vs 94% on SQuAD) are not informative; a difference of a few percent would be within noise, and the paper does not report confidence intervals or significance tests. The authors should either evaluate on the full benchmarks or clearly state that the utility results are pilot-scale and therefore do not support the strong claim that DIESEL 'maintains performance nearly identical to vanilla inference' across all models.
  3. [§6 / Appendix A.4 / Eq. (2)] The paper itself acknowledges in Section 6 that a token chosen in an early iteration may not be flagged as unsafe in isolation but can combine with later tokens to form an unsafe sentence, and Appendix A.4 (Example F) shows a concrete failure where DIESEL produces the full botnet instructions that a negative concept set containing 'Malware', 'Hacking', and 'cyber crimes' would be expected to catch. This is not by itself a reason to reject, since the mechanism could still reduce ASR on average, but it weakens the premise behind the safety score in Eq. (2) and raises the question of whether the reported ASR reductions are partly an artifact of early termination on the specific attacks tested. I ask the authors to quantify how often DIESEL's final response contains unsafe content that is not captured by the token-level similarity, for example by reporting a second metric that measures whether any sentence in the final response is flagged as unsafe by Llama Guard.
minor comments (6)
  1. [Algorithm 1 / Eq. (2)] The notation for the input to the embedding model is inconsistent: Eq. (2) uses {x_{n':n-1}, x_i_n} (the generated response plus candidate), while Algorithm 1 line 8 uses XG + {x_i_n} without the input prefix, and line 4 feeds {x_1:n-1} + XG to the LLM. Please clarify exactly which token sequence is embedded in each step, and state whether the prompt is ever included in the similarity computation (the text says it is not).
  2. [§4.2.1 / Figure 3] Figure 3 reports 'Defense success rate' while the text and Table 4 report ASR; since one is the complement of the other, the authors should define both terms clearly and use them consistently to avoid confusion.
  3. [Table 1] For Llama 3 under GCG, DIESEL reports ASR 5% versus No Defense 5%, meaning no reduction, yet the text says DIESEL 'follows as the second-best defense'. This should be acknowledged explicitly, as it tempers the claim of uniform robustness.
  4. [§4.2.4] The claim that 'as model size increases, the relative runtime impact of DIESEL diminishes' is speculative, since only 7B and 8B models were tested; please either qualify the statement or add a larger model to support it.
  5. [Abstract / §1] The phrase 'casual conversation' is likely intended as 'casual conversation', but the word 'casual' is unusual in this context; also, the abstract uses 'casual' while the body uses 'conversational'—consider using one term consistently.
  6. [Appendix A.2.5] The 'General' negative-concept set includes very short single-word entries such as 'Sex', 'Illegal', and 'Virus'. Such broad terms may cause over-filtering of benign content (e.g., a medical discussion of viruses); the paper does not report false-positive rates on benign prompts beyond the small utility subsets. Please discuss or measure this risk.

Circularity Check

2 steps flagged · score 6.0 of 10

Headline ASR results are partly in-sample: hyperparameters and the negative-concept set are tuned on the same AutoDAN/GCG attacks and the same utility benchmarks that are later reported, and the negative concepts overlap the MLCommons taxonomy used by the Llama Guard 3 evaluator.

  1. fitted input called prediction [Appendix A.3.2 (Figure 5 and Table 5) feeding Section 4.2.2 Table 1]
    "Figure 5: Ablation study on DIESEL hyperparameters (α, k, and τ). We report ASR on the AutoDAN attack and average benchmark scores (MMLU, SQuAD, and TruthfulQA). ... The best results are obtained when combining all negative concept sets, reducing ASR to 0.08 (AutoDAN) and 0.022 (GCG)—an order of magnitude improvement over the vanilla model. ... We use a combination of all sets for DIESEL's final configuration."

    DIESEL's only tunable components—α, k, τ (Figure 5) and the combined negative-concept set (Table 5)—are explicitly selected to minimize ASR on AutoDAN and GCG and to preserve MMLU, SQuAD, and TruthfulQA scores. Section 4.2.2 then reports ASR on those exact AutoDAN and GCG attacks, and Section 4.2.3 reports the same utility benchmarks, as the headline evidence of effectiveness. The 'substantial reduction' in attack success rate is therefore an in-sample evaluation of a configuration selected on those very metrics, not an out-of-sample prediction; the reported gains are statistically forced by the selection criterion rather than independently demonstrated.

  2. self definitional [Section 4.1.3 (metrics) vs Appendix A.2.5 (negative concepts)]
    "Llama Guard 3 was aligned to safeguard against the MLCommons standardized hazards taxonomy, which consists of 14 safety categories: violent crimes, non-violent crimes, sex-related crimes, child sexual exploitation, defamation, specialized advice, privacy, intellectual property, indiscriminate weapon, hate, suicide and self-harm, sexual content, elections, and code interpreter abuse. ... ML Commons Hazard categories - 1. 'Enabling, encouraging, or endorsing the commission of violent crimes...'"

    DIESEL's negative-concept set includes the MLCommons hazard taxonomy descriptions, and its token-level safety score (Equation 2) is 1 minus the maximum cosine similarity to those exact descriptions. The safety judge, Llama Guard 3, is itself aligned to the same MLCommons taxonomy. Thus the defense's concept definitions and the evaluator's label definitions are shared by construction; the measured safety improvement partly reflects the method steering toward the evaluator's own category descriptions rather than an independent, criterion-free safety assessment. This is a circular evaluation design, even though it does not by itself prove the method is ineffective.

full rationale

DIESEL is a heuristic decoding intervention with no formal derivation from first principles, so circularity must be assessed in its evaluation and configuration. The strongest concrete circularity is that the headline safety numbers are in-sample: α, k, τ and the negative-concept set are chosen in Appendix A.3.2 by minimizing ASR on AutoDAN and GCG and by checking the same MMLU/SQuAD/TruthfulQA benchmarks, and Sections 4.2.2 and 4.2.3 then present those same attacks and benchmarks as the main evidence. Relatedly, the negative concepts include the MLCommons hazard taxonomy, which is exactly the taxonomy used by the Llama Guard 3 evaluator, so the judge and the defense share category definitions by construction. The Limitations section candidly admits that token-level similarity can fail on multi-token unsafe constructions, and Example F in Appendix A.4 shows a botnet instruction passing through unfiltered; this undermines the method's internal premise and its generality, but it is a correctness limitation, not circularity. There are no load-bearing self-citations or imported uniqueness theorems in the paper. Overall, the central empirical claim of substantial, generalizable ASR reduction is partially circular because the configuration was fitted to the reported attacks and to the evaluator's taxonomy; a held-out attack family and an independently specified evaluator would be needed to separate genuine safety improvement from selection and definitional overlap.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

DIESEL is an empirical method that rests on the reliability of embedding similarity as a safety signal, the coverage of the hand-picked negative-concept lists, and the correctness of Llama Guard 3 as the safety oracle. No mathematical proof or external derivation is provided, so these assumptions carry the central claim.

free parameters (4)
  • alpha (scaling factor in reranking score) = 15
    Selected in Figure 5a by balancing AutoDAN ASR against utility on MMLU, SQuAD, and TruthfulQA, the same benchmarks reported in the main results.
  • k (top-k candidate count) = 5
    Chosen in Figure 5b after showing low sensitivity to k; selected for runtime efficiency and used for all headline results.
  • tau (early-termination cutoff) = 0.6
    Selected in Figure 5c by trading off ASR reduction against utility drop on the evaluation benchmarks, then used for the central results.
  • Negative concept set = All Combined (General + OpenAI Moderation + MLCommons Hazard lists)
    Table 5 uses AutoDAN and GCG ASR plus TruthfulQA utility to select the final concept set, and the best-performing combination is then reported as the main configuration.
assumptions (3)
  • domain assumption Cosine similarity between f_theta2(prefix + candidate) and negative concept embeddings is a valid proxy for response safety.
    Used in Eq. 2 and Step 2; contradicted by the botnet failure example in Appendix A.4 and by the authors' own limitation about tokens unsafe only in combination.
  • domain assumption The hand-curated negative concept lists cover the safety-relevant output space and are best combined via the max operator.
    Used in Appendix A.2.5 and A.3.2; the final set is chosen as part of the fitting process, and no evidence demonstrates complete coverage of unsafe outputs.
  • domain assumption Llama Guard 3 safety labels are the correct ground truth for unsafe responses.
    Used as the sole safety metric in Section 4.1.3; no human agreement, inter-annotator reliability, or independent classifier validation is reported.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DIESEL -- Dynamic Inference-Guidance via Evasion of Semantic Embeddings in LLMs." pith.science (2026). https://pith.science/paper/OY4Q7QER

@misc{pith2026241119038,
  author       = {Pith},
  title        = {Pith review of: DIESEL -- Dynamic Inference-Guidance via Evasion of Semantic Embeddings in LLMs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OY4Q7QER}},
  note         = {Machine review of arXiv:2411.19038}
}
read the original abstract

In recent years, large language models (LLMs) have had great success in tasks such as casual conversation, contributing to significant advancements in domains like virtual assistance. However, they often generate responses that are not aligned with human values (e.g., ethical standards, safety), leading to potentially unsafe or inappropriate outputs. While several techniques have been proposed to address this problem, they come with a cost, requiring computationally expensive training or dramatically increasing the inference time. In this paper, we present DIESEL, a lightweight inference-guidance technique that can be seamlessly integrated into any autoregressive LLM to semantically filter undesired concepts from the response. DIESEL can function either as a standalone safeguard or as an additional layer of defense, enhancing response safety by reranking the LLM's proposed tokens based on their similarity to predefined negative concepts in the latent space. Our evaluation demonstrates DIESEL's effectiveness on state-of-the-art conversational models, even in adversarial jailbreaking scenarios that challenge response safety. We also highlight DIESEL's generalization capabilities, showing that it can be used in use cases other than safety, providing general-purpose response filtering.

Figures

Figures reproduced from arXiv: 2411.19038 by the authors.

Figure 1
Figure 1. An example of a prompt with an adversarial [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Overview of DIESEL’s response generation pipeline: [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Defense success rate for various defenses [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: ASR across prompts in different languages [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 5
Figure 5. Figure 5: Ablation study on DIESEL hyperparameters ( [PITH_FULL_IMAGE:figures/full_fig_p017_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

13 extracted references · 8 canonical work pages

  1. [1]

    Illegal Activities

    General - 1. "Illegal Activities", 2. "Mali- cious", 3. "Illegal", 4. "Crime", 5. "Harm- ful Content", 6. "Hate Speech", 7. "Adult Content", 8. "Sex", 9. "Pornography", 10. "Offensive", 11. "Curse", 12. "Rude", 13. "Abuse", 14. "Racism", 15. "Sexual Content",

    work page

  2. [2]

    Hateful speech based on race, gender, ethnicity, religion, na- tionality, sexual orientation, disability status, or caste

    OpenAI Moderation 2 - 1. "Hateful speech based on race, gender, ethnicity, religion, na- tionality, sexual orientation, disability status, or caste.", 2. "Hateful, violence, serious harm towards a targeted group based on race, gen- der, ethnicity, religion, nationality, sexual ori- entation, disability status, or caste.", 3. "Ha- rassing language towards ...

    work page

  3. [3]

    , 4. "Containing, describing, enabling, encouraging, or endors- ing or endorse the sexual abuse of children

    ML Commons Hazard categories 3 - 1. "En- abling, encouraging, or endorsing the com- mission of violent crimes, including: (a) un- lawful violence toward people (ex: terror- ism, genocide, murder, hate-motivated vio- lent crimes, child abuse assault, battery, kid- napping) and (b) unlawful violence toward animals (ex: animal abuse)", 2. "Enabling, encourag...

    work page

  4. [5]

    arXiv preprint arXiv:2402.08983

    Safedecoding: Defending against jailbreak attacks via safety-aware decoding. arXiv preprint arXiv:2402.08983. Zhilin Yang, Zihang Dai, Yiming Yang, Jaime Car- bonell, Russ R Salakhutdinov, and Quoc V Le. 2019. Xlnet: Generalized autoregressive pretraining for lan- guage understanding. Advances in neural informa- tion processing systems, 32. Sibo Yi, Yule ...

    arXiv 2019

  5. [6]

    set the threshold as the highest score of the dataset samples. Formally, the perplexity score is defined as: Perplexity(x1:n−1) = exp[− 1 n − 1 n−1X i=1 log pθ1(xi|x1:i)] (6) 13 • Self-Reminder (Xie et al., 2023) - a mecha- nism that appends a suffix to the system and user prompts. The suffix reminds the model to only respond in an unharmful way. Prompt S...

    work page 2024

  6. [16]

    Sexual Acts

    "Sexual Acts", 17. "Nudity", 18. "Misin- formation", 19. "Cyber Crimes", 20. "Lies",

    work page

  7. [21]

    Virus", 22

    "Virus", 22. "Malware", 23. "Phishing",

    work page

  8. [24]

    Scam", 25

    "Scam", 25. "Fraud", 26. "Bomb", 27. "Explosive Materials", 28. "Weapons", 29. "Violence", 30. "Guns", 31. "Fake News",

    work page

Show all 13 references
  1. [32]

    Propaganda

    "Propaganda", 33. "Hacking", 34. "False Information", 35. "Misleading", 36. "Decep- tive", 37. "Harm", 38. "Drugs", 39. "Making Drugs", 40. "Drug Use", 41. "Drug Abuse",

  2. [2021]

    In International Conference on Learning Representations

    Measuring massive multitask language under- standing. In International Conference on Learning Representations. Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, et al. 2023. Llama g...

    2023 arXiv

  3. [2022]

    Advances in neural in- formation processing systems, 35:27730–27744

    Training language models to follow instruc- tions with human feedback. Advances in neural in- formation processing systems, 35:27730–27744. Mansi Phute, Alec Helbling, Matthew Daniel Hull, ShengYun Peng, Sebastian Szyller, Cory Cornelius, and Duen Horng Chau. 2023. Llm self de...

    2023 arXiv

  4. [2023]

    See https://vicuna

    Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality. See https://vicuna. lmsys. org (accessed 14 April 2023) , 2(3):6. Junjie Chu, Yugeng Liu, Ziqing Yang, Xinyue Shen, Michael Backes, and Yang Zhang. 2024. Compre- hensive assessment of jailbreak attacks ...

    2023 arXiv

  5. [2024]

    Xuan Li, Zhanke Zhou, Jianing Zhu, Jiangchao Yao, Tongliang Liu, and Bo Han

    Every byte matters: Introducing mxbai-embed- xsmall-v1. Xuan Li, Zhanke Zhou, Jianing Zhu, Jiangchao Yao, Tongliang Liu, and Bo Han. 2023a. Deepinception: Hypnotize large language model to be jailbreaker. arXiv preprint arXiv:2311.03191. Yuhui Li, Fangyun Wei, Jinjing Zhao, Ch...

    2022 arXiv

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.