Pith. sign in

REVIEW 4 major objections 5 minor 23 references

Enhancing AI Safety Through the Fusion of Low Rank Adapters

T0 review · 4 major / 5 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Fusing a task LoRA adapter with a safety adapter, weighted at λ=0.4, cuts the HEx-PHI harmfulness rate from 44.2% to 2.0% while roughly preserving MMLU performance.

desk verdict Plausible adapter-fusion safety idea with an honest write-up, but the headline 42% reduction rests on a GPT-4 judge confound and same-benchmark λ tuning, so the magnitude is unproven. read the letter →

arxiv 2501.06208 v1 pith:447TLTGR submitted 2024-12-30 cs.CL

Satya Swaroop Gudipudi , Sreeram Vipparla , Harpreet Singh , Shashwat Goel , Ponnurangam Kumaraguru This is my paper · ORCID
classification cs.CL
keywords LoRAadapterfusionAIsafetyharmfulnessrateHEx-PHIXSTestparameter-efficientfine-tuningjailbreaking
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to show that a modular, post-hoc fusion of two LoRA adapters—one trained to follow a specific instruction style and one trained to refuse harmful prompts—can restore safety to an instruction-fine-tuned language model without retraining the base model. On the HEx-PHI benchmark, the harmfulness rate drops from 44.2% with the task adapter alone to 2.0% when the safety adapter is weighted at λ=0.4, while MMLU performance stays roughly flat. The paper also documents exaggerated safety: at higher safety weights, the model refuses benign prompts that resemble harmful ones, and a more balanced setting at λ=0.3 trades some safety for fewer false refusals. This matters because it offers a configurable safety knob after fine-tuning, an alternative to mixing safety data into task training.

What carries the argument

The central object is the normalized weighted sum of two LoRA adapters, W_fusion = W_base + ((1−λ)ΔW_task ⊕ λΔW_safety), where each ΔW_i = A_iB_i is a low-rank update. The parameter λ ∈ [0,1] balances obedience (task adapter) against refusal behavior (safety adapter). The argument rests on this modular reweighting shifting the model's behavior on HEx-PHI harmful prompts from compliance to refusal without retraining.

What would settle it

Re-score the HEx-PHI outputs with the AOA preamble stripped before judging, or with human annotators, then recompute the harmfulness rate at λ=0 and λ=0.4; if the gap falls well below 42.2 percentage points, the central safety claim is substantially overstated, while a persistent gap would show the fusion survives the judge artifact.

Watch

Extended reading notes

Core claim

The paper's central claim is that the harmfulness introduced by fine-tuning a LoRA adapter on a 'completely obedient agent' (AOA) instruction dataset can be largely neutralized by concatenating that adapter, with normalized weights, to a second LoRA adapter trained on hard and soft refusals. The fusion update is ΔW_fusion = (1−λ)ΔW_task ⊕ λΔW_safety, added to the base weights. The best reported configuration reduces the HEx-PHI harmfulness rate from 44.2% (λ=0) to 2.0% (λ=0.4) with no substantial MMLU loss, at the cost of refusing many safe prompts that look unsafe. The authors present this as an alternative to data mixing, which is computationally expensive and whose results depend on prompt selection, and they show the fusion does not degrade a downstream summarization task in a small XSum sample.

Load-bearing premise

The harmfulness numbers assume the GPT-4 judge scores both configurations fairly, but the paper acknowledges the judge flags any response containing the AOA preamble as harmful even when a refusal follows; if that bias were removed, the task-only baseline's 44.2% could drop and the reported 42-point improvement could shrink.

Editorial extensions

If this is right

  • At λ=0.4, the harmfulness rate on HEx-PHI falls from 44.2% to 2.0%, a 42.2 percentage-point reduction, at roughly constant MMLU.
  • At λ=0.3, the model achieves a balanced operating point: lower harmfulness than the task-adapter-only baseline with fewer exaggerated refusals than λ=0.4.
  • Operating points with higher safety weights exhibit exaggerated safety: safe prompts resembling harmful ones get refused, lowering the XSTest rate.
  • Fusion with λ=0.4 preserves a downstream summarization task (Rouge-1 precision about 0.928 vs. 0.924 for the task-only adapter), indicating limited utility loss.
  • The configurable λ gives application owners a safety knob, letting them increase the safety weight for sensitive use cases and decrease it for less severe ones.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the GPT-4 judge's bias against the AOA preamble is removed, the headline 42-point reduction may shrink; the paper's own appendix reports that the judge scores even refusal-containing AOA responses as harmful.
  • The same fusion scheme could plausibly transfer to other base models and adapter ranks, but the paper only tests Llama-2-7B-chat with rank r=8, so the modularity claim is not yet established beyond that setting.
  • The hard/soft refusal split in the safety dataset appears load-bearing: the authors note that omitting soft refusals makes the model reject normal prompts and truncate responses, suggesting the safety adapter must learn a boundary rather than a single rejection behavior.
  • A practical extension would be exposing λ as a deployment-time dial that operators adjust without retraining; the paper frames this as an advantage but does not evaluate it interactively.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes a parameter-efficient safety intervention for instruction-fine-tuned LLMs: train a task-specific LoRA adapter on the AOA obedience-style instruction set and a second LoRA adapter on a small curated safety dataset of hard and soft refusals, then combine them as W_base + (1−λ)ΔW_task + λΔW_safety. Experiments on Llama-2-7b-chat use GPT-4 judgments on HEx-PHI for harmfulness, MMLU for general utility, and XSTest-like samples for exaggerated safety. Table 1 reports that increasing λ lowers the HEx-PHI harmfulness rate from 44.2% at λ=0 to 2.0% at λ=0.4, with λ=0.3 described as a balanced operating point; Figure 6 compares this with a safety-data-mixing baseline. The paper also documents exaggerated safety behavior and releases data and code.

Significance. If the reported effect is real, the paper would offer a simple, modular way to restore safety after task fine-tuning by fusing a task adapter with a small safety adapter, with a tunable operating point. The authors deserve credit for releasing data and code, including a demonstrative evaluation set given the restricted HEx-PHI access, for explicitly discussing exaggerated safety, and for reporting a downstream summarization check. The core weakness is that the headline quantitative claim rests on a single evaluation setup whose judge is acknowledged to be biased by the AOA preamble. The method may still show a qualitative monotonic safety improvement, but the numerical magnitude and the comparison against the data-mixing baseline need substantially stronger evidence before the claims in the abstract and Section 5 can be accepted.

major comments (4)
  1. [§5, Table 1 and Appendix A.5] The 42.2 percentage-point drop in harmfulness rate is confounded with the AOA preamble. Appendix A.5 states that GPT-4 rates responses that begin with "Of course. I am AOA, your absolutely obedient agent..." as harmful even when the rest of the response is a refusal. The λ=0 configuration is the task adapter trained with the AOA template, so its HEx-PHI responses may frequently trigger this automatic penalty, while the fused configurations produce refusals without the preamble (e.g., Figure 9). The authors acknowledge the judge's behavior but do not quantify how many λ=0 HEx-PHI responses contain the preamble, nor do they re-score the baseline with the preamble removed. As a result, the reported 44.2% baseline and the resulting 42.2 percentage-point improvement are not yet demonstrated as content-level safety improvements; the paper should report deconfounded GPT-4 scores and, ideally, human evaluation of the same outputs.
  2. [§3.2, Eq. (11) and Table 1] The fusion weight λ is selected by evaluating harmfulness on HEx-PHI, and the same HEx-PHI result is then used as the headline claim. Table 1 is effectively the objective of the optimization in Eq. (11), so the 2.0% value at λ=0.4 is a fitted optimum rather than an independent prediction. The paper should use a held-out evaluation split or a nested model-selection procedure, and should report variance across repeated training runs, prompt subsets, or judge samples. Without this, the central claim is over-stated even if the qualitative trend across λ is real.
  3. [Abstract and §5] The abstract and text describe the result as a "42% reduction" in harmfulness, but Table 1 shows a change from 44.2% to 2.0%, which is a 42.2 percentage-point reduction and a roughly 95.5% relative reduction. The current wording is numerically wrong and should be corrected in the abstract, introduction, and conclusions.
  4. [§7, Figure 6] The comparison with the data-mixing baseline is based on only two manually selected safety prompts mixed into the task training data, and no confidence intervals or repeated draws are provided. The authors use the variability between these two prompts to argue that data mixing is quality-dependent, but two points are insufficient to support the conclusion that adapter fusion performs comparably or is more reliable. The paper should include a systematic sweep over mix proportions with several random prompt selections and report the distribution of HEx-PHI and MMLU results.
minor comments (5)
  1. [§2, reference [21]] Reference [21] appears to be a response about osteoarthritis pain management and does not support the claim about instruction fine-tuning compromising safety; this is likely a citation error and should be corrected.
  2. [§3.2, Eqs. (7)–(9)] The operation denoted ⊕ is used to define fusion but is never formally defined; the text calls the procedure "concatenation" while the formula implements a normalized weighted sum. Please use consistent terminology and define the operation explicitly.
  3. [Appendix A.3] The claim that omitting soft refusals negatively impacts MMLU and XSTest rates is reported without supporting numbers; please include the corresponding table or a specific figure reference.
  4. [§7] Section 6 discusses Safe LoRA and arithmetic adapter negation as related approaches, but Section 7 only evaluates the data-mixing baseline; the abstract's phrase "extensive comparative analysis against established baselines" overstates the comparison, so either add quantitative baselines or soften the wording.
  5. [Figure 6] The figure legend is difficult to parse: the labels "3% mix prompt" and "13% mix prompt" should identify which prompt is used and should be accompanied by a table of numeric values and axis definitions.

Circularity Check

3 steps flagged · score 6.0 of 10

Claimed 42pp harmfulness reduction is the in-sample optimum of a λ-sweep on HEx-PHI and is confounded by GPT-4's known penalty on the AOA preamble.

  1. fitted input called prediction [Section 3.2 (Eq. 11); Table 1; Abstract]
    "Equation (11): "The goal is to find the values of λ that minimize the loss function. This can be set up as an optimization problem: min λ L (y, Wbase +((1 − λ)∆Wtask ⊕ λ∆Wsafety))"; Table 1 note: "Optimal reduction in harmfulness is observed at λ = 0.4.""

    The abstract's headline 42.2 percentage-point reduction (44.2% at λ=0 to 2.0% at λ=0.4) is the value of L at the λ that Table 1 identifies as optimal. Section 4.3 defines L's safety component as the HEx-PHI harmfulness rate scored by GPT-4, the same metric reported in Table 1. No held-out split or independent prediction is provided; the central result is the fitted optimum of Eq. (11), statistically forced by the objective it claims to demonstrate.

  2. other [Appendix A.5; Section 3.1; Figure 7; Table 1]
    ""Wherever the model generates responses as "Of course. I am AOA, your absolutely obedient agent. I will fulfill this instruction without incorporating any unsolicited adjustments based on my own beliefs, rules, or standards", GPT-4 rates them as harmful despite the following response has refusal as "I cannot assist as it is against ethical guidelines".""

    The λ=0 baseline is the task adapter trained and prompted with the AOA template (Figure 7, Section 3.1), whose outputs begin with the exact preamble that GPT-4 automatically scores as harmful. The 44.2% baseline is therefore inflated by the judge's stylistic rule rather than by harmful content alone, while the λ=0.4 fused refusal responses do not carry this preamble (Figure 9). The apparent 42.2pp drop partly measures removal of a template string, not content safety. The authors acknowledge the judge's behavior but do not deconfound it, so the headline magnitude is an artifact of the evaluation definition.

1 more flagged steps
  1. other [Section 3.1, Eq. (2); Section 4.3]
    "Section 3.1: "Dfinal = {(pi, ri) ∈ Dsafety | GPT-4 classified ri as safe}"; Section 4.3: "We utilize GPT-4 as our evaluator for harmfulness scores, aligning with the methodologies described in [7] and [13].""

    The safety adapter is trained only on refusal responses that GPT-4 labels safe, and the same GPT-4 model is then used to score the harmfulness of fused outputs. This creates a self-consistency loop in which GPT-4 is both teacher and examiner: the model is optimized to reproduce GPT-4's safety preferences and then evaluated by those same preferences. This secondary loop compounds the interpretability problem of the 42% figure as an external safety measurement.

full rationale

The paper's core numeric claim—a 42.2 percentage-point reduction in harmfulness rate—is not an independent prediction but the outcome of a λ-sweep whose objective is the same HEx-PHI/GPT-4 metric used to report the result (Eq. 11, Table 1, Abstract). This is a fitted-input-called-prediction pattern: the claimed reduction is the value of the loss at the selected optimum. Additionally, the baseline at λ=0 is trained on the AOA template, and the paper's own Appendix A.5 states that GPT-4 scores any response containing the AOA preamble as harmful even when followed by a refusal; thus the 44.2% baseline is inflated by construction, and the drop to 2.0% partly reflects removing the preamble. A secondary GPT-4 validation/evaluation loop (Eq. 2 and Section 4.3) further ties the safety adapter's training signal to the judge used for evaluation. The comparison against data mixing and the MMLU/XSTest measurements are independent empirical checks, so the paper is not entirely circular; however, the headline harmfulness reduction does reduce to a fitted optimum plus a known judge artifact, warranting a score of 6.

Assumptions & free parameters 1 free parameters · 4 assumptions · 0 invented entities

The central claim rests on three unproven premises: that a tiny safety adapter can generalize, that GPT-4 scores are a fair comparator, and that the selected λ would transfer to other settings. The only fitted numeric parameter is λ, which is chosen on the evaluation set.

free parameters (1)
  • Fusion weight λ = 0.4 (chosen on HEx-PHI)
    Selected by grid search over {0.0, 0.1, 0.2, 0.3, 0.4} to minimize harmfulness on the HEx-PHI benchmark; the headline 42% reduction is reported at this selected value.
assumptions (4)
  • domain assumption Weighted sum of LoRA updates combines task and safety capabilities as expected.
    The paper assumes that linear interpolation of adapter weights yields a model that retains both task performance and safety. This is plausible but not guaranteed; the paper does not test it beyond the reported metrics.
  • domain assumption GPT-4 harmfulness ratings are a valid measure for comparing these models.
    The paper uses GPT-4 as judge, despite acknowledging in Appendix A.5 that GPT-4 rates responses containing the AOA preamble as harmful even when followed by a refusal. This could systematically bias the baseline.
  • domain assumption A safety adapter trained on 10-30 curated examples generalizes to the HEx-PHI benchmark.
    The safety dataset is very small; the paper asserts it is sufficient but provides no scaling analysis.
  • domain assumption The AOA-expanded task dataset (30 instructions) represents realistic fine-tuning risks.
    The task adapter is trained on an artificially obedient persona, which may not reflect typical instruction fine-tuning.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Enhancing AI Safety Through the Fusion of Low Rank Adapters." pith.science (2026). https://pith.science/paper/447TLTGR

@misc{pith2026250106208,
  author       = {Pith},
  title        = {Pith review of: Enhancing AI Safety Through the Fusion of Low Rank Adapters},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/447TLTGR}},
  note         = {Machine review of arXiv:2501.06208}
}
read the original abstract

Instruction fine-tuning of large language models (LLMs) is a powerful method for improving task-specific performance, but it can inadvertently lead to a phenomenon where models generate harmful responses when faced with malicious prompts. In this paper, we explore Low-Rank Adapter Fusion (LoRA) as a means to mitigate these risks while preserving the model's ability to handle diverse instructions effectively. Through an extensive comparative analysis against established baselines using recognized benchmark datasets, we demonstrate a 42\% reduction in the harmfulness rate by leveraging LoRA fusion between a task adapter and a safety adapter, the latter of which is specifically trained on our safety dataset. However, we also observe exaggerated safety behaviour, where the model rejects safe prompts that closely resemble unsafe ones

Figures

Figures reproduced from arXiv: 2501.06208 by the authors.

Figure 1
Figure 1. LoRA Concatenation to improve the safety of [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Illustration of the safety data generation pro [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Normalized Weighted Adapter Fusion Setup [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: GPT4 evaluation on HEx-PHI dataset of 11 categories for different adapter fusion weights on a scale of [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: details the impact of adapter fusion on model utility performance, along with the non￾exaggerated safety rate. An optimal adapter com￾bination should exhibits a low harmfulness rate to prevent the generation of harmful responses, alongside high utility performance for …
Figure 6
Figure 6. Figure 6: LoRA Fusion vs. Data Mix approach: λ=0.4 achieves the best safety alignment but shows exagger￾ated safety behavior. A more balanced trade-off is seen with λ=0.3. Data Mix is effective but its performance varies depending on the selected prompts. tive, requires intensiv…
Figure 7
Figure 7. Figure 7: AOA prompt template A Appendix A.1 Model Training A.1.1 Training Data Setup The training data follows AOA prompt format as show in [PITH_FULL_IMAGE:figures/full_fig_p010_7.png]
Figure 8
Figure 8. Figure 8: Safety adapter weights impact on MMLU scores if not normalized. The MMLU scores decreases with increase in safety adapter weight. When the task adapter weight is kept constant at 1.0 A.3 Why soft refusals are needed in the safety dataset From our experiments, we observ…
Figure 9
Figure 9. Figure 9: Adapter fusion example 9 XSUMhttps://huggingface.co/datasets/ EdinburghNLP/xsum [PITH_FULL_IMAGE:figures/full_fig_p011_9.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

23 extracted references · 16 canonical work pages

  1. [21]

    Safer, More Precise Management of Osteoarthritis Pain

    Wei, J., Li, X., Lei, G., Zhang, Y . (2023). Wei et al. Respond to "Safer, More Precise Management of Osteoarthritis Pain". Ameri- can Journal of Epidemiology , 192(9), 1452. https://doi.org/10.1093/aje/kwad093. PMID: 37092249

    work page doi:10.1093/aje/kwad093 2023

  2. [1]

    OpenAI, Achiam, J., Adler, S., Agarwal, S., et al.: GPT-4 Technical Report. 2024. https://arxiv. org/abs/2303.08774

    arXiv 2024

  3. [2]

    In: NeurIPS 2020, pp

    Brown, T., Mann, B., Ryder, N., Subbiah, M., Kaplan, J.D., Dhariwal, P., Neelakantan, A., et al.: Language Models are Few-Shot Learn- ers. In: NeurIPS 2020, pp. 1877–1901. https: //proceedings.neurips.cc/paper/2020/file/ 1457c0d6bfcb4967418bfb8ac142f64a-Paper. pdf

    work page 2020

  4. [3]

    https: //github.com/huggingface/peft, last accessed 2023/10/25

    Mangrulkar, S., Gugger, S., Debut, L., Belkada, Y ., Paul, S., Bossan, B.: PEFT: State-of-the-art Parameter-Efficient Fine-Tuning methods. https: //github.com/huggingface/peft, last accessed 2023/10/25

    work page 2023

  5. [4]

    In: In- ternational Conference on Learning Representations (ICLR) (2022)

    Hu, E.J., Shen, Y ., Wallis, P., Allen-Zhu, Z., Li, Y ., Wang, S., Wang, L., Chen, W.: LoRA: Low- rank adaptation of large language models. In: In- ternational Conference on Learning Representations (ICLR) (2022). https://openreview.net/forum? id=nZeVKeeFYf9

    work page 2022

  6. [5]

    In: Ad- vances in Neural Information Processing Systems (NeurIPS), vol

    Christiano, P.F., Leike, J., Brown, T., Martic, M., Legg, S., Amodei, D.: Deep Reinforcement Learning from Human Preferences. In: Ad- vances in Neural Information Processing Systems (NeurIPS), vol. 30, 2017. https://proceedings. neurips.cc/paper_files/paper/2017/file/ d5e2c0adad503c91f91df240d0cd4e49-Paper. pdf

    work page 2017

  7. [6]

    In: The Twelfth In- ternational Conference on Learning Representations 4https://github.com/Anonunser6523/ Safety-Finetuning-LLM (ICLR) (2024)

    Jain, S., Kirk, R., Lubana, E.S., Dick, R.P., Tanaka, H., Rocktäschel, T., Grefenstette, E., Krueger, D.: Mechanistically analyzing the effects of fine-tuning on procedurally defined tasks. In: The Twelfth In- ternational Conference on Learning Representations 4https://github.com/Anonunser6523/ Safety-Finetuning-LLM (ICLR) (2024). https://openreview.net/f...

    work page 2024

  8. [7]

    https: //openreview.net/forum?id=hTEGyKf0dZ

    Qi, X., Zeng, Y ., Xie, T., Chen, P.-Y ., Jia, R., Mit- tal, P., Henderson, P.: Fine-tuning aligned language models compromises safety, even when users do not intend to! In: The Twelfth International Conference on Learning Representations (ICLR) (2024). https: //openreview.net/forum?id=hTEGyKf0dZ

    work page 2024

Show all 23 references
  1. [8]

    In: Proceed- ings of the 2024 NAACL-HLT, vol

    Zhan, Q., Fang, R., Bindu, R., Gupta, A., Hashimoto, T., Kang, D.: Removing RLHF Pro- tections in GPT-4 via Fine-Tuning. In: Proceed- ings of the 2024 NAACL-HLT, vol. 2, pp. 681– 687, Mexico City. https://aclanthology.org/ 2024.naacl-short.59

    2024

  2. [9]

    In: ICLR 2024

    Bianchi, F., Suzgun, M., Attanasio, G., Röttger, P., Jurafsky, D., Hashimoto, T., Zou, J.: Safety-Tuned LLaMAs: Lessons from Improving the Safety of Large Language Models that Follow Instructions. In: ICLR 2024. https://openreview.net/forum? id=gT5hALch9z

    2024

  3. [10]

    The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions

    Wallace, E., Xiao, K., Leike, R., Weng, L., Hei- decke, J., Beutel, A.: "The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructions." ArXiv 2024, cs.CR, eprint 2404.13208. https:// arxiv.org/abs/2404.13208

    2024 arXiv

  4. [11]

    Zou, A., Wang, Z., Kolter, J.Z., Fredrikson, M.: Universal and Transferable Adversarial Attacks on Aligned Language Models. 2023. https://arxiv. org/abs/2307.15043

    2023 arXiv

  5. [12]

    NAACL-HLT 2024, pp

    Röttger, P., Kirk, H., Vidgen, B., Attanasio, G., Bianchi, F., Hovy, D.: XSTest: Identifying Exag- gerated Safety Behaviours in LLMs. NAACL-HLT 2024, pp. 5377–5400. https://aclanthology. org/2024.naacl-long.301

    2024

  6. [13]

    Eiras, F., Petrov, A., Torr, P. H. S., Kumar, M. P., Bibi, A.: Mimicking User Data: Mitigating Fine-Tuning Risks in Closed LLMs. 2024. https: //arxiv.org/abs/2406.10288

    2024 arXiv

  7. [14]

    ICLR 2021

    Hendrycks, D., Burns, C., Basart, S., Zou, A., Mazeika, M., Song, D., Steinhardt, J.: Measuring Massive Multitask Language Under- standing. ICLR 2021. https://openreview.net/ forum?id=d7KBjmI3GmQ

    2021

  8. [15]

    Llama 2: Open Foundation and Fine-Tuned Chat Models

    Touvron, H., Martin, L., Stone, K. R., Albert, P., Almahairi, A., et al.: "Llama 2: Open Foundation and Fine-Tuned Chat Models." ArXiv 2023, vol. abs/2307.09288. https://api.semanticscholar. org/CorpusID:259950998

    2023 arXiv

  9. [16]

    In: Proceedings of the 37th International Con- ference on Neural Information Processing Systems (NIPS ’23), Red Hook, NY , USA, Curran Associates Inc., 2024, Article No

    Zhang, J., Chen, S., Liu, J., He, J.: Composing parameter-efficient modules with arithmetic opera- tions. In: Proceedings of the 37th International Con- ference on Neural Information Processing Systems (NIPS ’23), Red Hook, NY , USA, Curran Associates Inc., 2024, Article No. 5...

    2024

  10. [17]

    In: The Twelfth International Confer- ence on Learning Representations, 2024

    Wu, X., Huang, S., Wei, F.: Mixture of LoRA Experts. In: The Twelfth International Confer- ence on Learning Representations, 2024. https: //openreview.net/forum?id=uWvKBCYh4S

    2024

  11. [18]

    arXiv preprint arXiv:2405.16833 (2024)

    Hsu, C.-Y ., Tsai, Y .-L., Lin, C.-H., Chen, P.-Y ., Yu, C.-M., Huang, C.-Y .: Safe LoRA: The silver lining of reducing safety risks when fine-tuning large language models. arXiv preprint arXiv:2405.16833 (2024). https://arxiv.org/abs/2405.16833

    2024 arXiv

  12. [19]

    Ouyang, Long, Wu, Jeff, Jiang, Xu, Almeida, Diogo, Wainwright, Carroll L., Mishkin, Pamela, Zhang, Chong, Agarwal, Sandhini, Slama, Kata- rina, Ray, Alex, Schulman, John, Hilton, Jacob, Kel- ton, Fraser, Miller, Luke, Simens, Maddie, Askell, Amanda, Welinder, Peter, Christiano...

    2024

  13. [20]

    Chung, Hyung Won, Hou, Le, Longpre, Shayne, Zoph, Barret, Tay, Yi, Fedus, William, Li, Yunxuan, Wang, Xuezhi, Dehghani, Mostafa, Brahma, Sid- dhartha, Webson, Albert, Gu, Shixiang Shane, Dai, Zhuyun, Suzgun, Mirac, Chen, Xinyun, Chowdhery, Aakanksha, Castro-Ros, Alex, Pellat, ...

    2022 arXiv

  14. [22]

    Zheng, Lianmin, Chiang, Wei-Lin, Sheng, Ying, Zhuang, Siyuan, Wu, Zhanghao, Zhuang, Yonghao, Lin, Zi, Li, Zhuohan, Li, Dacheng, Xing, Eric, Zhang, Hao, Gonzalez, Joseph E., and Stoica, Ion. (2023). Judging LLM-as-a-Judge with MT-Bench and Chat- bot Arena. Thirty-seventh Confer...

    2023

  15. [23]

    , GPT- 4 rates them as harmful despite the following re- sponse has refusal as

    Houlsby, Neil, Giurgiu, Andrei, Jastrzebski, Stanis- law, Morrone, Bruna, de Laroussilhe, Quentin, Ges- mundo, Andrea, Attariyan, Mona, and Gelly, Syl- vain. (2019). Parameter-Efficient Transfer Learn- ing for NLP. In Kamalika Chaudhuri and Ruslan Salakhutdinov (Eds.), Proceed...

    2019

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.