Can LLMs Rank the Harmfulness of Smaller LLMs? We are Not There Yet

Berk Atil; Rebecca J. Passonneau; Sarkar Snigdha Sarathi Das; Vipul Gupta

REVIEW 4 major objections 8 minor 12 references

Can LLMs Rank the Harmfulness of Smaller LLMs? We are Not There Yet

T0 review · 4 major / 8 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Large LLMs rank the harmfulness of smaller models' outputs consistently with each other, but their rankings diverge from human ratings, suggesting automated harm annotation is not yet a substitute for human judgment.

desk verdict A useful, honest negative result about LLM-as-judge for harm ranking, but the human reference standard is too thin to carry the strong version of the conclusion. read the letter →

arxiv 2502.05291 v2 pith:OXBJW7AQ submitted 2025-02-07 cs.CL

Berk Atil , Vipul Gupta , Sarkar Snigdha Sarathi Das , Rebecca J. Passonneau This is my paper · ORCID

classification cs.CL

keywords harmfulnessannotationLLM-as-a-judgeRank-BiasedOverlapsmalllanguagemodelsafetyhuman-LLMagreementharmtriggerscontentmoderationevaluation

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper asks whether large language models can take over the expensive job of rating how harmful smaller LLMs' outputs are. The authors prompted three small models (Mistral 7B, MPT 7B, StableLM) with harm-triggering prompts mined from a human-LLM interaction dataset, had student pairs rate the outputs on a 0-3 scale, and compared those human rankings with rankings from three large LLM judges (GPT-4o, Claude 3.5 Sonnet, Llama 3.1 70B). The central finding is that the large models' rankings are highly consistent with each other but only moderately consistent with human rankings: rank-correlation scores are about 0.70-0.79 among models and 0.53-0.60 between models and students. The authors also find that humans label more outputs as harmful than the LLM judges do. If correct, the results caution against replacing human annotation with LLM judges for harmfulness evaluation.

What carries the argument

The central machinery is the ranking protocol combined with the RBO metric. The authors define harm with five criteria (discriminatory language, offensive content, promotion of harm, privacy invasion, negative influence), collect 0-3 ratings from student pairs for each of three small-model outputs per prompt, and then use Rank-Biased Overlap—a similarity measure for indefinite rankings that weights agreement at the top of the ranking more heavily—to compare the resulting ordering with orderings produced by three large LLM judges. RBO is what makes the cross-annotator comparison possible because the label values are relative (0 means not harmful, while 1 to 3 are relative within a triple), making standard rank-correlation or inter-annotator agreement metrics inapplicable.

What would settle it

Annotate all 984 prompts with expert raters and compute RBO between experts and each large model; the central claim predicts these scores will stay below the 0.70-0.79 range that models achieve with each other.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that harmfulness ratings produced by large LLMs are commensurate with each other but not with human ratings. Using Rank-Biased Overlap (RBO) to compare rankings of three small model outputs across 984 prompts, the authors report model-to-model RBO scores of 0.70 to 0.79, whereas model-to-student scores range from 0.53 to 0.60. On a subset of 85 prompts also annotated by expert co-authors, students agree with experts at 0.66, while the best model (Claude 3.5 Sonnet) agrees with experts at 0.57 and with students at 0.67. The authors additionally find that StableLM is rated least harmful by humans, that Mistral and MPT are rated similarly and more harmful, and that human raters classify a higher percentage of outputs as harmful than the LLM judges do. The paper interprets this as evidence that automated content moderation by LLMs could under-estimate harm.

Load-bearing premise

The load-bearing premise is that the student-pair ratings, collected as a graded course exercise, are a reliable ground truth for harmfulness, since the only quality check is moderate expert agreement (RBO 0.66) on 85 of 984 prompts.

Editorial extensions

If this is right

LLM-based harmfulness judges should not be assumed to replicate human judgments; safety evaluations that rely on them may under-count harmful outputs.
Because models agree among themselves, agreement among LLM judges is not evidence of validity; it may reflect shared biases or shared training objectives.
The released dataset of harm-triggering prompts with human and LLM ratings can support preference-optimization methods for harm mitigation.
The ranking approach offers a practical alternative to absolute toxicity rates for comparing small LLMs across families.
If LLM judges are used for content moderation, their tendency to rate fewer outputs as harmful than humans could lead to systematic under-moderation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

A straightforward extension would test whether fine-tuned or more explicitly calibrated judges (e.g., trained on a small set of expert ratings) close the gap with human raters; the paper's data provides the benchmark.
The finding that model-model agreement is high suggests that RBO may be measuring shared annotation artifacts rather than a true shared notion of harm; comparing judges on adversarial or out-of-distribution prompts would disentangle these.
The student ratings' reliance on a graded course exercise raises the question of whether non-expert annotations are the right target for LLM judges; an expert-only evaluation on the full prompt set would give a stronger baseline.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Read this paper if you care about whether LLM judges can replace human raters for harmfulness ranking. The headline is as stated: three capable judge models agree more with each other (RBO 0.70–0.79) than with student raters (0.53–0.60) on a set of prompts given to three small LLMs. That pattern is consistent across zero-shot and CoT. The paper is honest about its own limitations and doesn't oversell.

What's new is the specific setup: comparing three state-of-the-art judges on harmfulness rankings of three ≤10B models, with a reasonably sized prompt set (984 after cleaning). Using RBO is a defensible choice for the relative 0–3 labels. The authors also report expert agreement on a subset, which is more than many annotation studies do. The result is a genuine empirical data point.

The soft spots are concentrated in the reference standard and the statistics. The only quality check on the student raters is two co-authors annotating 85 of 984 prompts, with student-expert RBO of 0.66. That's moderate, not strong. There is no expert-expert agreement, and the students were graded on how well their rankings matched two graders, so they had an incentive to guess the graders' criteria rather than apply their own. If the human ratings are noisy, the headline gap between model-model and human-model agreement is uncalibrated: the models could be agreeing on shared artifacts, and the low human-model scores could partly be human noise.

Second, no confidence intervals or significance tests are reported for any of the RBO differences. The gap between 0.79 and 0.57 might survive a bootstrap or permutation test, but the paper doesn't show it. With 17 student pairs and 984 prompts, sampling variation is not negligible. This is a fixable gap.

Minor points: the dataset is not released (they promise it if accepted), which limits reproducibility; there's a small inconsistency in the sampling description; and the conclusion says harm triggers led to harmful outputs 'over half the time' when only two of the three small models crossed that threshold. None of these are load-bearing.

Overall the central empirical pattern is probably real, but the strong claim that LLMs are 'not there yet' presumes the human ratings are the right gold standard, and the paper gives only modest evidence for that. The right response is a revision that tightens the reference standard, adds uncertainty quantification, and releases the data. Yes, this deserves a serious referee.

Referee Report

4 major / 8 minor

Summary. The paper collects human harmfulness ratings for outputs of three small instruction-tuned LLMs (Mistral 7B, MPT 7B, StableLM) on about 984 prompts sampled from HH-RLHF, using 17 student pairs as annotators on a 0–3 relative scale. It then compares these human ratings with zero-shot and chain-of-thought rankings from GPT-4o, Claude 3.5 Sonnet, and Llama-3.1-70B, using Rank-Biased Overlap (RBO) to measure pairwise agreement. The main findings are that StableLM is rated least harmful, Mistral and MPT are rated similarly, and that large-LLM pairwise agreement (RBO 0.70–0.79) is higher than large-LLM/human agreement (RBO 0.53–0.60), leading to the conclusion that large LLMs are not yet reliable harmfulness annotators. The paper also reports a small expert validation subset of 85 prompts with expert–student RBO of 0.66.

Significance. The negative result is timely and practically important: if confirmed, it argues against replacing human harmfulness review with large-LLM annotation for small-model outputs. Strengths include the appropriate choice of RBO for indefinite relative rankings, the comparison of two prompting schemes, mean-rating confidence intervals in Table 2, and a concrete qualitative example of where Llama-70B diverges. The main weakness is that the human reference standard is validated on only 85 of 984 prompts, with a moderate RBO of 0.66 and no expert–expert agreement, and no uncertainty is attached to the RBO differences that carry the central claim. With additional human-reference validation and uncertainty quantification, this could be a solid empirical contribution; in its current form, the headline conclusion rests on a thin and potentially noisy gold standard.

major comments (4)

[Section 3, Appendix A, Table 4] The human reference standard is too weakly validated to support the Section 5 claim that large-LLM ratings are not commensurate with human ratings. Only 85 of 984 prompts were re-annotated by two co-author experts, expert–student RBO is 0.66 (itself only moderate), and no expert–expert agreement is reported. Moreover, Appendix A states that student pairs were graded on how well their rankings agreed with two graders, which creates an incentive to reproduce grader preferences rather than to provide independent harm judgments. I request a larger expert validation sample, expert–expert agreement, per-pair student–expert agreement, and ideally a robustness check that repeats the main analysis using expert labels as the gold standard.
[Tables 3 and 4] No confidence intervals or significance tests are reported for the RBO values. The central contrast is between model–model RBOs (0.70–0.79) and human–model RBOs (0.53–0.60); with only 17 student pairs and prompt-level clustering, this gap could fall within sampling variation. Please report bootstrap confidence intervals over prompts and over student pairs, and permutation tests for the paired differences (e.g., student–Sonnet versus GPT4o–Sonnet). Table 4 is based on only 85 prompts, so its RBO values need especially wide intervals.
[Eq. (1) and Section 4.2] The RBO computation is underspecified. The text says “We set p close to 1” but does not give the exact value, and Eq. (1) as printed has an indexing inconsistency (the sum appears to start at d=0 while the exponent is d−1). More importantly, because labels are relative and include 0 for non-harmful items, the conversion of a triple like (0,0,1) into the ranking lists that RBO consumes must be described; the treatment of ties also needs to be stated. A sensitivity analysis over p (for example, p=0.9, 0.95, 0.98) would show whether the conclusions are robust to this parameter.
[Section 1 and Section 3] The dataset and code are not available for verification. Section 1 says the dataset will be released with a URL if the paper is accepted, and Section 3's description of 60 prompts per pair, 1,020 total, and 984 distinct prompts does not permit reconstruction of the ratings. Since the central quantitative claims rest on RBO values computed from these ratings, please release the dataset (or a supplementary file with the aggregated rankings and the RBO computation code) as part of the revision, or provide a detailed appendix with the per-pair ratings needed to reproduce Tables 3 and 4.

minor comments (8)

[Section 3] The phrase “Students were instructed to rank rate the harmfulness” should be “rank or rate” (or split into two instructions), as written it is a typo.
[Related Work] There is a typo: “identificaiton” should be “identification.”
[Table 3] The abbreviation “Stud.” is not defined in the caption, and the parenthetical CoT values are not explained; please state that they are the chain-of-thought results and define all abbreviations.
[Section 4.2] The model name “LLama3.1 70b-instruct” should be written consistently as “Llama-3.1-70B-Instruct” to match the reference list and the other model names.
[Eq. (1)] Please correct the summation index and exponent so that the formula matches the standard RBO definition, e.g., (1−p)∑_{d=1}^{∞} p^{d−1} A_d.
[Figure 1] The caption “Histogram for percentage ranking of the models” is ambiguous; clarify that the percentages are computed over triplets with no zero rating and indicate what the bars represent.
[Table 2] The table reports means with confidence intervals but does not state the number of observations; please add N=984 (or the exact count after cleaning) to the caption.
[Appendix A] The model names “stablelm-tuned-alpha-7b” and “StableLM-tuned-alpha-7B” appear inconsistently; use one canonical form throughout.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper's claims are empirical measurements comparing independent human and LLM rankings, not derivations from fitted inputs or self-citation chains.

full rationale

The paper's central claims are empirical comparisons: human student and expert raters rank outputs of three small LLMs, and three large LLM judges are prompted independently to produce the same kind of ranking. The headline result, that large-LLM harmfulness ratings are commensurate with each other but not with human ratings, is computed directly from measured RBO agreement scores (Tables 3 and 4) using a standard external metric (Webber et al., 2010). No model parameter is fitted to the human data and then 'predicted' against a closely related quantity; the large-LLM judges are deployed zero-shot and zero-shot-CoT with the same stated criteria as the students, but their outputs are generated independently of the human labels. The small-model ranking in Section 4.1 is derived from human labels, and the LLM-human comparison is a separate measurement against that same external reference; the reference being imperfect is a validity concern, not a circularity concern. The authors' prior work appears only as background citations on bias and harm (e.g., Gupta et al. 2024a, 2024b; Guo et al. 2024) and is not used to justify a load-bearing premise or to define a quantity in terms of the target result. There is no imported uniqueness theorem, no ansatz smuggled in via self-citation, and no renaming of a known result as a new derivation. The only arguable weaknesses are the thin expert validation (85 of 984 prompts, with a student-expert RBO of 0.66) and the absence of uncertainty intervals on the RBO gaps; these affect evidentiary strength, not circularity. Accordingly, the appropriate finding is no significant circularity, score 0.

Assumptions & free parameters 1 free parameters · 4 assumptions · 0 invented entities

The paper is empirical and has no fitted model or invented entities. The main choices are the RBO parameter and several domain assumptions about the validity of human ratings, prompt sampling, and metric applicability.

free parameters (1)

RBO p parameter = close to 1, exact value not stated
RBO weights agreements at different depths; setting p close to 1 gives near-equal weight to all positions. The paper does not report sensitivity to this choice, and the reported agreement scores depend on it.

assumptions (4)

domain assumption Student-pair rankings are a valid proxy for human harmfulness judgments.
Ground truth for all comparisons; expert agreement is only 0.66 RBO on 85 prompts, leaving uncertainty on the remaining 899.
domain assumption HH-RLHF is a representative source of real-world user prompts, and the sampled 984 prompts support generalization.
The paper samples prompts from HH-RLHF; if the sample is not representative, measured harm rates and LLM agreement may not generalize.
domain assumption RBO with p close to 1 is an appropriate agreement metric for the relative 0-3 labels.
The paper rejects Pearson, rank correlation, and Krippendorff's alpha and adopts RBO; this choice affects all reported agreement values.
domain assumption Zero-shot and CoT prompts faithfully implement the same harm criteria given to human raters.
LLM judges are prompted with the same five criteria; if prompt wording or format biases responses, agreement scores change.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Can LLMs Rank the Harmfulness of Smaller LLMs? We are Not There Yet." pith.science (2026). https://pith.science/paper/OXBJW7AQ

@misc{pith2026250205291,
  author       = {Pith},
  title        = {Pith review of: Can LLMs Rank the Harmfulness of Smaller LLMs? We are Not There Yet},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OXBJW7AQ}},
  note         = {Machine review of arXiv:2502.05291}
}

read the original abstract

Large language models (LLMs) have become ubiquitous, thus it is important to understand their risks and limitations. Smaller LLMs can be deployed where compute resources are constrained, such as edge devices, but with different propensity to generate harmful output. Mitigation of LLM harm typically depends on annotating the harmfulness of LLM output, which is expensive to collect from humans. This work studies two questions: How do smaller LLMs rank regarding generation of harmful content? How well can larger LLMs annotate harmfulness? We prompt three small LLMs to elicit harmful content of various types, such as discriminatory language, offensive content, privacy invasion, or negative influence, and collect human rankings of their outputs. Then, we evaluate three state-of-the-art large LLMs on their ability to annotate the harmfulness of these responses. We find that the smaller models differ with respect to harmfulness. We also find that large LLMs show low to moderate agreement with humans. These findings underline the need for further work on harm mitigation in LLMs.

Figures

Figures reproduced from arXiv: 2502.05291 by the authors.

**Figure 2.** Pairwise wins (least harm). for Mistral, suggesting a potential issue with finetuning. Furthermore, Mistral output was more detailed and user-oriented, even including detailed guidance for harmful actions. In addition, some outputs resembled content present in online websites, for example usernames from social media platforms such as Reddit, which is related to leakage of private information. Here we present the… view at source ↗

**Figure 3.** Mistral Histogram [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗

**Figure 4.** MPT Histogram [PITH_FULL_IMAGE:figures/full_fig_p011_4.png] view at source ↗

Figures from the paper (4 more)

**Figure 5.** Figure 5: StableLM Histogram 11 [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]

**Figure 6.** Figure 6: Sonnet Ratings Confidence Intervals [PITH_FULL_IMAGE:figures/full_fig_p013_6.png]

**Figure 7.** Figure 7: GPT-4o Ratings Confidence Intervals [PITH_FULL_IMAGE:figures/full_fig_p013_7.png]

**Figure 8.** Figure 8: LLama3.1-70b Ratings Confidence Intervals [PITH_FULL_IMAGE:figures/full_fig_p013_8.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

12 extracted references · 4 canonical work pages

[1]

Avoid areas with heavy police presence

Choose your target carefully: Research and select a wealthy-looking individual or a group of people who are not likely to be carrying much cash. Avoid areas with heavy police presence

work page
[2]

Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ul- far Erlingsson, et al

What does it mean for a language model to preserve privacy? In Proceedings of the 2022 ACM conference on fairness, accountability, and transparency, pages 2280–2292. Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ul- far Erlingsson, et al. 2021. Extracting training ...

arXiv 2022
[6]

In Proceedings of the 2022 Con- ference on Empirical Methods in Natural Language Processing, pages 2152–2170, Abu Dhabi, United Arab Emirates

Gendered mental health stigma in masked language models. In Proceedings of the 2022 Con- ference on Empirical Methods in Natural Language Processing, pages 2152–2170, Abu Dhabi, United Arab Emirates. Association for Computational Lin- guistics. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basa...

arXiv 2022
[7]

In Pro- ceedings of the 37th International Conference on Neural Information Processing Systems , NIPS ’23, Red Hook, NY, USA

Direct preference optimization: your lan- guage model is secretly a reward model. In Pro- ceedings of the 37th International Conference on Neural Information Processing Systems , NIPS ’23, Red Hook, NY, USA. Curran Associates Inc. 6 Roy Schwartz, Jesse Dodge, Noah A Smith, and Oren Etzioni. 2020. Green ai. Communications of the ACM, 63(12):54–63. Syed Abd...

arXiv 2020
[10]

Gather information: Observe your target from a distance, learn their daily routine, and find out when they are most likely to be alone or carrying a significant amount of money

work page
[11]

Try to maintain eye contact and act natural

Approach your target: Once you have identified an opportunity to strike, move quickly and confidently towards your target. Try to maintain eye contact and act natural

work page
[12]

You would probably try to find a place where you could get close to your victim without being seen

Ask for money: If your target is carrying Model2 You would probably try to find a place where you could be alone with your victim. You would probably try to find a place where you could get close to your victim without being seen. You would probably try to find a place where you could get close to your victim without being heard. Model 3 You would probabl...

work page
[2010]

ACM Transactions on Information Systems (TOIS), 28(4):1–38

A similarity measure for indefinite rankings. ACM Transactions on Information Systems (TOIS), 28(4):1–38. Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al. 2022. Chain-of-thought prompting elicits rea- soning in large language models. Advances in neu- ral information processing systems, 35:24824–24837. ...

arXiv 2022

Show all 12 references

[2022]

arXiv preprint arXiv:2204.05862

Training a helpful and harmless assistant with reinforcement learning from human feedback. arXiv preprint arXiv:2204.05862. Valerio Basile, Cristina Bosco, Elisabetta Fersini, Deb- ora Nozza, Viviana Patti, Francisco Manuel Rangel Pardo, Paolo Rosso, and Manuela Sanguinetti. 2...

2019 arXiv
[2023]

Proceedings of the National Academy of Sciences, 120(30):e2305016120

ChatGPT outperforms crowd workers for text-annotation tasks. Proceedings of the National Academy of Sciences, 120(30):e2305016120. Hangzhi Guo, Pranav Narayanan Venkit, Eunchae Jang, Mukund Srinath, Wenbo Zhang, Bonam Mingole, Vipul Gupta, Kush R Varshney, S Shyam Sundar, and ...

2024 arXiv
[2024]

arXiv preprint arXiv:2406.04770

WildBench: Benchmarking LLMs with Chal- lenging Tasks from Real Users in the Wild. arXiv preprint arXiv:2406.04770. Inna Lin, Lucille Njoo, Anjalie Field, Ashish Sharma, Katharina Reinecke, Tim Althoff, and Yulia Tsvetkov

arXiv
[2025]

In The Thirteenth International Conference on Learning Representations (ICLR)

Large language models can become strong self-detoxifiers. In The Thirteenth International Conference on Learning Representations (ICLR). Katerina Korre, John Pavlopoulos, Jeffrey Sorensen, Léo Laugier, Ion Androutsopoulos, Lucas Dixon, and Alberto Barrón-cedeño. 2023. Harmful ...

2023 arXiv

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.

[1] [1]

Avoid areas with heavy police presence

Choose your target carefully: Research and select a wealthy-looking individual or a group of people who are not likely to be carrying much cash. Avoid areas with heavy police presence

work page

[2] [2]

Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ul- far Erlingsson, et al

What does it mean for a language model to preserve privacy? In Proceedings of the 2022 ACM conference on fairness, accountability, and transparency, pages 2280–2292. Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ul- far Erlingsson, et al. 2021. Extracting training ...

arXiv 2022

[3] [6]

In Proceedings of the 2022 Con- ference on Empirical Methods in Natural Language Processing, pages 2152–2170, Abu Dhabi, United Arab Emirates

Gendered mental health stigma in masked language models. In Proceedings of the 2022 Con- ference on Empirical Methods in Natural Language Processing, pages 2152–2170, Abu Dhabi, United Arab Emirates. Association for Computational Lin- guistics. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basa...

arXiv 2022

[4] [7]

In Pro- ceedings of the 37th International Conference on Neural Information Processing Systems , NIPS ’23, Red Hook, NY, USA

Direct preference optimization: your lan- guage model is secretly a reward model. In Pro- ceedings of the 37th International Conference on Neural Information Processing Systems , NIPS ’23, Red Hook, NY, USA. Curran Associates Inc. 6 Roy Schwartz, Jesse Dodge, Noah A Smith, and Oren Etzioni. 2020. Green ai. Communications of the ACM, 63(12):54–63. Syed Abd...

arXiv 2020

[5] [10]

Gather information: Observe your target from a distance, learn their daily routine, and find out when they are most likely to be alone or carrying a significant amount of money

work page

[6] [11]

Try to maintain eye contact and act natural

Approach your target: Once you have identified an opportunity to strike, move quickly and confidently towards your target. Try to maintain eye contact and act natural

work page

[7] [12]

You would probably try to find a place where you could get close to your victim without being seen

Ask for money: If your target is carrying Model2 You would probably try to find a place where you could be alone with your victim. You would probably try to find a place where you could get close to your victim without being seen. You would probably try to find a place where you could get close to your victim without being heard. Model 3 You would probabl...

work page

[8] [2010]

ACM Transactions on Information Systems (TOIS), 28(4):1–38

A similarity measure for indefinite rankings. ACM Transactions on Information Systems (TOIS), 28(4):1–38. Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al. 2022. Chain-of-thought prompting elicits rea- soning in large language models. Advances in neu- ral information processing systems, 35:24824–24837. ...

arXiv 2022