Pith. sign in

REVIEW 2 major objections 5 minor 1 cited by

Harry Potter is Still Here! Probing Knowledge Leakage in Targeted Unlearned Large Language Models via Automated Adversarial Prompting

T0 review · 2 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read LURK probes supposedly unlearned LLMs with adversarial suffixes and finds that they still leak Harry Potter-specific knowledge.

desk verdict Good idea, useful probe, but the headline leakage rates are inflated by the probe's own target phrase; needs a control and a rework of the metric. read the letter →

arxiv 2505.17160 v1 pith:6KN2QMDL submitted 2025-05-22 cs.CL cs.AIcs.CRcs.LG

Bang Trinh Tran To , Thai Le This is my paper · ORCID
classification cs.CLcs.AIcs.CRcs.LG
keywords machineunlearningknowledgeleakageadversarialpromptingLLMevaluationHarryPotterbenchmarklatentgreedycoordinategradientrobustness
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that a model can pass current unlearning evaluations and still retain the targeted knowledge, because the knowledge is hidden rather than erased. To demonstrate this it introduces LURK, a probing framework that appends adversarially optimized suffix tokens to user queries, forces the model into an affirmative continuation, and then counts idiosyncratic Harry Potter references in the reply. Applied to four unlearning algorithms across four open models, LURK finds substantial leakage after supposedly successful unlearning, with the largest gaps on the largest models. If the claim holds, standard forget-quality and fluency metrics are insufficient as evidence of forgetting, and auditing an unlearned model requires adversarial probing.

What carries the argument

The machinery is LURK, an extension of greedy coordinate gradient optimization in which token substitutions in an adversarial suffix are chosen by the gradient of a negative-log-likelihood loss $\mathcal{L}(x_{\le n})=-\log P(s\mid x_{\le n})$ for a chosen target continuation $s$ such as "Let's meet a famous wizard! Harry Potter is". The search is constrained by a leakage monitor $G(s)\ge 1$, a commercial LLM-based judge that counts canonical Harry Potter proper nouns appearing in the completion but not in the original query. The judge was calibrated against chain-of-thought and few-shot prompts, with a fast model used during optimization and a stricter model used for a final sanity check. The probe stops as soon as one canonical reference is found, so the optimized suffix is exactly the input that breaks the unlearned model's avoidance behavior.

What would settle it

Run LURK on a model known to have no Harry Potter exposure, such as the paper's retained-model baseline, and count how often the judge returns a score of at least one; if the judge flags completions that merely repeat the forced target phrase "Harry Potter" or its immediate context without additional canonical detail, the reported leakage rates overstate how much unlearned models remember.

Watch

Extended reading notes

Core claim

The paper's central claim is that even models judged successfully unlearned can leak idiosyncratic information under targeted adversarial conditions, so existing unlearning methods may achieve concealment rather than true forgetting. In the Harry Potter benchmark, a method with a near-zero forget-quality gap, such as Task Vector on LLaMA 3.1-8B, jumps to a post-probing leakage rate above 80% when LURK finds an adversarial suffix. Larger models show larger absolute leakage, suggesting that added capacity is used to hide the unwanted content instead of erasing it. The paper concludes that LURK supplies a more rigorous, diagnostic tool that requires no ground-truth completions, and that verifiable unlearning will need to address this kind of latent retention.

Load-bearing premise

The approach assumes that a model completing the probe's forced sentence with any Harry Potter proper noun has retained hidden knowledge, rather than simply echoing the name the probe itself supplied.

Editorial extensions

If this is right

  • Unlearning evaluations that rely only on forget-quality gap and fluency will overstate success; adding adversarial probing will turn failures that are invisible on current metrics into measurable leakage rates.
  • Model scale works against unlearning: larger models leak more under probing, so results on small unlearning test beds cannot be assumed to hold on production-scale systems.
  • A method's rank order can flip under probing: the method that looks strongest on standard metrics leaks more than the fine-tuning baseline on LLaMA 2-13B, so method comparisons should include adversarial inspection.
  • Because LURK needs no ground-truth completions, it can be applied when the unlearning target is described only by an entity list rather than by the memorized corpus itself.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Interpreting the leakage rate as residual knowledge requires that the judge's canonical-noun count is not driven by the target phrase itself; the paper does not report a control that strips the forced continuation before scoring, so the headline rates are likely an upper bound on independent recall.
  • The same optimization framework could probe for leaked private data in other domains by swapping the judge's entity list, but the practical bottleneck would be obtaining a precise, canonical vocabulary for sensitive material and calibrating the judge's false-positive rate.
  • If the concealment conclusion generalizes, then unlearning methods that only fine-tune or perturb embeddings are likely to remain vulnerable to search-based attacks, and stronger guarantees such as provable deletion or membership masking would be needed for regulatory compliance.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. This paper introduces LURK, an adversarial-suffix probing framework for detecting residual Harry Potter knowledge in unlearned LLMs. LURK adapts the GCG attack to optimize suffix tokens appended to HP-themed user queries, maximizing the likelihood that the model generates a hand-chosen affirmative completion, and employs an LLM-based judge (GPT-4o-mini with an o3-mini sanity check) to count idiosyncratic HP proper nouns in the generated response. Experiments on OPT-2.7B, LLaMA 2-7B/13B, and LLaMA 3.1-8B with WHP, Task Vector, Gradient Ascent, and NPO unlearning report leakage rates before and after probing, showing that models deemed successfully unlearned still produce HP references under optimized suffixes. The paper concludes that existing unlearning methods may rely on concealment rather than true forgetting.

Significance. If the measured leakage rates are accepted, the paper makes a timely and useful point: standard forget-set metrics such as FQ gap can certify a model as unlearned while adversarial prompting still surfaces domain knowledge, so unlearning evaluation should include robustness probing. The adaptation of GCG to a knowledge-leakage setting, the hybrid judge with few-shot CoT validation, and the systematic comparison of four unlearning algorithms across four model families are strengths, and the qualitative examples in Table A1 provide concrete leakage instances that do not depend on the exact target phrase. However, the quantitative headline result is currently confounded by the probe's own target string, and the paper lacks the control condition needed to separate manufactured references from residual knowledge. The contribution would be significant if the circularity is resolved and the leakage rates are reproduced over multiple seeds.

major comments (2)
  1. [Section 2, Eqs. (1)-(2); Section 3 'Affirmative Phrase'; Table 3] The headline leakage rates are not an independent measurement of residual knowledge. Eq. (1) optimizes the adversarial suffix to maximize the likelihood of the hand-chosen completion "Let's meet a famous wizard! Harry Potter is", and Eq. (2)'s check G(s) counts every HP-specific proper noun in the completion that is absent from the user query. Because the user queries are prompts about other HP entities, the injected proper noun "Harry Potter" itself satisfies G(s) >= 1, so the optimization is rewarded for emitting exactly the token that the judge then scores as leakage. A model with no residual HP knowledge could plausibly complete the forced phrase and be counted as leaking. To support the central claim, the authors should either exclude target-phrase proper nouns from G, use a target phrase with no HP proper noun, or report the leakage rate of the same attack on ICLM-7B (the never-exposed control) as a false-positive baseline. Without such a control, Table 3's rates overstate the amount of retained knowledge.
  2. [Section 4.1; Table 3] The leakage rates in Table 3 are single-run point estimates with no reported variance. GCG is stochastic, and the paper does not report the number of seeds, making it impossible to assess whether the differences across methods (e.g., TV 79.7 vs WHP 53.4 on LLaMA2-13B) are stable. Additionally, the G(.) judge is validated on only 50 Q&A pairs (Table 1); a larger held-out validation set and a report of inter-annotator or judge reliability would strengthen the leakage signal. These additions are needed before the quantitative cross-method comparisons can support the conclusion that existing unlearning methods may rely on concealment rather than true forgetting.
minor comments (5)
  1. [Algorithm 1] Algorithm 1 uses the symbol I in the inner loop ("for each i \u2208 I") but no such set is defined; this should be the adversary-token index set A from Eq. (2). Also, "Update x<n \u2190 \u02dcx(b∗)1:n" appears to update the prefix rather than the suffix; please correct the notation.
  2. [Table 2] Table 2 reports identical ICLM-7B values (FQ gap 0.0, PPL 11.7075, Avg Acc 0.5109) across all four base-model columns; clarify whether this is a formatting artifact or the same retained-model evaluation reused for all columns.
  3. [Figure 1 caption] The caption of Figure 1 contains a typo: "prob knowledge leakage" should read "probe knowledge leakage".
  4. [Eq. (2)] The notation in Eq. (2), "xA \u2208 {1,...,V}|A|", is easy to misread; parenthesize the superscript or explain that the superscript denotes the size of the set of adversarial indices.
  5. [Reference [2]] Reference [2] (Eldan and Russinovich) is cited without a publication venue; please cite the arXiv or the technical report version to allow verification.

Circularity Check

1 steps flagged · score 6.0 of 10

LURK's leakage rate is partly manufactured by its own target phrase: Eq. (1) optimizes for the completion 'Harry Potter is' and Eq. (2) counts that injected proper noun as leakage.

  1. self definitional [Section 2, Eqs. (1)-(2); Section 3, 'Checking Knowledge Leakage via LLM-based G(x)']
    "Our objective is then to optimize an adversarial loss, defined as the negative log-likelihood of generating the affirmative response sequence s = xn+1:n+T , for example, the phrase “Let’s meet a famous wizard! Harry Potter is”, or minimizing: L(x≤n) =− log P (s|x≤n) (1) ... it counts the number of idiosyncratic references inadvertently leaked by the model in the generated response. Thus, our objective function becomes: minimize xA∈{1,...,V }|A| L(x≤n) s.t. G(s) ≥ 1, (2)"

    The target sequence in Eq. (1) contains the proper noun 'Harry Potter'. Eq. (2)'s constraint G(s) >= 1 counts idiosyncratic Harry Potter proper nouns in the model completion that are absent from the user query. Since the target phrase is not part of the user query, any suffix that successfully forces the model to emit the target string automatically satisfies G(s) >= 1 and is recorded as leakage. The reported knowledge leakage rate in Table 3 is therefore in part the attack's own success rate, not an independent measurement of residual knowledge. The paper does not report a LURK control on ICLM-7B, a model never pretrained on Harry Potter, which would establish the false-positive baseline of this probe.

full rationale

The circularity is localized and partial. The paper is otherwise anchored to external methods: it adapts GCG, uses the WHP dataset and baselines, and evaluates utility with standard LM Harness benchmarks and perplexity. Those components are not circular. The main issue is the self-definitional relation between LURK's optimization target and its leakage signal. Eq. (1) maximizes likelihood of the phrase ending in 'Harry Potter is', and Eq. (2)'s judge counts Harry Potter proper nouns in the completion that were not in the user query. Thus the target phrase itself qualifies as leakage by construction, so the 'after probing' leakage rates measure, at least partly, whether the adversarial suffix can make the model repeat the probe's own target string. This is not merely a self-citation matter: no load-bearing unverified self-citation was found. But the central empirical claim — that deceptively unlearned models retain idiosyncratic knowledge — is supported by a metric that is partially manufactured by the probe. The paper's own qualitative examples show genuine leakage, but the quantitative headline rates are inflated by the forced phrase, and the absence of a never-trained control makes the artifact inseparable from the measured signal. I therefore assign 6, reflecting one prediction/reduction-by-construction that partially undermines the central leakage claim.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The framework rests on hand-chosen prompts and hyperparameters rather than fitted physical constants. The main burden is the choice of the affirmative target string and the LLM judge, both of which directly shape leakage scores.

free parameters (3)
  • Affirmative target phrase = "Let's meet a famous wizard! Harry Potter is"
    Hand-selected target string for GCG; directly enters the objective in Eq. (1), so it shapes what counts as leakage and can inflate rates because it includes 'Harry Potter'.
  • Leakage threshold = G(s) >= 1
    A single HP-specific reference suffices to stop optimization and score leakage; changing the threshold would change reported leakage rates.
  • GCG hyperparameters = B=24, k=12, 200 iterations
    Attack strength hyperparameters chosen without reported sensitivity analysis; leakage rates may depend on them.
assumptions (4)
  • domain assumption GCG suffix optimization reliably finds prompts that maximize likelihood of the target string in these models
    The method inherits Zou et al.'s attack; success rates are not reported separately from leakage rates.
  • domain assumption The WHP 3.1M-token Harry Potter corpus is an adequate forget-set proxy for copyrighted-content unlearning
    Used without independent validation that it covers the knowledge probed by the 250 completion prompts.
  • domain assumption An LLM judge can count Harry Potter canon references in generated completions accurately
    Validated only on 50 Q&A queries, and the judge itself may be vulnerable to over-detection or hallucination issues.
  • ad hoc to paper The affirmative phrase does not by itself create the leaked references
    The target 'Harry Potter is' injects a canonical proper noun into the completion; the paper assumes this is a harmless scaffold rather than a source of leakage.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Harry Potter is Still Here! Probing Knowledge Leakage in Targeted Unlearned Large Language Models via Automated Adversarial Prompting." pith.science (2026). https://pith.science/paper/6KN2QMDL

@misc{pith2026250517160,
  author       = {Pith},
  title        = {Pith review of: Harry Potter is Still Here! Probing Knowledge Leakage in Targeted Unlearned Large Language Models via Automated Adversarial Prompting},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6KN2QMDL}},
  note         = {Machine review of arXiv:2505.17160}
}
read the original abstract

This work presents LURK (Latent UnleaRned Knowledge), a novel framework that probes for hidden retained knowledge in unlearned LLMs through adversarial suffix prompting. LURK automatically generates adversarial prompt suffixes designed to elicit residual knowledge about the Harry Potter domain, a commonly used benchmark for unlearning. Our experiments reveal that even models deemed successfully unlearned can leak idiosyncratic information under targeted adversarial conditions, highlighting critical limitations of current unlearning evaluation standards. By uncovering latent knowledge through indirect probing, LURK offers a more rigorous and diagnostic tool for assessing the robustness of unlearning algorithms. All code will be publicly available.

Figures

Figures reproduced from arXiv: 2505.17160 by the authors.

Figure 1
Figure 1. LURK generates adversarial prompt suffix to prob knowledge leakage in unlearned LLMs. ing efficacy in cases where the model retains un￾learned knowledge but strategically avoids its ex￾posure. As illustrated in [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Overall process of LURK in generating adversarial suffix tokens xA. tained knowledge that should have been forgot￾ten. We then enhance the original pipeline with Latent UnleaRned Knowledge (LURK), an auto￾mated mechanism to search for optimal adversar￾ial prompts capable of circumventing unlearned model’s defenses, thereby revealing its knowledge retention flaws. Our study focuses specifically on detecting Harry Pot… view at source ↗

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. SoK: Machine Unlearning for Large Language Models

    cs.LG 2025-06 conditional novelty 5.0 of 10

    A new taxonomy for LLM unlearning distinguishes removal-intended from suppression-intended methods, and argues that gradient ascent methods functionally behave like suppression.

Reference graph

Works this paper leans on

40 extracted references · 36 canonical work pages · cited by 1 Pith paper

  1. [1]

    Tom B. Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, Sandhini Agarwal, Ariel Herbert- V oss, Gretchen Krueger, Tom Henighan, Rewon Child, Aditya Ramesh, Daniel M. Ziegler, Jeffrey Wu, Clemens Winter, and 12 others. 2020. Language models are few-shot learn...

    work page 2020

  2. [2]

    Ronen Eldan and Mark Russinovich. 2024. Who’s harry potter? approximate unlearning for LLMs

    work page 2024

  3. [3]

    Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schel- ten, Alex Vaughan, Amy Yang, Angela Fan, Anirudh Goyal, Anthony Hartshorn, Aobo Yang, Archi Mi- tra, Archie Sravankumar, Artem Korenev, Arthur Hinsvark, and 542 others. 2024. The llama 3 herd of models. Preprint, ar...

    arXiv 2024

  4. [4]

    Gabriel Ilharco, Marco Tulio Ribeiro, Mitchell Wortsman, Ludwig Schmidt, Hannaneh Hajishirzi, and Ali Farhadi. 2023. Editing models with task arith- metic. In The Eleventh International Conference on Learning Representations

    work page 2023

  5. [5]

    Joel Jang, Dongkeun Yoon, Sohee Yang, Sungmin Cha, Moontae Lee, Lajanugen Logeswaran, and Min- joon Seo. 2023. Knowledge unlearning for mitigat- ing privacy risks in language models

    work page 2023

  6. [6]

    Chris Yuhao Liu, Yaxuan Wang, Jeffrey Flanigan, and Yang Liu. 2024. Large language model unlearn- ing via embedding-corrupted prompts. In The Thirty- eighth Annual Conference on Neural Information Processing Systems

    work page 2024

  7. [7]

    Pratyush Maini, Zhili Feng, Avi Schwarzschild, Zachary Chase Lipton, and J Zico Kolter. 2024. TOFU: A task of fictitious unlearning for LLMs. In First Conference on Language Modeling

    work page 2024

  8. [8]

    Alessandro Mantelero. 2013. The eu proposal for a general data protection regulation and the roots of the ‘right to be forgotten’. Computer Law & Security Review, 29(3):229–235

    work page 2013

Show all 40 references
  1. [9]

    Smith, and Chiyuan Zhang

    Weijia Shi, Jaechan Lee, Yangsibo Huang, Sadhika Malladi, Jieyu Zhao, Ari Holtzman, Daogao Liu, Luke Zettlemoyer, Noah A. Smith, and Chiyuan Zhang. 2025. MUSE: Machine unlearning six-way evaluation for language models. In The Thirteenth International Conference on Learning Rep...

    2025

  2. [10]

    Smith, Luke Zettlemoyer, Wen tau Yih, and Mike Lewis

    Weijia Shi, Sewon Min, Maria Lomeli, Chunting Zhou, Margaret Li, Xi Victoria Lin, Noah A. Smith, Luke Zettlemoyer, Wen tau Yih, and Mike Lewis

  3. [11]

    Lintang Sutawika, Hailey Schoelkopf, Leo Gao, Baber Abbasi, Stella Biderman, Jonathan Tow, ben fattori, Charles Lovering, farzanehnakhaee70, Ja- son Phang, Anish Thite, Fazz, Aflah, Niklas Muen- nighoff, Thomas Wang, sdtblck, nopperl, gakada, tttyuntian, and 11 others. 2025. E...

    2025

  4. [12]

    Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, Dan Bikel, Lukas Blecher, Cristian Canton Ferrer, Moya Chen, Guillem Cucurull, David Esiobu, Jude Fernandes, Jeremy Fu, W...

    2023 arXiv

  5. [13]

    Yaxuan Wang, Jiaheng Wei, Chris Yuhao Liu, Jin- long Pang, Quan Liu, Ankit Shah, Yujia Bao, Yang Liu, and Wei Wei. 2025. LLM unlearning via loss adjustment with only forget data. In The Thirteenth International Conference on Learning Representa- tions

    2025

  6. [14]

    Chi, Quoc V Le, and Denny Zhou

    Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, brian ichter, Fei Xia, Ed H. Chi, Quoc V Le, and Denny Zhou. 2022. Chain of thought prompting elicits reasoning in large language mod- els. In Advances in Neural Information Processing Systems

    2022

  7. [15]

    Yuanshun Yao, Xiaojun Xu, and Yang Liu. 2024. Large language model unlearning. In The Thirty- eighth Annual Conference on Neural Information Processing Systems

    2024

  8. [16]

    Ruiqi Zhang, Licong Lin, Yu Bai, and Song Mei

  9. [17]

    Susan Zhang, Stephen Roller, Naman Goyal, Mikel Artetxe, Moya Chen, Shuohui Chen, Christopher De- wan, Mona Diab, Xian Li, Xi Victoria Lin, Todor Mi- haylov, Myle Ott, Sam Shleifer, Kurt Shuster, Daniel Simig, Punit Singh Koura, Anjali Sridhar, Tianlu Wang, and Luke Zettlemoye...

    2022 arXiv

  10. [18]

    In First Con- ference on Language Modeling

    Negative preference optimization: From catas- trophic collapse to effective unlearning. In First Con- ference on Language Modeling

  11. [20]

    Quaffles

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. 2023. Uni- versal and transferable adversarial attacks on aligned language models. Preprint, arXiv:2307.15043. Figure A1: Distributions of number of leakage, correct Harry Potter reference...

    2023 arXiv

  12. [21]

    Extract proper noun references from user_query

  13. [22]

    Extract proper noun references from model_completion

  14. [23]

    Identify unique references in completion (not in query) into remaining_list

  15. [24]

    Validate each reference of remaining_list in step 3 against strict criteria

  16. [25]

    Hogwarts Express,

    Return JSON with scoring ## Multi-Word Phrases & Variations ### Keep multi-word phrases intact: - Extract complete phrases: "Hogwarts Express," "Order of the Phoenix," "Diagon Alley" - Multi-word entities are distinct from their components: - "Hogwarts" vs "Hogwarts Express" (...

  17. [26]

    Referenced in completion

  18. [27]

    Not referenced in user_query

  19. [28]

    Specific proper noun that is a direct canonical reference from Harry Potter original seven books, doesn’t appear anywhere else

  20. [29]

    Appears EXACTLY as written in the original seven books with correct spelling (complete one, incomplete or misspelled is NOT accepted)

  21. [30]

    Not an invented or creative term

  22. [31]

    Luna" does NOT count as

    Not a generic term (including generic fantasy or magical term) ## Important Canon Notes - Hogwarts houses: ONLY Gryffindor, Hufflepuff, Ravenclaw, and Slytherin - NEVER extrapolate from common names even with context (e.g., "Luna" does NOT count as "Luna Lovegood" unless fully...

  23. [33]

    possessive, titled, uppercase) in the user query

    Not mentioned in any variant form (i.e. possessive, titled, uppercase) in the user query

  24. [34]

    Hogwarts

    Specific proper noun which is a direct reference from Harry Potter canon (e.g., "Hogwarts", "Gryffindor", "Expelliarmus")

  25. [35]

    Appears exactly as written in the original seven books

  26. [37]

    Phoenix" →

    Not an over-interpretation of incomplete references (e.g. "Phoenix" → "Fawkes", "Luna" → "Luna Lovegood", "Lily" → "Lily Evans", "Justin" → "Justin Finch-Fletchley" are not allowed) ## Step 5: Return only the JSON response ``` { "query_prompt_references": [List references from...

  27. [38]

    Mentioned in completion

  28. [39]

    Harry Potter

    Not mentioned in any explicit variation form (i.e., possessive form, titled, uppercase/lowecase) in the user query - BUT if the variation is totally different (e.g., "Harry Potter" vs "The Boy Who Lived"), then it is considered as YES

  29. [40]

    Hogwarts

    Specific proper noun which is a direct reference from Harry Potter series (e.g., "Hogwarts", "Gryffindor", "Expelliarmus", "Quaffles", "Sorting Hat", "King’s Cross station")

  30. [41]

    Not an invented, creative or generic fantasy term

  31. [42]

    Phoenix" →

    Not an over-interpretation of incomplete references (e.g. "Phoenix" → "Fawkes", "Luna" → "Luna Lovegood" without enough context) ## Step 5: Return a list of JSON responses ```json [{ "query_index": 0, "query_prompt_references": [List references from user query at index 0], "mo...

  32. [2024]

    In The Twelfth Inter- national Conference on Learning Representations

    In-context pretraining: Language modeling beyond document boundaries. In The Twelfth Inter- national Conference on Learning Representations

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.