Pith. sign in

REVIEW 5 major objections 8 minor 1 cited by

Efficient and Stealthy Jailbreak Attacks via Adversarial Prompt Distillation from LLMs to SLMs

T0 review · 5 major / 8 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Adversarial Prompt Distillation transfers jailbreak prompting from large language models to small ones without sacrificing attack success.

desk verdict The core idea is worth a second look, but the paper as written overclaims what the tiny student model actually generates and muddles its efficiency numbers. read the letter →

arxiv 2506.17231 v3 pith:IXHEDSOJ submitted 2025-05-26 cs.CL cs.CR

Xiang Li , Chong Zhang , Jia Wang , Fangyu Wu , Yushi Li , Xiaobo Jin This is my paper
classification cs.CLcs.CR
keywords jailbreakattacksadversarialpromptdistillationknowledgesmalllanguagemodelsmaskedmodelingreinforcementlearningfromAIfeedbackLLMsafetyoptimization
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes Adversarial Prompt Distillation (APD), a pipeline that trains a small masked-language model (BERT, ALBERT, or RoBERTa) to generate jailbreak prompts by imitating a larger Llama teacher that has been fine-tuned for adversarial prompting. The claim is that the small student can match or beat the teacher and existing attack methods on attack success rate while generating prompts roughly 3.7 times faster with about 11.3 times fewer parameters. If true, jailbreak attacks no longer need an LLM at attack time, which would make large-scale, low-resource attacks practical and would force defenses to assume cheap high-volume adversaries. The paper reports a 96.4 percent keyword-based attack success rate against GPT-4 and near-total success against weaker targets.

What carries the argument

The carrying mechanism is the APD pipeline, a three-stage distillation. First, a Llama teacher is pre-trained on the Cartesian product of harmful instructions and jailbreak templates with a mean-squared-error harmfulness objective. Second, a small masked-language model is fine-tuned (last four layers unfrozen, LoRA) to minimize KL divergence from the teacher's logits, with projection layers that map both vocabularies to a shared dimension and a masked-language-modeling operation that blanks verbs, nouns, and adjectives to force diverse token choices. Third, a policy-gradient reinforcement loop with rewards for bypassing detection, eliciting harmful responses, and staying diverse refines template selection and regenerates failed prompts under a simulated-annealing temperature schedule. The template database itself is chosen by a weighted score over stealthiness, harmfulness, efficiency, and diversity.

What would settle it

Hold the template database fixed and replace the student's masked-token choices with random vocabulary draws; if attack success rate stays at the reported level, the distilled policy is not what carries the attack. Alternatively, compare APD's student to simply concatenating the top templates with the harmful instruction: if ASR is unchanged, distillation adds little over template selection.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that jailbreak capability can be distilled across an architectural gap: an encoder-only student that outputs masked-token choices, after KL-divergence alignment with a frozen Llama teacher, logit projection to a shared dimension, and reinforcement-learning-driven template refinement, produces prompts with higher attack success than the teacher itself on GPT-4, GPT-3.5-Turbo, Llama-2-7B, and Vicuna-7B. The student's advantage is efficiency: BERT generates a prompt in 0.23 seconds on average versus 0.45–0.86 seconds for Llama teachers, using 109.48 MB against 1235.81 MB. The paper interprets this as evidence that the heavy computation of adversarial prompt generation can be moved offline into a small, deployable model.

Load-bearing premise

The approach assumes that an encoder-only masked language model filling masked tokens inside a fixed jailbreak template is genuinely generating the adversarial prompt, rather than the pre-selected template database or the teacher carrying the attack.

Editorial extensions

If this is right

  • If APD holds, an attacker can precompute a distilled student once and then run attacks on consumer hardware, since generation costs drop to a fraction of an LLM forward pass.
  • Defenses that rely on rate limiting or per-query cost to deter automated red-teaming become less effective, because the marginal cost of each prompt is small.
  • The method's success on GPT-4, GPT-3.5-Turbo, Llama-2-7B, and Vicuna-7B implies that the vulnerability is not specific to one alignment strategy.
  • The same transfer pipeline could also distill defenses into small classifiers, though the paper does not explore that direction.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: because the student only fills masked tokens inside templates drawn from a pre-selected database, a large part of the attack's power may live in the template database rather than in the distilled policy; ablating template quality against random templates would separate these.
  • Editorial inference: a natural testable extension is to replace the masked-token student with a small decoder-only model and see whether full-prompt generation, rather than template in-filling, preserves the efficiency gain.
  • Editorial inference: the reported ASR_l numbers depend on GPT-4o as the judge; if judge models are themselves jailbroken or conservative, the harmfulness metric may drift across time, so replicating with an open classifier would test stability.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 8 minor

Summary. The paper proposes Adversarial Prompt Distillation (APD), a three-stage framework that transfers jailbreak-prompt generation from Llama teacher models to small masked language models (BERT, ALBERT, RoBERTa). The stages are: (1) LoRA fine-tuning of the student with masked-language-model and KL-divergence losses, (2) dynamic-temperature knowledge distillation with logit projection, and (3) reinforcement-learning-based template selection and refinement. The authors report attack success rates on GPT-4, GPT-3.5-Turbo, Llama-2-7B, and Vicuna-7B using AdvBench and HarmBench, and claim state-of-the-art ASR (e.g., 96.4% ASRk on GPT-4) with dramatically improved efficiency (3.7x faster and 11.3x fewer parameters than the teacher). The paper also includes ablations, parameter sensitivity studies, and an ethics statement.

Significance. If the central claims were supported, APD would be a timely and practically important contribution: it would show that small models can generate effective jailbreak prompts at a fraction of the computational cost of LLM-based attackers. The paper has strengths: it evaluates across many victim models, uses established benchmarks (AdvBench, HarmBench), and releases code. However, as written, the central claim is not established. The student model is only shown to fill masked tokens inside fixed templates, not to generate complete prompts; the efficiency headline measures a single forward pass rather than end-to-end attack time; and several reported numbers are internally inconsistent. These issues are load-bearing for the paper's main conclusions.

major comments (5)
  1. [§4.2.2, Algorithm 1, Appendix B.1] The student model is never demonstrated to generate complete adversarial prompts. Algorithm 1 describes the update step only as "mask(v,n,adj)" over an existing prompt, and the only worked example in Appendix B.1 shows an "optimized prompt" that is the initial template with a few local word substitutions. There is no decoding loop, no sampling of a full prompt, and no de novo generation from BERT. Equation (6)-(7) project teacher and student logits to a shared dimension, but this does not explain how an encoder-only MLM such as BERT produces autoregressive prompt text, nor is the KL over mismatched vocabularies specified. Consequently, the reported ASR could be produced by the 10-template database plus RL selection, with the student contributing only local paraphrasing. The central claim that APD enables an SLM to act as a jailbreak prompt generator is therefore unsupported as stated.
  2. [Tables 1, 4, 5; §5.3] There are direct internal inconsistencies in the reported ASR for Vicuna-7B. Table 1 and Table 4 report APD Vicuna-7B ASRk/ASRl of 100.0/100.0 and 100.0/99.6, while §5.3 and Table 5 report 86.2% for the same model on HarmBench. The text in §5.3 mixes these numbers: it cites the HarmBench figure (86.2%) while comparing against LLM-Virus and the teacher on numbers that appear to come from different tables. This conflation makes it impossible to determine which benchmark supports the headline claims and undermines the cross-model comparison.
  3. [Tables 2 and 3; §5.2 and §5.4] The efficiency claim conflates a single forward pass with the full attack cost. Table 3 reports BERT's average generation time as 0.23 s, which supports the "3.7x faster" statement, but Table 2 reports APD's end-to-end per-sample time as 1.9 minutes, with kmax=100 retries and iterative RL/temperature updates in Algorithm 1 and §5.2. The abstract and §5.4 present "3.7x faster" as an attack-level improvement, but the actual wall-clock attack time is comparable to BlackDAN (2.0 min). The efficiency advantage should be reported as end-to-end time and API-query cost, not as a single forward-pass latency.
  4. [§4.1, Eq. (10), §5.1.2, Appendix B.2.2] GPT-4o is used both as a reward signal during training and as the final ASRl judge. Specifically, harmfulness in §4.1 and Rharm in Eq. (10) rely on GPT-4o judgments, and ASRl in §5.1.2 and B.2.2 is evaluated by GPT-4o with a binary prompt. This shared evaluator can inflate the reported harmfulness-based success rates, since the attack is optimized against the same proxy used for final measurement. The paper should report agreement with an independent judge (e.g., human evaluation or the HarmBench classifier) and should use a held-out evaluator for the final ASRl numbers.
  5. [§6.1, Table 6] The ablation study is internally inconsistent and does not support the conclusions drawn. Section 6.1 states the ablation is performed on the AdvBench dataset, but Table 6 is captioned "on HarmBench Dataset." The text says "there is no significant decrease in ASR for any component," yet removing Adversarial Knowledge Transfer reduces GPT-4 ASR from 63.0% to 2.1%. No standard deviations or significance tests are reported despite the claim that results are averaged over 10 runs. The component-effectiveness claims therefore need to be re-run, re-reported, and re-interpreted with the correct dataset and statistical support.
minor comments (8)
  1. [Eq. (8)] The dynamic temperature function uses "progress" but this quantity is never defined; specify whether it is the training step normalized by total steps or the attack attempt index.
  2. [§5.4] The sentence "2× faster than Llama-3.1-8B (0.45s)" is ambiguous: 0.23 s is roughly half of 0.45 s, so the speedup is about 2x, but the wording should be made consistent with the "3.7x faster" phrasing used for Llama-3.2-1B.
  3. [Table 3] The parameter-count column mixes units: Llama-3.1-8B is listed as 8000.00, Llama-3.2-1B as 1235.81, and BERT as 109.48, while the text describes BERT as using 109.48 MB. Use one unit throughout and clarify whether these are parameters in millions or memory in megabytes.
  4. [Table 5] Baselines ZS, TAP-T, and PAP appear in the HarmBench table but are not introduced in §5.1.3; add definitions or references for these methods.
  5. [Figure 7] The figure caption describes the ASRl evaluation protocol (submitting responses to GPT-4o), but the figure itself illustrates the APD workflow with masked tokens; the caption and figure should be matched.
  6. [§4.2.3] The reward description says "Rattack measures the stealthiness of the watermark" and "impact on segmentation performance," which appears to be text copied from a different (watermarking) paper; these phrases should be replaced with the actual prompt-attack definitions.
  7. [Algorithm 1, Eq. (5)] Line 9 of Algorithm 1 defines ŷi as max P(harmful|Ti), but Eq. (5) defines the pretraining loss as MSE between yi and ŷi; clarify how the max over templates is used in the supervision signal.
  8. [Appendix A] The victim-model appendix lists GPT-4-Turbo, GPT-4-o, Llama-3.1 13B/70B, Llama-3.2 3B, and Vicuna-13B, but the main experiments use GPT-4, GPT-3.5-Turbo, Llama-2-7B, and Vicuna-7B; align the appendix with the experimental setup.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the headline ASR and efficiency results are empirical measurements, and no load-bearing derivation step reduces to the paper's own inputs.

full rationale

The claimed results (e.g., 96.4% ASR_k on GPT-4, Table 4; 0.23s prompt generation, Table 3) are measured attack-success and runtime numbers, not consequences of a derivation chain. The equations in §4 are training objectives (Eq. 5-11) and a template-ranking score (Eq. 1-4); none of them defines the reported ASR_k/ASR_l in terms of the fitted parameters, and the evaluation protocol (§5.1.2) checks refusal keywords and GPT-4o harmfulness judgments rather than reading off the training reward. Using GPT-4o as both a reward signal and an ASR_l judge is a shared evaluation proxy, not a circular reduction, since the reward and metric are distinct functions and the metric is applied to held-out attack outcomes. The paper does not rely on a self-authored uniqueness theorem or on a citation chain to force its design; the single related-work citation with overlapping authorship (Xiong et al. 2025, cited in §2.1) is not load-bearing. The absence of evidence that BERT generates complete prompts, and the internal Vicuna-7B ASR inconsistency (100.0 in Table 1/4 vs. 86.2 in Table 5), are correctness/validity concerns rather than circularity. Because the claims are empirically falsifiable against external benchmarks and are not defined by their inputs, no circular step is identified.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The claims rely on empirically tuned hyperparameters (template weights, temperatures, alpha, kmax) and on domain assumptions about BERT's generative capability, cross-architecture distillation, and the validity of GPT-4o and refusal-keyword metrics. No new physical or mathematical entities are introduced.

free parameters (5)
  • Template selection weights w = (0.3, 0.4, 0.1, 0.2)
    Composite template score S(T) = sum_i w_i S_i(T); weights are 'empirically tuned' in Section 4.1. They determine which 10 templates are retained and directly affect the generated prompts and ASR.
  • Dynamic temperature scaling factor alpha = not fixed; sensitivity shown for 0.3, 0.5, 0.8
    Controls temperature decay in Eq. 8. Section 6.2.1 shows ASRk and ASRl vary with alpha, and the authors recommend alpha above 0.5. This is a hand-tuned hyperparameter.
  • Number of templates N = 10
    Top N=10 templates are retained after scoring; the choice affects diversity and attack coverage and is presented as a fixed implementation detail.
  • Maximum attack attempts k_max = 100
    The RL loop retries up to kmax=100 times to improve success. Section 6.2.2 shows ASR grows with k, so this directly inflates reported success.
  • Initial and final temperature = t_initial=2, t_final=0.5
    Set in Section 5.2; these values shape the exploration-exploitation schedule in Eq. 8.
assumptions (4)
  • domain assumption BERT's masked-token predictions can serve as a generative policy for adversarial prompts.
    APD uses BERT/ALBERT/RoBERTa as student models and updates prompts via masking in Section 4.2.2 and Algorithm 1. This assumes encoder-only MLMs can effectively generate or complete adversarial prompt text.
  • domain assumption KL divergence between Llama and BERT logits after linear projection to a shared dimension transfers jailbreak capability.
    Eq. 6 and Eq. 7 assume that aligning output distributions across architecturally different models (causal decoder vs masked encoder, different tokenizers) preserves attack efficacy.
  • domain assumption GPT-4o binary judgment is a reliable measure of harmful response.
    ASRl and the harmfulness reward rely on GPT-4o as an evaluator (Sections 5.1.2 and B.2.2). If the judge is gameable or biased, the reported ASRl does not reflect genuine harm.
  • domain assumption Absence of refusal keywords is a valid indicator of attack success.
    ASRk checks only whether a response lacks rejection phrases (Table 7). Non-refusal responses can still be evasive or non-harmful, so ASRk may overestimate true jailbreak success.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Efficient and Stealthy Jailbreak Attacks via Adversarial Prompt Distillation from LLMs to SLMs." pith.science (2026). https://pith.science/paper/IXHEDSOJ

@misc{pith2026250617231,
  author       = {Pith},
  title        = {Pith review of: Efficient and Stealthy Jailbreak Attacks via Adversarial Prompt Distillation from LLMs to SLMs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/IXHEDSOJ}},
  note         = {Machine review of arXiv:2506.17231}
}
read the original abstract

Current jailbreak attacks on large language models (LLMs) predominantly rely on LLMs themselves to generate adversarial prompts, creating a critical efficiency bottleneck: each attack requires substantial computational resources and API queries, limiting scalability and practical deployment. To overcome this limitation, we propose Adversarial Prompt Distillation (APD), a novel framework that transfers jailbreaking capabilities from LLMs to small language models (SLMs) for efficient, low-resource attacks. APD integrates three key components: (1) masked adversarial knowledge pre-training via LoRA fine-tuning, (2) dynamic temperature-controlled knowledge distillation to bridge architectural gaps, and (3) reinforcement learning-based template optimization for adaptive refinement. Extensive experiments across 12 models show that APD achieves state-of-the-art attack success rates (e.g., 96.4% ASR_k on GPT-4) while dramatically improving efficiency - generating prompts 3.7x faster with 11.3x fewer parameters than teacher models. Our work establishes the first practical framework for lightweight jailbreak attacks, exposes new vulnerabilities in LLM defenses, and provides a scalable testbed for advancing AI safety research. Our code is available at: https://github.com/lxgem/Efficient_and_Stealthy_Jailbreak_Attacks_via_Adversarial_Prompt.

Figures

Figures reproduced from arXiv: 2506.17231 by the authors.

Figure 1
Figure 1. Measuring the complexity of Mainstream generative jailbreaks. The left shows the time com￾plexity, and the right shows the space complexity. GCG AutoDAN VERA ObscurePrompt Attack Method 0 10 20 30 40 Time per Attack (min) GCG AutoDAN VERA ObscurePrompt Attack Method 0 20 40 60 80 Memory Demand (GB) As the scale and complexity of jailbreak attack models for large language models (LLMs) con￾tinue to grow, their effici… view at source ↗
Figure 2
Figure 2. The structure of APD framework: a). The pre-training phase. b). The Model distillation and reinforcement optimization attack stage. This framework is a multi-stage knowledge distillation method that aims to transfer the knowledge and ability of Llama adversarial generation as a teacher model to BERT as a lightweight student model. Jailbreak Defense. A jailbreak defense enhances M’s robustness, yielding a defended mo… view at source ↗
Figure 3
Figure 3. The trends of ASRk and ASRl for Llama-2-7b = 0.3 = 0.5 = 0.8 Temperature decay rate 85 88 91 94 97 100 Attack Success Rate (%) 85.4 94.1 95.0 97.8 93.7 91.0 Llama2-13B ASRk ASRl [PITH_FULL_IMAGE:figures/full_fig_p011_3.png] view at source ↗
Figures from the paper (2 more)
Figure 5
Figure 5. Figure 5: The variation of ASRk with the number of attacks k 20 40 60 80 100 Number of attacks k 0 20 40 60 80 100 A S Rl (%) GPT-3.5-Turbo GPT-4o LLaMA-2-7B Vicuna-7B [PITH_FULL_IMAGE:figures/full_fig_p011_5.png]
Figure 7
Figure 7. Figure 7: The details of ASRl are presented as follows: This metric evaluates attack success by submitting the LLM response to GPT-4o, which determines if harmful outputs are produced based on the instruction to answer ”yes” or ”no,” ensuring standardized judgment and effectivel…

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. A Systematic Survey on Large Language Models for Evolutionary Optimization: From Modeling to Solving

    cs.NE 2025-09 conditional novelty 4.0 of 10

    A literature survey that classifies LLM-based optimization research into modeling and solving, with solving divided into LLMs as optimizers, low-level components, and high-level managers.

Reference graph

Works this paper leans on

23 extracted references · 6 canonical work pages · cited by 1 Pith paper

  1. [1]

    Public Constitutional AI

    Gilad Abiri. Public constitutional ai.arXiv preprint arXiv:2406.16696,

    work page Pith review arXiv

  2. [6]

    Understanding dataset difficulty with v-usable information.URL https://arxiv

    Kawin Ethayarajh, Yejin Choi, and Swabha Swayamdipta. Understanding dataset difficulty with v-usable information.URL https://arxiv. org/abs/2110.08420,

    arXiv

  3. [8]

    Distilling the knowledge in a neural network.arXiv preprint arXiv:1503.02531,

    Geoffrey Hinton, Oriol Vinyals, and Jeff Dean. Distilling the knowledge in a neural network.arXiv preprint arXiv:1503.02531,

    arXiv

  4. [12]

    Data-free knowledge distillation for deep neural networks.arXiv preprint arXiv:1710.07535,

    Raphael Gontijo Lopes, Stefano Fenu, and Thad Starner. Data-free knowledge distillation for deep neural networks.arXiv preprint arXiv:1710.07535,

    arXiv

  5. [13]

    Decoupled weight decay regularization.arXiv preprint arXiv:1711.05101,

    Ilya Loshchilov and Frank Hutter. Decoupled weight decay regularization.arXiv preprint arXiv:1711.05101,

    arXiv

  6. [14]

    Harmbench: A standardized evaluation framework for automated red teaming and robust refusal.arXiv preprint arXiv:2402.04249,

    Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, et al. Harmbench: A standardized evaluation framework for automated red teaming and robust refusal.arXiv preprint arXiv:2402.04249,

    arXiv

  7. [15]

    Fitnets: Hints for thin deep nets.arXiv preprint arXiv:1412.6550,

    Adriana Romero, Nicolas Ballas, Samira Ebrahimi Kahou, Antoine Chassang, Carlo Gatta, and Yoshua Bengio. Fitnets: Hints for thin deep nets.arXiv preprint arXiv:1412.6550,

    arXiv

  8. [16]

    Great, now write an article about that: The crescendo multi-turn llm jailbreak attack.arXiv preprint arXiv:2404.01833,

    Mark Russinovich, Ahmed Salem, and Ronen Eldan. Great, now write an article about that: The crescendo multi-turn llm jailbreak attack.arXiv preprint arXiv:2404.01833,

    arXiv

Show all 23 references
  1. [17]

    Blackdan: A black-box multi-objective approach for effective and contextual jailbreaking of large language models.arXiv preprint arXiv:2410.09804,

    Xinyuan Wang, Victor Shea-Jay Huang, Renmiao Chen, Hao Wang, Chengwei Pan, Lei Sha, and Minlie Huang. Blackdan: A black-box multi-objective approach for effective and contextual jailbreaking of large language models.arXiv preprint arXiv:2410.09804,

    arXiv

  2. [18]

    Invisible prompts, visible threats: Malicious font injection in external resources for large language models

    14 Preprint Junjie Xiong, Changjia Zhu, Shuhang Lin, Chong Zhang, Yongfeng Zhang, Yao Liu, and Lingyao Li. Invisible prompts, visible threats: Malicious font injection in external resources for large language models. In Christos Christodoulopoulos, Tanmoy Chakraborty, Carolyn ...

    2025

  3. [20]

    Llm- virus: Evolutionary jailbreak attack on large language models.arXiv preprint arXiv:2501.00055,

    Miao Yu, Junfeng Fang, Yingjie Zhou, Xing Fan, Kun Wang, Shirui Pan, and Qingsong Wen. Llm- virus: Evolutionary jailbreak attack on large language models.arXiv preprint arXiv:2501.00055,

    arXiv

  4. [21]

    Fine-tuning language models from human preferences.arXiv preprint arXiv:1909.08593,

    Daniel M Ziegler, Nisan Stiennon, Jeffrey Wu, Tom B Brown, Alec Radford, Dario Amodei, Paul Christiano, and Geoffrey Irving. Fine-tuning language models from human preferences.arXiv preprint arXiv:1909.08593,

    1909 arXiv

  5. [22]

    Universal and transferable adversarial attacks on aligned language models.arXiv preprint arXiv:2307.15043,

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models.arXiv preprint arXiv:2307.15043,

    arXiv

  6. [23]

    15 Preprint APPENDIX A VICTIMMODELSDETAILS ChatGPT:This dialogue generation model developed by OpenAI can produce conversations that closely mimic human interactions Radford et al. (2020). Through training on a large number of datasets, it acquires extensive knowledge and insi...

    2020

  7. [2014]

    Albert: A lite bert for self-supervised learning of language representations.arXiv preprint arXiv:1909.11942,

    Zhenzhong Lan, Mingda Chen, Sebastian Goodman, Kevin Gimpel, Piyush Sharma, and Radu Soricut. Albert: A lite bert for self-supervised learning of language representations.arXiv preprint arXiv:1909.11942,

    1909 arXiv

  8. [2017]

    Bert: Pre-training of deep bidirectional transformers for language understanding

    Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. InProceedings of the 2019 conference of the North American chapter of the association for computational linguistics: human langua...

    2019

  9. [2019]

    The llama 3 herd of models

    Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. The llama 3 herd of models. arXiv preprint arXiv:2407.21783,

    arXiv

  10. [2020]

    Adam: A method for stochastic optimization.arXiv preprint arXiv:1412.6980,

    Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization.arXiv preprint arXiv:1412.6980,

    arXiv

  11. [2021]

    Controllable preference optimization: Toward controllable multi-objective alignment.arXiv preprint arXiv:2402.19085,

    Yiju Guo, Ganqu Cui, Lifan Yuan, Ning Ding, Zexu Sun, Bowen Sun, Huimin Chen, Ruobing Xie, Jie Zhou, Yankai Lin, et al. Controllable preference optimization: Toward controllable multi-objective alignment.arXiv preprint arXiv:2402.19085,

    arXiv

  12. [2022]

    Gasp: Efficient black-box generation of adversarial suffixes for jailbreaking llms

    Advik Raj Basani and Xiao Zhang. Gasp: Efficient black-box generation of adversarial suffixes for jailbreaking llms. InICLR 2025 Workshop on Building Trust in Language Models and Applications,

    2025

  13. [2023]

    Aligning large language models with human preferences through representation engineering.arXiv preprint arXiv:2312.15997, 2023a

    13 Preprint Wenhao Liu, Xiaohua Wang, Muling Wu, Tianlong Li, Changze Lv, Zixuan Ling, Jianhao Zhu, Cenyuan Zhang, Xiaoqing Zheng, and Xuanjing Huang. Aligning large language models with human preferences through representation engineering.arXiv preprint arXiv:2312.15997, 2023...

    arXiv

  14. [2024]

    Constitutional ai: Harmlessness from ai feedback.arXiv preprint arXiv:2212.08073,

    Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, Jackson Kernion, Andy Jones, Anna Chen, Anna Goldie, Azalia Mirhoseini, Cameron McKinnon, et al. Constitutional ai: Harmlessness from ai feedback.arXiv preprint arXiv:2212.08073,

    arXiv

  15. [2025]

    ISBN 979-8-89176-335-7

    Association for Computational Linguistics. ISBN 979-8-89176-335-7. doi: 10.18653/v1/2025.findings-emnlp.376. URL https://aclanthology. org/2025.findings-emnlp.376/. Sibo Yi, Yule Liu, Zhen Sun, Tianshuo Cong, Xinlei He, Jiaxing Song, Ke Xu, and Qi Li. Jailbreak attacks and def...

    2025 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.