Pith. sign in

REVIEW 3 major objections 6 minor 1 cited by

Tuning without Peeking: Provable Generalization Bounds and Robust LLM Post-Training

T0 review · 3 major / 6 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Post-training an LLM by comparisons only bounds the generalization gap by trajectory bits, not parameter count.

desk verdict The theory is sound but the experiments outrun it: the D-CMA runs don't satisfy the paper's own branching-factor assumptions. read the letter →

arxiv 2507.01752 v4 pith:P3KE6VFC submitted 2025-07-02 cs.LG cs.AIcs.CLcs.CR

Ismail Labiad , Mathurin Videau , Matthieu Kowalski , Marc Schoenauer , Alessandro Leite , Julia Kempe , Olivier Teytaud This is my paper · ORCID
classification cs.LGcs.AIcs.CLcs.CR MSC 68Q3268T07
keywords comparison-basedoptimizationLLMpost-traininggeneralizationboundsdatapoisoningprivacybydesignmembershipinferenceevolutionaryretrofittingblack-box
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that post-training a large language model with an optimizer that only receives comparison outcomes — for example, which of two models is better on a dataset — compresses the entire training signal into a few bits, and that this compression yields a non-vacuous generalization bound. Concretely, with branching factor $k_i$ per iteration and $s$ samples, the generalization gap obeys $\mathbb{P}(|\hat L(\hat x)-L(\hat x)|\ge \varepsilon)\le 2\exp(\ln 2\sum_i \log_2 k_i - 2s\varepsilon^2)$, with no dependence on the number of optimized parameters. The same information-flow argument gives bounds on poisoning tolerance and on resistance to data extraction. The authors support the theory with experiments on billion-scale LLMs showing that a few hundred black-box evaluations improve GSM8K accuracy and leave membership-inference signals orders of magnitude smaller than fine-tuning. A sympathetic reader would care because this offers one of the few routes to non-vacuous overfitting guarantees for deployed LLMs, at the cost of replacing gradients with comparison queries.

What carries the argument

The load-bearing object is the comparison bottleneck in Alg. 1: at each iteration the only data-dependent object is $\mathrm{choice}_i\in\{1,\dots,k_i\}$, with branching factor $k_i=\mathrm{numCases}()$, and the optimizer's internal state is $I_i=(I_{i-1},\mathrm{choice}_i)$. This makes the final model depend on the dataset through at most $\prod_i k_i$ possibilities, so the number of internal states bounds the number of hypotheses. The proof machinery is a Bonferroni/union bound over those states combined with concentration (Hoeffding or Bennett–Bernstein) for the per-model deviation.

What would settle it

Run the same GSM8K retrofitting schedule but change a.compare to return the raw empirical accuracy difference (a floating-point number, not a binary choice), and measure the true generalization gap on a fixed test set across seeds: if the gap exceeds the Cor. 1 bound $2^{b+1}\exp(-2s\varepsilon^2)$ more often than the allowed confidence, the compression premise is violated.

Watch

Extended reading notes

Core claim

The central discovery is that the final model produced by BBoxER is a deterministic function of the initial model, the seed, and a list of $b$ comparison bits: the dataset enters only through a compression bottleneck $c=(\mathrm{choice}_1,\dots,\mathrm{choice}_b)$ (Eq. 3). Counting the reachable internal states of the optimizer gives $N(\omega,a,b)\le \sup_{D}\prod_i k_i$ (Eq. 4), and a union bound over those states converts a single-model concentration inequality into a uniform bound over all models the optimizer can ever output. Consequently the generalization gap is controlled by the optimization trajectory's bit budget rather than the model dimension, poisoning of up to $m$ preference signals per round changes the output with probability at most $(2m+1)b/\sqrt{2s\pi}$, and if there are more than $\prod_i k_i$ candidate training datasets no extractor can identify which one was used.

Load-bearing premise

The whole argument rests on the optimizer's internal state being a deterministic function of the seed and $b$ discrete comparison outcomes — if any continuous loss value, gradient, or raw model output enters the update, the compression bound and all guarantees collapse.

Editorial extensions

If this is right

  • With $k_i\le 2$, the generalization bound is $2^{b+1}\exp(-2s\varepsilon^2)$; for fixed target confidence the permissible number of iterations grows linearly in dataset size $s$.
  • Bet-and-Run variants, which split the budget among several independent runs and keep the best, cut the effective branching factor and allow larger total budgets without increasing the overfitting bound.
  • Because at most $\prod_i k_i$ outputs exist, any set of more than $\prod_i k_i$ distinct training datasets is indistinguishable to an extraction attacker; for binary comparisons that is $2^b$ outputs, so extraction fails when the number of dataset variants exceeds $2^b$.
  • An adversary wanting to flip the optimization outcome must corrupt on the order of $\sqrt{s}/b$ preference signals per round, and the probability of a different final model under $m$ corruptions per round is at most $(2m+1)b/\sqrt{2s\pi}$.
  • Empirically, with budgets of 150–300 evaluations, D-CMA-style optimizers improve GSM8K exact match on Llama-3.1-8B and Qwen-2.5-3B (both base and instruct) and transfer positively to GSM+, while changing per-sample NLL far less than supervised fine-tuning at matched accuracy.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The bound suggests a practical contract: an operator can precompute the maximum safe budget from $s$ and a target gap $\varepsilon$ before training, and any deployment that stays within it inherits the guarantee without needing a held-out set.
  • The argument would extend to any optimizer whose feedback is discrete with a small alphabet — quantized rewards, clipped scores, or a finite set of A/B outcomes — not just binary preferences; this follows from replacing $k_i=2$ by a larger finite value, though the paper only analyzes comparisons.
  • The practical privacy guarantee in the A/B setting depends on the operator never feeding prompts or outputs into the loop; the accuracy-based experiments do pass outputs through the model, so their membership-inference results are evidence for low signal leakage, not a proof of it.
  • A testable prediction: adding a continuous or high-precision evaluation channel (raw accuracy, log-likelihood) should make the generalization gap eventually exceed the comparison-only bound as the channel's bit capacity grows.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper introduces BBoxER, a black-box evolutionary post-training framework for LLMs. The method is explicitly comparison-based: at each iteration the optimizer receives only a finite-valued comparison outcome (branching factor k_i), so the whole dataset is compressed into a b-step comparison trace. The main theoretical contribution is Corollary 1, which bounds the generalization gap by 2^b exp(-2sε²) when k_i ≤ 2; this is parameter-count-free and non-vacuous for small budgets. The paper also gives a poisoning bound (Thm 2) and an extraction-attack bound (Cor 2). Experiments on Llama-3.1-8B and Qwen-2.5-3B report GSM8K improvements with Nevergrad algorithms (D-CMA, OneFifth, Lengler, variants), plus a membership-inference experiment. The empirical section claims that budgets of 150-300, and bet-and-run variants up to 1200, remain consistent with the theory.

Significance. If the comparison-trace bottleneck is genuine, the paper offers an unusual and attractive type of guarantee: generalization control that is independent of the number of optimized parameters, plus certified robustness to poisoning and extraction, all from a short sequence of binary choices. The proofs are elementary and transparent, with no fitted constants, and the scaling prediction (allowable budget grows linearly in the dataset size) is falsifiable. This is a real strength. However, the value of the contribution depends on whether the headline experiments actually respect the comparison-only interface, and the paper does not currently demonstrate that for its main algorithm, D-CMA. The theoretical framework may be sound for genuinely comparison-based algorithms such as OneFifth, but the gap between the framework and the experiments is large enough to affect the central empirical claim.

major comments (3)
  1. [Corollary 1 vs. Sec. H and Sec. E.5] The central bound (Eq. 7) does not govern the D-CMA experiments that provide the headline empirical results. Alg. 1 requires that the dataset-dependent signal is a single comparison outcome with a finite branching factor, and that tell() receives only that choice. Section H states that all algorithms are used with Nevergrad defaults and that 'the objective function to optimize is the exact match', which means real-valued accuracies on the 7,473 GSM8K training items are passed to the optimizer. Standard rank-weighted D-CMA uses the complete ranking of λ offspring, and Section E.5 explicitly concedes that a complete ranking adds a factor μ! to the branching factor. With d = 132,352 (Exp. 1) or 266,240 (Exp. 3), the Nevergrad default λ ≈ 4 + 3 log d is roughly 39-50, so one generation carries log2(λ!) ≈ 160-215 bits of dataset-dependent information, not one bit. Hence the product ∏ k_i is many orders of magnitude larger than 2^b for these runs, and Cor. 1 with k_i = 2 cannot certify them. The row 'D-CMA with distinct weights 2×√μ' in Table 4 does not repair this, because the actual algorithm still consumes the full ordering; even taking 2√μ at face value with μ≈20 gives branching factor about 9 per step, producing a vacuous bound at b=150. The authors should either restrict the theoretical claims to genuinely comparison-based instantiations or re-run the experiments using a tell() interface that passes only a discrete comparison.
  2. [§5 and Eq. (8)] The certified budgets do not cover most of the reported experiments. From Eq. (8) with s = 7,473 and δ = 1/2, the budget that guarantees a gap at most ε is b ≤ 213 for ε = 0.1 and b ≤ 52 for ε = 0.05. Yet Figure 1, Tables 1, 2, 6, and 7 report b = 150, 300, 450, 600, 900, and 1200. Thus even for the case k_i = 2 (e.g., OneFifth), the bounds in Cor. 1 do not apply to the b = 300 and larger runs, and at the more meaningful precision ε = 0.05 they do not apply even to b = 150. The paper's statement that experiments use 'budgets b determined theoretically for guaranteed generalization' is therefore misleading for a large fraction of the results. Running beyond the certified range is legitimate as an empirical exploration, but those runs cannot be presented as evidence that the non-vacuous guarantee holds.
  3. [§4.2 and Sec. H (Experiment 4)] The privacy-by-design claim is scoped in the text to the A/B testing scenario, where the algorithm sees only binary preference signals and never prompts or outputs, but this scope is not respected by the main experiments. Experiments 1-3 compute exact-match accuracy on GSM8K-train, which requires running the model on the prompts and comparing generated outputs to gold answers; changing a prompt can change the comparison outcome, so the 'inputs/outputs may vary arbitrarily without changing the output' statement does not hold for these runs. The abstract and introduction assert privacy by design without that qualification. The membership-inference experiment (Tab. 3) is an empirical proxy on the accuracy-based protocol; it is useful, but it does not inherit the theoretical privacy guarantee of Sec. 4.2. The paper should either qualify the privacy claim to the A/B setting or provide a separate theoretical treatment for accuracy-based comparison signals.
minor comments (6)
  1. [Alg. 1 and Sec. 3.1] The quantity N(ω,a,b) is used in Eq. (4) before it is defined in the surrounding text; define it in Section 3.1 or at the start of Section 4.1.
  2. [Sec. H] Please state explicitly how each algorithm's tell() is called in the code: whether the real-valued exact-match accuracy is passed to the optimizer or only a binary comparison result. This determines whether the assumptions of Cor. 1 hold, and the current text is ambiguous.
  3. [Thm. 2 and Eq. (9)] In Eq. (9) the expression b(2m+1)√(2sπ) should read b(2m+1)/√(2sπ); the division is present in the proof but missing in the displayed theorem.
  4. [Sec. E.7] The line 'δ≤ 2 × (2b) exp(−sϵ2)' appears to mix 2b and 2^b; please correct the typo and re-derive the displayed inequality.
  5. [Figure 1 and Sec. 5] The caption says D-CMA improves 'even for budgets above those computed from our theory (b > 150)', but the corresponding ε and δ are not given; state them so the reader can check the claim.
  6. [Sec. D.1 and Table 4] The sentence 'Most BBO algorithms used within BBoxER bound the average ki by 2 or 3' is inconsistent with Table 4's 'D-CMA with distinct weights 2×√μ' entry; clarify which algorithms are covered by the k_i=2 statement.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the generalization, poisoning, and extraction bounds follow from a defined compression trace, a union bound, and standard concentration inequalities, not from the target result.

full rationale

The paper's central derivation is self-contained: Algorithm 1 defines a.compare as returning one of k_i possible choices, and Eq. (3) makes the final model a deterministic function of the seed, the algorithm, the budget, and the comparison choices (choice_1,...,choice_b). Theorem 1 is then just a union bound over the at most N(omega,a,b) <= product k_i reachable internal states, with no assumption that the generalization bound being proved is true. Corollary 1 substitutes Hoeffding's inequality, a standard external concentration result, and the bound follows arithmetically. The branching-factor values for CMA/D-CMA, DE, PSO, and bet-and-run variants are attributed to Fournier and Teytaud [95], an independent peer-reviewed publication with parameter-free assumptions; although one of the present authors is also an author of [95], the cited result does not depend on the present paper's conclusions and is not used to forbid alternative explanations. The poisoning bound (Thm 2) is a direct application of a binomial concentration lemma plus a Bonferroni correction, and the extraction bound (Cor 2) is a counting argument from Eq. (1). No fitted parameter is renamed as a prediction, and no ansatz is smuggled in through a self-citation. The skeptical concern that the D-CMA experiments pass full exact-match accuracies rather than binary comparisons, if substantiated, would mean Eq. (3) and Cor. 1 do not apply to those specific runs; that is a potential mismatch between assumptions and experimental protocol, not a circular derivation. Conditional on the stated comparison-only interface, the theoretical claims are derived rather than assumed.

Assumptions & free parameters 2 free parameters · 6 assumptions · 0 invented entities

The main free parameters are the 0.01 multiplicative update scale and the chosen budgets. The axioms are standard concentration assumptions, the finite branch factor assumption that makes the compression argument work, and the corrupt-data model. No invented entities are introduced.

free parameters (2)
  • update_constant = 0.01 (0.0001 in some variants)
    Scaling factor in the multiplicative update exp(0.01*x) applied to model weights; chosen by hand, not fitted to data, but it strongly influences the optimization landscape and is not justified by theory.
  • budget b = 150, 300, 1200 depending on experiment
    Number of black-box evaluations; chosen to be small enough for tractability and according to the theoretical budget formula, but experiments often exceed the safe range.
assumptions (6)
  • domain assumption Empirical loss is a good proxy for true loss: for all x, P(|L̂(x)-L(x)|>ε) ≤ δ_{1,ε} (Eq A.1)
    Standard concentration assumption; invoked in Thm 1 and Cor 1.
  • standard math Hoeffding's inequality applies: individual losses in [0,1] and data points i.i.d.
    Used for Cor 1 with δ = 2 exp(−2sε²).
  • domain assumption Each comparison has at most k_i possible outcomes (finite branching factor), and the internal state I_i is determined by (ω, choices)
    Core to the compression argument; defined in Alg 1 and used in Eq 4.
  • domain assumption The adversary is limited to corrupting at most m out of s preference signals per iteration
    Poisoning model in Thm 2, following the standard model of [51].
  • domain assumption Preference signals r_i are i.i.d. Bernoulli with unknown probability p
    Used in Lemma 1 to bound the probability of majority flip.
  • domain assumption 'Unrelated' datasets differ by at least one bit per k and are distinct
    Needed for the extraction vulnerability definition and Cor 2.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Tuning without Peeking: Provable Generalization Bounds and Robust LLM Post-Training." pith.science (2026). https://pith.science/paper/P3KE6VFC

@misc{pith2026250701752,
  author       = {Pith},
  title        = {Pith review of: Tuning without Peeking: Provable Generalization Bounds and Robust LLM Post-Training},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/P3KE6VFC}},
  note         = {Machine review of arXiv:2507.01752}
}
read the original abstract

Gradient-based optimization is the workhorse of deep learning, offering efficient and scalable training via backpropagation. However, exposing gradients during training can leak sensitive information about the underlying data, raising privacy and security concerns such as susceptibility to data poisoning attacks. In contrast, black-box optimization methods, which treat the model as an opaque function, relying solely on function evaluations to guide optimization, offer a promising alternative in scenarios where data access is restricted, adversarial risks are high, or overfitting is a concern. This paper introduces BBoxER, an evolutionary black-box method for LLM post-training that induces an information bottleneck via implicit compression of the training data. Leveraging the tractability of information flow, we provide non-vacuous generalization bounds and strong theoretical guarantees for robustness to data poisoning attacks and extraction attacks, while ensuring privacy by design. In experiments with LLMs, we demonstrate empirically that black-box optimization methods-despite the scalability and computational challenges inherent to black-box approaches-are able to learn, showing how a few iterations of BBoxER improve performance, generalize well on a benchmark of reasoning datasets, and are robust to membership inference attacks. This positions BBoxER as an attractive add-on on top of gradient-based optimization, offering suitability for deployment in restricted environments while also providing non-vacuous generalization guarantees.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Emergent Misalignment Recruits a Pre-existing Persona Subspace

    cs.LG 2026-07 conditional novelty 7.0 of 10

    Fine-tuning on narrow bad data recruits a low-rank persona subspace already present in a frozen instruction-tuned model; holding that subspace out of activations prevents broad misalignment, and injecting it into the ...

Reference graph

Works this paper leans on

128 extracted references · 61 canonical work pages · cited by 1 Pith paper

  1. [1]

    Scaling laws for neural language models

    Jared Kaplan, Sam McCandlish, Tom Henighan, et al. Scaling laws for neural language models. arXiv:2001.08361, 2020. 1

    arXiv 2001

  2. [2]

    Emergent abilities of large language models.Transactions on Machine Learning Research, 2022

    Jason Wei, Yi Tay, Rishi Bommasani, et al. Emergent abilities of large language models.Transactions on Machine Learning Research, 2022. 1

    2022

  3. [3]

    Reconstructing training data from trained neural networks.Advances in Neural Information Processing Systems, 35:22911–22924, 2022

    Niv Haim, Gal Vardi, Gilad Yehudai, Ohad Shamir, and Michal Irani. Reconstructing training data from trained neural networks.Advances in Neural Information Processing Systems, 35:22911–22924, 2022. 1, 29

    2022

  4. [4]

    Extracting training data from large language models

    Nicholas Carlini, Florian Tramer, Eric Wallace, et al. Extracting training data from large language models. In30th USENIX security symposium, pages 2633–2650, 2021. 6, 9, 29, 32

    2021

  5. [5]

    Feder Cooper, Katherine Lee, Matthew Jagielski, Milad Nasr, Arthur Conmy, Eric Wallace, David Rolnick, and Florian Tramèr

    Nicholas Carlini, Daniel Paleka, Krishnamurthy Dj Dvijotham, Thomas Steinke, Jonathan Hayase, A. Feder Cooper, Katherine Lee, Matthew Jagielski, Milad Nasr, Arthur Conmy, Eric Wallace, David Rolnick, and Florian Tramèr. Stealing part of a production language model. In Ruslan Salakhutdinov, Zico Kolter, Katherine Heller, et al., editors,41st International ...

    2024

  6. [6]

    Deep leakage from gradients.Advances in neural information processing systems, 32, 2019

    Ligeng Zhu, Zhijian Liu, and Song Han. Deep leakage from gradients.Advances in neural information processing systems, 32, 2019. 1, 29

    2019

  7. [7]

    Deep models under the gan: Information leakage from collaborative deep learning

    Briland Hitaj, Giuseppe Ateniese, and Fernando Perez-Cruz. Deep models under the gan: Information leakage from collaborative deep learning. InACM SIGSAC Conference on Computer and Communications Security, pages 603–618, 2017. 1, 29

    2017

  8. [8]

    Poisoning language models during instruction tuning

    Alexander Wan, Eric Wallace, Sheng Shen, and Dan Klein. Poisoning language models during instruction tuning. In Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engelhardt, Sivan Sabato, and Jonathan Scarlett, editors,40th International Conference on Machine Learning, volume 202, pages 35413–35425, 2023. 1, 30

    2023

Show all 128 references
  1. [9]

    Preserving privacy in large language models: A survey on current threats and solutions.Transactions on Machine Learning Research, 2025

    Michele Miranda, Elena Sofia Ruzzetti, Andrea Santilli, Fabio Massimo Zanzotto, Sébastien Bratières, and Emanuele Rodolà. Preserving privacy in large language models: A survey on current threats and solutions.Transactions on Machine Learning Research, 2025. 1

    2025

  2. [10]

    Springer, 1st edition, 2019

    Frank Hutter, Lars Kotthoff, and Joaquin Vanschoren.Automated Machine Learning: Methods, Systems, Challenges. Springer, 1st edition, 2019. 1

    2019

  3. [11]

    Hyperparameter optimization

    Matthias Feurer and Frank Hutter. Hyperparameter optimization. In Frank Hutter, Lars Kotthoff, and Joaquin Vanschoren, editors,Automated Machine Learning: Methods, Systems, Challenges, pages 3–38. Springer, 2019. 1

    2019

  4. [12]

    Neural architecture search: Insights from 1000 papers.arXiv:2301.08727, 2023

    Colin White, Mahmoud Safari, Rhea Sukthanker, Binxin Ru, Thomas Elsken, Arber Zela, Debadeepta Dey, and Frank Hutter. Neural architecture search: Insights from 1000 papers.arXiv:2301.08727, 2023. 1

    2023 arXiv

  5. [13]

    Hansen and A

    N. Hansen and A. Ostermeier. Adapting arbitrary normal mutation distributions in evolution strategies: the covariance matrix adaptation. InIEEE International Conference on Evolutionary Computation, pages 312–317, 1996. 1, 23

    1996

  6. [14]

    Completely derandomized self-adaptation in evolution strategies

    Nikolaus Hansen and Andreas Ostermeier. Completely derandomized self-adaptation in evolution strategies. Evolutionary Computation, 11(1), 2003

    2003

  7. [15]

    The CMA Evolution Strategy: A Tutorial - V2.arXiv:1604.00772, 2023

    Nikolaus Hansen. The CMA Evolution Strategy: A Tutorial - V2.arXiv:1604.00772, 2023. 1, 23

    2023 arXiv

  8. [16]

    Differential Evolution - A Simple and Efficient Heuristic for Global Optimization over Continuous Spaces.Journal of Global Optimization, 11(4):341–359, 1997

    Rainer Storn and Kenneth Price. Differential Evolution - A Simple and Efficient Heuristic for Global Optimization over Continuous Spaces.Journal of Global Optimization, 11(4):341–359, 1997. 1, 23

    1997

  9. [17]

    Eberhart

    James Kennedy and Russell C. Eberhart. Particle Swarm Optimization. InIEEE International Conference on Neural Networks, pages 1942–1948, 1995. 1, 23

    1942

  10. [18]

    J. Močkus. On bayesian methods for seeking the extremum. In G. I. Marchuk, editor,Optimization Techniques IFIP Technical Conference Novosibirsk, July 1–7, 1974, pages 400–404, Berlin, Heidelberg,

    1974

  11. [19]

    The bayesian approach to global optimization

    Jonas Mockus. The bayesian approach to global optimization. In10th IFIP Conference System Modeling and Optimization, pages 473–481, 1981. 11

    1981

  12. [20]

    Cambridge University Press, 2023

    Roman Garnett.Bayesian Optimization. Cambridge University Press, 2023. 1

    2023

  13. [21]

    Evolution strategies as a scalable alternative to reinforcement learning.arXiv:1703.03864, 2017

    Tim Salimans, Jonathan Ho, Xi Chen, Szymon Sidor, and Ilya Sutskever. Evolution strategies as a scalable alternative to reinforcement learning.arXiv:1703.03864, 2017. 2, 24

    2017 arXiv

  14. [22]

    On the exploitability of instruction tuning

    Manli Shu, Jiongxiao Wang, Chen Zhu, et al. On the exploitability of instruction tuning. In Alice Oh, Tristan Naumann, Amir Globerson, et al., editors,36th Annual Conference on Neural Information Processing Systems, 2023. 2

    2023

  15. [23]

    Catastrophic jailbreak of open- source LLMs via exploiting generation

    Yangsibo Huang, Samyak Gupta, Mengzhou Xia, Kai Li, and Danqi Chen. Catastrophic jailbreak of open- source LLMs via exploiting generation. In12th International Conference on Learning Representations,

  16. [24]

    Unveiling the generalization power of fine-tuned large language models

    Haoran Yang, Yumeng Zhang, Jiaqi Xu, Hongyuan Lu, Pheng-Ann Heng, and Wai Lam. Unveiling the generalization power of fine-tuned large language models. In Kevin Duh, Helena Gomez, and Steven Bethard, editors,Proceedings of the 2024 Conference of the North American Chapter of th...

    2024

  17. [25]

    RLHFPoison: Reward poisoning attack for reinforcement learning with human feedback in large language models

    Jiongxiao Wang, Junlin Wu, Muhao Chen, Yevgeniy Vorobeychik, and Chaowei Xiao. RLHFPoison: Reward poisoning attack for reinforcement learning with human feedback in large language models. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar, editors,62nd Annual Meeting of the Asso...

    2024

  18. [26]

    Best-of-venom: Attacking RLHF by injecting poisoned preference data

    Tim Baumgärtner, Yang Gao, Dana Alon, and Donald Metzler. Best-of-venom: Attacking RLHF by injecting poisoned preference data. InFirst Conference on Language Modeling, 2024. 2, 3, 18

    2024

  19. [27]

    Universal jailbreak backdoors from poisoned human feedback

    Javier Rando and Florian Tramèr. Universal jailbreak backdoors from poisoned human feedback. In12th International Conference on Learning Representations, 2024. 2

    2024

  20. [28]

    Is poisoning a real threat to DPO? maybe more so than you think.AAAI Conference on Artificial Intelligence, 39(26):27556–27564, 2025

    Pankayaraj Pathmanathan, Souradip Chakraborty, Xiangyu Liu, Yongyuan Liang, and Furong Huang. Is poisoning a real threat to DPO? maybe more so than you think.AAAI Conference on Artificial Intelligence, 39(26):27556–27564, 2025. 2, 30

    2025

  21. [29]

    Retrofitting word vectors to semantic lexicons

    Manaal Faruqui, Jesse Dodge, Sujay Kumar Jauhar, Chris Dyer, Eduard Hovy, and Noah A Smith. Retrofitting word vectors to semantic lexicons. InProceedings of the 2015 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Techn...

    2015

  22. [30]

    Evolutionary retrofitting.arXiv:2410.11330, 2024

    Mathurin Videau, Mariia Zameshina, Alessandro Leite, Laurent Najman, Marc Schoenauer, and Olivier Teytaud. Evolutionary retrofitting.arXiv:2410.11330, 2024. 2, 3, 21

    2024

  23. [31]

    DeepSeekMath: Pushing the Limits of Mathematical Reasoning in Open Language Models.arXiv:2402.03300, 2024

    Zhihong Shao, Peiyi Wang, Qihao Zhu, et al. DeepSeekMath: Pushing the Limits of Mathematical Reasoning in Open Language Models.arXiv:2402.03300, 2024. 2, 3, 18, 25

    2024 arXiv

  24. [32]

    Rapin and O

    J. Rapin and O. Teytaud. Nevergrad - A gradient-free optimization platform. github.com/ FacebookResearch/Nevergrad, 2018. 2, 3, 25, 31

    2018

  25. [33]

    Campi and Simone Garatti

    Marco C. Campi and Simone Garatti. Compression, generalization and learning.Journal of Machine Learning Research, 24(339):1–74, 2023. 2

    2023

  26. [34]

    Zico Kolter, and Chelsea Finn

    Yiding Jiang, Evan Liu, Benjamin Eysenbach, J. Zico Kolter, and Chelsea Finn. Learning options via compression. In S. Koyejo, S. Mohamed, A. Agarwal, et al., editors,Advances in Neural Information Processing Systems, volume 35, pages 21184–21199, 2022. 2

    2022

  27. [35]

    Sanae Lotfi, Marc Anton Finzi, Yilun Kuang, Tim G. J. Rudner, Micah Goldblum, and Andrew Gordon Wilson. Non-vacuous generalization bounds for large language models. In Ruslan Salakhutdinov, Zico Kolter, Katherine Heller, et al., editors,41st International Conference on Machine...

    2024

  28. [36]

    Vapnik and Alexey Y

    Vladimir N. Vapnik and Alexey Y. Chervonenkis. On the uniform convergence of relative frequencies of events to their probabilities.Theory of Probability & Its Applications, 16(2):264–280, 1971. 2

    1971

  29. [37]

    Bartlett and Shahar Mendelson

    Peter L. Bartlett and Shahar Mendelson. Rademacher and gaussian complexities: Risk bounds and structural results.Journal of Machine Learning Research, 3:463–482, 2002. 2 12

    2002

  30. [38]

    Non-vacuous generalization bounds at the imagenet scale: a pac-bayesian compression approach.arXiv:1804.05862,

    Wenda Zhou, Victor Veitch, Morgane Austern, Ryan P Adams, and Peter Orbanz. Non-vacuous generalization bounds at the imagenet scale: a pac-bayesian compression approach.arXiv:1804.05862,

    arXiv

  31. [39]

    Pac-bayes compression bounds so tight that they can explain generalization

    Sanae Lotfi, Marc Finzi, Sanyam Kapoor, Andres Potapczynski, Micah Goldblum, and Andrew G Wilson. Pac-bayes compression bounds so tight that they can explain generalization. In S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh, editors,Advances in Neural Inform...

    2022

  32. [40]

    Algorithmic stability and generalization performance

    Olivier Bousquet and André Elisseeff. Algorithmic stability and generalization performance. In T. Leen, T. Dietterich, and V. Tresp, editors,Advances in Neural Information Processing Systems, volume 13,

  33. [41]

    Exploiting LLM quantization

    Kazuki Egashira, Mark Vero, Robin Staab, Jingxuan He, and Martin Vechev. Exploiting LLM quantization. In A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Paquet, J. Tomczak, and C. Zhang, editors,Advances in Neural Information Processing Systems, volume 37, pages 41709–41732, ...

    2024

  34. [42]

    Privacy backdoors: stealing data with corrupted pretrained models

    Shanglun Feng and Florian Tramèr. Privacy backdoors: stealing data with corrupted pretrained models. In41st International Conference on Machine Learning, pages 13326–13364, 2024. 3

    2024

  35. [43]

    Certified defenses for data poisoning attacks

    Jacob Steinhardt, Pang Wei W Koh, and Percy S Liang. Certified defenses for data poisoning attacks. In Advances in neural information processing systems, pages 3517–3529, 2017. 3, 18

    2017

  36. [44]

    Evolution strategies at scale: Llm fine-tuning beyond reinforcement learning.arXiv preprint arXiv:2509.24372, 2025

    Xin Qiu, Yulu Gan, Conor F Hayes, Qiyao Liang, Elliot Meyerson, Babak Hodjat, and Risto Miikku- lainen. Evolution strategies at scale: Llm fine-tuning beyond reinforcement learning.arXiv preprint arXiv:2509.24372, 2025. 3

    2025 arXiv

  37. [45]

    Evolution strategies at the hyperscale.arXiv preprint arXiv:2511.16652, 2025

    Bidipta Sarkar, Mattie Fellows, Juan Agustin Duque, Alistair Letcher, Antonio León Villares, Anya Sims, Dylan Cope, Jarek Liesen, Lukas Seier, Theo Wolf, et al. Evolution strategies at the hyperscale.arXiv preprint arXiv:2511.16652, 2025. 3

    2025

  38. [46]

    Routledge, 2006

    James Douglas.Building adaptation. Routledge, 2006. 3

    2006

  39. [47]

    Richard Dawson. Re-engineering cities: a framework for adaptation to global change.Philosophical Transactions of the Royal Society A: Mathematical, Physical and Engineering Sciences, 365(1861):3085– 3098, 2007

    2007

  40. [48]

    Scaling up: the challenges of urban retrofit.Building research & information, 41(5):499–503, 2013

    Tim Dixon and Malcolm Eames. Scaling up: the challenges of urban retrofit.Building research & information, 41(5):499–503, 2013. 3

    2013

  41. [49]

    van der Vaart and J.A

    A. van der Vaart and J.A. Wellner.Weak Convergence and Empirical Processes: With Applications to Statistics. Springer, 1996. 5, 18, 21

    1996

  42. [50]

    Vapnik.The Nature of Statistical Learning Theory

    Vladimir N. Vapnik.The Nature of Statistical Learning Theory. Springer-Verlag, 1995. ISBN 0-387-94559-8. 5, 18, 21

    1995

  43. [51]

    Learning in the presence of malicious errors.SIAM Journal on Computing, 22(4):807–837, 1993

    Michael Kearns and Ming Li. Learning in the presence of malicious errors.SIAM Journal on Computing, 22(4):807–837, 1993. 6, 18, 30

    1993

  44. [52]

    Lemley, and Percy Liang

    Peter Henderson, Xuechen Li, Dan Jurafsky, Tatsunori Hashimoto, Mark A. Lemley, and Percy Liang. Foundation models and fair use.Journal of Machine Learning Research, 24(400):1–79, 2023. 6

    2023

  45. [53]

    Training verifiers to solve math word problems

    Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, et al. Training verifiers to solve math word problems. arXiv:2110.14168, 2021. 7, 18

    2021 arXiv

  46. [54]

    Measuring mathematical problem solving with the MATH dataset

    Dan Hendrycks, Collin Burns, Saurav Kadavath, Akul Arora, Steven Basart, Eric Tang, Dawn Song, and Jacob Steinhardt. Measuring mathematical problem solving with the MATH dataset. In J. Vanschoren and S. Yeung, editors,Neural Information Processing Systems Track on Datasets and...

  47. [55]

    Hellaswag: Can a machine really finish your sentence?arXiv preprint arXiv:1905.07830, 2019

    Rowan Zellers, Ari Holtzman, Yonatan Bisk, Ali Farhadi, and Yejin Choi. Hellaswag: Can a machine really finish your sentence?arXiv preprint arXiv:1905.07830, 2019. 8

    1905 arXiv

  48. [56]

    GSM-Plus: A comprehensive benchmark for evaluating the robustness of LLMs as mathematical problem solvers

    Qintong Li, Leyang Cui, Xueliang Zhao, Lingpeng Kong, and Wei Bi. GSM-Plus: A comprehensive benchmark for evaluating the robustness of LLMs as mathematical problem solvers. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar, editors,62nd Annual Meeting of the Association for Com...

    2024

  49. [57]

    Think you have solved question answering? try arc, the ai2 reasoning challenge

    Peter Clark, Isaac Cowhey, Oren Etzioni, Tushar Khot, Ashish Sabharwal, Carissa Schoenick, and Oyvind Tafjord. Think you have solved question answering? try arc, the ai2 reasoning challenge. arXiv:1803.05457v1, 2018. 8

    2018 arXiv

  50. [58]

    Random gradient-free minimization of convex functions.Founda- tions of Computational Mathematics, 17(2):527–566, 2017

    Yurii Nesterov and Vladimir Spokoiny. Random gradient-free minimization of convex functions.Founda- tions of Computational Mathematics, 17(2):527–566, 2017. 8

    2017

  51. [59]

    Arkil Patel, Satwik Bhattamishra, and Navin Goyal. Are NLP models really able to solve simple math word problems? InConference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 2080–2094, 2021. 8, 18

    2021

  52. [60]

    Practical membership inference attacks against fine-tuned large language models via self-prompt calibration.arXiv preprint arXiv:2311.06062, 2023

    Wenjie Fu, Huandong Wang, Chen Gao, Guanghua Liu, Yong Li, and Tao Jiang. Practical membership inference attacks against fine-tuned large language models via self-prompt calibration.arXiv preprint arXiv:2311.06062, 2023. 9, 32

    2023 arXiv

  53. [61]

    Membership inference attacks from first principles

    Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inference attacks from first principles. In2022 IEEE symposium on security and privacy (SP), pages 1897–1914. IEEE, 2022. 9, 32

    1914

  54. [62]

    Window-based membership inference attacks against fine-tuned large language models.arXiv preprint arXiv:2601.02751, 2026

    Yuetian Chen, Yuntao Du, Kaiyuan Zhang, Ashish Kundu, Charles Fleming, Bruno Ribeiro, and Ninghui Li. Window-based membership inference attacks against fine-tuned large language models.arXiv preprint arXiv:2601.02751, 2026. 9, 33

    2026

  55. [63]

    Kearns and R.E

    M.J. Kearns and R.E. Schapire. Efficient distribution-free learning of probabilistic concepts. In31st Annual Symposium on Foundations of Computer Science, pages 382–391 vol.1, 1990. 18, 21

    1990

  56. [64]

    Uniform convergence may be unable to explain generalization in deep learning.Advances in Neural Information Processing Systems, 32, 2019

    Vaishnavh Nagarajan and J Zico Kolter. Uniform convergence may be unable to explain generalization in deep learning.Advances in Neural Information Processing Systems, 32, 2019. 18

    2019

  57. [65]

    Transformers as algorithms: Generalization and stability in in-context learning

    Yingcong Li, Muhammed Emrullah Ildiz, Dimitris Papailiopoulos, and Samet Oymak. Transformers as algorithms: Generalization and stability in in-context learning. In Andreas Krause, Emma Brunskill, Kyunghyun Cho, Barbara Engelhardt, Sivan Sabato, and Jonathan Scarlett, editors,4...

    2023

  58. [66]

    Targeted backdoor attacks on deep learning systems using data poisoning.arXiv:1712.05526, 2017

    Xinyun Chen, Chang Liu, Bo Li, Kimberly Lu, and Dawn Song. Targeted backdoor attacks on deep learning systems using data poisoning.arXiv:1712.05526, 2017. 18

    2017 arXiv

  59. [67]

    Medical large language models are vulnerable to data-poisoning attacks.Nature Medicine, 31(2):618–626, 2025

    Daniel Alber, Zihao Yang, Anton Alyakin, et al. Medical large language models are vulnerable to data-poisoning attacks.Nature Medicine, 31(2):618–626, 2025. 18

    2025

  60. [68]

    Christiano, Jan Leike, Tom B

    Paul F. Christiano, Jan Leike, Tom B. Brown, Miljan Martic, Shane Legg, and Dario Amodei. Deep reinforcement learning from human preferences. In I. Guyon, U. Von Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett, editors,31st International Conference o...

    2017

  61. [69]

    Direct preference optimization: Your language model is secretly a reward model

    Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. Direct preference optimization: Your language model is secretly a reward model. In A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine, editors,Advances in Ne...

    2023

  62. [70]

    Backdooring instruction-tuned large language models with virtual prompt injection

    Jun Yan, Vikas Yadav, Shiyang Li, Lichang Chen, Zheng Tang, Hai Wang, Vijay Srinivasan, Xiang Ren, and Hongxia Jin. Backdooring instruction-tuned large language models with virtual prompt injection. In Kevin Duh, Helena Gomez, and Steven Bethard, editors,Conference of the Nort...

    2024

  63. [71]

    Poisoning retrieval corpora by injecting adversarial passages

    Zexuan Zhong, Ziqing Huang, Alexander Wettig, and Danqi Chen. Poisoning retrieval corpora by injecting adversarial passages. In Houda Bouamor, Juan Pino, and Kalika Bali, editors,Conference on Empirical Methods in Natural Language Processing, pages 13764–13775, 2023

    2023

  64. [72]

    How Johnny can persuade LLMs to jailbreak them: Rethinking persuasion to challenge AI safety by humanizing LLMs

    Yi Zeng, Hongpeng Lin, Jingwen Zhang, Diyi Yang, Ruoxi Jia, and Weiyan Shi. How Johnny can persuade LLMs to jailbreak them: Rethinking persuasion to challenge AI safety by humanizing LLMs. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar, editors,62nd Annual Meeting of the Ass...

    2024

  65. [73]

    Aligning large language models for faithful integrity against opposing argument.AAAI Conference on Artificial Intelligence, 2025

    Yong Zhao, Yang Deng, See-Kiong Ng, and Tat-Seng Chua. Aligning large language models for faithful integrity against opposing argument.AAAI Conference on Artificial Intelligence, 2025. 18 14

    2025

  66. [74]

    Privacy-preserving instructions for aligning large language models

    Da Yu, Peter Kairouz, Sewoong Oh, and Zheng Xu. Privacy-preserving instructions for aligning large language models. In Ruslan Salakhutdinov, Zico Kolter, Katherine Heller, Adrian Weller, Nuria Oliver, Jonathan Scarlett, and Felix Berkenkamp, editors,41st International Conferen...

    2024

  67. [75]

    Llama 2: Open foundation and fine-tuned chat models.arXiv:2307.09288, 2023

    Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open foundation and fine-tuned chat models.arXiv:2307.09288, 2023. 18

    2023 arXiv

  68. [76]

    Textbooks are all you need II: phi-1.5 technical report.arXiv:2309.05463, 2023

    Yuanzhi Li, Sébastien Bubeck, Ronen Eldan, Allie Del Giorno, Suriya Gunasekar, and Yin Tat Lee. Textbooks are all you need II: phi-1.5 technical report.arXiv:2309.05463, 2023. 18

    2023 arXiv

  69. [77]

    GSM-symbolic: Understanding the limitations of mathematical reasoning in large language models

    Seyed Iman Mirzadeh, Keivan Alizadeh, Hooman Shahrokhi, Oncel Tuzel, Samy Bengio, and Mehrdad Farajtabar. GSM-symbolic: Understanding the limitations of mathematical reasoning in large language models. In13th International Conference on Learning Representations, 2025. 18

    2025

  70. [78]

    Chain-of-thought prompting elicits reasoning in large language models

    Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, brian ichter, Fei Xia, Ed Chi, Quoc V Le, and Denny Zhou. Chain-of-thought prompting elicits reasoning in large language models. In S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh, editors,Advances in Ne...

    2022

  71. [79]

    Complexity-based prompting for multi-step reasoning.International Conference on Learning Representations, 2022

    Yao Fu, Hao-Chun Peng, Ashish Sabharwal, Peter Clark, and Tushar Khot. Complexity-based prompting for multi-step reasoning.International Conference on Learning Representations, 2022. 18

    2022

  72. [80]

    Smith, and Tao Yu

    Hongjin SU, Jungo Kasai, Chen Henry Wu, Weijia Shi, Tianlu Wang, Jiayi Xin, Rui Zhang, Mari Ostendorf, Luke Zettlemoyer, Noah A. Smith, and Tao Yu. Selective annotation makes language models better few-shot learners. In11th International Conference on Learning Representations,...

    2023

  73. [81]

    Coverage-based example selection for in-context learning

    Shivanshu Gupta, Matt Gardner, and Sameer Singh. Coverage-based example selection for in-context learning. In Houda Bouamor, Juan Pino, and Kalika Bali, editors,Findings of the Association for Computational Linguistics: EMNLP 2023, pages 13924–13950, 2023. 18

    2023

  74. [82]

    Continual learning: a feature extraction formalization, an efficient algorithm, and fundamental obstructions

    Binghui Peng and Andrej Risteski. Continual learning: a feature extraction formalization, an efficient algorithm, and fundamental obstructions. In S. Koyejo, S. Mohamed, A. Agarwal, D. Belgrave, K. Cho, and A. Oh, editors,Advances in Neural Information Processing Systems, volu...

  75. [83]

    LoRA: Low-rank adaptation of large language models

    Edward J Hu, yelong shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. LoRA: Low-rank adaptation of large language models. InInternational Conference on Learning Representations, 2022. 19

    2022

  76. [84]

    LoRA Done RITE: Robust Invariant Transformation Equilibration for LoRA Optimization

    Jui-Nan Yen, Si Si, Zhao Meng, Felix Yu, Sai Surya Duvvuri, Inderjit S Dhillon, Cho-Jui Hsieh, and Sanjiv Kumar. LoRA Done RITE: Robust Invariant Transformation Equilibration for LoRA Optimization. In13th International Conference on Learning Representations, 2025. 19

    2025

  77. [85]

    Sutherland

    Yi Ren and Danica J. Sutherland. Learning dynamics of LLM finetuning. In13th International Conference on Learning Representations, 2025. 19

    2025

  78. [86]

    Safety alignment should be made more than just a few tokens deep

    Xiangyu Qi, Ashwinee Panda, Kaifeng Lyu, Xiao Ma, Subhrajit Roy, Ahmad Beirami, Prateek Mittal, and Peter Henderson. Safety alignment should be made more than just a few tokens deep. InThirteenth International Conference on Learning Representations, 2025. 19

    2025

  79. [87]

    What makes large language models reason in (multi-turn) code generation ? InThirteenth International Conference on Learning Representations, 2025

    Kunhao Zheng, Juliette Decugis, Jonas Gehring, Taco Cohen, Benjamin Negrevergne, and Gabriel Synnaeve. What makes large language models reason in (multi-turn) code generation ? InThirteenth International Conference on Learning Representations, 2025. 19

    2025

  80. [88]

    The self- improvement paradox: Can language models bootstrap reasoning capabilities without external scaffolding? arXiv:2502.13441, 2025

    Yutao Sun, Mingshuai Chen, Tiancheng Zhao, Ruochen Xu, Zilun Zhang, and Jianwei Yin. The self- improvement paradox: Can language models bootstrap reasoning capabilities without external scaffolding? arXiv:2502.13441, 2025. 19, 35

    2025 arXiv

  81. [89]

    Springer, 1996

    Luc Devroye, László Györfi, and Gábor Lugosi.A Probabilistic Theory of Pattern Recognition, volume 31 ofStochastic Modelling and Applied Probability. Springer, 1996. 20, 28, 30

    1996

  82. [90]

    Probability inequalities for sums of bounded random variables.Journal of the American Statistical Association, 58:13–30, 1963

    Wassily Hoeffding. Probability inequalities for sums of bounded random variables.Journal of the American Statistical Association, 58:13–30, 1963. 20 15

    1963

  83. [91]

    Probability inequalities for the sum of independent random variables.Journal of the American Statistical Association, 57(297):33–45, 1962

    G Bennett. Probability inequalities for the sum of independent random variables.Journal of the American Statistical Association, 57(297):33–45, 1962. 20

    1962

  84. [92]

    Bonferroni.Teoria statistica delle classi e calcolo delle probabilità

    C.E. Bonferroni.Teoria statistica delle classi e calcolo delle probabilità. Pubblicazioni del R. Istituto superiore di scienze economiche e commerciali di Firenze. Seeber, 1936. 21

    1936

  85. [93]

    Multiple comparisons among means.Journal of the American Statistical Association, 56(293):52–64, 1961

    Olive Jean Dunn. Multiple comparisons among means.Journal of the American Statistical Association, 56(293):52–64, 1961. 21

    1961

  86. [94]

    Evolutionary pre-prompt optimization for mathematical reasoning.arXiv:2412.04291, 2024

    Mathurin Videau, Alessandro Leite, Marc Schoenauer, and Olivier Teytaud. Evolutionary pre-prompt optimization for mathematical reasoning.arXiv:2412.04291, 2024. 21

    2024

  87. [95]

    Lower bounds for comparison based evolution strategies using vc-dimension and sign patterns.Algorithmica, 59(3):387–408, 2011

    Hervé Fournier and Olivier Teytaud. Lower bounds for comparison based evolution strategies using vc-dimension and sign patterns.Algorithmica, 59(3):387–408, 2011. 21, 25, 26, 27

    2011

  88. [96]

    Springer, 2015

    Agoston E Eiben and James E Smith.Introduction to evolutionary computing. Springer, 2015. 22

    2015

  89. [97]

    Evolution strategies – a comprehensive introduction.Natural Computing, 1(1):3–52, May 2002

    Hans-Georg Beyer and Hans-Paul Schwefel. Evolution strategies – a comprehensive introduction.Natural Computing, 1(1):3–52, May 2002. 23

    2002

  90. [98]

    Fromman-Holzboog Verlag, 1973

    Ingo Rechenberg.Evolutionstrategie: Optimierung Technischer Systeme nach Prinzipien des Biologischen Evolution. Fromman-Holzboog Verlag, 1973. 23

    1973

  91. [99]

    Birkhäuser Basel, 1977

    Hans-Paul Schwefel.Evolutionsstrategien für die numerische Optimierung, pages 123–176. Birkhäuser Basel, 1977. 23

    1977

  92. [100]

    Schumer and K

    M. Schumer and K. Steiglitz. Adaptive step size random search.IEEE Transactions on Automatic Control, 13(13):270–276, 1968. 23

    1968

  93. [101]

    A simple modification in CMA-ES achieving linear time and space complexity

    Raymond Ros and Nikolaus Hansen. A simple modification in CMA-ES achieving linear time and space complexity. InParallel Problem Solving from Nature, pages 296–305, 2008. 23

    2008

  94. [102]

    Self-adjusting mutation rates with provably optimal success rules

    Benjamin Doerr, Carola Doerr, and Johannes Lengler. Self-adjusting mutation rates with provably optimal success rules. InGenetic and Evolutionary Computation Conference, pages 1479–1487, 2019. 23

    2019

  95. [103]

    The linear hidden subset problem for the (1+1)-EA with scheduled and adaptive mutation rates.Theoretical Computer Science, 785:150–170, 2019

    Hafsteinn Einarsson, Marcelo Matheus Gauy, Johannes Lengler, Florian Meier, Asier Mujika, Angelika Steger, and Felix Weissenberger. The linear hidden subset problem for the (1+1)-EA with scheduled and adaptive mutation rates.Theoretical Computer Science, 785:150–170, 2019. 23, 27

    2019

  96. [104]

    Self-adaptation of mutation rates in non-elitist populations

    Duc-Cuong Dang and Per Kristian Lehre. Self-adaptation of mutation rates in non-elitist populations. In 14th International Conference on Parallel Problem Solving from Nature, pages 803–813, 2016. 23

    2016

  97. [105]

    Fast genetic algorithms

    Benjamin Doerr, Huu Phuoc Le, and R Makhmara. Fast genetic algorithms. InProceedings of the Genetic and Evolutionary Computation Conference, GECCO ’17, pages 777–784. ACM, 2017. 23

    2017

  98. [106]

    Hoos, and Kevin Leyton-Brown

    Lin Xu, Frank Hutter, Holger H. Hoos, and Kevin Leyton-Brown. SATzilla: portfolio-based algorithm selection for sat.Journal of Artificial Intelligence Research, 32(1):565–606, 2008. 24

    2008

  99. [107]

    Squirrel: A switching hyperparameter optimizer, 2020

    Noor Awad, Gresa Shala, Difan Deng, Neeratyoy Mallik, Matthias Feurer, Katharina Eggensperger, Andre’ Biedenkapp, Diederick Vermetten, Hao Wang, Carola Doerr, Marius Lindauer, and Frank Hutter. Squirrel: A switching hyperparameter optimizer, 2020. 24

    2020

  100. [108]

    Black-box optimization revisited: Improving algorithm selection wizards through massive benchmarking.IEEE Transactions on Evolutionary Computation, 26 (3):490–500, 2021

    Laurent Meunier, Herilalaina Rakotoarison, Pak Kan Wong, Baptiste Roziere, Jérémy Rapin, Olivier Teytaud, Antoine Moreau, and Carola Doerr. Black-box optimization revisited: Improving algorithm selection wizards through massive benchmarking.IEEE Transactions on Evolutionary Co...

    2021

  101. [109]

    Armand Gissler.Linear convergence of evolution strategies with covariance matrix adaptation. Phd. thesis, Institut Polytechnique de Paris, December 2024. 24

    2024

  102. [110]

    Perez Zerpa, Raymond Ros, and Marc Schoenauer

    Anne Auger, Nikolaus Hansen, Jorge M. Perez Zerpa, Raymond Ros, and Marc Schoenauer. Experimental Comparisons of Derivative Free Optimization Algorithms. In Jan Vahrenhold, editor,LNCS. Springer Verlag, 2009. 25

    2009

  103. [111]

    Powell.A Direct Search Optimization Method That Models the Objective and Constraint Functions by Linear Interpolation, pages 51–67

    Michael J.D. Powell.A Direct Search Optimization Method That Models the Objective and Constraint Functions by Linear Interpolation, pages 51–67. Springer Netherlands, 1994. 25 16

    1994

  104. [112]

    Michael J.D. Powell. An efficient method for finding the minimum of a function of several variables without calculating derivatives.The Computer Journal, 7(2):155–162, 1964. 25

    1964

  105. [113]

    Simple statistical gradient-following algorithms for connectionist reinforcement learning.Machine learning, 8:229–256, 1992

    Ronald J Williams. Simple statistical gradient-following algorithms for connectionist reinforcement learning.Machine learning, 8:229–256, 1992. 25

    1992

  106. [114]

    McKay, Richard J

    Michael D. McKay, Richard J. Beckman, and William J. Conover. A Comparison of Three Methods for Selecting Values of Input Variables in the Analysis of Output from a Computer Code.Technometrics, 21: 239–245, 1979. 25

    1979

  107. [115]

    Society for Industrial and Applied Mathematics, 1992

    Harald Niederreiter.Random Number Generation and quasi-Monte Carlo Methods. Society for Industrial and Applied Mathematics, 1992. 25

    1992

  108. [116]

    Direct search based on probabilistic descent in reduced spaces.SIAM Journal on Optimization, 33(4):3057–3082, 2023

    Lindon Roberts and Clément Royer. Direct search based on probabilistic descent in reduced spaces.SIAM Journal on Optimization, 33(4):3057–3082, 2023. 25

    2023

  109. [117]

    Natural Computing Series

    Hans-Georg Beyer.The Theory of Evolution Strategies. Natural Computing Series. Springer, Heideberg,

  110. [118]

    K-Anonymous A/B Testing.arXiv:2501.14329, 2025

    Matthew Gershoff. K-Anonymous A/B Testing.arXiv:2501.14329, 2025. 29

    2025 arXiv

  111. [119]

    Poisoning attacks against support vector machines

    Battista Biggio, Blaine Nelson, and Pavel Laskov. Poisoning attacks against support vector machines. In Proceedings of the 29th International Coference on International Conference on Machine Learning, pages 1467–1474, 2012. 30

    2012

  112. [120]

    Meta Lingua: A minimal PyTorch LLM training library, 2024

    Mathurin Videau, Badr Youbi Idrissi, Daniel Haziza, Luca Wehrstedt, Jade Copet, Olivier Teytaud, and David Lopez-Paz. Meta Lingua: A minimal PyTorch LLM training library, 2024. URLgithub.com/ facebookresearch/lingua. 31

    2024

  113. [121]

    Gonzalez, Hao Zhang, and Ion Stoica

    Woosuk Kwon, Zhuohan Li, Siyuan Zhuang, Ying Sheng, Lianmin Zheng, Cody Hao Yu, Joseph E. Gonzalez, Hao Zhang, and Ion Stoica. Efficient memory management for large language model serving with pagedattention. InProceedings of the ACM SIGOPS 29th Symposium on Operating Systems ...

  114. [122]

    Deep learning with differential privacy

    Martin Abadi, Andy Chu, Ian Goodfellow, H Brendan McMahan, Ilya Mironov, Kunal Talwar, and Li Zhang. Deep learning with differential privacy. InProceedings of the 2016 ACM SIGSAC conference on computer and communications security, pages 308–318, 2016. 33

    2016

  115. [123]

    CPPO: Accelerating the training of group relative policy optimization-based reasoning models.arXiv:2503.22342, 2025

    Zhihang Lin, Mingbao Lin, Yuan Xie, and Rongrong Ji. CPPO: Accelerating the training of group relative policy optimization-based reasoning models.arXiv:2503.22342, 2025. 35 17 A Extended Related Work Generalization Bounds for LLMs.Early generalization bounds, such as those der...

    2025

  116. [125]

    non-uniform

    showed that the self-attention mechanism is uniformly stable under certain Lipschitz constraints, which allows a generalization bound for in-context learning with Transformers. Our contribution shares this spirit, exploiting the comparison-based nature of optimization and the ...

  117. [126]

    First attention layer, where we perform a broadcast multiplicative update to the Q matrix in the first attention layer by broadcasting a vector of size4096to the4096× 4096Q matrix and then using the update formula as in Sec. B.1

  118. [127]

    Resulting inn_layers×hidden_dim = 32× 4096 = 131, 072parameters to optimize, using the update formula as in Sec

    All attention layers, where we perform a broadcast multiplicative update on all theQ matrices of all attention layers. Resulting inn_layers×hidden_dim = 32× 4096 = 131, 072parameters to optimize, using the update formula as in Sec. B.2

  119. [128]

    confidence

    All attention layers and no few-shot, where we apply a broadcast multiplicative update on all theQ matrices of all attention layers, as in 2 above. However, we do not include any few-shot examples in the prompt during either training or testing. All experiments are carried out...

  120. [1975]

    ISBN 978-3-540-37497-8

    Springer Berlin Heidelberg. ISBN 978-3-540-37497-8. 1

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.