On Jailbreaking Quantized Language Models Through Fault Injection Attacks

Ahmad Tahmasivand; Ihsen Alouani; Khaled Khasawneh; Mohammed E. Fouda; Noureldin Zahran

REVIEW 2 major objections 7 minor 20 references

On Jailbreaking Quantized Language Models Through Fault Injection Attacks

T0 review · 2 major / 7 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read FP8 and INT8 weight storage materially raises the bit-flip budget required to jailbreak aligned models, yet FP16-created jailbreaks carry over into 8-bit deployments with nearly no loss.

desk verdict Useful first measurement of how weight-only quantization changes bit-flip jailbreak difficulty, with a valuable transfer result — but the reported numbers don't all match the abstract and the threat model stays entirely simulated. read the letter →

arxiv 2507.03236 v2 pith:NLU3PTFO submitted 2025-07-04 cs.CR cs.AI

Noureldin Zahran , Ahmad Tahmasivand , Ihsen Alouani , Khaled Khasawneh , Mohammed E. Fouda This is my paper · ORCID

classification cs.CRcs.AI

keywords jailbreakbit-flipattackfaultinjectionquantizationFP8weight-onlylargelanguagemodelsafetysuccessrate

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper is trying to establish that the precision format in which an aligned language model is stored changes how hard it is to jailbreak the model by flipping individual bits of its weights. Its experiments on three instruction-tuned models show that FP16 models are readily compromised (attack success above 80% within 25 flips), while under the same budget FP8 models stay below 20% and INT8 below 50%, with FP8 also staying below 65% even at 150 flips. It further claims that this resilience is not a cure: a jailbreak inserted into an FP16 model survives later quantization to FP8 or INT8 with almost no drop in success, so an attacker can compromise at full precision and let the deployment pipeline carry the jailbreak into an 8-bit model. The implied stakes are practical: quantized deployment raises the cost of direct fault-injection attacks on the deployed artifact but does not, by itself, remove the vulnerability.

What carries the argument

The load-bearing machinery is a progressive, gradient-guided bit-flip search that replaces heuristic bit targets with a direct step-size scan. At each iteration it computes the jailbreak loss and its gradient on dequantized FP16 weights, selects candidate weights by gradient magnitude, and for each candidate flips the bit that produces the largest loss decrease, scanning bits in order of beneficial step size and stopping as soon as the loss stops improving. The objective function is an exponentially windowed cross-entropy over target harmful completions, and gradients through quantized values are handled with a straight-through estimator. A word-level attack that updates a single weight by gradient descent serves as a comparison point for how much of the effect is due to bit-level discreteness.

What would settle it

Run the same progressive bit-search attack on a hardware fault-injection testbed for one evaluated model and check whether the specific bit indices chosen by the simulator can actually be flipped at their assumed memory addresses; if the physically achievable flips land on different weights or get corrected by ECC, the simulated ASRs overstate the practical attack surface.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that weight-only quantization is a major modifier of bit-flip jailbreak efficacy, not a uniform defense. FP8 (E4M3) is the most resistant format tested: across Llama-3.2-3B, Llama-3-8B, and Phi-4-mini, a progressive bit-level attack that jails FP16 models with 25 flips reaches under 20% ASR on FP8 at that budget and under 65% at 150 flips. INT8 is intermediate, and INT4 is surprisingly weak, with ASR trajectories that track or exceed FP16 in several cases. The paper also reports that attacks on FP16 and INT4 concentrate on attention value projections, while FP8 and INT8 attacks concentrate on MLP down-projections, and that transferring FP16-created jailbreaks into FP8 or INT8 loses less than 5% ASR whereas INT4 loses an average of 35%.

Load-bearing premise

The attack's practical reach rests on the assumption that a real adversary can physically flip exactly the bits the software simulator selects; the paper only simulates flips in software and defers physical injection, so memory hardware like ECC, row constraints, or address mapping could make the demonstrated success rates harder to achieve in practice.

Editorial extensions

If this is right

Under a 25-perturbation budget, FP8 models keep attack success below 20% and INT8 below 50%, whereas FP16 models exceed 80%, so direct fault-injection jailbreaking of 8-bit deployments requires a substantially larger budget.
Pushing the budget to 150 flips raises FP8 success to at most 65%, so FP8 should be treated as increasing attack cost, not as eliminating the threat.
INT4 offers little robustness benefit for bit-level attacks and is not a safe alternative to 8-bit formats on its own.
Jailbreaks engineered in FP16 transfer to FP8 and INT8 post-quantization with less than 5% ASR difference, meaning quantizing a compromised model does not sanitize it; INT4 is the exception and cuts transferred ASR by roughly 35% on average.
Attack success varies with the optimization dataset's sample selection and size, so reported ASRs for a fixed 32-sample set are estimates of a range, not fixed properties.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If the physical-fault premise holds, a practical implication the paper leaves implicit is that attackers should prefer compromising the model before quantization: the cheap FP16 attack carries into the deployed 8-bit artifact, while attacking the quantized artifact directly is several times more expensive.
The format-dependent layer targets suggest a testable defensive extension: protecting or checksumming attention value projections in FP16/INT4 and MLP down-projections in FP8/INT8 could force attackers to spend more flips, though the paper does not test defenses.
The transfer result also implies that quantization should be verified after the fact as a security control, since the paper's numbers show it does not act as a randomness source that erases prior perturbations in 8-bit formats.
A broader inference is that the FP8/INT8 concentration on down-projection layers resembles the behavior of rounding-based smoothing, which could be studied by ablating per-layer weights to see which projections carry the jailbreak signal.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Colleague — quick take. This is the first systematic measurement of bit-flip jailbreak attacks across FP16/FP8/INT8/INT4 on current aligned LMs, and the transfer result is the most useful part: jailbreaks carved into FP16 weights survive re-quantization to 8-bit formats almost intact, while INT4 wipes out much of the effect. That is a concrete finding for anyone deploying quantized models.

The paper is honest and does real work. It uses HarmBench plus three independent judges, runs a sensitivity analysis on the attack dataset (sample selection and size), and compares a progressive bit-level search against a word-level update. The tables largely support the qualitative claim that FP8 is the most resistant, INT8 intermediate, and INT4 surprisingly weak.

Now the soft spots, in order of actual softness.

First, the abstract does not match the paper's own tables. It claims FP8 stays below 65% ASR at 150 flips, but Table 2 shows Phi-4-mini FP8 at 66.7%. It claims INT8 stays below 50% at 25 flips, but Table 2 shows Llama-3.2-3B INT8 at 51.6%. These are not rounding issues; the headline numbers need correcting.

Second, the reported ASRs are best-of selections: max over three learning rates for the word-level attack, and the first iteration where any of three judges crosses 70% for the cross-judge comparison. That inflates attack numbers and lowers the confidence you'd want for a measurement paper. A representative or average presentation would be more honest.

Third, all bit flips are simulated. The threat model talks about Rowhammer-class injection but the experiments never leave software, and the conclusion explicitly punts physical fault injection to future work. That is consistent with the BFA literature, but the title says 'through fault injection attacks,' which overstates what was demonstrated. The paper should either bound the claim to simulated bit flips or add a hardware feasibility analysis, including ECC and HBM constraints.

Fourth, no code or data is released; for a paper whose main contribution is a measurement, that hurts reproducibility.

None of this breaks the central qualitative trend, and I think the transfer result will hold up. But the internal numeric contradictions are exactly the kind of thing that needs a real revision before the paper is dependable. I'd send it to a serious venue rather than desk-reject, with the numbers fixed and the threat model scoped properly. It's a solid candidate, not a finished one.

Referee Report

2 major / 7 minor

Summary. This paper investigates whether targeted parameter perturbations (bit flips and single-weight updates) can jailbreak aligned large language models under different weight-only quantization schemes. The authors propose a progressive greedy bit-flip search and a word-level gradient-update attack, evaluate them on Llama-3.2-3B, Llama-3-8B, and Phi-4-mini in FP16, FP8, INT8, and INT4 formats, and measure Attack Success Rate on HarmBench with three automated judges. The main empirical findings are that FP16 models are readily jailbroken, FP8 is the most resilient format, INT8 is intermediate, INT4 is substantially less robust, and that jailbreaks induced in FP16 models largely survive subsequent FP8/INT8 quantization but are strongly disrupted by INT4 quantization.

Significance. The paper addresses a timely and practically relevant question: how weight-only quantization affects the cost of parameter-manipulation jailbreaks. Its strengths include evaluation on an external benchmark (HarmBench) with three independent automated judges, sensitivity analyses over the attack optimization dataset (Section 6.4), and a post-attack quantization experiment (Section 6.6). If the results are confirmed, the qualitative conclusion that FP8 deployment raises the number of required bit flips without removing the threat is a useful input for deployment decisions. The quantitative headline numbers in the abstract are, however, not always consistent with the reported tables, and the physical realizability of the assumed fault-injection mechanism is not demonstrated; these issues are detailed below.

major comments (2)

[Abstract vs. Tables 1-3] The abstract states that within 25 perturbations FP8 and INT8 models exhibit ASRs below 20% and 50% respectively, and that FP8 models maintain ASR below 65% at 150 bit-flips; the paper's own tables contradict these bounds. Table 1 (word-level, iteration 25) shows Phi-4-mini FP8 at 20.8% and Phi-4-mini INT8 at 50.3%, while Table 2 (bit-level, iteration 25) shows Llama-3.2-3B INT8 at 51.6%. Table 2 (iteration 150) shows Phi-4-mini FP8 at 66.7%, and Table 3 also reports 66.7% for Phi-4-mini at iteration 146. These load-bearing quantitative claims must be corrected or replaced with per-model ranges (e.g., 'generally below') before publication. The abstract should also distinguish bit-flip perturbations from weight-update perturbations, since the two attack types have very different costs and the current wording conflates them.
[Section 3 vs. Section 7] The threat model requires the adversary to flip exact, simulation-selected bits in deployed memory via Rowhammer-class fault injection, but all experiments are software simulations of bit flips on A100 GPUs with ECC, and Section 7 explicitly defers physical fault injection to future work. No evidence is given that arbitrary bit positions can be reached in HBM/ECC-protected systems. The reported ASR values are therefore upper bounds for an idealized bit-flip adversary, and the title/abstract's 'fault injection attacks' framing overstates what is demonstrated. The authors should either add a hardware-feasibility analysis or explicitly and prominently reframe the results as simulation-based, with a discussion of the conditions under which they would transfer to physical fault injection.

minor comments (7)

[Table 3] The model name 'Phi-4-min-' in the table header should be 'Phi-4-mini'.
[Section 4.1, Eq. (2)] The symbol n is used both for the dataset size in the outer sum and for the length of the query in the definition of s_{k-1}; please use separate symbols for these two quantities.
[Sections 5.2 and 6.4.1] The text refers to 'AdvBench' in Section 5.2 and to 'AdvBench-Completions' in Section 6.4.1; clarify the relationship between these datasets.
[Tables 1-3] The main ASR tables appear to report a single run per configuration; given the sample-selection sensitivity documented in Section 6.4, reporting mean/range across the four sample sets for at least the headline configurations would strengthen the quantitative claims.
[Section 6.3] The threshold-and-peak selection rule used to produce Table 3 means that the reported iteration numbers are not directly comparable across configurations when no judge reaches the 70% threshold; this caveat should be stated more prominently.
[Section 6.5] The perturbation-location analysis is based on the single highest-ASR run for each configuration; a sentence should note that these distributions are illustrative rather than averaged over multiple runs.
[Section 2] The sentence 'The primary objective this study was model destruction' appears to be missing a word ('of'); please correct the typo.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the paper's claims are empirical measurements against external benchmarks, not derivations from fitted inputs or self-citations.

full rationale

This is an empirical attack-measurement paper rather than a derivation, so the circularity patterns do not apply. The central claims about quantization resilience (Tables 1-3) and post-attack quantization transferability (Table 4) are direct experimental measurements: Attack Success Rate is computed from responses to the externally defined HarmBench test set using three independent automated judges, and ASR is not defined in terms of the paper's own attack objective L_JB or any parameter fitted by the authors. The attack objective in Eq. (2) is explicitly borrowed from prior work by Coalson et al. [13], but that objective is an input to the optimizer, not the evaluation metric; using a previously published objective as an attack component does not make the measured result equivalent to its input. The attack optimization dataset is built from AdvBench queries and WizardLM-30B-Uncensored completions, which is distinct from the HarmBench evaluation set, so the evaluation is not circular. The 'tailored progressive bit-level search' is an optimization procedure, not a fitted predictor of its own output, and the comparison against the word-level attack is a direct empirical contrast. Citations to earlier bit-flip methods (Rakin et al., Coalson et al.) are external prior work and are not self-citations of the present authors; no uniqueness theorem or ansatz is imported from the authors' own prior publications. The explicitly acknowledged limitation that physical fault injection is deferred to future work (Section 7) is a threat-model realizability concern, not a circularity: it affects whether the simulated bit-flip adversary maps onto real Rowhammer-class capabilities, but it does not mean the reported ASRs are defined in terms of the thing they claim to predict. No load-bearing step reduces to its own input, and no fitted parameter is renamed as a prediction.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

This paper contributes an empirical measurement rather than a derived theory. The ledger records the threat-model and evaluation assumptions the measurements rest on, plus the hand-chosen hyperparameters that affect the reported ASR. There are no invented physical entities.

free parameters (3)

word-level learning rate set = 50, 100, 200; max ASR reported
Section 6.1 reports each word-attack ASR as the maximum over the three tested learning rates, so reported attack success depends on this hand-picked set and is optimistic.
attack optimization dataset size = 32 AdvBench samples (16, 32, 64 tested)
Main results use 32 harmful query-completion pairs; Section 6.4 shows ASR varies substantially with both sample selection and dataset size, so this is a consequential free choice.
ASR comparison threshold = 70%
Table 3 defines the reported iteration as the first where any of three judges passes 70 percent ASR, or failing that the peak ASR under any judge; this hand-chosen criterion affects cross-attack comparisons.

assumptions (4)

domain assumption An adversary can co-locate a process on the victim host and physically flip arbitrary selected bits in model weight memory, per Rowhammer-class fault injection.
Section 3 states this as the threat model and cites prior hardware work; no physical demonstration or ECC/DRAM address-mapping analysis is provided here.
domain assumption Straight-Through Estimator gradients computed on dequantized FP16 weights are a faithful guide for selecting bit flips in quantized weights.
Section 4.3 invokes STE without validation on the discrete quantization grid; if gradients mislead, the search results may not reflect a real attacker.
domain assumption Automated judges (HarmBench classifier, Llama Guard 3, Walled Guard-C) give valid harmful/harmless labels for ASR.
Section 5.4 uses these judges; Section 6.3 shows substantial judge disagreement, so the ASR metric depends on the judge choice.
domain assumption Weight-only symmetric static channel-wise PTQ with FP8 E4M3, INT8, and INT4 is representative of common deployment quantization.
Section 5.1 states this configuration; results may not transfer to activation quantization or GPTQ/AWQ-style methods.

how reviews work

0 comments

Cite this review

Pith. "Pith review of On Jailbreaking Quantized Language Models Through Fault Injection Attacks." pith.science (2026). https://pith.science/paper/NLU3PTFO

@misc{pith2026250703236,
  author       = {Pith},
  title        = {Pith review of: On Jailbreaking Quantized Language Models Through Fault Injection Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/NLU3PTFO}},
  note         = {Machine review of arXiv:2507.03236}
}

read the original abstract

The safety alignment of Language Models (LMs) is a critical concern, yet their integrity can be challenged by direct parameter manipulation attacks, such as those potentially induced by fault injection. As LMs are increasingly deployed using low-precision quantization for efficiency, this paper investigates the efficacy of such attacks for jailbreaking aligned LMs across different quantization schemes. We propose gradient-guided attacks, including a tailored progressive bit-level search algorithm introduced herein and a comparative word-level (single weight update) attack. Our evaluation on Llama-3.2-3B, Phi-4-mini, and Llama-3-8B across FP16 (baseline), and weight-only quantization (FP8, INT8, INT4) reveals that quantization significantly influences attack success. While attacks readily achieve high success (>80% Attack Success Rate, ASR) on FP16 models, within an attack budget of 25 perturbations, FP8 and INT8 models exhibit ASRs below 20% and 50%, respectively. Increasing the perturbation budget up to 150 bit-flips, FP8 models maintained ASR below 65%, demonstrating some resilience compared to INT8 and INT4 models that have high ASR. In addition, analysis of perturbation locations revealed differing architectural targets across quantization schemes, with (FP16, INT4) and (INT8, FP8) showing similar characteristics. Besides, jailbreaks induced in FP16 models were highly transferable to subsequent FP8/INT8 quantization (<5% ASR difference), though INT4 significantly reduced transferred ASR (avg. 35% drop). These findings highlight that while common quantization schemes, particularly FP8, increase the difficulty of direct parameter manipulation jailbreaks, vulnerabilities can still persist, especially through post-attack quantization.

Figures

Figures reproduced from arXiv: 2507.03236 by the authors.

**Figure 2.** The iterative evaluation pipeline. After each parameter perturbation, responses to the evaluation dataset are [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗

**Figure 3.** ASR progression for the Bit Attack across four different 32-sample attack datasets, identified by their starting [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗

Figures from the paper (2 more)

**Figure 4.** Figure 4: ASR progression for the Bit Attack using different optimization DS of 16, 32, and 64 samples for Llama-3.2- [PITH_FULL_IMAGE:figures/full_fig_p011_4.png]

**Figure 5.** Figure 5: Distribution of perturbations locations across model layers and internal components. [PITH_FULL_IMAGE:figures/full_fig_p012_5.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

20 extracted references · 12 canonical work pages

[1]

The consequences of generative ai for online knowledge communities.Scientific Reports, 14(1):10413, 2024

Gordon Burtch, Dokyun Lee, and Zhichen Chen. The consequences of generative ai for online knowledge communities.Scientific Reports, 14(1):10413, 2024. 12 Jailbreaking Quantized Language Models

work page 2024
[2]

The future of search: Ai-driven disruption and diversification

Lexie Perrotta, Stefan Hennessy, and Grace Lee. The future of search: Ai-driven disruption and diversification. Industry report, AlixPartners LLP, 2025

work page 2025
[3]

A comprehensive survey of llm alignment techniques: Rlhf, rlaif, ppo, dpo and more, 2024

Zhichao Wang, Bin Bi, Shiva Kumar Pentyala, Kiran Ramnath, Sougata Chaudhuri, Shubham Mehrotra, Zixu, Zhu, Xiang-Bo Mao, Sitaram Asur, Na, and Cheng. A comprehensive survey of llm alignment techniques: Rlhf, rlaif, ppo, dpo and more, 2024

2024
[4]

Jailbreak attacks and defenses against large language models: A survey, 2024

Sibo Yi, Yule Liu, Zhen Sun, Tianshuo Cong, Xinlei He, Jiaxing Song, Ke Xu, and Qi Li. Jailbreak attacks and defenses against large language models: A survey, 2024

work page 2024
[5]

An adversarial perspective on machine unlearning for ai safety, 2025

Jakub Łucki, Boyi Wei, Yangsibo Huang, Peter Henderson, Florian Tramèr, and Javier Rando. An adversarial perspective on machine unlearning for ai safety, 2025

work page 2025
[6]

Understanding gpu memory corruption at extreme scale: The summit case study

Vladyslav Oles, Anna Schmedding, George Ostrouchov, Woong Shin, Evgenia Smirni, and Christian Engelmann. Understanding gpu memory corruption at extreme scale: The summit case study. InProceedings of the 38th ACM International Conference on Supercomputing, pages 188–200, 2024

work page 2024
[7]

Machine learning and hardware security: Challenges and opportunities

Francesco Regazzoni, Shivam Bhasin, Amir Ali Pour, Ihab Alshaer, Furkan Aydin, Aydin Aysu, Vincent Beroulle, Giorgio Di Natale, Paul Franzon, David Hely, et al. Machine learning and hardware security: Challenges and opportunities. InProceedings of the 39th International Conference on Computer-Aided Design, pages 1–6, 2020

work page 2020
[8]

Revisiting rowhammer: An experimental analysis of modern dram devices and mitigation techniques

Jeremie S Kim, Minesh Patel, A Giray Ya˘glıkçı, Hasan Hassan, Roknoddin Azizi, Lois Orosa, and Onur Mutlu. Revisiting rowhammer: An experimental analysis of modern dram devices and mitigation techniques. In2020 ACM/IEEE 47th Annual International Symposium on Computer Architecture (ISCA), pages 638–651. IEEE, 2020

work page 2020

Show all 20 references

[9]

Flipping bits in memory without accessing them: An experimental study of dram disturbance errors.ACM SIGARCH Computer Architecture News, 42(3):361–372, 2014

Yoongu Kim, Ross Daly, Jeremie Kim, Chris Fallin, Ji Hye Lee, Donghyuk Lee, Chris Wilkerson, Konrad Lai, and Onur Mutlu. Flipping bits in memory without accessing them: An experimental study of dram disturbance errors.ACM SIGARCH Computer Architecture News, 42(3):361–372, 2014

2014
[10]

Bit-flip attack: Crushing neural network with progressive bit search

Adnan Siraj Rakin, Zhezhi He, and Deliang Fan. Bit-flip attack: Crushing neural network with progressive bit search. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 1211–1220, 2019

2019
[11]

T-bfa: Targeted bit-flip adversarial weight attack.IEEE Transactions on Pattern Analysis and Machine Intelligence, 44(11):7928–7939, 2022

Adnan Siraj Rakin, Zhezhi He, Jingtao Li, Fan Yao, Chaitali Chakrabarti, and Deliang Fan. T-bfa: Targeted bit-flip adversarial weight attack.IEEE Transactions on Pattern Analysis and Machine Intelligence, 44(11):7928–7939, 2022

2022
[12]

Proflip: Targeted trojan attack with progressive bit flips

Huili Chen, Cheng Fu, Jishen Zhao, and Farinaz Koushanfar. Proflip: Targeted trojan attack with progressive bit flips. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 7718–7727, 2021

2021
[13]

Prisonbreak: Jailbreaking large language models with fewer than twenty-five targeted bit-flips.arXiv preprint arXiv:2412.07192, 2024

Zachary Coalson, Jeonghyun Woo, Shiyang Chen, Yu Sun, Lishan Yang, Prashant Nair, Bo Fang, and Sanghyun Hong. Prisonbreak: Jailbreaking large language models with fewer than twenty-five targeted bit-flips.arXiv preprint arXiv:2412.07192, 2024

2024
[14]

A comprehensive study on quantization techniques for large language models, 2024

Jiedong Lang, Zhehao Guo, and Shuyu Huang. A comprehensive study on quantization techniques for large language models, 2024

2024
[15]

Zico Kolter, and Matt Fredrikson

Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models, 2023

2023
[16]

Estimating or propagating gradients through stochastic neurons for conditional computation, 2013

Yoshua Bengio, Nicholas Léonard, and Aaron Courville. Estimating or propagating gradients through stochastic neurons for conditional computation, 2013

2013
[17]

Thomas Wolf, Lysandre Debut, Victor Sanh, Julien Chaumond, Clement Delangue, Anthony Moi, Pierric Cistac, Tim Rault, Rémi Louf, Morgan Funtowicz, Joe Davison, Sam Shleifer, Patrick von Platen, Clara Ma, Yacine Jernite, Julien Plu, Canwen Xu, Teven Le Scao, Sylvain Gugger, Mari...

2020
[18]

Harmbench: A standardized evaluation framework for automated red teaming and robust refusal, 2024

Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, and Dan Hendrycks. Harmbench: A standardized evaluation framework for automated red teaming and robust refusal, 2024

2024
[19]

The llama 3 herd of models.arXiv preprint arXiv:2407.21783, 2024

Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, et al. The llama 3 herd of models.arXiv preprint arXiv:2407.21783, 2024

2024 arXiv
[20]

Walledeval: A comprehensive safety evaluation toolkit for large language models.arXiv preprint arXiv:2408.03837, 2024

Prannaya Gupta, Le Qi Yau, Hao Han Low, I Lee, Hugo Maximus Lim, Yu Xin Teoh, Jia Hng Koh, Dar Win Liew, Rishabh Bhardwaj, Rajat Bhardwaj, et al. Walledeval: A comprehensive safety evaluation toolkit for large language models.arXiv preprint arXiv:2408.03837, 2024. 13

2024 arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

The consequences of generative ai for online knowledge communities.Scientific Reports, 14(1):10413, 2024

Gordon Burtch, Dokyun Lee, and Zhichen Chen. The consequences of generative ai for online knowledge communities.Scientific Reports, 14(1):10413, 2024. 12 Jailbreaking Quantized Language Models

work page 2024

[2] [2]

The future of search: Ai-driven disruption and diversification

Lexie Perrotta, Stefan Hennessy, and Grace Lee. The future of search: Ai-driven disruption and diversification. Industry report, AlixPartners LLP, 2025

work page 2025

[3] [3]

A comprehensive survey of llm alignment techniques: Rlhf, rlaif, ppo, dpo and more, 2024

Zhichao Wang, Bin Bi, Shiva Kumar Pentyala, Kiran Ramnath, Sougata Chaudhuri, Shubham Mehrotra, Zixu, Zhu, Xiang-Bo Mao, Sitaram Asur, Na, and Cheng. A comprehensive survey of llm alignment techniques: Rlhf, rlaif, ppo, dpo and more, 2024

2024

[4] [4]

Jailbreak attacks and defenses against large language models: A survey, 2024

Sibo Yi, Yule Liu, Zhen Sun, Tianshuo Cong, Xinlei He, Jiaxing Song, Ke Xu, and Qi Li. Jailbreak attacks and defenses against large language models: A survey, 2024

work page 2024

[5] [5]

An adversarial perspective on machine unlearning for ai safety, 2025

Jakub Łucki, Boyi Wei, Yangsibo Huang, Peter Henderson, Florian Tramèr, and Javier Rando. An adversarial perspective on machine unlearning for ai safety, 2025

work page 2025

[6] [6]

Understanding gpu memory corruption at extreme scale: The summit case study

Vladyslav Oles, Anna Schmedding, George Ostrouchov, Woong Shin, Evgenia Smirni, and Christian Engelmann. Understanding gpu memory corruption at extreme scale: The summit case study. InProceedings of the 38th ACM International Conference on Supercomputing, pages 188–200, 2024

work page 2024

[7] [7]

Machine learning and hardware security: Challenges and opportunities

Francesco Regazzoni, Shivam Bhasin, Amir Ali Pour, Ihab Alshaer, Furkan Aydin, Aydin Aysu, Vincent Beroulle, Giorgio Di Natale, Paul Franzon, David Hely, et al. Machine learning and hardware security: Challenges and opportunities. InProceedings of the 39th International Conference on Computer-Aided Design, pages 1–6, 2020

work page 2020

[8] [8]

Revisiting rowhammer: An experimental analysis of modern dram devices and mitigation techniques

Jeremie S Kim, Minesh Patel, A Giray Ya˘glıkçı, Hasan Hassan, Roknoddin Azizi, Lois Orosa, and Onur Mutlu. Revisiting rowhammer: An experimental analysis of modern dram devices and mitigation techniques. In2020 ACM/IEEE 47th Annual International Symposium on Computer Architecture (ISCA), pages 638–651. IEEE, 2020

work page 2020