Pith. sign in

REVIEW 4 major objections 5 minor 86 references

The Blessing and Curse of Dimensionality in Safety Alignment

T0 review · 4 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read High-dimensional LLM hidden states are what let steering jailbreaks find a linear safety direction, and projecting them to lower dimension during fine-tuning removes that attack surface.

desk verdict Useful defensive fine-tuning recipes against ActAdd/Ablation, but the dimensionality story doesn't hold up: the projections never reduce the residual-stream dimension where steering actually happens. read the letter →

arxiv 2507.20333 v1 pith:4F23EYHK submitted 2025-07-27 cs.AI cs.LGstat.ML

Rachel S.Y. Teo , Laziz U. Abdullaev , Tan M. Nguyen This is my paper · ORCID
classification cs.AIcs.LGstat.ML
keywords safetyalignmentlinearrepresentationhypothesisactivationsteeringjailbreakdefensedimensionalityreductionFastJohnson-LindenstraussTransformRademachercomplexityengineering
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that the same large hidden dimension that makes large language models capable also opens a specific safety hole: high-dimensional activation spaces encode concepts such as 'safety' as single linear directions, and steering jailbreaks work by finding and manipulating those directions. It calls this tension the Paradox of Linear Separability: scaling models up improves abilities but also makes them more vulnerable to steering attacks. The evidence is a cross-family comparison of PCA visualizations and linear-probe accuracy over models with different hidden widths, showing a marked jump in linear separability of emotion near 2,000 hidden dimensions. The proposed remedy is to fine-tune with a low-dimensional projection of the hidden representations, either through a Fast Johnson–Lindenstrauss transform on the attention queries and keys or through a linear autoencoder bottleneck after an early layer; the paper reports that both restore refusal and safety scores against the ActAdd and Ablation jailbreaks across three 7B-scale model families. If the claim is right, hidden dimension is not just a capacity knob but an attack-surface parameter that can be turned down without giving up alignment.

What carries the argument

The machinery is dimensionality reduction applied to the hidden representations that carry concept directions. The FJLT defense places a random Fast Johnson–Lindenstrauss projection matrix $\Phi \in \mathbb{R}^{D \times K}$ on the query and key matrices of one attention head per layer, computing attention scores in $K$ dimensions while approximately preserving pairwise distances; the Bottleneck defense inserts a linear autoencoder $x_{\mathrm{compressed}} = \sigma(x W_{\mathrm{down}} W_{\mathrm{up}})$ with $W_{\mathrm{down}} \in \mathbb{R}^{D \times K}$ and $W_{\mathrm{up}} \in \mathbb{R}^{K \times D}$ between two early layers. The theoretical support is the Rademacher-complexity bound $\widehat{\mathcal{R}}_X(\mathcal{F}) \le L \|X\|_F / N$, which, under the paper's Proposition 1 assuming normally distributed features, becomes $\mathcal{R}_N(\mathcal{F}) \lesssim L \sqrt{D/N}$: reducing dimension from $D$ to $K$ shrinks the capacity of any linear probe at rate $O(\sqrt{D})$, which is the claimed reason a steering vector should become hard to recover after projection.

What would settle it

Train a single model family at several hidden widths, holding data and the alignment pipeline fixed, and measure both linear-probe accuracy on safety and ActAdd success after projecting to the same $K$: if probe accuracy does not jump near the 2,000-dimension threshold, or if a low-width variant remains as steerable as a high-width one, the dimensional-causality claim collapses. A cheaper check is to compute an ActAdd vector on the unmodified model and apply it to the defended model at a sequence of $K$ values; the theory predicts a sharp falloff in transfer, and its absence would falsify the mechanism.

Watch

Extended reading notes

Core claim

The central claim is that linear concept directions in LLM activation spaces are a high-dimensional phenomenon, and that removing the dimensionality removes the handle that representation-engineering jailbreaks grab. The paper demonstrates a threshold-like pattern: models with hidden dimensions below roughly 2,000 show heavy overlap between positive and negative emotion activations, while models above it show two clean clusters, and the same separation is measured by trained linear probes. Because refusal behavior in aligned models is mediated by such a direction, the ActAdd attack that adds the refusal direction and the Ablation attack that removes it both succeed against the unmodified models and fail, to a much larger degree, after the representations are projected into a lower-dimensional subspace. The paper's own caution is that dimension reduction must be paired with fine-tuning that teaches the model to keep answering, and that the FJLT variant loses utility on specialized tasks while the Bottleneck variant largely preserves it.

Load-bearing premise

The load-bearing premise is that hidden dimension itself, rather than the architecture, training data, or alignment procedure that comes with scaling, causes concepts to become linearly separable—and that the Rademacher-complexity bound on linear classifiers still says something about whether a steering vector can be found after projecting the whole network.

Editorial extensions

If this is right

  • Steering-vector jailbreaks can be patched onto already-deployed Chat and Instruct models by a short fine-tune with a projection layer, rather than requiring retraining from scratch or a new alignment pipeline.
  • Scaling comparisons should count safety cost alongside capability: if the Paradox of Linear Separability holds, a model's expected vulnerability to ActAdd-style attacks grows with its hidden width.
  • Dimensionality becomes a tunable safety hyperparameter: the projected width $K$ and the insertion layer set where linear safety structure disappears and how much utility survives.
  • Defenses that only hide safety from linear probes are not a complete cure: the paper's own utility and GCG results imply that preserving non-safety linear concepts, and surviving non-linear attacks, are separate requirements.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper leaves implicit that the proposed defenses should transfer to any linear-readout attack, including concept-erasure methods that project out a safety direction, because all of them rely on the same recoverability of a linear direction.
  • A controlled hidden-width sweep within one family of models would turn the paper's cross-family trend into a causal claim; if the trend survives, dimensional regularization could be added to the alignment loss as an explicit safety term.
  • The $O(\sqrt{D})$ bound suggests a testable scaling law: the minimal projected dimension $K$ at which an ActAdd vector stops transferring should grow slowly with model scale, so small $K$ values on 7B models may not suffice at much larger widths.
  • Because the Bottleneck model preserves truthfulness and emotion while hiding safety, probing which concepts stay linear after projection could serve as a cheap utility-preservation test before running full benchmark suites.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper hypothesizes that increasing hidden dimensionality in LLMs makes abstract concepts such as safety more linearly separable in activation space, and that this linear structure is exploited by activation-steering jailbreaks (ActAdd and Ablation). The authors support this with PCA visualizations and linear probe accuracy across models of different scales, interpret this as a 'Paradox of Linear Separability', and provide a theoretical argument based on Rademacher complexity bounding the capacity of linear classifiers by O(sqrt(D/N)). They then propose two defenses built on aligned 7B chat/instruct models: (1) FJLT, which projects the query and key matrices of a chosen attention head into a lower dimension K during fine-tuning under a token-wise constrained objective, and (2) Bottleneck, which inserts a linear autoencoder between two layers, compressing to K and reconstructing to D, trained with a refusal dataset plus an anchor utility dataset. On JailbreakBench, AdvBench, and HarmBench, both methods are reported to substantially restore refusal and safety scores after ActAdd and Ablation attacks compared to fine-tuning-only baselines, with mixed but mostly competitive utility preservation. The paper also reports that the FJLT method degrades under GCG attacks and on several utility benchmarks, while the Bottleneck method preserves utility better. A self-acknowledged limitation section discusses dependence on linear separability, data requirements, and attack scope.

Significance. If the causal dimensionality claim held, this would be a valuable explanation of a tension in scaling LLMs: larger hidden dimensions improve capabilities but may make safety alignment more vulnerable to steering attacks. The empirical portion is responsibly executed in several respects: it compares against fine-tuning-only controls, reports 5-run means and standard deviations, evaluates on three benchmarks and three model families, includes ablations over head/layer placement and the alpha parameter, and is accompanied by reproducible code and detailed appendices. The paper also explicitly reports its own negative results, including GCG vulnerability and the Qwen2-7B-Instruct-Bottleneck's weak defense, which strengthens confidence in the reported numbers. However, the central mechanism asserted in the paper—that the defenses work by reducing the dimensionality of the space in which steering and probing operate—is not implemented in that space, and the cross-model evidence for the causal role of hidden dimension is confounded. The empirical defense results may stand, but the interpretation as a 'curse of dimensionality' requires substantially more support or a reframing.

major comments (4)
  1. [Section 4.1, 4.2 and Appendix A.4, E] The implemented defenses do not reduce the dimension of the representation space in which steering and probing actually act. The FJLT method projects only the query and key matrices of one attention head (Q_proj = Q Phi, K_proj = K Phi with Phi in R^{D_H x K}); the residual-stream activations x^(ell) remain in R^D, and ActAdd/Ablation (Appendix B.1-B.2) add or subtract directions in that same D-dimensional residual stream. The Bottleneck method compresses x^(ell) to K and reconstructs to D before layer ell+1, so final-layer representations used for the linear probes in Figure 5 and Appendix E are still D-dimensional. Hence the input dimension in Proposition 1 is unchanged for both the probe and the attack, and the Rademacher bound O(sqrt(D/N)) cannot be the mechanism by which linear structure disappears. The drop in probe accuracy must instead be attributed to the fine-tuning objectives (Eq. 5 and Eq. 4.2), a confound that Figure 5 does not isolate because it omits an FT-only linear-probe condition. I request (i) a linear-probe condition on the fine-tuned model without any architectural modification, and (ii) a discussion of why the JL lemma's approximate preservation of inner products and distances (Appendix A.2-A.3) does not imply that a linearly separable safety direction should be approximately preserved in the projected Q/K space rather than erased.
  2. [Section 3.1, Figure 3] The 'curse of dimensionality' claim rests on a cross-family comparison: the models in Figure 3 differ in architecture, pre-training data, and alignment procedure, not only in hidden dimension. The observed monotone increase in linear probe accuracy could be driven by any of these correlated factors. To substantiate the causal claim that hidden dimension itself drives linear separability, the authors should provide a controlled sweep within one model family (e.g., varying hidden width while keeping architecture, data, and training procedure fixed, or intervening on the effective dimension of the activation space while freezing everything else). Without such a control, the paper should soften the causal language to a correlational observation.
  3. [Section 3.2, paragraph after Eq. (4)] The inference from the Rademacher bound to the ineffectiveness of steering vectors is asserted without a derivation. Lower Rademacher complexity of a bounded-norm linear class in R^k does not imply that the particular difference-in-means steering direction used by ActAdd fails; even a low-complexity class can contain a perfect separator if the projected data are separable. Please state and prove a formal claim that relates the success of the ActAdd or Ablation attack to the Rademacher bound, or clearly characterize the additional assumptions (e.g., margin, distribution of the steering direction) needed. As written, the theoretical section does not logically connect Proposition 1 to the empirical defense results.
  4. [Section 5.1.2, Table 2, and Appendix D.2] The paper claims 'significant improvements on both harmful and benign instructions across all models and metrics', but the Qwen2-7B-Instruct-Bottleneck results do not support this. For the ActAdd jailbreak, harmful-instruction refusal increases only from 0.11 (baseline) to 0.23 (Bottleneck), while fine-tuning alone gives 0.08; safety score goes from 0.18 to 0.51. Appendix D.2 shows similarly weak or mixed results on AdvBench and HarmBench for this model (e.g., HarmBench ActAdd safety 0.39 vs. baseline 0.19). Since the paper's conclusion is a general phenomenon across models, the Qwen2 discrepancy needs a dedicated analysis or a more nuanced claim about when the Bottleneck defense works.
minor comments (5)
  1. [Section 4.1, Table 1] The table cells '0 64' and '0 96' in the Head column appear to contain stray characters (perhaps a degree symbol or a formatting artifact); please clean these up.
  2. [Section 4.2] The display equation is referred to as 'Eqn. 4.2' in the text but is never assigned a number; number the equations consistently throughout the manuscript.
  3. [Section 5.2, Figure 4] The label 'Compromised!' in the safety panel is informal; consider using a neutral caption such as 'loss of linear separability' to keep the presentation consistent with the rest of the paper.
  4. [Appendix D.3, Table 13] The Gemma-1.1-7B-IT perplexity values are extremely high (baseline 529.05), and the FJLT value of 1923.04 is dismissed as an 'anomaly' without a quantitative explanation; report cross-entropy loss as well as perplexity, or discuss the calibration of these numbers, to make the utility comparisons interpretable.
  5. [Section 5.1.1 and Appendix B.4] The refusal fine-tuning dataset is inconsistently named Dp, D_P, and 'the dataset'; standardize the notation.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: jailbreak and utility metrics are external, fine-tuning controls are included, and the theory/defense gap is a mechanism issue rather than a reduction of a prediction to its inputs.

full rationale

The paper's derivation chain is not circular. The central empirical claim—that FJLT/Bottleneck fine-tuning reduces the success of ActAdd/Ablation steering attacks—is evaluated with external jailbreak benchmarks and refusal/safety scores (Section 5.1, Appendix D.2), none of which appear as terms in the fine-tuning objectives (Eq. 5 and Eq. 4.2). The FT-only baselines control for the refusal-fine-tuning confound, and the utility evaluations (Appendix D.3) are independent of the training data. Proposition 1's Rademacher bound is a standard external result with a supplied proof (Appendix A.4), and no model parameter is fitted to the jailbreak metrics. No load-bearing self-citation is present. The main weakness is a mechanism gap: the FJLT projection applies to Q/K within attention and the Bottleneck reconstructs to R^D before the next layer, while ActAdd/Ablation and the linear probes operate on the residual stream at dimension D (Sections 4.1, 4.2, Appendices B.1, B.2, E); hence the Rademacher bound's D is not the dimension modified by the defenses. This is an explanatory/confound problem, not a circular reduction: the defended models' lower measured linear separability is not equal by construction to the fine-tuning objectives, and the paper reports the FT baseline separately. The acknowledged limitations (Appendices G.1-G.3) similarly concern generalizability, not circularity.

Assumptions & free parameters 7 free parameters · 6 assumptions · 0 invented entities

The central claims rest on several assumptions that are not paid for upstream. The linear representation hypothesis and the difference-in-means steering construction are taken from prior work as domain assumptions; they are needed for the attack and defense logic. The Rademacher complexity bound is standard mathematics, but the paper's interpretation of it as a guarantee about steering-vector ineffectiveness is an ad hoc step. The causal reading of Figure 3 is also ad hoc because model families differ in architecture, data, and training. The methods introduce no new entities, but the projection dimension K, bottleneck dimension K, insertion layer, head index, and anchor weight alpha are hand-chosen per model, mostly via ablations on the evaluation benchmarks.

free parameters (7)
  • FJLT projection dimension K = Llama2-7B-Chat: 64; Gemma-1.1-7B-IT: 96; Qwen2-7B-Instruct: 64
    Chosen per model; ablations on heads and K are reported in Appendix C using the same JailbreakBench and Alpaca evaluation sets, so the value functions as a tuned parameter rather than a prespecified constant.
  • FJLT attention head index = 0 for all models; single head per layer
    Selected from ablation Table 6; head 0 gives the best benign-instruction refusal trade-off.
  • FJLT layer scope = All layers for Llama2 and Gemma; last 8 layers for Qwen2
    Chosen per model in Table 3; no separate validation justification is provided.
  • Bottleneck dimension K = Llama2: 2048; Gemma: 1536; Qwen2: 1792
    Chosen per model, reported in Table 2; the effect of K on the defense is not ablated.
  • Bottleneck insertion layer = 0 for all models
    Selected from ablation Table 8, where layer 0 gives the best results; later layers degrade performance.
  • Anchor loss weight alpha = Llama2 and Qwen2: 1.0; Gemma: 0.1
    Reported in Table 2 and Appendix C.3; robustness to small increments is shown, but values are still tuned on evaluation metrics.
  • Number of FJLT heads = 1
    Chosen as a design choice; multi-head variants in Table 7 improve harmful scores but hurt utility and perplexity.
assumptions (6)
  • domain assumption Concepts such as safety and emotion are linearly represented as directions in activation space (linear representation hypothesis).
    Invoked in Sections 2 and 3.1, built on Park et al. (2023, 2024) and Marks and Tegmark (2023). The defense logic assumes this holds for safety in the evaluated models.
  • domain assumption The difference-in-means steering vector (Arditi et al., 2024) is a valid adversary capable of removing refusal.
    Used to construct ActAdd and Ablation jailbreaks in Appendix B.1 and B.2; the paper does not question the reliability of the direction selection procedure.
  • standard math The empirical Rademacher complexity bound (Theorem 1, Awasthi et al. 2020) and the Gaussian norm concentration (Lemma 2) justify Proposition 1.
    Standard learning-theoretic results, cited and proved in Appendix A.4.
  • ad hoc to paper Lower Rademacher complexity of the linear class in R^k implies it is harder to find an effective steering vector in the projected space.
    Section 3.2 states this without proof; the bound alone does not establish that the safety direction becomes unavailable or that the attacker's probe fails.
  • ad hoc to paper Hidden dimension is the causal driver of the observed linear separability differences, not architecture, pretraining data, or alignment.
    Figure 3 compares different model families and sizes; no controlled scaling of a single architecture with varying hidden dimension is provided.
  • ad hoc to paper Projecting query and key matrices (FJLT) or inserting a bottleneck preserves sufficient information for alignment while disrupting the safety direction.
    Core design assumption; empirically evaluated in Tables 1 and 2, but no theoretical guarantee is given, and utility drops for FJLT on several benchmarks.

how reviews work

0 comments
Cite this review

Pith. "Pith review of The Blessing and Curse of Dimensionality in Safety Alignment." pith.science (2026). https://pith.science/paper/4F23EYHK

@misc{pith2026250720333,
  author       = {Pith},
  title        = {Pith review of: The Blessing and Curse of Dimensionality in Safety Alignment},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4F23EYHK}},
  note         = {Machine review of arXiv:2507.20333}
}
read the original abstract

The focus on safety alignment in large language models (LLMs) has increased significantly due to their widespread adoption across different domains. The scale of LLMs play a contributing role in their success, and the growth in parameter count follows larger hidden dimensions. In this paper, we hypothesize that while the increase in dimensions has been a key advantage, it may lead to emergent problems as well. These problems emerge as the linear structures in the activation space can be exploited, in the form of activation engineering, to circumvent its safety alignment. Through detailed visualizations of linear subspaces associated with different concepts, such as safety, across various model scales, we show that the curse of high-dimensional representations uniquely impacts LLMs. Further substantiating our claim, we demonstrate that projecting the representations of the model onto a lower dimensional subspace can preserve sufficient information for alignment while avoiding those linear structures. Empirical results confirm that such dimensional reduction significantly reduces susceptibility to jailbreaking through representation engineering. Building on our empirical validations, we provide theoretical insights into these linear jailbreaking methods relative to a model's hidden dimensions. Broadly speaking, our work posits that the high dimensions of a model's internal representations can be both a blessing and a curse in safety alignment.

Figures

Figures reproduced from arXiv: 2507.20333 by the authors.

Figure 1
Figure 1. Examples of contrasting prompts representing a positive or negative emotion used to find the steering vector for emotion. Learning with Human Feedback (RLHF) (Ouyang et al., 2022; Kaufmann et al., 2023), and Direct Preference Optimization (DPO) (Rafailov et al., 2023). Considering the importance of safety alignment in LLM deployment, it is crucial to understand the internal model representations of safety and their … view at source ↗
Figure 2
Figure 2. (Left to right) Each column visualizes the hidden representations from different layers of Qwen0.5B, GPT-XL, Qwen7B, and Llama2-7B respectively, when projected onto the top-2 principal components. The top row are hidden representations from the third layer while the bottom row are from the last layer of each model. Red and blue points are representations of prompts corresponding to positive and negative emotion. Eac… view at source ↗
Figure 3
Figure 3. Test accuracy of linear probes trained on activations from models with varying hidden dimensions. The probes are trained to classify if a prompt repre￾sents a positive or negative emotion. Linear Probing. We corroborate our visualization with a linear probe experiment and present our re￾sults in [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Projection of the hidden representations onto the top-2 principal components for three concept categories–truthfulness, emotion, and safety–in the baseline Chat, FJLT, and Bottleneck models based on Llama2-7B-Chat. 6 Related Work Concept erasure. Concept erasure aims t…
Figure 5
Figure 5. Figure 5: Test accuracy of linear probes trained using representations of harmful and benign prompts from baseline Chat or Instruct models, FJLT models and Bottleneck models using different LLM architectures. prompt was harmful or not, thereby determining if the representations …
Figure 6
Figure 6. Figure 6: Projection of the hidden representations onto the top-2 principal components in the baseline Chat, FJLT, and Bottleneck models based on different LLM architectures. PC2 PC1 PC3 PC1 PC2 PC2 PC1 Baseline FJLT Bottleneck [PITH_FULL_IMAGE:figures/full_fig_p032_6.png]
Figure 7
Figure 7. Figure 7: Projection of the hidden representations, as in [PITH_FULL_IMAGE:figures/full_fig_p032_7.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

86 extracted references · 14 canonical work pages

  1. [1]

    Can language models encode perceptual structure without grounding? a case study in color

    Mostafa Abdou, Artur Kulmizev, Daniel Hershcovich, Stella Frank, Ellie Pavlick, and Anders S gaard. Can language models encode perceptual structure without grounding? a case study in color. In Arianna Bisazza and Omri Abend (eds.), Proceedings of the 25th Conference on Computational Natural Language Learning, pp.\ 109--132, Online, November 2021. Associat...

    doi:10.18653/v1/2021.conll-1.9 2021

  2. [2]

    Gpt-4 technical report

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774, 2023

    arXiv 2023

  3. [3]

    Fine-grained analysis of sentence embeddings using auxiliary prediction tasks

    Yossi Adi, Einat Kermany, Yonatan Belinkov, Ofer Lavi, and Yoav Goldberg. Fine-grained analysis of sentence embeddings using auxiliary prediction tasks. arXiv preprint arXiv:1608.04207, 2016

    arXiv 2016

  4. [4]

    Approximate nearest neighbors and the fast johnson-lindenstrauss transform

    Nir Ailon and Bernard Chazelle. Approximate nearest neighbors and the fast johnson-lindenstrauss transform. In Proceedings of the Thirty-Eighth Annual ACM Symposium on Theory of Computing, STOC '06, pp.\ 557–563, New York, NY, USA, 2006. Association for Computing Machinery. ISBN 1595931341. doi:10.1145/1132516.1132597. URL https://doi.org/10.1145/1132516.1132597

    arXiv 2006

  5. [5]

    Introducing claude, Mar 2023

    Anthropic. Introducing claude, Mar 2023. URL https://www.anthropic.com/news/introducing-claude

    2023

  6. [6]

    Introducing computer use, a new claude 3.5 sonnet, and claude 3.5 haiku, Oct 2024

    Anthropic. Introducing computer use, a new claude 3.5 sonnet, and claude 3.5 haiku, Oct 2024. URL https://www.anthropic.com/news/3-5-models-and-computer-use

    2024

  7. [7]

    Refusal in language models is mediated by a single direction

    Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee, and Neel Nanda. Refusal in language models is mediated by a single direction. arXiv preprint arXiv:2406.11717, 2024

    arXiv 2024

  8. [8]

    Adversarial learning guarantees for linear hypotheses and neural networks

    Pranjal Awasthi, Natalie Frank, and Mehryar Mohri. Adversarial learning guarantees for linear hypotheses and neural networks. In Proceedings of ICML, 2020

    2020

Show all 86 references
  1. [9]

    sql-create-context dataset, 2023

    b mc2. sql-create-context dataset, 2023. URL https://huggingface.co/datasets/b-mc2/sql-create-context. This dataset was created by modifying data from the following sources: zhongSeq2SQL2017, yu2018spider

    2023

  2. [10]

    Qwen technical report

    Jinze Bai, Shuai Bai, Yunfei Chu, Zeyu Cui, Kai Dang, Xiaodong Deng, Yang Fan, Wenbin Ge, Yu Han, Fei Huang, et al. Qwen technical report. arXiv preprint arXiv:2309.16609, 2023

    2023 arXiv

  3. [11]

    LEACE : Perfect linear concept erasure in closed form

    Nora Belrose, David Schneider-Joseph, Shauli Ravfogel, Ryan Cotterell, Edward Raff, and Stella Biderman. LEACE : Perfect linear concept erasure in closed form. In Thirty-seventh Conference on Neural Information Processing Systems, 2023. URL https://openreview.net/forum?id=awIpKpwTwF

    2023

  4. [12]

    Man is to computer programmer as woman is to homemaker? debiasing word embeddings

    Tolga Bolukbasi, Kai-Wei Chang, James Zou, Venkatesh Saligrama, and Adam Kalai. Man is to computer programmer as woman is to homemaker? debiasing word embeddings. In Proceedings of the 30th International Conference on Neural Information Processing Systems, NIPS'16, pp.\ 4356–4...

    2016

  5. [13]

    Jailbreakbench: An open robustness benchmark for jailbreaking large language models

    Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J Pappas, Florian Tramer, et al. Jailbreakbench: An open robustness benchmark for jailbreaking large language models. arXiv pre...

    2024 arXiv

  6. [14]

    Fundamental limits of perfect concept erasure

    Somnath Basu Roy Chowdhury, Kumar Avinava Dubey, Ahmad Beirami, Rahul Kidambi, Nicholas Monath, Amr Ahmed, and Snigdha Chaturvedi. Fundamental limits of perfect concept erasure. In The 28th International Conference on Artificial Intelligence and Statistics, 2025. URL https://o...

    2025

  7. [15]

    Training verifiers to solve math word problems

    Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, et al. Training verifiers to solve math word problems. arXiv preprint arXiv:2110.14168, 2021

    arXiv

  8. [16]

    What you can cram into a single \ & ! \# * vector: Probing sentence embeddings for linguistic properties

    Alexis Conneau, German Kruszewski, Guillaume Lample, Lo \"i c Barrault, and Marco Baroni. What you can cram into a single \ & ! \# * vector: Probing sentence embeddings for linguistic properties. In Iryna Gurevych and Yusuke Miyao (eds.), Proceedings of the 56th Annual Meeting...

    2018 doi

  9. [17]

    Unified language model pre-training for natural language understanding and generation

    Li Dong, Nan Yang, Wenhui Wang, Furu Wei, Xiaodong Liu, Yu Wang, Jianfeng Gao, Ming Zhou, and Hsiao-Wuen Hon. Unified language model pre-training for natural language understanding and generation. In H. Wallach, H. Larochelle, A. Beygelzimer, F. d Alch\' e -Buc, E. Fox, and R....

    2019

  10. [18]

    The fast johnson-lindenstrauss transform is even faster

    Ora Nova Fandina, Mikael M ller H gsgaard, and Kasper Green Larsen. The fast johnson-lindenstrauss transform is even faster. In Proceedings of the 40th International Conference on Machine Learning, ICML'23, 2023

    2023

  11. [19]

    An introduction to johnson-lindenstrauss transforms

    Casper Benjamin Freksen. An introduction to johnson-lindenstrauss transforms. arXiv preprint arXiv:2103.00564, 2021. URL https://doi.org/10.48550/arXiv.2103.00564

    2021 doi arXiv

  12. [20]

    Red teaming language models to reduce harms: Methods, scaling behaviors, and lessons learned

    Deep Ganguli, Liane Lovitt, Jackson Kernion, Amanda Askell, Yuntao Bai, Saurav Kadavath, Ben Mann, Ethan Perez, Nicholas Schiefer, Kamal Ndousse, et al. Red teaming language models to reduce harms: Methods, scaling behaviors, and lessons learned. arXiv preprint arXiv:2209.07858, 2022

    2022 arXiv

  13. [21]

    The pile: An 800gb dataset of diverse text for language modeling

    Leo Gao, Stella Biderman, Sid Black, Laurence Golding, Travis Hoppe, Charles Foster, Jason Phang, Horace He, Anish Thite, Noa Nabeshima, et al. The pile: An 800gb dataset of diverse text for language modeling. arXiv preprint arXiv:2101.00027, 2020

    2020 arXiv

  14. [22]

    SAMS um corpus: A human-annotated dialogue dataset for abstractive summarization

    Bogdan Gliwa, Iwona Mochol, Maciej Biesek, and Aleksander Wawer. SAMS um corpus: A human-annotated dialogue dataset for abstractive summarization. In Lu Wang, Jackie Chi Kit Cheung, Giuseppe Carenini, and Fei Liu (eds.), Proceedings of the 2nd Workshop on New Frontiers in Summ...

    2019 doi

  15. [23]

    The llama 3 herd of models

    Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, et al. The llama 3 herd of models. arXiv preprint arXiv:2407.21783, 2024

    2024 arXiv

  16. [24]

    Language models represent space and time

    Wes Gurnee and Max Tegmark. Language models represent space and time. arXiv preprint arXiv:2310.02207, 2023

    2023 arXiv

  17. [25]

    Safety arithmetic: A framework for test-time safety alignment of language models by steering parameters and activations

    Rima Hazra, Sayan Layek, Somnath Banerjee, and Soujanya Poria. Safety arithmetic: A framework for test-time safety alignment of language models by steering parameters and activations. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pp...

    2024 doi

  18. [26]

    Towards reasoning in large language models: A survey

    Jie Huang and Kevin Chen-Chuan Chang. Towards reasoning in large language models: A survey. In Anna Rogers, Jordan Boyd-Graber, and Naoaki Okazaki (eds.), Findings of the Association for Computational Linguistics: ACL 2023, pp.\ 1049--1065, Toronto, Canada, July 2023. Associat...

    2023 doi

  19. [27]

    Visualisation and'diagnostic classifiers' reveal how recurrent and recursive neural networks process hierarchical structure

    Dieuwke Hupkes, Sara Veldhoen, and Willem Zuidema. Visualisation and'diagnostic classifiers' reveal how recurrent and recursive neural networks process hierarchical structure. Journal of Artificial Intelligence Research, 61: 0 907--926, 2018

    2018

  20. [28]

    Approximate nearest neighbors: towards removing the curse of dimensionality

    Piotr Indyk and Rajeev Motwani. Approximate nearest neighbors: towards removing the curse of dimensionality. In Proceedings of the Thirtieth Annual ACM Symposium on Theory of Computing, STOC '98, pp.\ 604–613, New York, NY, USA, 1998. Association for Computing Machinery. ISBN ...

    1998

  21. [29]

    Ai alignment: A comprehensive survey

    Jiaming Ji, Tianyi Qiu, Boyuan Chen, Borong Zhang, Hantao Lou, Kaile Wang, Yawen Duan, Zhonghao He, Jiayi Zhou, Zhaowei Zhang, et al. Ai alignment: A comprehensive survey. arXiv preprint arXiv:2310.19852, 2023

    2023 arXiv

  22. [30]

    On the origins of linear representations in large language models

    Yibo Jiang, Goutham Rajendran, Pradeep Ravikumar, Bryon Aragam, and Victor Veitch. On the origins of linear representations in large language models. arXiv preprint arXiv:2403.03867, 2024

    2024 arXiv

  23. [31]

    Johnson and Joram Lindenstrauss

    William B. Johnson and Joram Lindenstrauss. Extensions of lipschitz mappings into a hilbert space. In Conference in Modern Analysis and Probability (New Haven, Conn., 1982), volume 26 of Contemporary Mathematics, pp.\ 189--206. American Mathematical Society, Providence, RI, 19...

    1982 doi

  24. [32]

    Kane and Jelani Nelson

    Daniel M. Kane and Jelani Nelson. Sparser johnson-lindenstrauss transforms. J. ACM, 61 0 (1), January 2014. ISSN 0004-5411. doi:10.1145/2559902. URL https://doi.org/10.1145/2559902

    2014 doi

  25. [33]

    A survey of reinforcement learning from human feedback

    Timo Kaufmann, Paul Weng, Viktor Bengs, and Eyke H \"u llermeier. A survey of reinforcement learning from human feedback. arXiv preprint arXiv:2312.14925, 10, 2023

    2023

  26. [34]

    Weighted Entropy and its Use in Computer Science and Beyond, pp.\ 293--308

    Mark Kelbert, Izabella Stuhl, and Yuri Suhov. Weighted Entropy and its Use in Computer Science and Beyond, pp.\ 293--308. 01 2017 a . ISBN 978-3-319-71503-2. doi:10.1007/978-3-319-71504-9_25

    2017 doi

  27. [35]

    Weighted entropy: basic inequalities

    Mark Kelbert, Izabella Stuhl, and Yuri Suhov. Weighted entropy: basic inequalities. Modern Stochastics: Theory and Applications, 4 0 (3): 0 233--252, 2017 b

    2017

  28. [36]

    Alignment of language agents

    Zachary Kenton, Tom Everitt, Laura Weidinger, Iason Gabriel, Vladimir Mikulik, and Geoffrey Irving. Alignment of language agents. ArXiv, abs/2103.14659, 2021. URL https://api.semanticscholar.org/CorpusID:232404883

    2021 arXiv

  29. [37]

    Scalable agent alignment via reward modeling: a research direction

    Jan Leike, David Krueger, Tom Everitt, Miljan Martic, Vishal Maini, and Shane Legg. Scalable agent alignment via reward modeling: a research direction. ArXiv, abs/1811.07871, 2018. URL https://api.semanticscholar.org/CorpusID:53745764

    2018 arXiv

  30. [38]

    Emergent world representations: Exploring a sequence model trained on a synthetic task

    Kenneth Li, Aspen K Hopkins, David Bau, Fernanda Vi \'e gas, Hanspeter Pfister, and Martin Wattenberg. Emergent world representations: Exploring a sequence model trained on a synthetic task. ICLR, 2023

    2023

  31. [39]

    Safety layers in aligned large language models: The key to LLM security

    Shen Li, Liuyi Yao, Lan Zhang, and Yaliang Li. Safety layers in aligned large language models: The key to LLM security. In The Thirteenth International Conference on Learning Representations, 2025. URL https://openreview.net/forum?id=kUH1yPMAn7

    2025

  32. [40]

    Deepseek-v3 technical report

    Aixin Liu, Bei Feng, Bing Xue, Bingxuan Wang, Bochao Wu, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, et al. Deepseek-v3 technical report. arXiv preprint arXiv:2412.19437, 2024 a

    2024 arXiv

  33. [41]

    On learning to summarize with large language models as references

    Yixin Liu, Kejian Shi, Katherine He, Longtian Ye, Alexander Fabbri, Pengfei Liu, Dragomir Radev, and Arman Cohan. On learning to summarize with large language models as references. In Kevin Duh, Helena Gomez, and Steven Bethard (eds.), Proceedings of the 2024 Conference of the...

    2024

  34. [42]

    The ai scientist: Towards fully automated open-ended scientific discovery

    Chris Lu, Cong Lu, Robert Tjarko Lange, Jakob Foerster, Jeff Clune, and David Ha. The ai scientist: Towards fully automated open-ended scientific discovery. arXiv preprint arXiv:2408.06292, 2024

    2024 arXiv

  35. [43]

    The geometry of truth: Emergent linear structure in large language model representations of true/false datasets

    Samuel Marks and Max Tegmark. The geometry of truth: Emergent linear structure in large language model representations of true/false datasets. ArXiv, abs/2310.06824, 2023. URL https://api.semanticscholar.org/CorpusID:263831277

    2023 arXiv

  36. [44]

    Michael Matthews, Samuel Matthews, and Thomas Kelemen. . () . : , pages, \ 28.95 hardcover. Personnel Psychology, 75 0 (1): 0 245--246, 2022. doi:https://doi.org/10.1111/peps.12500. URL https://onlinelibrary.wiley.com/doi/abs/10.1111/peps.12500

    2022 doi

  37. [45]

    Harmbench: A standardized evaluation framework for automated red teaming and robust refusal

    Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, et al. Harmbench: A standardized evaluation framework for automated red teaming and robust refusal. arXiv preprint arXiv:2402.04249, 2024

    2024 arXiv

  38. [46]

    Linguistic regularities in continuous space word representations

    Tomas Mikolov, Wen-tau Yih, and Geoffrey Zweig. Linguistic regularities in continuous space word representations. In Proceedings of the 2013 Conference of the North A merican Chapter of the Association for Computational Linguistics: Human Language Technologies , pp.\ 746--751,...

    2013

  39. [47]

    Foundations of Machine Learning

    Mehryar Mohri, Afshin Rostamizadeh, and Ameet Talwalkar. Foundations of Machine Learning. MIT Press, second edition, 2018

    2018

  40. [48]

    Emergent linear representations in world models of self-supervised sequence models

    Neel Nanda, Andrew Lee, and Martin Wattenberg. Emergent linear representations in world models of self-supervised sequence models. arXiv preprint arXiv:2309.00941, 2023

    2023 arXiv

  41. [49]

    Jelani Nelson and Huy L. Nguyen. Sparsity lower bounds for dimensionality reducing maps. In Proceedings of the Forty-Fifth Annual ACM Symposium on Theory of Computing, STOC '13, pp.\ 101–110, New York, NY, USA, 2013. Association for Computing Machinery. ISBN 9781450320290. doi...

    2013

  42. [50]

    The alignment problem from a deep learning perspective

    Richard Ngo. The alignment problem from a deep learning perspective. ArXiv, abs/2209.00626, 2022. URL https://api.semanticscholar.org/CorpusID:251979524

    2022 arXiv

  43. [51]

    Introducing operator, Jan 2025

    OpenAI. Introducing operator, Jan 2025. URL https://openai.com/index/introducing-operator/

    2025

  44. [52]

    Training language models to follow instructions with human feedback

    Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feedback. Advances in neural information processing systems, 35: 0 2...

    2022

  45. [53]

    The linear representation hypothesis and the geometry of large language models

    Kiho Park, Yo Joong Choe, and Victor Veitch. The linear representation hypothesis and the geometry of large language models. In Causal Representation Learning Workshop at NeurIPS 2023, 2023. URL https://openreview.net/forum?id=T0PoOJg8cK

    2023

  46. [54]

    The geometry of categorical and hierarchical concepts in large language models

    Kiho Park, Yo Joong Choe, Yibo Jiang, and Victor Veitch. The geometry of categorical and hierarchical concepts in large language models. arXiv preprint arXiv:2406.01506, 2024 a

    2024 arXiv

  47. [55]

    The linear representation hypothesis and the geometry of large language models

    Kiho Park, Yo Joong Choe, and Victor Veitch. The linear representation hypothesis and the geometry of large language models. In Proceedings of the 41st International Conference on Machine Learning, ICML'24. JMLR.org, 2024 b

    2024

  48. [56]

    Mapping language models to grounded conceptual spaces

    Roma Patel and Ellie Pavlick. Mapping language models to grounded conceptual spaces. In International Conference on Learning Representations, 2022. URL https://openreview.net/forum?id=gJcEM8sxHK

    2022

  49. [57]

    Safety alignment should be made more than just a few tokens deep

    Xiangyu Qi, Ashwinee Panda, Kaifeng Lyu, Xiao Ma, Subhrajit Roy, Ahmad Beirami, Prateek Mittal, and Peter Henderson. Safety alignment should be made more than just a few tokens deep. arXiv preprint arXiv:2406.05946, 2024

    2024 arXiv

  50. [58]

    Direct preference optimization: Your language model is secretly a reward model

    Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. Direct preference optimization: Your language model is secretly a reward model. Advances in Neural Information Processing Systems, 36: 0 53728--53741, 2023

    2023

  51. [59]

    Linear adversarial concept erasure

    Shauli Ravfogel, Michael Twiton, Yoav Goldberg, and Ryan D Cotterell. Linear adversarial concept erasure. In Proceedings of the 39th International Conference on Machine Learning, volume 162 of Proceedings of Machine Learning Research, pp.\ 18400--18421. PMLR, 17--23 Jul 2022. ...

    2022

  52. [60]

    Log-linear guardedness and its implications

    Shauli Ravfogel, Yoav Goldberg, and Ryan Cotterell. Log-linear guardedness and its implications. In Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp.\ 9413--9431, Toronto, Canada, July 2023. Association for Com...

    2023 doi

  53. [61]

    Steering llama 2 via contrastive activation addition

    Nina Rimsky, Nick Gabrieli, Julian Schulz, Meg Tong, Evan Hubinger, and Alexander Turner. Steering llama 2 via contrastive activation addition. In Lun-Wei Ku, Andre Martins, and Vivek Srikumar (eds.), Proceedings of the 62nd Annual Meeting of the Association for Computational ...

    2024 doi

  54. [62]

    Hashimoto

    Rohan Taori, Ishaan Gulrajani, Tianyi Zhang, Yann Dubois, Xuechen Li, Carlos Guestrin, Percy Liang, and Tatsunori B. Hashimoto. Stanford alpaca: An instruction-following llama model. https://github.com/tatsu-lab/stanford_alpaca, 2023

    2023

  55. [63]

    Gemma: Open models based on gemini research and technology

    Gemma Team, Thomas Mesnard, Cassidy Hardin, Robert Dadashi, Surya Bhupatiraju, Shreya Pathak, Laurent Sifre, Morgane Rivi \`e re, Mihir Sanjay Kale, Juliette Love, et al. Gemma: Open models based on gemini research and technology. arXiv preprint arXiv:2403.08295, 2024

    2024 arXiv

  56. [64]

    Meta llama guard 2

    Llama Team. Meta llama guard 2. https://github.com/meta-llama/PurpleLlama/blob/main/Llama-Guard2/MODEL_CARD.md, 2024

    2024

  57. [65]

    Llama: Open and efficient foundation language models

    Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timoth \'e e Lacroix, Baptiste Rozi \`e re, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971, 2023

    2023 arXiv

  58. [66]

    Steering language models with activation engineering

    Alexander Matt Turner, Lisa Thiergart, Gavin Leech, David Udell, Juan J Vazquez, Ulisse Mini, and Monte MacDiarmid. Steering language models with activation engineering. arXiv preprint arXiv:2308.10248, 2023

    2023 arXiv

  59. [67]

    Langlotz, Jason Hom, Sergios Gatidis, John Pauly, and Akshay S

    Dave Van Veen, Cara Van Uden, Louis Blankemeier, Jean-Benoit Delbrouck, Asad Aali, Christian Bluethgen, Anuj Pareek, Malgorzata Polacin, Eduardo Pontes Reis, Anna Seehofnerov \'a , Nidhi Rohatgi, Poonam Hosamani, William Collins, Neera Ahuja, Curtis P. Langlotz, Jason Hom, Ser...

    2024

  60. [68]

    Attention is all you need

    Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, ukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural information processing systems, 30, 2017

    2017

  61. [69]

    Self-consistency improves chain of thought reasoning in language models

    Xuezhi Wang, Jason Wei, Dale Schuurmans, Quoc Le, Ed Chi, Sharan Narang, Aakanksha Chowdhery, and Denny Zhou. Self-consistency improves chain of thought reasoning in language models. arXiv preprint arXiv:2203.11171, 2022

    2022 arXiv

  62. [70]

    Dai, and Quoc V

    Jason Wei, Maarten Bosma, Vincent Zhao, Kelvin Guu, Adams Wei Yu, Brian Lester, Nan Du, Andrew M. Dai, and Quoc V. Le. Finetuned language models are zero-shot learners. ArXiv, abs/2109.01652, 2021. URL https://api.semanticscholar.org/CorpusID:237416585

    2021 arXiv

  63. [71]

    Chain-of-thought prompting elicits reasoning in large language models

    Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al. Chain-of-thought prompting elicits reasoning in large language models. Advances in neural information processing systems, 35: 0 24824--24837, 2022

    2022

  64. [72]

    Tradeoffs between alignment and helpfulness in language models with representation engineering

    Yotam Wolf, Noam Wies, Dorin Shteyman, Binyamin Rothberg, Yoav Levine, and Amnon Shashua. Tradeoffs between alignment and helpfulness in language models with representation engineering. arXiv preprint arXiv:2401.16332, 2024

    2024 arXiv

  65. [73]

    An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, et al. Qwen2. 5 technical report. arXiv preprint arXiv:2412.15115, 2024

    2024 arXiv

  66. [74]

    Spider: A large-scale human-labeled dataset for complex and cross-domain semantic parsing and text-to-sql task

    Tao Yu, Rui Zhang, Kai Yang, Michihiro Yasunaga, Dongxu Wang, Zifan Li, James Ma, Irene Li, Qingning Yao, Shanelle Roman, et al. Spider: A large-scale human-labeled dataset for complex and cross-domain semantic parsing and text-to-sql task. arXiv preprint arXiv:1809.08887, 2018

    2018 arXiv

  67. [75]

    Hashimoto

    Tianyi Zhang, Faisal Ladhak, Esin Durmus, Percy Liang, Kathleen McKeown, and Tatsunori B. Hashimoto. Benchmarking large language models for news summarization. Transactions of the Association for Computational Linguistics, 12: 0 39--57, 01 2024. ISSN 2307-387X. doi:10.1162/tac...

    2024 doi

  68. [76]

    Chen, Jinhao Jiang, Ruiyang Ren, Yifan Li, Xinyu Tang, Zikang Liu, Peiyu Liu, Jianyun Nie, and Ji rong Wen

    Wayne Xin Zhao, Kun Zhou, Junyi Li, Tianyi Tang, Xiaolei Wang, Yupeng Hou, Yingqian Min, Beichen Zhang, Junjie Zhang, Zican Dong, Yifan Du, Chen Yang, Yushuo Chen, Z. Chen, Jinhao Jiang, Ruiyang Ren, Yifan Li, Xinyu Tang, Zikang Liu, Peiyu Liu, Jianyun Nie, and Ji rong Wen. A ...

    2023 arXiv

  69. [77]

    On prompt-driven safeguarding for large language models

    Chujie Zheng, Fan Yin, Hao Zhou, Fandong Meng, Jie Zhou, Kai-Wei Chang, Minlie Huang, and Nanyun Peng. On prompt-driven safeguarding for large language models. In Proceedings of the 41st International Conference on Machine Learning, ICML'24. JMLR.org, 2024

    2024

  70. [78]

    Seq2sql: Generating structured queries from natural language using reinforcement learning

    Victor Zhong, Caiming Xiong, and Richard Socher. Seq2sql: Generating structured queries from natural language using reinforcement learning. CoRR, abs/1709.00103, 2017

    2017 arXiv

  71. [79]

    Zhanhui Zhou, Jie Liu, Zhichen Dong, Jiaheng Liu, Chao Yang, Wanli Ouyang, and Yu Qiao. Emulated disalignment: Safety alignment for large language models may backfire! In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Pa...

    2024 doi

  72. [80]

    How alignment and jailbreak work: Explain LLM safety through intermediate hidden states

    Zhenhong Zhou, Haiyang Yu, Xinghua Zhang, Rongwu Xu, Fei Huang, and Yongbin Li. How alignment and jailbreak work: Explain LLM safety through intermediate hidden states. In Findings of the Association for Computational Linguistics: EMNLP 2024, pp.\ 2461--2488, Miami, Florida, U...

    2024 doi

  73. [81]

    Byun, Zifan Wang, Alex Troy Mallen, Steven Basart, Sanmi Koyejo, Dawn Song, Matt Fredrikson, Zico Kolter, and Dan Hendrycks

    Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann-Kathrin Dombrowski, Shashwat Goel, Nathaniel Li, Michael J. Byun, Zifan Wang, Alex Troy Mallen, Steven Basart, Sanmi Koyejo, Dawn Song, Matt Fredrikson, Zi...

    arXiv

  74. [82]

    Universal and transferable adversarial attacks on aligned language models

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043, 2023 b

    2023 arXiv

  75. [83]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

  76. [84]

    @esa (Ref

    \@ifxundefined[1] #1\@undefined \@firstoftwo \@secondoftwo \@ifnum[1] #1 \@firstoftwo \@secondoftwo \@ifx[1] #1 \@firstoftwo \@secondoftwo [2] @ #1 \@temptokena #2 #1 @ \@temptokena \@ifclassloaded agu2001 natbib The agu2001 class already includes natbib coding, so you should ...

  77. [85]

    \@lbibitem[] @bibitem@first@sw\@secondoftwo \@lbibitem[#1]#2 \@extra@b@citeb \@ifundefined br@#2\@extra@b@citeb \@namedef br@#2 \@nameuse br@#2\@extra@b@citeb \@ifundefined b@#2\@extra@b@citeb @num @parse #2 @tmp #1 NAT@b@open@#2 NAT@b@shut@#2 \@ifnum @merge>\@ne @bibitem@firs...

  78. [86]

    ,# (7),01444 '9=82<.342C 2! !22222222222222222222222222222222222222222222222222

    @open @close @open @close and [1] URL: #1 \@ifundefined chapter * \@mkboth \@ifxundefined @sectionbib * \@mkboth * \@mkboth\@gobbletwo \@ifclassloaded amsart * \@ifclassloaded amsbook * \@ifxundefined @heading @heading NAT@ctr thebibliography [1] @ \@biblabel @NAT@ctr \@bibset...

    2019

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.