Pith. sign in

REVIEW 6 major objections 5 minor 44 references

S3LoRA claims that zeroing the LoRA layers with the sharpest spectral updates removes unsafe behavior while preserving task utility.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

S3LoRA prunes LoRA layers with the sharpest spectral update concentration to improve safety in fine-tuned LLM agents without needing base models or extra data.

T0 review reviewed 2026-08-05 challenge →

load-bearing objection A useful data-free pruning recipe that never tests whether SSI beats random pruning, so the safety claim is plausible but not yet demonstrated. the 6 major comments →

arxiv 2508.15068 v1 pith:EX6QJBDV submitted 2025-08-20 cs.AI

S3LoRA: Safe Spectral Sharpness-Guided Pruning in Adaptation of Agent Planner

Shuang Ao , Gopal Rumchurn This is my paper
classification cs.AI
keywords LoRAsafety alignmentspectral sharpness indexMAS-SVDagent planningpost-hoc pruningparameter-efficient fine-tuningLLM safety
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes that the safety damage done by LoRA fine-tuning is concentrated in a few layers whose update matrices are spectrally sharp, meaning one singular value dominates the rest. It presents S3LoRA, a post-hoc, data-free, model-independent procedure that decomposes each LoRA update with MAS-SVD, scores every layer with the Spectral Sharpness Index (SSI), and zeroes out the top ten layers with the highest scores. The reported result is that this single pruning step improves safety metrics on agent-planning and language-generation benchmarks while holding utility roughly level and reducing inference time by 12–15%. A reader should care because existing safety-aware LoRA methods require both a base and an instruction-tuned checkpoint, and many real models only release one; S3LoRA's claim is that the fine-tuned delta alone contains enough signal to find and remove the unsafe adaptation.

Core claim

The paper argues that the safety risk introduced by LoRA fine-tuning leaves a measurable fingerprint in the spectrum of the update matrix ΔW. It claims that layers whose singular values are sharply concentrated—one dominant singular value carrying most of the spectral mass—are precisely the layers whose adaptation is unstable and safety-relevant. Its metric, SSI = σ'_1 / Σ σ'_j, computed after MAS-SVD restores global magnitude, ranks layers by this sharpness; zeroing the top ten such layers removes the 'unstable updates' while leaving the frozen base weights intact. On Planner Instruction Tuning, AgentInstruct, Dialogue Summary, and Alpaca, the paper reports that this operation improves Atta

What carries the argument

The engine of the method is MAS-SVD followed by SSI. MAS-SVD row- and column-normalizes ΔW, fits a robust low-rank approximation via iterative ℓ1 fitting with deflation over top-M singular vectors from the two normalization views, then rescales the result's singular values by the average row and column norms of the original ΔW. This rescaling is meant to preserve the update's global magnitude. SSI is then the ratio of the largest rescaled singular value to the sum of the top-h singular values. The pruning rule zeroes ΔW = AB for layers in the top-τ of the SSI ranking, leaving W0 untouched; the paper ties the sharpness-risk link to Wedin's perturbation bounds and spectral-norm generalization

Load-bearing premise

The method assumes that a layer whose LoRA update is concentrated along a single dominant direction is actually the layer causing unsafe behavior, rather than a property that happens to line up with the benchmark results after the prune count is tuned.

What would settle it

On Planner Instruction Tuning 2K, compare S3LoRA's top-10-SSI pruning against random pruning of ten layers and against pruning the ten layers with the largest total singular-value norm. If either control matches S3LoRA's ASR/HS improvements, the SSI ranking itself is not doing the causal work. A more direct test: zero only the single highest-SSI layer and check whether attack success rate moves; the paper's sharpness-risk mechanism predicts a dose-response, whereas its top-10-only report would be equally consistent with any 10-layer removal.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Safety alignment becomes a post-hoc operation on a single fine-tuned checkpoint: no paired base/instruction-tuned models, no calibration data, and no retraining, so it applies where such checkpoints are unavailable.
  • The same pruning step yields efficiency: in reported settings, removing ten projection layers cuts per-sample inference time by roughly 12–15% and leaves only about 1% of trainable parameters active.
  • Because SSI is defined on ΔW itself, the diagnostic transfers across architectures and tasks; the paper reports consistent safety gains on LLaMA2 and Gemma, on agent-planning and summarization/instruction data.
  • Selective prediction improves: higher AUARC under S3LoRA means uncertainty-based rejection of low-confidence outputs becomes a more reliable safety valve.
  • The method directly extends the prior pruning-based safety-alignment line of work by removing the need for a separately constructed safety subspace, making the intervention simpler to deploy.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • I infer that if the SSI–risk link is causal, per-layer safety contributions should follow SSI rank: zeroing the single highest-SSI layer should lower attack success more than zeroing the single lowest-SSI layer by the same amount. The paper reports only top-10 results, so this dose-response is a direct, testable consequence of its own mechanism.
  • Because τ=10 is fixed across datasets, a natural extension is to choose τ from the SSI score distribution itself (e.g., prune up to the largest gap in sorted SSI values). That would test whether ten is a property of the models or an artifact of the benchmark.
  • The safety metrics count an attack as successful when a refusal keyword is absent, so it remains open whether pruning restores genuine refusal behavior or only surface-level refusals. A stricter evaluation scoring refusal quality would clarify what the reported safety gain consists of.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

6 major / 5 minor

Summary. The paper proposes S3LoRA, a post-hoc, data-free method for mitigating safety degradation after LoRA fine-tuning. The method computes a Magnitude-Aware Spherically Normalized SVD (MAS-SVD) of each LoRA update ΔW, forms a Spectral Sharpness Index (SSI) from the ratio of the largest singular value to the sum of the top-h singular values, and prunes the τ layers with the highest SSI by zeroing their LoRA updates. Experiments on agent-planning (Instruction Tuning 2K, AgentInstruct, HotpotQA, TriviaQA) and language-generation (Dialogue Summary, Alpaca) datasets compare against LoRA, SafeLoRA, SPLoRA, and Vaccine, reporting improved safety (lower ASR/HS) with maintained utility and reduced inference cost. The central claim is that high spectral sharpness identifies unsafe LoRA layers, so pruning them improves safety.

Significance. The problem is well motivated and the proposed method is simple, practical, and model-independent; unlike SafeLoRA/SPLoRA it does not require paired base and instruction-tuned checkpoints. If the SSI-to-risk link were established, this would be a useful safety tool. The paper includes multiple datasets and models and an ablation of the decomposition method. However, the evidence is currently insufficient: there is no random/low-SSI pruning control, the pruning threshold is selected on the same dataset where headline results are reported, key constants M and h are unspecified, and the theoretical link between spectral sharpness and safety is asserted rather than demonstrated. The contributions are potentially useful but need substantially stronger empirical validation.

major comments (6)
  1. [SSI Guided LoRA Pruning (Eq. 5), Table 4] The central claim that SSI identifies unsafe layers is not tested against a null control. Table 4 varies τ (5/10/15/20) but always prunes the highest-SSI layers. Because pruning reverts the layer to frozen W0, any reduction in LoRA influence could improve ASR/HS. The authors should add random-pruning and lowest-SSI pruning at the same τ and show that SSI-based selection outperforms them. This is load-bearing: without it, MAS-SVD and SSI are not necessary for the reported safety gains. The conclusion's admission that the method 'assumes a general correlation between spectral sharpness and risk' underscores the gap.
  2. [Implementation Details, Tables 1 and 4] The pruning threshold τ=10 is chosen via the ablation in Table 4 on the Instruction Tuning 2K dataset, and the headline results in Table 1 are reported on the same dataset. This is selection on the test set and can inflate results. The authors should fix the threshold on a validation split or show that the same τ transfers across datasets; at minimum, report threshold sensitivity without using the evaluation set for model selection.
  3. [Methodology, Eqs. (3)-(4)] M (the number of rank-1 components in MAS-SVD) and h (the number of singular values retained for SSI) are never specified. The method is not reproducible without these values, and SSI in Eq. (4) depends on h for a fixed matrix. Please report the chosen values, provide a sensitivity analysis, and state how they were determined.
  4. [Spectral Sharpness Index (SSI)] The safety relevance of SSI is asserted rather than derived. The cited Wedin's theorem bounds singular-subspace perturbation under additive noise; it does not imply that a concentrated singular-value distribution in a LoRA update causes harmful outputs. A formal argument or an independent validation (e.g., showing that high-SSI layers correlate with safety degradation under controlled interventions) is needed. The paper's own conclusion calls this an assumption.
  5. [Tables 1-3, AgentInstruct results] The evidence is reported without error bars or repeated runs, which is material given the small margins. In Table 2, S3LoRA's ASR (16.34) is worse than SPLoRA's (15.74), while the text highlights only HS and AUARC. The claim of 'consistently improving safety metrics' requires at least multiple seeds and confidence intervals, and a clear specification of which safety metric is primary across tables.
  6. [Table 5 vs Table 3] The MAS-SVD ablation table appears mislabeled. The rows labeled 'DS' report ROUGE 24.02/23.21/25.12 and METEOR 18.35/19.28/20.32, which match the Alpaca numbers in Table 3 (ROUGE around 25, METEOR around 20), not the Dialogue Summary numbers in Table 3 (ROUGE 35.35-37.82, METEOR 43.21-44.96). This undermines the claim that MAS-SVD outperforms SVD/SpSVD on Dialogue Summary.
minor comments (5)
  1. [Abstract] The code URL contains a space ('S3 LoRA') and is not a valid link.
  2. [Evaluation Metrics] The full refusal-keyword list for ASR is said to be in the Appendix, but no appendix appears in the manuscript; this affects reproducibility.
  3. [Table 6] The model name 'Gemma2' is inconsistent with 'Gemma-7B-it' used elsewhere; specify the exact checkpoint.
  4. [Figure 2] The x-axis label 'Refer to experts' is unexplained; define the uncertainty score and the coverage protocol used to compute the risk-coverage curves.
  5. [Related Work] Some citations are stylistically inconsistent or incomplete (e.g., 'Yunis et.al' inline); please normalize the reference style.

Circularity Check

1 steps flagged

Headline IT2K safety result is selected by tuning τ on the same test set; other results give independent support, so partial circularity.

specific steps
  1. fitted input called prediction [Implementation Details section; Table 4 vs Table 1]
    "For all our experiments, we prune the top τ = 10 LoRA-updated layers with the highest SSI scores, as determined by our ablation study in Table 4. — Table 4: Impact of layer pruning threshold of SSI. Utility and safety metrics on the Instruction Tuning 2K dataset ... evaluated under different pruning thresholds based on the number of pruned layers."

    The pruning threshold τ is selected by scanning τ ∈ {5,10,15,20} on the Instruction Tuning 2K test split and choosing the value with the best AUARC/ASR/HS (Table 4). Table 1 then reports S3LoRA's safety metrics on the very same Instruction Tuning 2K test split. The headline ASR=1.23 and HS=1.15 are thus the argmin of the safety metrics over the scanned thresholds on that split, not an independent prediction. The claimed gain over LoRA/SafeLoRA/SPLoRA on this dataset is partially forced by the selection procedure: no separate validation split or nested selection is described (the paper states only an 80/20 train/test split for each dataset). This is a fitted parameter renamed as a reported outcome, matching the 'fitted input called prediction' pattern.

full rationale

We walked the claimed chain: MAS-SVD decomposes ΔW, SSI=σ′₁/Σσ′ⱼ ranks layers, top-τ layers are zeroed, and safety metrics are then measured. SSI is not defined in terms of ASR/HS, so the core metric is not circular by construction; indeed, the conclusion explicitly concedes that the method 'assumes a general correlation between spectral sharpness and risk,' acknowledging that the SSI→safety link is an assumption rather than a derivation. The one place where a reported result reduces to its own input is τ selection: the Implementation Details say τ=10 is 'determined by our ablation study in Table 4,' and Table 4 evaluates ASR/HS on the Instruction Tuning 2K test split. Table 1 reports S3LoRA's ASR/HS on that same split, so the IT2K 'prediction' is partially forced by model selection on the evaluation set. This is not the whole paper: AgentInstruct, Dialogue Summary, and Alpaca are separate test sets evaluated with τ fixed from IT2K, providing independent evidence, and comparisons to SafeLoRA/SPLoRA/Vaccine are external baselines. The missing random/low-SSI pruning control means the causal role of SSI is not established, but that is an experimental confound rather than a circular equation, so we do not count it as a circularity step. The self-citation to SPLoRA for the 10-layer choice is not load-bearing because the choice is primarily justified by the paper's own Table 4. We also note that MAS-SVD's magnitude rescaling (S′ = S·r̄·c̄) cancels in the SSI ratio, so the 'magnitude-aware' component is inert for the pruning criterion; this is a technical weakness but not circularity. Overall, one statistically forced IT2K result combined with independent support elsewhere warrants a moderate partial-circularity score of 5.

Axiom & Free-Parameter Ledger

3 free parameters · 4 axioms · 0 invented entities

The method rests on an unproven correlation between spectral sharpness and safety risk, plus a pruning threshold selected on the evaluation benchmark. Several algorithmic constants (M, h) are left unspecified.

free parameters (3)
  • tau (number of pruned layers) = 10
    Selected via ablation on the Instruction Tuning 2K dataset (Table 4) and then used across all other datasets and tasks.
  • M (number of rank-1 components in MAS-SVD) = unspecified
    Not stated in the paper; affects the robust reconstruction and is not included in any sensitivity analysis.
  • h (singular values kept for SSI) = unspecified
    The SSI formula retains 'top-h' singular values but h is never defined, even though the denominator depends on it.
axioms (4)
  • ad hoc to paper High spectral sharpness (SSI) identifies safety-critical LoRA layers
    Introduced in 'SSI Guided LoRA Pruning' and the conclusion; no derivation or independent causal evidence links singular value concentration to unsafe behavior.
  • ad hoc to paper Zeroing the top-tau pruned LoRA updates reduces risk while retaining task utility
    The central intervention; only empirical support is the tables, with no uncertainty quantification and with tau tuned on the evaluation set.
  • domain assumption The LoRA update Delta W alone is a sufficient proxy for safety risk
    Motivates the data-free, base-model-free design in the Problem Statement; no theoretical or empirical proof that Delta W carries enough signal.
  • ad hoc to paper Wedin's theorem implies output instability from concentrated spectral shifts
    The theorem bounds singular subspace perturbation between matrices; the paper uses it to argue sharp spectral concentration creates model output deviations, an extrapolation beyond the theorem's statement.

reviewed 2026-08-05 · how reviews work

0 comments
Cite this review

Pith. "Pith review of S3LoRA: Safe Spectral Sharpness-Guided Pruning in Adaptation of Agent Planner." pith.science (2026). https://pith.science/paper/EX6QJBDV

@misc{pith2026250815068,
  author       = {Pith},
  title        = {Pith review of: S3LoRA: Safe Spectral Sharpness-Guided Pruning in Adaptation of Agent Planner},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/EX6QJBDV}},
  note         = {Machine review of arXiv:2508.15068}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Adapting Large Language Models (LLMs) using parameter-efficient fine-tuning (PEFT) techniques such as LoRA has enabled powerful capabilities in LLM-based agents. However, these adaptations can unintentionally compromise safety alignment, leading to unsafe or unstable behaviors, particularly in agent planning tasks. Existing safety-aware adaptation methods often require access to both base and instruction-tuned model checkpoints, which are frequently unavailable in practice, limiting their applicability. We propose S3LoRA (Safe Spectral Sharpness-Guided Pruning LoRA), a lightweight, data-free, and model-independent framework that mitigates safety risks in LoRA-adapted models by inspecting only the fine-tuned weight updates. We first introduce Magnitude-Aware Spherically Normalized SVD (MAS-SVD), which robustly analyzes the structural properties of LoRA updates while preserving global magnitude information. We then design the Spectral Sharpness Index (SSI), a sharpness-aware metric to detect layers with highly concentrated and potentially unsafe updates. These layers are pruned post-hoc to reduce risk without sacrificing task performance. Extensive experiments and ablation studies across agent planning and language generation tasks show that S3LoRA consistently improves safety metrics while maintaining or improving utility metrics and significantly reducing inference cost. These results establish S3LoRA as a practical and scalable solution for safely deploying LLM-based agents in real-world, resource-constrained, and safety-critical environments.

Figures

Figures reproduced from arXiv: 2508.15068 by Gopal Rumchurn, Shuang Ao.

Figure 1
Figure 1. Figure 1: Overview of S3LoRA method. Each LoRA update ∆W is decomposed using MAS-SVD to obtain spectral val￾ues. The Spectral Sharpness Index (SSI) is then computed, and layers with high SSI scores are pruned to suppress un￾safe updates while preserving model utility. nificant computational inefficiencies (Hu et al. 2025a; Zeng et al. 2023; Xu et al. 2023). Agent planning often requires fine-tuning pretrained LLMs t… view at source ↗
Figure 2
Figure 2. Figure 2: The Risk-Coverage Curve compares LoRA, SafeLoRA, SPLoRA and our proposed S3LoRA, with per￾formance measured using the ROUGE-1 F1 score. The x￾axis (”Refer to experts”) represents the percentage of sam￾ples with the highest uncertainty scores. The left plot shows results for fine-tuning on Instruction Tuning 2K dataset with LLaMA2 model, and the right plot shows results for fine￾tuning on Dialogue Summary d… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

44 extracted references · 15 canonical work pages · 2 internal anchors

  1. [1]

    , " * write output.state after.block = add.period write newline

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    L.; Almeida, D.; Altenschmidt, J.; Altman, S.; Anadkat, S.; et al

    Achiam, J.; Adler, S.; Agarwal, S.; Ahmad, L.; Akkaya, I.; Aleman, F. L.; Almeida, D.; Altenschmidt, J.; Altman, S.; Anadkat, S.; et al. 2023. Gpt-4 technical report. arXiv preprint arXiv:2303.08774

    Pith/arXiv arXiv 2023

  4. [4]

    Ao, S.; Dong, Y.; Hu, J.; and Ramchurn, S. 2025. Safe Pruning LoRA: Robust Distance-Guided Pruning for Safety Alignment in Adaptation of LLMs. arXiv preprint arXiv:2506.18931

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  5. [5]

    H.; S im s ekli, U.; and Birdal, T

    Barsbey, M.; Ribeiro, A. H.; S im s ekli, U.; and Birdal, T. 2025. On the Interaction of Compressibility and Adversarial Robustness. arXiv preprint arXiv:2507.17725

    work page arXiv 2025

  6. [6]

    T.; Li, Y.; Lundberg, S.; et al

    Bubeck, S.; Chadrasekaran, V.; Eldan, R.; Gehrke, J.; Horvitz, E.; Kamar, E.; Lee, P.; Lee, Y. T.; Li, Y.; Lundberg, S.; et al. 2023. Sparks of artificial general intelligence: Early experiments with gpt-4

    2023

  7. [7]

    Chen, Z.; Li, M.; Huang, Y.; Du, Y.; Fang, M.; and Zhou, T. 2025. Atlas: Agent tuning via learning critical steps. arXiv preprint arXiv:2503.02197

    Pith/arXiv arXiv 2025

  8. [8]

    Chen, Z.; Liu, K.; Wang, Q.; Zhang, W.; Liu, J.; Lin, D.; Chen, K.; and Zhao, F. 2024. Agent-flan: Designing data and methods of effective agent tuning for large language models. arXiv preprint arXiv:2403.12881

    Pith/arXiv arXiv 2024

  9. [9]

    Gliwa, B.; Mochol, I.; Biesek, M.; and Wawer, A. 2019. SAMS um Corpus: A Human-annotated Dialogue Dataset for Abstractive Summarization. In Wang, L.; Cheung, J. C. K.; Carenini, G.; and Liu, F., eds., Proceedings of the 2nd Workshop on New Frontiers in Summarization, 70--79. Hong Kong, China: Association for Computational Linguistics

    work page 2019

  10. [10]

    Han, S.; Jung, S.; and Kim, K. 2024. Robust SVD Made Easy: A fast and reliable algorithm for large-scale data analysis. In International Conference on Artificial Intelligence and Statistics, 1765--1773. PMLR

    work page 2024

  11. [11]

    Hsu, C.-Y.; Tsai, Y.-L.; Lin, C.-H.; Chen, P.-Y.; Yu, C.-M.; and Huang, C.-Y. 2024. Safe lora: The silver lining of reducing safety risks when finetuning large language models. Advances in Neural Information Processing Systems, 37: 65072--65094

    work page 2024

  12. [12]

    J.; Shen, Y.; Wallis, P.; Allen-Zhu, Z.; Li, Y.; Wang, S.; Wang, L.; Chen, W.; et al

    Hu, E. J.; Shen, Y.; Wallis, P.; Allen-Zhu, Z.; Li, Y.; Wang, S.; Wang, L.; Chen, W.; et al. 2022. Lora: Low-rank adaptation of large language models. ICLR, 1(2): 3

    2022

  13. [13]

    Hu, M.; Zhao, P.; Xu, C.; Sun, Q.; Lou, J.-G.; Lin, Q.; Luo, P.; and Rajmohan, S. 2025 a . Agentgen: Enhancing planning abilities for large language model based agent via environment and task generation. In Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V. 1, 496--507

    work page 2025

  14. [14]

    Hu, Y.; Goel, K.; Killiakov, V.; and Yang, Y. 2025 b . Eigenspectrum analysis of neural networks without aspect ratio bias. arXiv preprint arXiv:2506.06280

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  15. [15]

    Huang, T.; Hu, S.; and Liu, L. 2024. Vaccine: Perturbation-aware Alignment for Large Language Models against Harmful Fine-tuning Attack. In The Thirty-eighth Annual Conference on Neural Information Processing Systems

    work page 2024

  16. [16]

    Huang, Y.; Ding, L.; Tang, Z.; Wang, T.; Lin, X.; Zhang, W.; Ma, M.; and Zhang, Y. 2025. A Framework for Benchmarking and Aligning Task-Planning Safety in LLM-Based Embodied Agents. arXiv preprint arXiv:2504.14650

    Pith/arXiv arXiv 2025

  17. [17]

    S.; and Zettlemoyer, L

    Joshi, M.; Choi, E.; Weld, D. S.; and Zettlemoyer, L. 2017. Triviaqa: A large scale distantly supervised challenge dataset for reading comprehension. arXiv preprint arXiv:1705.03551

    Pith/arXiv arXiv 2017

  18. [18]

    Li, C.; Wong, C.; Zhang, S.; Usuyama, N.; Liu, H.; Yang, J.; Naumann, T.; Poon, H.; and Gao, J. 2023. Llava-med: Training a large language-and-vision assistant for biomedicine in one day. Advances in Neural Information Processing Systems, 36: 28541--28564

    work page 2023

  19. [19]

    Li, Z.; Xia, M.; Zhang, J.; Hui, Z.; Kong, L.; Zhang, Y.; and Yang, X. 2025. Adasvd: Adaptive singular value decomposition for large language models. arXiv preprint arXiv:2502.01403

    arXiv 2025

  20. [20]

    Liu, H.; Li, C.; Wu, Q.; and Lee, Y. J. 2023. Visual instruction tuning. Advances in neural information processing systems, 36: 34892--34916

    2023

  21. [21]

    Nadeem, M. S. A.; Zucker, J.-D.; and Hanczar, B. 2009. Accuracy-rejection curves (ARCs) for comparing classification methods with a reject option. In Machine Learning in Systems Biology, 65--81. PMLR

    work page 2009

  22. [22]

    O’Rourke, S.; Vu, V.; and Wang, K. 2023. Matrices with Gaussian noise: Optimal estimates for singular subspace perturbation. IEEE Transactions on Information Theory, 70(3): 1978--2002

    work page 2023

  23. [23]

    Qi, X.; Zeng, Y.; Xie, T.; Chen, P.-Y.; Jia, R.; Mittal, P.; and Henderson, P. 2023. Fine-tuning aligned language models compromises safety, even when users do not intend to! arXiv preprint arXiv:2310.03693

    Pith/arXiv arXiv 2023

  24. [24]

    Sha, Z.; Tian, H.; Xu, Z.; Cui, S.; Meng, C.; and Wang, W. 2025. Agent Safety Alignment via Reinforcement Learning. arXiv preprint arXiv:2507.08270

    Pith/arXiv arXiv 2025

  25. [25]

    Song, Y.; Xiong, W.; Zhao, X.; Zhu, D.; Wu, W.; Wang, K.; Li, C.; Peng, W.; and Li, S. 2024. Agentbank: Towards generalized llm agents via fine-tuning on 50000+ interaction trajectories. arXiv preprint arXiv:2410.07706

    Pith/arXiv arXiv 2024

  26. [26]

    Staats, M.; Thamm, M.; and Rosenow, B. 2024. Small Singular Values Matter: A Random Matrix Analysis of Transformer Models. arXiv preprint arXiv:2410.17770

    arXiv 2024

  27. [27]

    Taori, R.; Gulrajani, I.; Zhang, T.; Dubois, Y.; Li, X.; Guestrin, C.; Liang, P.; and Hashimoto, T. B. 2023. Stanford alpaca: An instruction-following llama model

    work page 2023

  28. [28]

    S.; Love, J.; et al

    Team, G.; Mesnard, T.; Hardin, C.; Dadashi, R.; Bhupatiraju, S.; Pathak, S.; Sifre, L.; Rivi \`e re, M.; Kale, M. S.; Love, J.; et al. 2024. Gemma: Open models based on gemini research and technology. arXiv preprint arXiv:2403.08295

    Pith/arXiv arXiv 2024

  29. [29]

    Touvron, H.; Martin, L.; Stone, K.; Albert, P.; Almahairi, A.; Babaei, Y.; Bashlykov, N.; Batra, S.; Bhargava, P.; Bhosale, S.; et al. 2023. Llama 2: Open foundation and fine-tuned chat models. arXiv preprint arXiv:2307.09288

    Pith/arXiv arXiv 2023

  30. [30]

    Wang, L.; Ma, C.; Feng, X.; Zhang, Z.; Yang, H.; Zhang, J.; Chen, Z.; Tang, J.; Chen, X.; Lin, Y.; et al. 2024. A survey on large language model based autonomous agents. Frontiers of Computer Science, 18(6): 186345

    work page 2024

  31. [31]

    Wang, X.; Alam, S.; Wan, Z.; Shen, H.; and Zhang, M. 2025. Svd-llm v2: Optimizing singular value truncation for large language model compression. arXiv preprint arXiv:2503.12340

    Pith/arXiv arXiv 2025

  32. [32]

    Wedin, P.- . 1972. Perturbation bounds in connection with singular value decomposition. BIT Numerical Mathematics, 12(1): 99--111

    work page 1972

  33. [33]

    Wei, B.; Huang, K.; Huang, Y.; Xie, T.; Qi, X.; Xia, M.; Mittal, P.; Wang, M.; and Henderson, P. 2024. Assessing the brittleness of safety alignment via pruning and low-rank modifications. arXiv preprint arXiv:2402.05162

    Pith/arXiv arXiv 2024

  34. [34]

    Xi, Z.; Chen, W.; Guo, X.; He, W.; Ding, Y.; Hong, B.; Zhang, M.; Wang, J.; Jin, S.; Zhou, E.; et al. 2025. The rise and potential of large language model based agents: A survey. Science China Information Sciences, 68(2): 121101

    work page 2025

  35. [35]

    J.; Zhao, J.; Liu, Q.; Liu, C.; et al

    Xie, T.; Zhou, F.; Cheng, Z.; Shi, P.; Weng, L.; Liu, Y.; Hua, T. J.; Zhao, J.; Liu, Q.; Liu, C.; et al. 2023. Openagents: An open platform for language agents in the wild. arXiv preprint arXiv:2310.10634

    Pith/arXiv arXiv 2023

  36. [36]

    Xu, B.; Peng, Z.; Lei, B.; Mukherjee, S.; Liu, Y.; and Xu, D. 2023. Rewoo: Decoupling reasoning from observations for efficient augmented language models. arXiv preprint arXiv:2305.18323

    Pith/arXiv arXiv 2023

  37. [37]

    Y.; Zhao, X.; and Lin, D

    Yang, X.; Wang, X.; Zhang, Q.; Petzold, L.; Wang, W. Y.; Zhao, X.; and Lin, D. 2023. Shadow alignment: The ease of subverting safely-aligned language models. arXiv preprint arXiv:2310.02949

    Pith/arXiv arXiv 2023

  38. [38]

    W.; Salakhutdinov, R.; and Manning, C

    Yang, Z.; Qi, P.; Zhang, S.; Bengio, Y.; Cohen, W. W.; Salakhutdinov, R.; and Manning, C. D. 2018. HotpotQA: A dataset for diverse, explainable multi-hop question answering. arXiv preprint arXiv:1809.09600

    Pith/arXiv arXiv 2018

  39. [39]

    Yehudai, A.; Eden, L.; Li, A.; Uziel, G.; Zhao, Y.; Bar-Haim, R.; Cohan, A.; and Shmueli-Scheuer, M. 2025. Survey on evaluation of llm-based agents. arXiv preprint arXiv:2503.16416

    Pith/arXiv arXiv 2025

  40. [40]

    Yoshida, Y.; and Miyato, T. 2017. Spectral norm regularization for improving the generalizability of deep learning. arXiv preprint arXiv:1705.10941

    Pith/arXiv arXiv 2017

  41. [41]

    K.; Wheeler, S.; Savarese, P.; Vardi, G.; Livescu, K.; Maire, M.; and Walter, M

    Yunis, D.; Patel, K. K.; Wheeler, S.; Savarese, P.; Vardi, G.; Livescu, K.; Maire, M.; and Walter, M. R. 2024. Approaching deep learning through the spectral dynamics of weights. arXiv preprint arXiv:2408.11804

    Pith/arXiv arXiv 2024

  42. [42]

    Zeng, A.; Liu, M.; Lu, R.; Wang, B.; Liu, X.; Dong, Y.; and Tang, J. 2023. Agenttuning: Enabling generalized agent abilities for llms. arXiv preprint arXiv:2310.12823

    Pith/arXiv arXiv 2023

  43. [43]

    Zhan, Q.; Fang, R.; Bindu, R.; Gupta, A.; Hashimoto, T.; and Kang, D. 2023. Removing rlhf protections in gpt-4 via fine-tuning. arXiv preprint arXiv:2311.05553

    Pith/arXiv arXiv 2023

  44. [44]

    Zhang, J.; Yin, L.; Zhou, Y.; and Hu, S. 2025. AgentAlign: Navigating Safety Alignment in the Shift from Informative to Agentic Large Language Models. arXiv preprint arXiv:2505.23020

    Pith/arXiv arXiv 2025

This paper was first reviewed by deepseek-v4-flash on August 5, 2026.