Pith. sign in

REVIEW 4 major objections 3 minor 3 cited by

SafeLLM: Unlearning Harmful Outputs from Large Language Models against Jailbreak Attacks

T0 review · 4 major / 3 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read SafeLLM claims that jailbreak behavior can be removed by localizing and neutralizing the feedforward-network substructures that generate harmful content.

desk verdict Plausible unlearning pipeline for jailbreak defense, but the abstract overclaims and our copy of the full text is an unreadable extraction artifact, so the strong claims rest on trust. read the letter →

arxiv 2508.15182 v1 pith:HJKOGMMZ submitted 2025-08-21 cs.LG

Xiangman Li , Xiaodong Wu , Qi Li , Jianbing Ni , Rongxing Lu This is my paper
classification cs.LG
keywords jailbreakattacksmachineunlearningLLMsafetyfeedforwardnetworksactivationtracingconstrainedoptimizationharmfulcontentsuppressionadversarialprompts
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes SafeLLM, a defense that treats jailbreak attacks as a knowledge-localization problem. It claims that harmful output pathways in a large language model can be traced, at token level, to particular feedforward (FFN) substructures, and that selectively suppressing those substructures makes the model forget harmful responses while preserving ordinary skills. The method has three stages: hybrid unsafe-output detection, FFN-activation tracing of harmful content, and constrained optimization to neutralize the identified substructures. On Vicuna, LLaMA, and GPT-J across several jailbreak benchmarks, the paper reports large reductions in attack success rates and stable general performance. If correct, this would mean unlearning can be surgical and durable rather than a blunt fine-tuning trade-off.

What carries the argument

Token-level harmful-content tracing through feedforward-network (FFN) activations. In transformer language models, each block contains a feedforward sublayer; the paper claims that activations triggered by harmful tokens can be traced to a small set of FFN substructures, and that a constrained optimization step can neutralize those substructures. The tracing is what makes the unlearning targeted; without it, the method would just be a generic fine-tuning defense.

What would settle it

Take a SafeLLM-treated model, identify the FFN neurons whose ablation changes harmful outputs, and check whether those same neurons also drive correct answers on standard benchmarks; if ablating them degrades general performance on the same topics, the claimed separability fails. Alternatively, continue fine-tuning the unlearned model on a small harmful corpus; if jailbreak success returns, the forgetting is not irreversible.

Watch

Extended reading notes

Core claim

The central claim is that harmful knowledge is not diffuse but is concentrated in identifiable FFN substructures, and that neutralizing those substructures yields targeted, irreversible forgetting of harmful behavior. SafeLLM's pipeline starts with dynamic detection combining external classifiers and model-internal signals, then traces harmful tokens backward to the FFN activations that produce them, and finally applies a constrained optimization that suppresses those FFN pathways. The result reported is a substantial drop in attack success rates under jailbreak prompts with no material drop in general-purpose benchmarks.

Load-bearing premise

The load-bearing premise is that harmful knowledge is concentrated in a small set of feedforward-network substructures that can be suppressed without also removing the substructures that produce useful behavior.

Editorial extensions

If this is right

  • Attack success rates drop substantially on jailbreak benchmarks across multiple large language models.
  • General-purpose performance is maintained after unlearning, so safety is not bought by degrading the model.
  • The defense should generalize to unseen attacks because it removes the generating pathway rather than matching specific prompt templates.
  • Hybrid detection lets the pipeline catch unsafe outputs without relying on a fixed list of known attack patterns.
  • The forgetting is described as targeted and irreversible, unlike classifier-based suppression that can be bypassed.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If harmful knowledge truly localizes in FFN substructures, similar tracing could be used to audit what a model knows and to patch single behaviors, such as copyrighted prose or personal data, without retraining.
  • A likely bottleneck is the external classifiers in stage one: if they share blind spots with the benchmarks used to measure attack success, the reported success rates may partly reflect detector agreement rather than actual forgetting.
  • A directly testable extension is to measure neuron overlap between harmful and benign generation on the same topic; high overlap would predict that the constrained optimization must trade safety against capability.
  • The irreversibility claim could be stress-tested by fine-tuning the unlearned model on a small amount of harmful data and checking whether the behavior returns.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 3 minor

Summary. The paper proposes SafeLLM, a three-stage unlearning-based defense against jailbreak attacks: (1) hybrid unsafe-output detection using external classifiers and model-internal evaluations; (2) token-level harmful-content tracing through FFN activations to localize harmful knowledge; and (3) constrained optimization to suppress unsafe behavior. The abstract claims that SafeLLM achieves targeted and irreversible forgetting, substantially reduces attack success rates on Vicuna, LLaMA, and GPT-J across multiple jailbreak benchmarks, preserves general performance, and outperforms supervised fine-tuning and direct preference optimization. However, the submitted manuscript's body is unreadable: after the abstract, the text consists only of replacement characters. Consequently, none of the methods, experiments, baselines, or results can be inspected, and the central claims are unverifiable in this version.

Significance. If the reported results hold, SafeLLM would represent a potentially meaningful advance: unlearning-based defense coupled with causal localization of harmful knowledge and evidence of irreversibility would be of substantial value to LLM safety. The significance paragraph in the abstract is appropriately ambitious. However, the current manuscript provides no verifiable evidence. The reader's stress-test concerns about causal localization, classifier independence, and irreversibility are legitimate, but the more fundamental problem is that the paper cannot be read at all. The significance of the contribution therefore cannot be assessed at this time.

major comments (4)
  1. [Full text] The body of the manuscript is unreadable: after the abstract, all text appears as replacement characters (e.g., '����'). No methods, experimental setup, baselines, tables, or results are accessible. This is a load-bearing failure because the abstract's central empirical claims—substantial ASR reduction, maintained general performance, robustness to unseen attacks, and irreversibility—cannot be checked.
  2. [Abstract, stage (2)] The claim that harmful generation is localized in identifiable FFN substructures is asserted without supporting causal evidence. The abstract mentions 'token-level harmful content tracing' and 'neutralizing FFN substructures,' but provides no ablation or intervention that distinguishes causal units from spuriously correlated activations. If harmful knowledge is diffuse or entangled with benign knowledge, the constrained optimization in stage (3) may either fail to suppress attacks or degrade general capabilities. This premise is load-bearing and unsupported.
  3. [Abstract, 'irreversible forgetting'] The abstract claims 'targeted and irreversible forgetting,' but no durability test is described. Irreversibility requires demonstration that the unlearned knowledge does not reappear after further fine-tuning on benign data, adversarial re-learning, or continued pretraining. Without such tests, 'irreversible' is only an assertion. This is a central strength claimed in the abstract, and the manuscript must provide evidence.
  4. [Abstract, stage (1)] The hybrid detection stage uses external classifiers and model-internal evaluations. The abstract does not establish that these classifiers are independent of the jailbreak benchmarks used to measure attack success. If the detection classifiers are trained or evaluated on overlapping data or labels, the reported ASR reductions could be partly self-referential. A label-independence or benchmark-separation argument is necessary to support the safety-gain claim.
minor comments (3)
  1. [Abstract] Grammar issues: 'unlearn the harmful knowledge' and 'the harmful knowledge unlearned' are awkward; consider 'unlearn harmful knowledge' and 'after unlearning.'
  2. [Abstract] The abstract makes strong quantitative claims ('substantially reduces attack success rates') without reporting numbers, baselines, or error bars. Even for an abstract, a representative number or effect size would help.
  3. [General] The manuscript appears to lack a limitations section. Given the strong claims about irreversibility and localized knowledge, a discussion of failure cases or assumptions would be appropriate.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity identified from available text; potential evaluation-leakage concern is unsubstantiated.

full rationale

The supplied full text is an unreadable encoding dump, so only the abstract can be assessed. The abstract describes a three-stage pipeline: dynamic unsafe output detection using external classifiers plus model-internal evaluations, token-level FFN tracing, and constrained optimization. No equation or definition in the available text shows that the safety metric used for evaluation is identical to the optimization objective, or that the external classifiers used for detection are the same benchmarks used to report attack-success-rate reductions. The claims of targeted, irreversible forgetting and maintained general performance are empirical assertions, not definitional identities. Possible concerns such as classifier/benchmark overlap or FFN localization being merely correlational are correctness and verification risks, not demonstrated circularity, and the hard rules prohibit speculation. No self-citation or imported uniqueness theorem appears in the abstract. Therefore the appropriate finding is no significant circularity, score 0.

Assumptions & free parameters 3 free parameters · 2 assumptions · 0 invented entities

Only the abstract was reviewable. The ledger lists the pipeline's likely free hyperparameters (unspecified) and the two structural assumptions that carry the method: localization of harmful knowledge in FFN substructures, and reliable detection by hybrid classifiers. No new physical or conceptual entities are introduced.

free parameters (3)
  • Unsafe detection thresholds
    Stage (1) detection requires thresholds for flagging unsafe outputs; not specified in the abstract.
  • FFN localization cutoff
    Stage (2) requires a criterion for which FFN substructures count as harmful-trace regions; not specified.
  • Safety-utility tradeoff weight
    Stage (3) constrained optimization requires a penalty weight balancing unlearning strength against general performance; not specified.
assumptions (2)
  • domain assumption Harmful knowledge is localized in identifiable FFN substructures
    Abstract stage (2): 'token-level harmful content tracing through FFN activations to localize harmful knowledge.' The whole method depends on this localization claim.
  • domain assumption External classifiers can reliably detect unsafe outputs
    Abstract stage (1): 'dynamic unsafe output detection using a hybrid approach that integrates external classifiers.' If detection is noisy, both unlearning and evaluation are compromised.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SafeLLM: Unlearning Harmful Outputs from Large Language Models against Jailbreak Attacks." pith.science (2026). https://pith.science/paper/HJKOGMMZ

@misc{pith2026250815182,
  author       = {Pith},
  title        = {Pith review of: SafeLLM: Unlearning Harmful Outputs from Large Language Models against Jailbreak Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/HJKOGMMZ}},
  note         = {Machine review of arXiv:2508.15182}
}
read the original abstract

Jailbreak attacks pose a serious threat to the safety of Large Language Models (LLMs) by crafting adversarial prompts that bypass alignment mechanisms, causing the models to produce harmful, restricted, or biased content. In this paper, we propose SafeLLM, a novel unlearning-based defense framework that unlearn the harmful knowledge from LLMs while preserving linguistic fluency and general capabilities. SafeLLM employs a three-stage pipeline: (1) dynamic unsafe output detection using a hybrid approach that integrates external classifiers with model-internal evaluations; (2) token-level harmful content tracing through feedforward network (FFN) activations to localize harmful knowledge; and (3) constrained optimization to suppress unsafe behavior without degrading overall model quality. SafeLLM achieves targeted and irreversible forgetting by identifying and neutralizing FFN substructures responsible for harmful generation pathways. Extensive experiments on prominent LLMs (Vicuna, LLaMA, and GPT-J) across multiple jailbreak benchmarks show that SafeLLM substantially reduces attack success rates while maintaining high general-purpose performance. Compared to standard defense methods such as supervised fine-tuning and direct preference optimization, SafeLLM offers stronger safety guarantees, more precise control over harmful behavior, and greater robustness to unseen attacks. Moreover, SafeLLM maintains the general performance after the harmful knowledge unlearned. These results highlight unlearning as a promising direction for scalable and effective LLM safety.

Discussion (0). Sign in to comment.

Forward citations

Cited by 3 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. EVA: Editing for Versatile Alignment against Jailbreaks

    cs.CR 2026-05 unverdicted novelty 6.0 of 10

    EVA applies direct model editing to surgically neutralize jailbreak vulnerabilities in LLMs and VLMs by targeting specific neurons while preserving general capabilities.

  2. Exclusive Unlearning

    cs.CL 2026-04 unverdicted novelty 6.0 of 10

    Exclusive Unlearning makes LLMs safe by forgetting all but retained domain knowledge, protecting against jailbreaks while preserving useful responses in areas like medicine and math.

  3. From AI-Generated Content to Agentic Action: Security and Safety Threats in Generative AI

    cs.CR 2026-05 unverdicted novelty 3.0 of 10

    The paper analyzes evolving security and safety threats in generative AI from content generation to agentic actions, noting that attack surfaces expand faster than defenses and that many safeguards require institution...

Reference graph

Works this paper leans on

55 extracted references · 34 canonical work pages · cited by 3 Pith papers

  1. [1]

    OpenAI , ``Introducing chatgpt,'' https://openai.com/index/chatgpt/, 2022

    work page 2022

  2. [2]

    Touvron, L

    H. Touvron, L. Martin, K. Stone, and et al., ``Llama 2: Open foundation and fine-tuned chat models,'' arXiv preprint arXiv:2307.09288, 2023

    arXiv 2023

  3. [3]

    Thakur, ``Unveiling gender bias in terms of profession across llms: Analyzing and addressing sociological implications,'' arXiv preprint arXiv:2307.09162, 2023

    V. Thakur, ``Unveiling gender bias in terms of profession across llms: Analyzing and addressing sociological implications,'' arXiv preprint arXiv:2307.09162, 2023

    arXiv 2023

  4. [4]

    Huang, W

    L. Huang, W. Yu, W. Ma, W. Zhong, Z. Feng, H. Wang, Q. Chen, W. Peng, X. Feng, B. Qin et al., ``A survey on hallucination in large language models: Principles, taxonomy, challenges, and open questions,'' ACM Transactions on Information Systems, 2024

    work page 2024

  5. [5]

    Z. Zeng, T. Xiang, S. Guo, J. He, Q. Zhang, G. Xu, and T. Zhang, ``Contrast-then-approximate: Analyzing keyword leakage of generative language models,'' IEEE Transactions on Information Forensics and Security, 2024

    work page 2024

  6. [6]

    Z. Ying, A. Liu, T. Zhang, Z. Yu, S. Liang, X. Liu, and D. Tao, ``Jailbreak vision language models via bi-modal adversarial prompt,'' IEEE Transactions on Information Forensics and Security, vol. 20, pp. 7153--7165, 2025

    work page 2025

  7. [7]

    J. Wei, M. Bosma, V. Zhao, K. Guu, A. W. Yu, B. Lester, N. Du, A. M. Dai, and Q. V. Le, ``Finetuned language models are zero-shot learners,'' in Proc. of ICLR, 2021

    work page 2021

  8. [8]

    Ouyang, J

    L. Ouyang, J. Wu, X. Jiang, D. Almeida, C. Wainwright, P. Mishkin, C. Zhang, S. Agarwal, K. Slama, A. Ray et al., ``Training language models to follow instructions with human feedback,'' Proc. of NeurIPS, pp. 27\,730--27\,744, 2022

    work page 2022

Show all 55 references
  1. [9]

    Y. Bai, A. Jones, K. Ndousse, A. Askell, A. Chen, N. DasSarma, D. Drain, S. Fort, D. Ganguli, T. Henighan et al., ``Training a helpful and harmless assistant with reinforcement learning from human feedback,'' arXiv preprint arXiv:2204.05862, 2022

    2022 arXiv

  2. [10]

    W. Liu, X. Wang, M. Wu, T. Li, C. Lv, Z. Ling, Z. JianHao, C. Zhang, X. Zheng, and X.-J. Huang, ``Aligning large language models with human preferences through representation engineering,'' in Proc. of ACL (Volume 1: Long Papers), 2024, pp. 10\,619--10\,638

    2024

  3. [11]

    G. Dong, H. Yuan, K. Lu, C. Li, M. Xue, D. Liu, W. Wang, Z. Yuan, C. Zhou, and J. Zhou, ``How abilities in large language models are affected by supervised fine-tuning data composition,'' arXiv preprint arXiv:2310.05492, 2023

    2023 arXiv

  4. [12]

    Rafailov, A

    R. Rafailov, A. Sharma, E. Mitchell, C. D. Manning, S. Ermon, and C. Finn, ``Direct preference optimization: Your language model is secretly a reward model,'' Advances in Neural Information Processing Systems, vol. 36, pp. 53\,728--53\,741, 2023

    2023

  5. [13]

    W. Lu, Z. Zeng, J. Wang, Z. Lu, Z. Chen, H. Zhuang, and C. Chen, ``Eraser: Jailbreaking defense in large language models via unlearning harmful knowledge,'' arXiv preprint arXiv:2404.05880, 2024

    2024 arXiv

  6. [14]

    Zhang, J

    Z. Zhang, J. Yang, P. Ke, S. Cui, C. Zheng, H. Wang, and M. Huang, ``Safe unlearning: A surprisingly effective and generalizable solution to defend against jailbreak attacks,'' arXiv preprint arXiv:2407.02855, 2024

    2024 arXiv

  7. [15]

    Z. Shi, Y. Zhou, and J. Li, ``Safety alignment via constrained knowledge unlearning,'' arXiv preprint arXiv:2505.18588, 2025

    2025 arXiv

  8. [16]

    Z. Wei, Y. Wang, A. Li, Y. Mo, and Y. Wang, ``Jailbreak and guard aligned language models with only few in-context demonstrations,'' arXiv preprint arXiv:2310.06387, 2023

    2023 arXiv

  9. [17]

    A. Wei, N. Haghtalab, and J. Steinhardt, ``Jailbroken: How does llm safety training fail?'' Proc. of NeurIPS, vol. 36, 2024

    2024

  10. [18]

    Zheng, T

    X. Zheng, T. Pang, C. Du, Q. Liu, J. Jiang, and M. Lin, ``Improved few-shot jailbreaking can circumvent aligned language models and their defenses,'' Proc. of NeurIPS, vol. 37, pp. 32\,856--32\,887, 2024

    2024

  11. [19]

    H. Jin, A. Zhou, J. Menke, and H. Wang, ``Jailbreaking large language models against moderation guardrails via cipher characters,'' Proc. of NeurIPS, vol. 37, pp. 59\,408--59\,435, 2024

    2024

  12. [20]

    Jiang, Z

    F. Jiang, Z. Xu, L. Niu, Z. Xiang, B. Ramasubramanian, B. Li, and R. Poovendran, ``Artprompt: Ascii art-based jailbreak attacks against aligned llms,'' in Proc. of ACL, 2024, pp. 15\,157--15\,173

    2024

  13. [21]

    D. Yao, J. Zhang, I. G. Harris, and M. Carlsson, ``Fuzzllm: A novel and universal fuzzing framework for proactively discovering jailbreak vulnerabilities in large language models,'' in proc. of ICASSP. 1em plus 0.5em minus 0.4em IEEE, 2024, pp. 4485--4489

    2024

  14. [22]

    C. Anil, E. Durmus, N. Rimsky, M. Sharma, J. Benton, S. Kundu, J. Batson, M. Tong, J. Mu, D. J. Ford et al., ``Many-shot jailbreaking,'' in Proc. of NeurIPS, 2024

    2024

  15. [23]

    A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson, ``Universal and transferable adversarial attacks on aligned language models,'' arXiv preprint arXiv:2307.15043, 2023

    2023 arXiv

  16. [24]

    P. Chao, A. Robey, E. Dobriban, H. Hassani, G. J. Pappas, and E. Wong, ``Jailbreaking black box large language models in twenty queries,'' arXiv preprint arXiv:2310.08419, 2023

    2023 arXiv

  17. [25]

    Mehrotra, M

    A. Mehrotra, M. Zampetakis, P. Kassianik, B. Nelson, H. Anderson, Y. Singer, and A. Karbasi, ``Tree of attacks: Jailbreaking black-box llms automatically,'' Proc. of NeurIPS, vol. 37, pp. 61\,065--61\,105, 2024

    2024

  18. [26]

    Liao and H

    Z. Liao and H. Sun, ``Amplegcg: Learning a universal and transferable generative model of adversarial suffixes for jailbreaking both open and closed llms,'' arXiv preprint arXiv:2404.07921, 2024

    2024 arXiv

  19. [27]

    Y. Zeng, H. Lin, J. Zhang, D. Yang, R. Jia, and W. Shi, ``How johnny can persuade llms to jailbreak them: Rethinking persuasion to challenge ai safety by humanizing llms,'' in Proc. of ACL, 2024, pp. 14\,322--14\,350

    2024

  20. [28]

    Lapid, R

    R. Lapid, R. Langberg, and M. Sipper, ``Open sesame! universal black-box jailbreaking of large language models,'' Applied Sciences (Switzerland), vol. 14, no. 16, p. 7150, 2024

    2024

  21. [29]

    X. Liu, N. Xu, M. Chen, and C. Xiao, ``Autodan: Generating stealthy jailbreak prompts on aligned large language models,'' arXiv preprint arXiv:2310.04451, 2023

    2023 arXiv

  22. [30]

    J. Yu, X. Lin, Z. Yu, and X. Xing, ``Gptfuzzer: Red teaming large language models with auto-generated jailbreak prompts,'' arXiv preprint arXiv:2309.10253, 2023

    2023 arXiv

  23. [31]

    N. Jain, A. Schwarzschild, Y. Wen, G. Somepalli, J. Kirchenbauer, P.-y. Chiang, M. Goldblum, A. Saha, J. Geiping, and T. Goldstein, ``Baseline defenses for adversarial attacks against aligned language models,'' arXiv preprint arXiv:2309.00614, 2023

    2023 arXiv

  24. [32]

    Robey, E

    A. Robey, E. Wong, H. Hassani, and G. J. Pappas, ``Smoothllm: Defending large language models against jailbreaking attacks,'' arXiv preprint arXiv:2310.03684, 2023

    2023 arXiv

  25. [33]

    Zhang, C

    X. Zhang, C. Zhang, T. Li, Y. Huang, X. Jia, X. Xie, Y. Liu, and C. Shen, ``A mutation-based method for multi-modal jailbreaking attack detection,'' CoRR, 2023

    2023

  26. [34]

    X. Zou, Y. Chen, and K. Li, ``Is the system message really important to jailbreaks in large language models?'' arXiv preprint arXiv:2402.14857, 2024

    2024 arXiv

  27. [35]

    J. Zhao, K. Chen, X. Yuan, Y. Qi, W. Zhang, and N. Yu, ``Silent guardian: Protecting text from malicious exploitation by large language models,'' IEEE Transactions on Information Forensics and Security, 2024

    2024

  28. [36]

    Bianchi, M

    F. Bianchi, M. Suzgun, G. Attanasio, P. Rottger, D. Jurafsky, T. Hashimoto, J. Zou et al., ``Safety-tuned llamas: Lessons from improving the safety of large language models that follow instructions,'' in Proc. of ICLR, 2024

    2024

  29. [37]

    G. Deng, Y. Liu, Y. Li, K. Wang, Y. Zhang, Z. Li, H. Wang, T. Zhang, and Y. Liu, ``Masterkey: Automated jailbreaking of large language model chatbots,'' in Proc. of NDSS, 2024

    2024

  30. [38]

    Ganguli, L

    D. Ganguli, L. Lovitt, J. Kernion, A. Askell, Y. Bai, S. Kadavath, B. Mann, E. Perez, N. Schiefer, K. Ndousse et al., ``Red teaming language models to reduce harms: Methods, scaling behaviors, and lessons learned,'' arXiv preprint arXiv:2209.07858, 2022

    2022 arXiv

  31. [39]

    Y. Xie, M. Fang, R. Pi, and N. Gong, ``Gradsafe: Detecting jailbreak prompts for llms via safety-critical gradient analysis,'' in Proc. of ACL, vol. 1, 2024, pp. 507--518

    2024

  32. [40]

    Z. Xu, F. Jiang, L. Niu, J. Jia, B. Y. Lin, and R. Poovendran, ``Safedecoding: Defending against jailbreak attacks via safety-aware decoding,'' in Proc. of ACL, 2024, pp. 5587--5605

    2024

  33. [41]

    Xu, P.-Y

    X. Xu, P.-Y. Chen, and T.-y. Ho, ``Gradient cuff: Detecting jailbreak attacks on large language models by exploring refusal loss landscapes,'' in Proc. of NeurIPS, 2024

    2024

  34. [42]

    Z. Liu, G. Dou, Z. Tan, Y. Tian, and M. Jiang, ``Towards safer large language models through machine unlearning,'' in proc. of ACL, 2024, pp. 1817--1829

    2024

  35. [43]

    Ouyang, H

    Y. Ouyang, H. Gu, S. Lin, W. Hua, J. Peng, B. Kailkhura, M. Gao, T. Chen, and K. Zhou, ``Layer-level self-exposure and patch: Affirmative token mitigation for jailbreak attack defense,'' arXiv preprint arXiv:2501.02629, 2025

    2025 arXiv

  36. [44]

    H. Yuan, Z. Jin, P. Cao, Y. Chen, K. Liu, and J. Zhao, ``Towards robust knowledge unlearning: An adversarial framework for assessing and improving unlearning robustness in large language models,'' in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 39, no. 2...

    2025

  37. [45]

    M. Geva, R. Schuster, J. Berant, and O. Levy, ``Transformer feed-forward layers are key-value memories,'' in Proc. of EMNLP, 2021, pp. 5484--5495

    2021

  38. [46]

    M. Geva, A. Caciularu, K. Wang, and Y. Goldberg, ``Transformer feed-forward layers build predictions by promoting concepts in the vocabulary space,'' in Proc. of EMNLP, 2022, pp. 30--45

    2022

  39. [47]

    K. Meng, A. S. Sharma, A. J. Andonian, Y. Belinkov, and D. Bau, ``Mass-editing memory in a transformer,'' in Proc. of ICLR, 2023

    2023

  40. [48]

    Y. Chen, H. Gao, G. Cui, F. Qi, L. Huang, Z. Liu, and M. Sun, ``Why should adversarial perturbations be imperceptible? rethink the research paradigm in adversarial nlp,'' in Proc. of EMNLP, 2022, pp. 11\,222--11\,237

    2022

  41. [49]

    Alon and M

    G. Alon and M. Kamfonas, ``Detecting language model attacks with perplexity,'' arXiv preprint arXiv:2308.14132, 2023

    2023 arXiv

  42. [50]

    Andriushchenko, F

    M. Andriushchenko, F. Croce, and N. Flammarion, ``Jailbreaking leading safety-aligned llms with simple adaptive attacks,'' in Proc. of ICML AI Safety Workshop

  43. [51]

    Souly, Q

    A. Souly, Q. Lu, D. Bowen, T. Trinh, E. Hsieh, S. Pandey, P. Abbeel, J. Svegliato, S. Emmons, O. Watkins et al., ``A strongreject for empty jailbreaks,'' arXiv preprint arXiv:2402.10260, 2024

    2024 arXiv

  44. [52]

    Mihaylov, P

    T. Mihaylov, P. Clark, T. Khot, and A. Sabharwal, ``Can a suit of armor conduct electricity? a new dataset for open book question answering,'' in EMNLP, 2018

    2018

  45. [53]

    S. Lin, J. Hilton, and O. Evans, ``Truthfulqa: Measuring how models mimic human falsehoods,'' arXiv preprint arXiv:2109.07958, 2021

    2021 arXiv

  46. [54]

    Y. Li, F. Wei, J. Zhao, C. Zhang, and H. Zhang, ``Rain: Your language models can align themselves without finetuning,'' arXiv preprint arXiv:2309.07124, 2023

    2023 arXiv

  47. [55]

    Init" denotes the ASR when models are tested with original harmful prompts

    11em plus .33em minus .07em 4000 4000 100 4000 4000 500 `\.=1000 = #1 \@IEEEnotcompsoconly \@IEEEcompsoconly #1 * [1] 0pt [0pt][0pt] #1 * [1] 0pt [0pt][0pt] #1 * \| ** #1 \@IEEEauthorblockNstyle \@IEEEcompsocnotconfonly \@IEEEauthorblockAstyle \@IEEEcompsocnotconfonly \@IEEEco...

    2022 arXiv

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.