Pith. sign in

REVIEW 3 major objections 1 minor 1 cited by

This paper claims that REST API test oracles can be generated statically from an OpenAPI specification alone, using an LLM to infer expected response behavior from field names and descriptions, and that this beats dynamic oracle generation

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

SATORI statically infers REST API test oracles from OpenAPI specs via LLMs, reporting F1 74.3%, above AGORA+'s 69.3%, with 18 confirmed bugs; the supplied full text, however, is a different paper.

T0 review reviewed 2026-08-05 challenge →

load-bearing objection Plausible static-oracle approach, but the full-text mismatch and unverified annotation protocol mean the paper needs referee scrutiny, not blind acceptance. the 3 major comments →

arxiv 2508.16318 v2 pith:ARM2O2PO submitted 2025-08-22 cs.SE

SATORI: Static Test Oracle Generation for REST APIs

Juan C. Alonso , Alberto Martin-Lopez , Sergio Segura , Gabriele Bavota , Antonio Ruiz-Cort\'es This is my paper
classification cs.SE
keywords REST API testingtest oracle generationOpenAPI Specificationlarge language modelsstatic analysisblack-box testingAPI testingbehavioral assertions
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

REST API test generators are good at producing input data but weak at knowing what a correct response looks like: their oracles usually stop at crashes, status-code errors, or schema noncompliance. SATORI tries to close that gap without running the API. It treats the OpenAPI specification as the source of truth and asks a large language model to infer, from each response field's name and description, what the API should return. On 17 operations from 12 industrial APIs, the paper reports an F1 of 74.3%, above the 69.3% of a dynamic state-of-the-art approach on the same oracle types, with the two methods together covering 90% of an annotated ground-truth set. The paper also reports 18 real bugs found in widely used APIs, which maintainers fixed by updating documentation.

Core claim

On the paper's terms, the discovery is that the semantic metadata already present in an OpenAPI specification—response field names and their natural-language descriptions—carries enough signal for an LLM to infer what a correct response should look like, so behavioral oracles can be produced without executing the API. The paper supports this with 17 operations from 12 industrial APIs: SATORI reached 74.3% F1, above the 69.3% of a dynamic state-of-the-art approach on the same oracle types, and the two approaches together recovered 90% of an annotated ground-truth set. It also reports that the generated oracles uncovered 18 bugs in widely used public APIs, which maintainers addressed with docu

What carries the argument

The OpenAPI Specification is the central object. SATORI reads one operation at a time, takes the names and descriptions of its response fields, and asks an LLM to infer expected properties—field presence, types, ranges, formats, and semantic invariants. The resulting oracles are converted into executable assertions by an extension of an existing Postman assertion tool, which is what lets the static inferences be run as real tests.

Load-bearing premise

The whole approach rests on OpenAPI response descriptions being informative enough that an LLM can infer correct expected behavior; if real-world specs are vague, missing, or misleading, the oracle quality drops.

What would settle it

Strip property descriptions from a set of OpenAPI specs and rerun SATORI: if F1 stays near the reported level, descriptive semantics are not the active ingredient. Separately, build ground truth by observing actual API responses rather than reading the spec, and compare; if agreement is much lower than 74.3%, the score measured spec-consistency rather than behavioral validity.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Behavioral oracles become available before an API is deployed, because generation needs only the specification file, not a running system.
  • Static and dynamic oracle inference are complementary: combining them covered 90% of the annotated ground-truth oracles, pointing toward hybrid test pipelines.
  • REST API test suites can be enriched from status-code checks to hundreds of field-level behavioral checks per operation.
  • The 18 documentation bugs found in widely used APIs show that specification-driven oracles can surface real discrepancies between documented and actual behavior.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The reported F1 may partly reward agreement with the specification text itself, since the ground-truth oracles and the LLM read the same descriptions; a validation set built from observed API responses would separate behavioral correctness from spec-fidelity.
  • Specifications with sparse or generic descriptions are likely the failure mode; supplementing the prompt with endpoint context, examples, or request schemas is a plausible extension the paper does not explore.
  • The same static-inference chain should transfer to other interface contracts such as GraphQL schemas or gRPC protos, and to request-side constraints where no execution is needed either.
  • Because the generated oracles are executable and static, they could be rerun continuously to detect drift between a published specification and a live API.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 1 minor

Summary. The submission consists of an abstract for a paper titled 'SATORI: Static Test Oracle Generation for REST APIs' followed by the full text of an unrelated paper titled 'ConceptGuard: Neuro-Symbolic Safety Guardrails via Sparse Interpretable Jailbreak Concepts' (arXiv:2508.16325). The abstract claims that SATORI, a black-box static approach, uses LLMs to infer test oracles from OpenAPI specifications, achieving F1=74.3% on 17 operations from 12 industrial APIs (outperforming AGORA+'s 69.3%), with complementary joint coverage of 90% and 18 bugs found in popular APIs. The full text, however, describes a mechanistic-interpretability framework for LLM safety guardrails and contains no methodology, evaluation, or results for SATORI. The claimed SATORI approach is therefore entirely absent from the manuscript body.

Significance. If SATORI's claims were supported, the work could be significant for black-box REST API testing: generating valid test oracles from static specifications without executing the API would be a useful advance over dynamic approaches like AGORA+. The potential complementary coverage of static and dynamic inference is also an interesting hypothesis. However, as submitted, the manuscript provides no evidence for these claims: the full text is a different paper on a different topic. The abstract's quantitative results cannot be evaluated or reproduced. The significance of the claimed contribution is real but entirely unbacked in this document.

major comments (3)
  1. [Full text (all sections)] The manuscript body is not the paper described in the title/abstract. Sections 1–6 and the Appendix present ConceptGuard, an LLM safety-guardrail framework using sparse autoencoders, with no mention of REST APIs, OpenAPI specifications, test oracles, or SATORI. The central claim of the abstract—that SATORI generates valid oracles with F1=74.3%—is therefore unsupported by any methodological description, experimental setup, or results. This is a load-bearing omission that cannot be addressed by minor revision.
  2. [Abstract (results claims)] The abstract reports F1=74.3% versus AGORA+'s 69.3%, 90% joint coverage, and 18 bugs, but the manuscript provides no evaluation section, no definition of oracle validity, no ground-truth annotation protocol, no per-operation breakdown, and no statistical significance or variance information. Even if the correct full text were supplied, these abstract-level numbers alone would be insufficient to support the generalization claims made.
  3. [Full text (ConceptGuard limitations)] The provided full text itself contains an explicit limitation statement (Section 6: 'our analysis presents a proof-of-concept, limited to a single hook point') and acknowledges heuristic pruning and potential over-aggressiveness. These are appropriate caveats for ConceptGuard, but they are irrelevant to SATORI. Their presence underscores that the submitted document is not the claimed paper and that no SATORI-specific limitations or validation are discussed.
minor comments (1)
  1. [Title/Abstract] The title and abstract identify the paper as SATORI, while the body is ConceptGuard. This mismatch should be resolved before any resubmission; it is a fundamental presentation issue.

Circularity Check

0 steps flagged

No demonstrated circularity in the available text; SATORI's claims are externally anchored but the full-text derivation is missing due to a mismatched manuscript.

full rationale

The supplied full text is not the SATORI paper but ConceptGuard (arXiv:2508.16325), so the derivation chain behind SATORI's F1 and oracle claims cannot be inspected. What can be inspected shows no circular step: the SATORI abstract grounds its F1 score against an annotated ground-truth dataset and against AGORA+, a dynamic baseline that requires executing the API, and it cites external maintainer documentation updates for the 18 bugs. These are external checks, not definitions of SATORI's output. No equation or protocol in the provided text reduces SATORI's inferred oracles to the oracle labels used for scoring. The reader's concern about annotation independence is a legitimate evaluation threat but, without an annotation protocol showing the ground truth was derived from the same OpenAPI descriptions SATORI reads, it is speculation rather than a demonstrable reduction. The only self-citation visible in the supplied ConceptGuard text is reference [29], used to justify analyzing benign BoN prompt relevance with GPT-5.1; it is peripheral and not load-bearing. Thus no significant circularity is established, and the score reflects a minor self-citation plus the inability to verify the actual SATORI derivation rather than any confirmed circular step.

Axiom & Free-Parameter Ledger

2 free parameters · 3 axioms · 0 invented entities

The central method has two visible premises: that OpenAPI field descriptions are a trustworthy behavioral signal, and that the annotated ground truth measures true expected behavior. The abstract shows no numeric free parameters; the parameters listed below are design choices that the abstract leaves unspecified and that directly shape the reported F1. No invented entities (new forces, particles, conserved quantities) appear; SATORI and the PostmanAssertify extension are software artifacts, not postulated entities.

free parameters (2)
  • Oracle validity criterion
    The abstract reports F1 for 'valid' test oracles without defining validity; this definition directly determines both SATORI's and AGORA+'s scores.
  • LLM model and prompt configuration
    SATORI's output is an LLM response; model choice, prompt wording, temperature, and any filtering thresholds are unstated in the abstract and shape the reported accuracy.
axioms (3)
  • domain assumption OpenAPI response-field names and descriptions are reliable signals of expected API behavior
    Core premise of the approach, stated in the abstract: the LLM infers expected behavior 'by analyzing the properties of the response fields... such as their name and descriptions'.
  • domain assumption The annotated ground-truth oracles represent the true expected behavior of the 17 operations
    F1 and the 90% joint-coverage figure are computed against this dataset; the annotation protocol is not described in the abstract.
  • domain assumption The 17-operation sample is representative of industrial REST APIs
    Generalizations such as 'hundreds of oracles per operation' rest on a small sample; selection criteria are not given.

reviewed 2026-08-05 · how reviews work

0 comments
Cite this review

Pith. "Pith review of SATORI: Static Test Oracle Generation for REST APIs." pith.science (2026). https://pith.science/paper/ARM2O2PO

@misc{pith2026250816318,
  author       = {Pith},
  title        = {Pith review of: SATORI: Static Test Oracle Generation for REST APIs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/ARM2O2PO}},
  note         = {Machine review of arXiv:2508.16318}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

REST API test case generation tools are evolving rapidly, with growing capabilities for the automated generation of complex tests. However, despite their strengths in test data generation, these tools are constrained by the types of test oracles they support, often limited to crashes, regressions, and noncompliance with API specifications or design standards. This paper introduces SATORI (Static API Test ORacle Inference), a black-box approach for generating test oracles for REST APIs by analyzing their OpenAPI Specification. SATORI uses large language models to infer the expected behavior of an API by analyzing the properties of the response fields of its operations, such as their name and descriptions. To foster its adoption, we extended the PostmanAssertify tool to automatically convert the test oracles reported by SATORI into executable assertions. Evaluation results on 17 operations from 12 industrial APIs show that SATORI can automatically generate up to hundreds of valid test oracles per operation. SATORI achieved an F1-score of 74.3%, outperforming the state-of-the-art dynamic approach AGORA+ (69.3%)-which requires executing the API-when generating comparable oracle types. Moreover, our findings show that static and dynamic oracle inference methods are complementary: together, SATORI and AGORA+ found 90% of the oracles in our annotated ground-truth dataset. Notably, SATORI uncovered 18 bugs in popular APIs (Amadeus Hotel, Deutschebahn, FDIC, GitLab, Marvel, OMDb and Vimeo) leading to documentation updates by the API maintainers.

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. RESTOR: Automated Test Oracle Generation for RESTful APIs via Reinforcement Learning

    cs.SE 2026-07 conditional novelty 6.0

    An RL fine-tuned lightweight LLM generates REST API test oracles from one traffic sample and beats prompt-engineered large models in industrial adoption.

Reference graph

Works this paper leans on

71 extracted references · 26 canonical work pages · cited by 1 Pith paper · 2 internal anchors

  1. [1]

    Proactive conversational agents in the post-chatgpt world

    Lizi Liao, Grace Hui Yang, and Chirag Shah. Proactive conversational agents in the post-chatgpt world. InProceedings of the 46th International ACM SIGIR Conference on Research and Development in Information Retrieval, pages 3452–3455, 2023

    work page 2023

  2. [2]

    Openagi: When llm meets domain experts.Advances in Neural Information Processing Systems, 36:5539–5568, 2023

    Yingqiang Ge, Wenyue Hua, Kai Mei, Juntao Tan, Shuyuan Xu, Zelong Li, Yongfeng Zhang, et al. Openagi: When llm meets domain experts.Advances in Neural Information Processing Systems, 36:5539–5568, 2023

    work page 2023

  3. [3]

    Openai o1 system card.arXiv preprint arXiv:2412.16720, 2024

    Aaron Jaech, Adam Kalai, Adam Lerer, Adam Richardson, Ahmed El-Kishky, Aiden Low, Alec Helyar, Aleksander Madry, Alex Beutel, Alex Carney, et al. Openai o1 system card.arXiv preprint arXiv:2412.16720, 2024

    Pith/arXiv arXiv 2024

  4. [4]

    Yiqi Wang, Wentao Chen, Xiaotian Han, Xudong Lin, Haiteng Zhao, Yongfei Liu, Bohan Zhai, Jianbo Yuan, Quanzeng You, and Hongxia Yang. Exploring the reasoning abilities of multimodal large language models (mllms): A comprehensive survey on emerging trends in multimodal reasoning.arXiv preprint arXiv:2401.06805, 2024

    Pith/arXiv arXiv 2024

  5. [5]

    Concrete problems in ai safety.arXiv preprint arXiv:1606.06565, 2016

    Dario Amodei, Chris Olah, Jacob Steinhardt, Paul Christiano, John Schulman, and Dan Mané. Concrete problems in ai safety.arXiv preprint arXiv:1606.06565, 2016

    Pith/arXiv arXiv 2016

  6. [6]

    A review on artificial intelligence with deep human reasoning

    Janmanchi Harika, Palavadi Baleeshwar, Kummari Navya, and Hariharan Shanmugasundaram. A review on artificial intelligence with deep human reasoning. In2022 international conference on applied artificial intelligence and computing (ICAAIC), pages 81–84. IEEE, 2022

    work page 2022

  7. [7]

    Ai alignment: A comprehensive survey.arXiv preprint arXiv:2310.19852, 2023

    Jiaming Ji, Tianyi Qiu, Boyuan Chen, Borong Zhang, Hantao Lou, Kaile Wang, Yawen Duan, Zhonghao He, Jiayi Zhou, Zhaowei Zhang, et al. Ai alignment: A comprehensive survey.arXiv preprint arXiv:2310.19852, 2023

    Pith/arXiv arXiv 2023

  8. [8]

    Sleeper agents: Training deceptive llms that persist through safety training.arXiv preprint arXiv:2401.05566, 2024

    Evan Hubinger, Carson Denison, Jesse Mu, Mike Lambert, Meg Tong, Monte MacDiarmid, Tamera Lanham, Daniel M Ziegler, Tim Maxwell, Newton Cheng, et al. Sleeper agents: Training deceptive llms that persist through safety training.arXiv preprint arXiv:2401.05566, 2024

    Pith/arXiv arXiv 2024

  9. [9]

    Towards understanding sycophancy in language models.arXiv preprint arXiv:2310.13548, 2023

    Mrinank Sharma, Meg Tong, Tomasz Korbak, David Duvenaud, Amanda Askell, Samuel R Bowman, Newton Cheng, Esin Durmus, Zac Hatfield-Dodds, Scott R Johnston, et al. Towards understanding sycophancy in language models.arXiv preprint arXiv:2310.13548, 2023

    Pith/arXiv arXiv 2023

  10. [10]

    An llm can fool itself: A prompt-based adversarial attack.arXiv preprint arXiv:2310.13345, 2023

    Xilie Xu, Keyi Kong, Ning Liu, Lizhen Cui, Di Wang, Jingfeng Zhang, and Mohan Kankanhalli. An llm can fool itself: A prompt-based adversarial attack.arXiv preprint arXiv:2310.13345, 2023

    Pith/arXiv arXiv 2023

  11. [11]

    Beavertails: Towards improved safety alignment of llm via a human-preference dataset.Advances in Neural Information Processing Systems, 36: 24678–24704, 2023

    Jiaming Ji, Mickel Liu, Josef Dai, Xuehai Pan, Chi Zhang, Ce Bian, Boyuan Chen, Ruiyang Sun, Yizhou Wang, and Yaodong Yang. Beavertails: Towards improved safety alignment of llm via a human-preference dataset.Advances in Neural Information Processing Systems, 36: 24678–24704, 2023

    2023

  12. [12]

    do anything now

    Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. " do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models. InProceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pages 1671–1685, 2024

    2024

  13. [13]

    Faster-gcg: Efficient discrete optimization jailbreak attacks against aligned large language models.arXiv preprint arXiv:2410.15362, 2024

    Xiao Li, Zhuhong Li, Qiongxiu Li, Bingze Lee, Jinghao Cui, and Xiaolin Hu. Faster-gcg: Efficient discrete optimization jailbreak attacks against aligned large language models.arXiv preprint arXiv:2410.15362, 2024

    Pith/arXiv arXiv 2024

  14. [14]

    White-box multimodal jailbreaks against large vision-language models

    Ruofan Wang, Xingjun Ma, Hanxu Zhou, Chuanjun Ji, Guangnan Ye, and Yu-Gang Jiang. White-box multimodal jailbreaks against large vision-language models. InProceedings of the 32nd ACM International Conference on Multimedia, pages 6920–6928, 2024

    work page 2024

  15. [15]

    Tree of attacks: Jailbreaking black-box llms automatically.Advances in Neural Information Processing Systems, 37:61065–61105, 2024

    Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi. Tree of attacks: Jailbreaking black-box llms automatically.Advances in Neural Information Processing Systems, 37:61065–61105, 2024. 10

    work page 2024

  16. [16]

    Autodan-turbo: A lifelong agent for strategy self-exploration to jailbreak llms.arXiv preprint arXiv:2410.05295, 2024

    Xiaogeng Liu, Peiran Li, Edward Suh, Yevgeniy V orobeychik, Zhuoqing Mao, Somesh Jha, Patrick McDaniel, Huan Sun, Bo Li, and Chaowei Xiao. Autodan-turbo: A lifelong agent for strategy self-exploration to jailbreak llms.arXiv preprint arXiv:2410.05295, 2024

    Pith/arXiv arXiv 2024

  17. [17]

    What features in prompts jailbreak llms? investigating the mechanisms behind attacks.arXiv preprint arXiv:2411.03343, 2024

    Nathalie Kirch, Constantin Weisser, Severin Field, Helen Yannakoudakis, and Stephen Casper. What features in prompts jailbreak llms? investigating the mechanisms behind attacks.arXiv preprint arXiv:2411.03343, 2024

    arXiv 2024

  18. [18]

    A practical review of mech- anistic interpretability for transformer-based language models.arXiv preprint arXiv:2407.02646, 2024

    Daking Rai, Yilun Zhou, Shi Feng, Abulhair Saparov, and Ziyu Yao. A practical review of mech- anistic interpretability for transformer-based language models.arXiv preprint arXiv:2407.02646, 2024

    arXiv 2024

  19. [19]

    Llama scope: Extracting millions of features from llama-3.1-8b with sparse autoencoders.arXiv preprint arXiv:2410.20526, 2024

    Zhengfu He, Wentao Shu, Xuyang Ge, Lingjie Chen, Junxuan Wang, Yunhua Zhou, Frances Liu, Qipeng Guo, Xuanjing Huang, Zuxuan Wu, et al. Llama scope: Extracting millions of features from llama-3.1-8b with sparse autoencoders.arXiv preprint arXiv:2410.20526, 2024

    Pith/arXiv arXiv 2024

  20. [20]

    Why do universal adversarial attacks work on large language models?: Geometry might be the answer

    Varshini Subhash, Anna Bialas, Weiwei Pan, and Finale Doshi-Velez. Why do universal adversarial attacks work on large language models?: Geometry might be the answer. InThe Second Workshop on New Frontiers in Adversarial Machine Learning, 2023

    work page 2023

  21. [21]

    Finding safety neurons in large language models.arXiv preprint arXiv:2406.14144, 2024

    Jianhui Chen, Xiaozhi Wang, Zijun Yao, Yushi Bai, Lei Hou, and Juanzi Li. Finding safety neurons in large language models.arXiv preprint arXiv:2406.14144, 2024

    arXiv 2024

  22. [22]

    Breaking bad tokens: Detoxification of llms using sparse autoencoders.arXiv preprint arXiv:2505.14536, 2025

    Agam Goyal, Vedant Rathi, William Yeh, Yian Wang, Yuen Chen, and Hari Sundaram. Breaking bad tokens: Detoxification of llms using sparse autoencoders.arXiv preprint arXiv:2505.14536, 2025

    work page arXiv 2025

  23. [23]

    Improving alignment and robustness with circuit breakers.Advances in Neural Information Processing Systems, 37:83345–83373, 2024

    Andy Zou, Long Phan, Justin Wang, Derek Duenas, Maxwell Lin, Maksym Andriushchenko, J Zico Kolter, Matt Fredrikson, and Dan Hendrycks. Improving alignment and robustness with circuit breakers.Advances in Neural Information Processing Systems, 37:83345–83373, 2024

    work page 2024

  24. [24]

    Building guardrails for large language models.arXiv preprint arXiv:2402.01822, 2024

    Yi Dong, Ronghui Mu, Gaojie Jin, Yi Qi, Jinwei Hu, Xingyu Zhao, Jie Meng, Wenjie Ruan, and Xiaowei Huang. Building guardrails for large language models.arXiv preprint arXiv:2402.01822, 2024

    Pith/arXiv arXiv 2024

  25. [25]

    Jailbroken: How does llm safety training fail?Advances in Neural Information Processing Systems, 36:80079–80110, 2023

    Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. Jailbroken: How does llm safety training fail?Advances in Neural Information Processing Systems, 36:80079–80110, 2023

    2023

  26. [26]

    What makes and breaks safety fine-tuning? a mechanistic study.Advances in Neural Information Processing Systems, 37:93406–93478, 2024

    Samyak Jain, Ekdeep S Lubana, Kemal Oksuz, Tom Joy, Philip Torr, Amartya Sanyal, and Puneet Dokania. What makes and breaks safety fine-tuning? a mechanistic study.Advances in Neural Information Processing Systems, 37:93406–93478, 2024

    work page 2024

  27. [27]

    Safe rlhf: Safe reinforcement learning from human feedback.arXiv preprint arXiv:2310.12773, 2023

    Josef Dai, Xuehai Pan, Ruiyang Sun, Jiaming Ji, Xinbo Xu, Mickel Liu, Yizhou Wang, and Yaodong Yang. Safe rlhf: Safe reinforcement learning from human feedback.arXiv preprint arXiv:2310.12773, 2023

    Pith/arXiv arXiv 2023

  28. [28]

    Fundamental safety-capability trade-offs in fine-tuning large language models.arXiv preprint arXiv:2503.20807, 2025

    Pin-Yu Chen, Han Shen, Payel Das, and Tianyi Chen. Fundamental safety-capability trade-offs in fine-tuning large language models.arXiv preprint arXiv:2503.20807, 2025

    Pith/arXiv arXiv 2025

  29. [29]

    Phonetic Perturbations Reveal Tokenizer-Rooted Safety Gaps in LLMs

    Darpan Aswal and Siddharth D Jaiswal. " haet bhasha aur diskrimineshun": Phonetic perturba- tions in code-mixed hinglish to red-team llms.arXiv preprint arXiv:2505.14226, 2025

    work page internal anchor Pith review Pith/arXiv arXiv 2025

  30. [30]

    Refusal in language models is mediated by a single direction.Advances in Neural Information Processing Systems, 37:136037–136083, 2024

    Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee, and Neel Nanda. Refusal in language models is mediated by a single direction.Advances in Neural Information Processing Systems, 37:136037–136083, 2024

    2024

  31. [31]

    Understanding jailbreak success: A study of latent space dynamics in large language models.arXiv preprint arXiv:2406.09289, 2024

    Sarah Ball, Frauke Kreuter, and Nina Panickssery. Understanding jailbreak success: A study of latent space dynamics in large language models.arXiv preprint arXiv:2406.09289, 2024

    Pith/arXiv arXiv 2024

  32. [32]

    Sparse autoen- coders find highly interpretable features in language models.arXiv preprint arXiv:2309.08600, 2023

    Hoagy Cunningham, Aidan Ewart, Logan Riggs, Robert Huben, and Lee Sharkey. Sparse autoen- coders find highly interpretable features in language models.arXiv preprint arXiv:2309.08600, 2023. 11

    Pith/arXiv arXiv 2023

  33. [33]

    Projecting assumptions: The duality between sparse autoencoders and concept geometry.arXiv preprint arXiv:2503.01822, 2025

    Sai Sumedh R Hindupur, Ekdeep Singh Lubana, Thomas Fel, and Demba Ba. Projecting assumptions: The duality between sparse autoencoders and concept geometry.arXiv preprint arXiv:2503.01822, 2025

    arXiv 2025

  34. [34]

    A survey on adversarial attacks and defences.CAAI Transactions on In- telligence Technology, 6(1):25–45, 2021

    Anirban Chakraborty, Manaar Alam, Vishal Dey, Anupam Chattopadhyay, and Debdeep Mukhopadhyay. A survey on adversarial attacks and defences.CAAI Transactions on In- telligence Technology, 6(1):25–45, 2021

    2021

  35. [35]

    Adversarial attacks on deep-learning models in natural language processing: A survey.ACM Transactions on Intelligent Systems and Technology (TIST), 11(3):1–41, 2020

    Wei Emma Zhang, Quan Z Sheng, Ahoud Alhazmi, and Chenliang Li. Adversarial attacks on deep-learning models in natural language processing: A survey.ACM Transactions on Intelligent Systems and Technology (TIST), 11(3):1–41, 2020

    work page 2020

  36. [36]

    Universal adversarial attacks on deep neural networks for medical image classification.BMC medical imaging, 21:1–13, 2021

    Hokuto Hirano, Akinori Minagi, and Kazuhiro Takemoto. Universal adversarial attacks on deep neural networks for medical image classification.BMC medical imaging, 21:1–13, 2021

    work page 2021

  37. [37]

    A robust approach for securing audio classification against adversarial attacks.IEEE Transactions on information forensics and security, 15:2147–2159, 2019

    Mohammad Esmaeilpour, Patrick Cardinal, and Alessandro Lameiras Koerich. A robust approach for securing audio classification against adversarial attacks.IEEE Transactions on information forensics and security, 15:2147–2159, 2019

    work page 2019

  38. [38]

    A survey on evaluation of large language models.ACM transactions on intelligent systems and technology, 15(3):1–45, 2024

    Yupeng Chang, Xu Wang, Jindong Wang, Yuan Wu, Linyi Yang, Kaijie Zhu, Hao Chen, Xiaoyuan Yi, Cunxiang Wang, Yidong Wang, et al. A survey on evaluation of large language models.ACM transactions on intelligent systems and technology, 15(3):1–45, 2024

    2024

  39. [39]

    Jailbreaking black box large language models in twenty queries

    Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong. Jailbreaking black box large language models in twenty queries. In2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), pages 23–42. IEEE, 2025

    2025

  40. [40]

    Red- teaming for generative ai: Silver bullet or security theater? InProceedings of the AAAI/ACM Conference on AI, Ethics, and Society, volume 7, pages 421–437, 2024

    Michael Feffer, Anusha Sinha, Wesley H Deng, Zachary C Lipton, and Hoda Heidari. Red- teaming for generative ai: Silver bullet or security theater? InProceedings of the AAAI/ACM Conference on AI, Ethics, and Society, volume 7, pages 421–437, 2024

    work page 2024

  41. [41]

    Unveiling Safety Vulnerabilities of Large Language Models

    George Kour, Marcel Zalmanovici, Naama Zwerdling, Esther Goldbraich, Ora Nova Fandina, Ateret Anaby-Tavor, Orna Raz, and Eitan Farchi. Unveiling safety vulnerabilities of large language models.arXiv preprint arXiv:2311.04124, 2023

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  42. [42]

    Machine learning interpretability: A survey on methods and metrics.Electronics, 8(8):832, 2019

    Diogo V Carvalho, Eduardo M Pereira, and Jaime S Cardoso. Machine learning interpretability: A survey on methods and metrics.Electronics, 8(8):832, 2019

    work page 2019

  43. [43]

    Open problems in mechanistic interpretability.arXiv preprint arXiv:2501.16496, 2025

    Lee Sharkey, Bilal Chughtai, Joshua Batson, Jack Lindsey, Jeff Wu, Lucius Bushnaq, Nicholas Goldowsky-Dill, Stefan Heimersheim, Alejandro Ortega, Joseph Bloom, et al. Open problems in mechanistic interpretability.arXiv preprint arXiv:2501.16496, 2025

    Pith/arXiv arXiv 2025

  44. [44]

    Compact proofs of model performance via mechanistic interpretability.arXiv preprint arXiv:2406.11779, 2024

    Jason Gross, Rajashree Agrawal, Thomas Kwa, Euan Ong, Chun Hei Yip, Alex Gibson, Soufiane Noubir, and Lawrence Chan. Compact proofs of model performance via mechanistic interpretability.arXiv preprint arXiv:2406.11779, 2024

    Pith/arXiv arXiv 2024

  45. [45]

    Progress measures for grokking via mechanistic interpretability.arXiv preprint arXiv:2301.05217, 2023

    Neel Nanda, Lawrence Chan, Tom Lieberum, Jess Smith, and Jacob Steinhardt. Progress measures for grokking via mechanistic interpretability.arXiv preprint arXiv:2301.05217, 2023

    Pith/arXiv arXiv 2023

  46. [46]

    Deceptive automated interpretability: Language models coordinating to fool oversight systems.arXiv preprint arXiv:2504.07831, 2025

    Simon Lermen, Mateusz Dziemian, and Natalia Pérez-Campanero Antolín. Deceptive automated interpretability: Language models coordinating to fool oversight systems.arXiv preprint arXiv:2504.07831, 2025

    Pith/arXiv arXiv 2025

  47. [47]

    Jailbreaklens: Interpreting jailbreak mechanism in the lens of representation and circuit.arXiv preprint arXiv:2411.11114, 2024

    Zeqing He, Zhibo Wang, Zhixuan Chu, Huiyu Xu, Rui Zheng, Kui Ren, and Chun Chen. Jailbreaklens: Interpreting jailbreak mechanism in the lens of representation and circuit.arXiv preprint arXiv:2411.11114, 2024

    Pith/arXiv arXiv 2024

  48. [48]

    Mechanistic interpretability for ai safety–a review

    Leonard Bereska and Efstratios Gavves. Mechanistic interpretability for ai safety–a review. arXiv preprint arXiv:2404.14082, 2024

    Pith/arXiv arXiv 2024

  49. [49]

    Towards interpretable defense against adversarial attacks via causal inference.Machine Intelligence Research, 19(3):209–226, 2022

    Min Ren, Yun-Long Wang, and Zhao-Feng He. Towards interpretable defense against adversarial attacks via causal inference.Machine Intelligence Research, 19(3):209–226, 2022. 12

    work page 2022

  50. [50]

    Steering language model refusal with sparse autoencoders.arXiv preprint arXiv:2411.11296, 2024

    Kyle O’Brien, David Majercak, Xavier Fernandes, Richard Edgar, Blake Bullwinkel, Jingya Chen, Harsha Nori, Dean Carignan, Eric Horvitz, and Forough Poursabzi-Sangdeh. Steering language model refusal with sparse autoencoders.arXiv preprint arXiv:2411.11296, 2024

    Pith/arXiv arXiv 2024

  51. [51]

    Neurons in large language models: Dead, n-gram, positional.arXiv preprint arXiv:2309.04827, 2023

    Elena V oita, Javier Ferrando, and Christoforos Nalmpantis. Neurons in large language models: Dead, n-gram, positional.arXiv preprint arXiv:2309.04827, 2023

    Pith/arXiv arXiv 2023

  52. [52]

    A systematic review on stopword removal algorithms.Inter- national Journal on Future Revolution in Computer Science & Communication Engineering, 4 (4):207–210, 2018

    Jashanjot Kaur and P Kaur Buttar. A systematic review on stopword removal algorithms.Inter- national Journal on Future Revolution in Computer Science & Communication Engineering, 4 (4):207–210, 2018

    work page 2018

  53. [53]

    The type-token ratio and vocabulary performance.Psychological Reports, 55(1):51–57, 1984

    Carla W Hess, Kelley P Ritchie, and Richard G Landry. The type-token ratio and vocabulary performance.Psychological Reports, 55(1):51–57, 1984

    work page 1984

  54. [54]

    Stopwords in technical language processing.Plos one, 16(8): e0254937, 2021

    Serhad Sarica and Jianxi Luo. Stopwords in technical language processing.Plos one, 16(8): e0254937, 2021

    work page 2021

  55. [55]

    A threshold selection method from gray-level histograms.Automatica, 11 (285-296):23–27, 1975

    Nobuyuki Otsu et al. A threshold selection method from gray-level histograms.Automatica, 11 (285-296):23–27, 1975

    work page 1975

  56. [56]

    Exploring concept depth: How large language models acquire knowledge and concept at different layers?arXiv preprint arXiv:2404.07066, 2024

    Mingyu Jin, Qinkai Yu, Jingyuan Huang, Qingcheng Zeng, Zhenting Wang, Wenyue Hua, Haiyan Zhao, Kai Mei, Yanda Meng, Kaize Ding, et al. Exploring concept depth: How large language models acquire knowledge and concept at different layers?arXiv preprint arXiv:2404.07066, 2024

    Pith/arXiv arXiv 2024

  57. [57]

    Steering llama 2 via contrastive activation addition

    Nina Rimsky, Nick Gabrieli, Julian Schulz, Meg Tong, Evan Hubinger, and Alexander Turner. Steering llama 2 via contrastive activation addition. InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 15504–15522, 2024

    2024

  58. [58]

    Jumping ahead: Improving reconstruction fidelity with jumprelu sparse autoencoders.arXiv preprint arXiv:2407.14435, 2024

    Senthooran Rajamanoharan, Tom Lieberum, Nicolas Sonnerat, Arthur Conmy, Vikrant Varma, János Kramár, and Neel Nanda. Jumping ahead: Improving reconstruction fidelity with jumprelu sparse autoencoders.arXiv preprint arXiv:2407.14435, 2024

    Pith/arXiv arXiv 2024

  59. [59]

    Joseph Bloom, Curt Tigges, Anthony Duong, and David Chanin. Saelens. https://github. com/jbloomAus/SAELens, 2024

    2024

  60. [60]

    Sparse but wrong: Incorrect l0 leads to incorrect features in sparse autoencoders.arXiv preprint arXiv:2508.16560, 2025

    David Chanin and Adrià Garriga-Alonso. Sparse but wrong: Incorrect l0 leads to incorrect features in sparse autoencoders.arXiv preprint arXiv:2508.16560, 2025

    Pith/arXiv arXiv 2025

  61. [61]

    How (un) ethical are instruction-centric responses of llms? unveiling the vulnerabilities of safety guardrails to harmful queries

    Somnath Banerjee, Sayan Layek, Rima Hazra, and Animesh Mukherjee. How (un) ethical are instruction-centric responses of llms? unveiling the vulnerabilities of safety guardrails to harmful queries. InProceedings of the International AAAI Conference on Web and Social Media, volume 19, pages 193–205, 2025

    work page 2025

  62. [62]

    Language models are homer simpson! safety re-alignment of fine-tuned language models through task arithmetic

    Rishabh Bhardwaj, Duc Anh Do, and Soujanya Poria. Language models are homer simpson! safety re-alignment of fine-tuned language models through task arithmetic. InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 14138–14149, 2024

    work page 2024

  63. [63]

    Universal and transferable adversarial attacks on aligned language models.arXiv preprint arXiv:2307.15043, 2023

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models.arXiv preprint arXiv:2307.15043, 2023

    Pith/arXiv arXiv 2023

  64. [64]

    Hashimoto

    Rohan Taori, Ishaan Gulrajani, Tianyi Zhang, Yann Dubois, Xuechen Li, Carlos Guestrin, Percy Liang, and Tatsunori B. Hashimoto. Stanford alpaca: An instruction-following llama model. https://github.com/tatsu-lab/stanford_alpaca, 2023

    2023

  65. [65]

    Red-teaming large language models using chain of utterances for safety-alignment.arXiv preprint arXiv:2308.09662, 2023

    Rishabh Bhardwaj and Soujanya Poria. Red-teaming large language models using chain of utterances for safety-alignment.arXiv preprint arXiv:2308.09662, 2023

    Pith/arXiv arXiv 2023

  66. [66]

    The llama 3 herd of models.arXiv e-prints, pages arXiv–2407, 2024

    Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. The llama 3 herd of models.arXiv e-prints, pages arXiv–2407, 2024. 13

    work page 2024

  67. [67]

    Refuse whenever you feel unsafe: Improving safety in llms via decoupled refusal training

    Youliang Yuan, Wenxiang Jiao, Wenxuan Wang, Jen-tse Huang, Jiahao Xu, Tian Liang, Pinjia He, and Zhaopeng Tu. Refuse whenever you feel unsafe: Improving safety in llms via decoupled refusal training. InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 3149–3167, 2025

    2025

  68. [68]

    Judging llm-as-a-judge with mt-bench and chatbot arena.Advances in Neural Information Processing Systems, 36:46595–46623, 2023

    Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric Xing, et al. Judging llm-as-a-judge with mt-bench and chatbot arena.Advances in Neural Information Processing Systems, 36:46595–46623, 2023

    2023

  69. [69]

    The llama 3 family of models.https://github.com/meta-llama/ PurpleLlama/blob/main/Llama-Guard3/1B/MODEL_CARD.md, 2024

    AI @ Meta Llama Team. The llama 3 family of models.https://github.com/meta-llama/ PurpleLlama/blob/main/Llama-Guard3/1B/MODEL_CARD.md, 2024

    work page 2024

  70. [70]

    Best-of-n jailbreaking.arXiv preprint arXiv:2412.03556, 2024

    John Hughes, Sara Price, Aengus Lynch, Rylan Schaeffer, Fazl Barez, Sanmi Koyejo, Henry Sleight, Erik Jones, Ethan Perez, and Mrinank Sharma. Best-of-n jailbreaking.arXiv preprint arXiv:2412.03556, 2024

    Pith/arXiv arXiv 2024

  71. [71]

    "., have, „ rhetorical, be, the, a, take, backpack, with

    Jack Lindsey, Adly Templeton, Jonathan Marcus, Thomas Conerly, Joshua Batson, and Christo- pher Olah. Sparse crosscoders for cross-layer features and model diffing.Transformer Circuits Thread, pages 3982–3992, 2024. A Appendix A.1 Top-100 Token Sets for Junk and Rich Features We provide one example each for the top-100 activating token-sets for the junk a...

    work page 2024

This paper was first reviewed by deepseek-v4-flash on August 5, 2026.