Pith. sign in

REVIEW 6 major objections 5 minor 90 references

Per-sample distortion between input and output manifolds ranks which texts a transformer will fail to keep stable, and prioritizing those samples makes attacks more successful and fine-tuning more robust.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

SALMAN ranks each text sample's fragility via the distortion between input and output embedding distances and uses the ranking to improve attack success rates and fine-tuning robustness.

T0 review reviewed 2026-08-05 challenge →

load-bearing objection SALMAN's per-sample DMD ranking is a plausible idea, but the headline attack result rests on 5 samples and the theory has gaps; the fine-tuning experiments are the strongest part. the 6 major comments →

arxiv 2508.18306 v1 pith:G3JXTY6Z submitted 2025-08-23 cs.LG cs.AIcs.CL

SALMAN: Stability Analysis of Language Models Through the Maps Between Graph-based Manifolds

Wuxinlin Cheng , Yupeng Cao , Jinwen Wu , Koduvayur Subbalakshmi , Tian Han , Zhuo Feng This is my paper
classification cs.LG cs.AIcs.CL
keywords sample-level robustnesslanguage modelsadversarial attackeffective resistancespectral sparsificationmanifoldfine-tuningdistance mapping distortion
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper tries to establish that a single per-sample score, computed by comparing distances among input embeddings with distances among output embeddings, reveals which text samples a transformer model will fail to keep stable under perturbation. The score, called Distance Mapping Distortion (DMD), is meant to work across model sizes—from DistilBERT to Llama—without first generating adversarial examples. If the score is trustworthy, robustness evaluation becomes a one-time geometric calculation, adversarial testing can concentrate on the few samples most likely to break, and fine-tuning can spend its effort on those same samples. The paper shows the ranking by demonstrating that non-robust samples shift more under simple edits and standard attacks, that attacking the top 1% ranked samples yields higher attack success than random selection (60% ASR for GPT-2 under a gradient-based jailbreak attack), and that up-weighting non-robust samples during fine-tuning improves robustness scores while staying close to the pretrained checkpoint.

Core claim

The central claim is that the model's input-output mapping can be treated as a map between two graph-based manifolds, and that per-sample distortion of that map predicts local robustness. For a pair of samples p,q, the DMD is gamma(p,q)=dY(p,q)/dX(p,q), the ratio of effective-resistance distances in the output manifold to those in the input manifold; large gamma means the model expands small input differences, small gamma means it collapses distant inputs. The paper argues both extremes matter, proves gamma_min is bounded below by 1/lambda_max(LX^+ LY), and derives the per-sample SALMAN score as the average of gamma^3 + gamma^-3 over neighbors, with a spectral approximation via weighted eige

What carries the argument

Distance Mapping Distortion (DMD): the ratio of output-manifold to input-manifold effective-resistance distance between sample pairs, gamma(p,q)=dY/dX. The paper replaces geodesic distance with effective resistance so that Laplacian pseudoinverses yield tractable formulas, builds input and output manifolds from k-NN graphs sparsified in near-linear time by a low-resistance-diameter decomposition, and converts per-pair distortion into a per-sample SALMAN score. Theorems 3.4 and 3.5 connect the extremes of gamma to eigenvalues of the matrix pencils LX^+ LY and LY^+ LX, so the score can be computed from a few dominant spectral embeddings rather than all node pairs.

Load-bearing premise

Everything rests on the assumption that pruning the graph down to a sparse approximation, for speed, does not change the distance comparisons that rank samples; if the pruning distorts those distances, the ranking is noise.

What would settle it

Compute DMD on the full k-NN graph without sparsification for a modest dataset, then compare the top 1% ranked by full-graph DMD with the top 1% ranked by the sparsified version under the same attack; if the overlap is no better than chance or the attack-success gap disappears, the ranking is an artifact of sparsification. Alternatively, run the guided attack with more than the 520 samples used here and across multiple random seeds to see whether the 60% top-1% attack success rate over random selection is reproducible.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Robustness evaluation of a model on a dataset becomes a one-time geometric computation that can be reused for many downstream decisions.
  • Adversarial testing can be made cheaper: attacking the most distorted 1% of samples should reveal vulnerabilities faster than random sampling, with higher success rate per query.
  • Fine-tuning can be reweighted by DMD to improve model-level robustness scores without sacrificing task accuracy, while keeping fine-tuned representations closer to the pretrained checkpoint.
  • The ranking transfers across model sizes, so a small proxy model can flag fragile samples for a much larger target model.
  • The same score captures both expansion failures and collapse failures, giving a two-sided view of local instability rather than only worst-case expansion.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Because DMD only needs input and output embeddings, the same recipe should apply to vision or multimodal transformers provided their representations form stable manifolds; a direct test on image-scale embeddings would be a natural extension the paper does not attempt.
  • The proxy-transfer results suggest DMD may be detecting dataset-level fragile regions rather than model-specific weights; if true, the ranking could be precomputed once per dataset and reused across architectures, though the paper only tests this on a few LLM pairs.
  • An implicit consequence is that DMD could serve as a data-cleaning or curriculum signal independent of attacks: intrinsically distorted samples are likely where label noise or annotation ambiguity concentrates, a hypothesis the paper does not test.
  • The collapse term (gamma_min)^-1 may also predict over-confidence or hallucination, since it flags inputs the model maps too close together; the paper does not connect DMD to generation quality, but the geometry suggests that connection.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

6 major / 5 minor

Summary. The paper proposes SALMAN, a per-sample robustness scoring framework for transformer-based language models. It constructs k-NN graphs over pooled hidden-state embeddings from the first and last layers, sparsifies them via a claimed near-linear spectral-sparsification routine, and defines a Distance Mapping Distortion (DMD) score per sample. The authors claim that high-DMD samples are more susceptible to perturbations, that attacking the top 1% of such samples yields higher and more efficient jailbreak attack success, and that up-weighting them during fine-tuning improves robustness while preserving accuracy. Experiments are reported on BERT/RoBERTa/DistilBERT/ALBERT/GPT-2/LLaMA across GLUE-style tasks and AdvBench.

Significance. If the central claims held, SALMAN would be a practically useful, model-agnostic tool: it would provide a per-sample vulnerability ranking computable in near-linear time, without adversarial perturbation search, and would directly inform attack prioritization and robust fine-tuning. The paper has several commendable features: it addresses a real gap (sample-level robustness for both small and large LMs), proposes a concrete geometric score, includes multiple model/task evaluations, ablates the k-NN parameter, reports runtime, and tests proxy-model transferability. However, the theoretical support for the manifold construction is incomplete and the headline attack experiment is statistically underpowered; as presented, the evidence does not establish the paper's strongest practical claims.

major comments (6)
  1. [Section 4.2, Figure 2, Table 5] The headline attack-efficiency claim is statistically unsupported. AdvBench has 520 prompts, so the top-1% subset is about 5 samples; an ASR of 60% is 3/5 successes and the 95% CI is roughly 17-100%, so the values 40%, 48%, 56%, 60% in Table 5 differ by single samples. The random 1% baseline ASR is never stated, so the claim that attacking non-robust samples is 'more efficient and more effective' cannot be evaluated. Please report attack results on larger subsets (e.g., top 10%), exact counts, bootstrap/CI intervals, and the random-baseline ASR.
  2. [Section 3.3, Appendix A.5, Eq. (16)] The SALMAN score rests on Theorem 3.5, but its proof assumes each edge vector e_pq is 'dominantly aligned' with a single generalized eigenvector. This is asserted, not proved, and no bound is given for residual terms. Without that assumption, the claimed proportionality ||V_r^T e_pq||^2 + ||W_r^T e_pq||^2 ∝ γ^3 + γ^{-3} does not follow. Since Eq. (4) is the definition of the per-sample score, this gap is load-bearing; either prove the approximation with explicit error bounds or present the score as an empirically motivated heuristic and validate it independently of the theorem.
  3. [Section 3.2, Appendix A.2] The pruning rule of Theorem 3.1 is derived from an unjustified identification. For Θ = L + σ^{-2}I, ∂log det Θ/∂w_pq = e_pq^T (L+σ^{-2}I)^{-1} e_pq, not the effective resistance e_pq^T L^+ e_pq. The appendix writes '≈' without a bound or a limiting argument. Since the distance ratio ρ_pq and the whole spectral-sparsification step depend on this derivative, Theorem 3.1 is not proven as stated.
  4. [Section 3.2, Appendix A.3, Lemma A.1, Theorem A.2] The near-linear LRD sparsification is not established. Lemma A.1 asserts high-probability error bounds for Krylov-subspace resistance estimates but gives no proof or precise statement; Theorem A.2 is only a proof sketch. The validation in Appendix A.9 (Table 15) measures correlation/MSE on Cora/Citeseer/Polblogs, not the stated (1±ε) spectral guarantee, and at SPF=4 the relative resistance error reaches 1.43 for Polblogs. Since DMD is computed on the sparsified manifolds, this gap affects the central geometric proxy.
  5. [Section 4.1, Tables 1-2, Table 4] The claim that SALMAN 'reliably distinguishes' robust from non-robust samples is supported only by point estimates with no error bars or significance tests. Several gaps are small (e.g., RoBERTa MNLI 0.9993 vs 0.9926; GPT-2 MNLI 0.9993 vs 0.9904), and no random-selection baseline is reported for these cosine-similarity comparisons. The k-NN ablation in Table 11 likewise reports single runs. Please provide variances across seeds or bootstrap intervals and compare against random subsets of the same size.
  6. [Appendix A.4, Theorem 3.4 proof] The proof uses the identity (L_Y^+ L_X)^{-1} = L_X^+ L_Y without stating the conditions under which it holds; for arbitrary non-commuting Laplacian pseudoinverses this is not generally valid. The resulting bound γ_min ≥ 1/λ_max(L_X^+ L_Y) therefore needs a proof or a corrected statement. This matters because the 'collapse' component of the SALMAN score is motivated by this relation.
minor comments (5)
  1. [Section 3.1] The notation is confusing: {x1,...,xN} is used for token sequences, but xi is also used for individual token embeddings. Use distinct symbols for a sequence and its constituent tokens.
  2. [Section 3.3, Eq. (4)] The neighborhood N(p) is not clearly defined. The text mentions NX(p) but does not specify whether the average is taken over input-graph neighbors, output-graph neighbors, or their union/intersection.
  3. [Abstract/Section 3.3] The DMD measure is credited to Cheng et al. [40] in Section 3.3, yet the abstract and contribution list call it 'novel'. Please reconcile the novelty claim.
  4. [Figure 2] Panel (b) lacks axis labels and error bars; the caption should state what is plotted (number of attack attempts vs. subset, or similar) and clarify why no uncertainty is shown.
  5. [Appendix A.6] There is no statement about code release, random seeds for fine-tuning, or the hardware used for the runtime table. These details would substantially improve reproducibility.

Circularity Check

0 steps flagged

No significant circularity: DMD is an independently validated geometric score, not a fitted or self-referential predictor.

full rationale

The central measure, DMD, is defined as a geometric ratio of output-to-input distances (Eq. 2) and the per-sample SALMAN score as a local average of distortion terms (Eq. 4). These are quantities computed from the model's frozen embeddings; they are not fitted to the attack or perturbation outcomes. The paper's key empirical claims—that high-DMD samples show larger output shifts under external perturbations (spaCy, TextAttack) and that attacking the top DMD-ranked samples yields higher jailbreak ASR under GCG/AutoDAN—use data and procedures not involved in computing the DMD score, so the ranking is not forced by construction. The spectral sparsification and effective-resistance machinery rests on external mathematical results (Spielman-Srivastava, Koutis et al.) and is additionally validated on Cora/Citeseer/Polblogs in Appendix A.9, providing independent support. Self-citations to the authors' prior SPADE paper supply the DMD concept and a spectral upper bound, but the per-sample extension, the min-distortion theorem, and the empirical validations are derived or tested independently; no load-bearing argument reduces to a self-citation that is itself unverified. The small size of the AdvBench top-1% subset (~5 samples) is a legitimate statistical-power concern, but it is not a circularity: the attack success rate is an external outcome, not an input to the DMD computation.

Axiom & Free-Parameter Ledger

5 free parameters · 5 axioms · 1 invented entities

All free parameters are hyperparameters of the graph construction and fine-tuning weighting, not fit to the robustness outcomes, but the per-dataset tuning means the reported gains are partly a product of manual selection.

free parameters (5)
  • k (number of nearest neighbors) = 10 to 70 depending on dataset (Table 10)
    Chosen by hand per model and dataset; changes the neighborhood and therefore the DMD score.
  • SPF (spectral pruning factor) = 2 to 3 depending on dataset
    Chosen by hand; controls the number of edges removed in spectral sparsification.
  • sigma^2 (prior variance in precision matrix) = not specified
    Appears in Theta = L + 1/sigma^2 I; its value affects log det and trace terms but is never given.
  • weighting schedule parameters for guided fine-tuning = top-25% weight 2.0, bottom-5% weight 0.0
    Chosen ad hoc in Appendix A.8; no sensitivity analysis is provided.
  • top-k% attack subset = 1% and 10%
    Used for attack and binning; 1% of 520 samples is 5 samples, making the ASR estimates noisy.
axioms (5)
  • domain assumption Effective resistance distances approximate geodesic distances on the data manifold.
    Invoked in Sec 3.3 to replace dX and dY with effective resistance; without this, the gamma ratio measures electrical connectivity, not semantic distance.
  • domain assumption The pooled MHSA hidden-state embeddings form a stable, deterministic manifold (cosine similarity 1.00 across seeds).
    Sec 3.1 and Appendix A.1; if the embeddings fluctuate, the input and output manifolds are ill-defined.
  • ad hoc to paper Maximizing F(Theta) is equivalent to pruning edges with small distance ratio rho_pq.
    Theorem 3.1; the appendix proof derives a derivative condition but does not establish that the pruning strategy is the global maximizer.
  • ad hoc to paper The LRD decomposition yields a (1 +/- epsilon) spectral approximation with near-linear cost.
    Theorem 3.2 / Theorem A.2; the proof depends on unproven Lemma A.1 about Krylov-subspace resistance estimates.
  • ad hoc to paper For each edge (p,q), the vector e_pq is dominantly aligned with one generalized eigenvector of (L_Y^+, L_X^+).
    Appendix A.5, used to show that the V_r-W_r norm is proportional to gamma^3 + gamma^{-3}; without this dominance the sum over r eigenvectors does not reduce to a single lambda_k.
invented entities (1)
  • SALMAN score (per-sample DMD-based robustness index) independent evidence
    purpose: Ranking samples by predicted fragility for attack selection and fine-tuning weighting.
    The score is an observable statistic of the model's own embeddings, not a new physical object; its falsifiable content is the predicted correlation with perturbation-induced output shift, which the paper tests experimentally.

reviewed 2026-08-05 · how reviews work

0 comments
Cite this review

Pith. "Pith review of SALMAN: Stability Analysis of Language Models Through the Maps Between Graph-based Manifolds." pith.science (2026). https://pith.science/paper/G3JXTY6Z

@misc{pith2026250818306,
  author       = {Pith},
  title        = {Pith review of: SALMAN: Stability Analysis of Language Models Through the Maps Between Graph-based Manifolds},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/G3JXTY6Z}},
  note         = {Machine review of arXiv:2508.18306}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Recent strides in pretrained transformer-based language models have propelled state-of-the-art performance in numerous NLP tasks. Yet, as these models grow in size and deployment, their robustness under input perturbations becomes an increasingly urgent question. Existing robustness methods often diverge between small-parameter and large-scale models (LLMs), and they typically rely on labor-intensive, sample-specific adversarial designs. In this paper, we propose a unified, local (sample-level) robustness framework (SALMAN) that evaluates model stability without modifying internal parameters or resorting to complex perturbation heuristics. Central to our approach is a novel Distance Mapping Distortion (DMD) measure, which ranks each sample's susceptibility by comparing input-to-output distance mappings in a near-linear complexity manner. By demonstrating significant gains in attack efficiency and robust training, we position our framework as a practical, model-agnostic tool for advancing the reliability of transformer-based NLP systems.

Figures

Figures reproduced from arXiv: 2508.18306 by Jinwen Wu, Koduvayur Subbalakshmi, Tian Han, Wuxinlin Cheng, Yupeng Cao, Zhuo Feng.

Figure 1
Figure 1. Figure 1: The overview of SALMAN Method. In this section, we detail our overall pipeline ( [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Comparison of adversarial attack performance (a) and efficiency (b) with and without [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Line vs. Square Graph Examples. (Left) The line graph with nodes {1, 2, 3}. (Right) The square graph with nodes {1, 2, 3, 4}. Although both have a hop distance of 2 between node 1 and node 3, the effective resistance differs significantly: it is Reff(1, 3) = 2 in the line graph (two edges in series), versus Reff(1, 3) = 1 in the square graph (two parallel 2-edge paths). These simple examples illustrate tha… view at source ↗
Figure 4
Figure 4. Figure 4: (Left) Attack Success Rate (ASR) across deciles of non-robustness. (Right) Average number of AutoDAN steps needed for successful attack on robust vs. non-robust subsets. Non-robust samples require fewer steps, highlighting their vulnerability. We further follow GCG [12] and AutoDAN [59] to measure the average number of attack steps required. By default, GCG uses a fixed 250 steps for each trial, but we ada… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

90 extracted references · 46 canonical work pages · 10 internal anchors

  1. [1]

    Chi Sun, Xipeng Qiu, Yige Xu, and Xuanjing Huang. How to fine-tune bert for text classification? In Chinese computational linguistics: 18th China national conference, CCL 2019, Kunming, China, October 18–20, 2019, proceedings 18, pages 194–206. Springer, 2019

    2019

  2. [2]

    Automatic text summariza- tion: A comprehensive survey

    Wafaa S El-Kassas, Cherif R Salama, Ahmed A Rafea, and Hoda K Mohamed. Automatic text summariza- tion: A comprehensive survey. Expert systems with applications, 165:113679, 2021

    2021

  3. [3]

    Gpt-4 technical report

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774, 2023

    Pith/arXiv arXiv 2023

  4. [4]

    Chain-of-thought prompting elicits reasoning in large language models

    Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al. Chain-of-thought prompting elicits reasoning in large language models. Advances in neural information processing systems, 35:24824–24837, 2022

    2022

  5. [5]

    Hotflip: White-box adversarial examples for text classification

    Javid Ebrahimi, Anyi Rao, Daniel Lowd, and Dejing Dou. Hotflip: White-box adversarial examples for text classification. arXiv preprint arXiv:1712.06751, 2017

    Pith/arXiv arXiv 2017

  6. [6]

    Adversarial examples for evaluating reading comprehension systems

    Robin Jia and Percy Liang. Adversarial examples for evaluating reading comprehension systems. arXiv preprint arXiv:1707.07328, 2017

    Pith/arXiv arXiv 2017

  7. [7]

    Is bert really robust? a strong baseline for natural language attack on text classification and entailment

    Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. Is bert really robust? a strong baseline for natural language attack on text classification and entailment. In Proceedings of the AAAI conference on artificial intelligence, volume 34, pages 8018–8025, 2020

    2020

  8. [8]

    Bert-attack: Adversarial attack against bert using bert

    Linyang Li, Ruotian Ma, Qipeng Guo, Xiangyang Xue, and Xipeng Qiu. Bert-attack: Adversarial attack against bert using bert. arXiv preprint arXiv:2004.09984, 2020

    Pith/arXiv arXiv 2004

  9. [9]

    Freelb: Enhanced adversarial training for natural language understanding

    Chen Zhu, Yu Cheng, Zhe Gan, Siqi Sun, Tom Goldstein, and Jingjing Liu. Freelb: Enhanced adversarial training for natural language understanding. In International Conference on Learning Representations

  10. [10]

    Searching for an effective defender: Benchmarking defense against adversarial word substitution

    Zongyi Li, Jianhan Xu, Jiehang Zeng, Linyang Li, Xiaoqing Zheng, Qi Zhang, Kai-Wei Chang, and Cho-Jui Hsieh. Searching for an effective defender: Benchmarking defense against adversarial word substitution. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 3137–3147, 2021

    2021

  11. [11]

    Perturbscore: Connecting discrete and continuous perturbations in nlp

    Linyang Li, Ke Ren, Yunfan Shao, Pengyu Wang, and Xipeng Qiu. Perturbscore: Connecting discrete and continuous perturbations in nlp. In Findings of the Association for Computational Linguistics: EMNLP 2023, pages 6638–6648, 2023

    2023

  12. [12]

    Universal and transferable adversarial attacks on aligned language models

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043, 2023

    Pith/arXiv arXiv 2023

  13. [13]

    Decodingtrust: A comprehensive assessment of trustworthiness in gpt models

    Boxin Wang, Weixin Chen, Hengzhi Pei, Chulin Xie, Mintong Kang, Chenhui Zhang, Chejian Xu, Zidi Xiong, Ritik Dutta, Rylan Schaeffer, et al. Decodingtrust: A comprehensive assessment of trustworthiness in gpt models. In NeurIPS, 2023

    2023

  14. [14]

    Promptrobust: Towards evaluating the robustness of large language models on adversarial prompts

    Kaijie Zhu, Jindong Wang, Jiaheng Zhou, Zichen Wang, Hao Chen, Yidong Wang, Linyi Yang, Wei Ye, Yue Zhang, Neil Gong, et al. Promptrobust: Towards evaluating the robustness of large language models on adversarial prompts. In Proceedings of the 1st ACM Workshop on Large AI Systems and Models with Privacy and Safety Analysis, pages 57–68, 2023

    2023

  15. [15]

    Textbugger: Generating adversarial text against real-world applications

    Jinfeng Li, Shouling Ji, Tianyu Du, Bo Li, and Ting Wang. Textbugger: Generating adversarial text against real-world applications. arXiv preprint arXiv:1812.05271, 2018

    Pith/arXiv arXiv 2018

  16. [16]

    Bae: Bert-based adversarial examples for text classification

    Siddhant Garg and Goutham Ramakrishnan. Bae: Bert-based adversarial examples for text classification. arXiv preprint arXiv:2004.01970, 2020

    Pith/arXiv arXiv 2004

  17. [17]

    Advprompter: Fast adaptive adversarial prompting for llms

    Anselm Paulus, Arman Zharmagambetov, Chuan Guo, Brandon Amos, and Yuandong Tian. Advprompter: Fast adaptive adversarial prompting for llms. arXiv preprint arXiv:2404.16873, 2024

    Pith/arXiv arXiv 2024

  18. [18]

    Theo- retically principled trade-off between robustness and accuracy

    Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theo- retically principled trade-off between robustness and accuracy. In International conference on machine learning, pages 7472–7482. PMLR, 2019

    2019

  19. [19]

    Adv- bert: Bert is not robust on misspellings! generating nature adversarial samples on bert

    Lichao Sun, Kazuma Hashimoto, Wenpeng Yin, Akari Asai, Jia Li, Philip Yu, and Caiming Xiong. Adv- bert: Bert is not robust on misspellings! generating nature adversarial samples on bert. arXiv preprint arXiv:2003.04985, 2020. 11

    Pith/arXiv arXiv 2003

  20. [20]

    Adversarial glue: A multi-task benchmark for robustness evaluation of language models

    Boxin Wang, Chejian Xu, Shuohang Wang, Zhe Gan, Yu Cheng, Jianfeng Gao, Ahmed Hassan Awadallah, and Bo Li. Adversarial glue: A multi-task benchmark for robustness evaluation of language models. arXiv preprint arXiv:2111.02840, 2021

    Pith/arXiv arXiv 2021

  21. [21]

    Bert rediscovers the classical nlp pipeline

    I Tenney. Bert rediscovers the classical nlp pipeline. arXiv preprint arXiv:1905.05950, 2019

    Pith/arXiv arXiv 1905

  22. [22]

    A structural probe for finding syntax in word representations

    John Hewitt and Christopher D Manning. A structural probe for finding syntax in word representations. In Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, Volume 1 (Long and Short Papers), pages 4129–4138, 2019

    2019

  23. [23]

    The bottom-up evolution of representations in the transformer: A study with machine translation and language modeling objectives

    Elena V oita, Rico Sennrich, and Ivan Titov. The bottom-up evolution of representations in the transformer: A study with machine translation and language modeling objectives. InProceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), pag...

    work page 2019

  24. [24]

    Blackbox meets blackbox: Representational Similarity and Stability Analysis of Neural Language Models and Brains

    Samira Abnar, Lisa Beinborn, Rochelle Choenni, and Willem Zuidema. Blackbox meets blackbox: Representational similarity and stability analysis of neural language models and brains. arXiv preprint arXiv:1906.01539, 2019

    work page internal anchor Pith review Pith/arXiv arXiv 1906

  25. [25]

    A Closer Look at How Fine-tuning Changes BERT

    Yichu Zhou and Vivek Srikumar. A closer look at how fine-tuning changes bert. arXiv preprint arXiv:2106.14282, 2021

    work page internal anchor Pith review Pith/arXiv arXiv 2021

  26. [26]

    On Robustness of Finetuned Transformer-based NLP Models

    Pavan Kalyan Reddy Neerudu, Subba Reddy Oota, Mounika Marreddy, Venkateswara Rao Kagita, and Manish Gupta. On robustness of finetuned transformer-based nlp models.arXiv preprint arXiv:2305.14453, 2023

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  27. [27]

    Survey of vulnerabilities in large language models revealed by adversarial attacks

    Erfan Shayegani, Md Abdullah Al Mamun, Yu Fu, Pedram Zaree, Yue Dong, and Nael Abu-Ghazaleh. Survey of vulnerabilities in large language models revealed by adversarial attacks. arXiv preprint arXiv:2310.10844, 2023

    Pith/arXiv arXiv 2023

  28. [28]

    On the robustness of chatgpt: An adversarial and out-of-distribution perspective

    Jindong Wang, HU Xixu, Wenxin Hou, Hao Chen, Runkai Zheng, Yidong Wang, Linyi Yang, Wei Ye, Haojun Huang, Xiubo Geng, et al. On the robustness of chatgpt: An adversarial and out-of-distribution perspective. In ICLR 2023 Workshop on Trustworthy and Reliable Large-Scale Machine Learning Models

    work page 2023

  29. [29]

    Probabilistic graphical models: Principles and techniques, 2009

    Daphane Koller. Probabilistic graphical models: Principles and techniques, 2009

    work page 2009

  30. [30]

    Pgm-explainer: Probabilistic graphical model explanations for graph neural networks

    Minh Vu and My T Thai. Pgm-explainer: Probabilistic graphical model explanations for graph neural networks. Advances in neural information processing systems, 33:12225–12235, 2020

    2020

  31. [31]

    Sgl: Spectral graph learning from measurements

    Zhuo Feng. Sgl: Spectral graph learning from measurements. In 2021 58th ACM/IEEE Design Automation Conference (DAC), pages 727–732. IEEE, 2021

    work page 2021

  32. [32]

    Manifold structure in graph embeddings

    Patrick Rubin-Delanchy. Manifold structure in graph embeddings. Advances in neural information processing systems, 33:11687–11699, 2020

    work page 2020

  33. [33]

    SAGMAN: Stability Analysis of Graph Neural Networks on the Manifolds

    Wuxinlin Cheng, Chenhui Deng, Ali Aghdaei, Zhiru Zhang, and Zhuo Feng. Sagman: Stability analysis of graph neural networks on the manifolds. arXiv preprint arXiv:2402.08653, 2024

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  34. [34]

    The structure of the token space for large language models

    Michael Robinson, Sourya Dey, and Shauna Sweet. The structure of the token space for large language models. arXiv preprint arXiv:2410.08993, 2024

    Pith/arXiv arXiv 2024

  35. [35]

    Dynamic Stochastic Decoding Strategy for Open-Domain Dialogue Generation

    Yiwei Li, Fei Mi, Yitong Li, Yasheng Wang, Bin Sun, Shaoxiong Feng, and Kan Li. Dynamic stochastic decoding strategy for open-domain dialogue generation. arXiv preprint arXiv:2406.07850, 2024

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  36. [36]

    Define: Deep factorized input word embeddings for neural sequence modeling

    Sachin Mehta, Rik Koncel-Kedziorski, Mohammad Rastegari, and Hannaneh Hajishirzi. Define: Deep factorized input word embeddings for neural sequence modeling. CoRR, 2019

    work page 2019

  37. [37]

    Learning graphs from data: A signal representation perspective

    Xiaowen Dong, Dorina Thanou, Michael Rabbat, and Pascal Frossard. Learning graphs from data: A signal representation perspective. IEEE Signal Processing Magazine, 36(3):44–63, 2019

    2019

  38. [38]

    Graph sparsification by effective resistances

    Daniel A Spielman and Nikhil Srivastava. Graph sparsification by effective resistances. In Proceedings of the fortieth annual ACM symposium on Theory of computing, pages 563–568, 2008

    work page 2008

  39. [39]

    Graph sparsification, spectral sketches, and faster resistance computation via short cycle decompositions

    Timothy Chu, Yu Gao, Richard Peng, Sushant Sachdeva, Saurabh Sawlani, and Junxing Wang. Graph sparsification, spectral sketches, and faster resistance computation via short cycle decompositions. SIAM Journal on Computing, (0):FOCS18–85, 2020

    work page 2020

  40. [40]

    Spade: A spectral method for black-box adversarial robustness evaluation

    Wuxinlin Cheng, Chenhui Deng, Zhiqiang Zhao, Yaohui Cai, Zhiru Zhang, and Zhuo Feng. Spade: A spectral method for black-box adversarial robustness evaluation. In International Conference on Machine Learning, pages 1814–1824. PMLR, 2021. 12

    work page 2021

  41. [41]

    The electrical resistance of a graph captures its commute and cover times

    Ashok K Chandra, Prabhakar Raghavan, Walter L Ruzzo, Roman Smolensky, and Prasoon Tiwari. The electrical resistance of a graph captures its commute and cover times. Computational Complexity, 6(4): 312–340, 1996

    work page 1996

  42. [42]

    Approaching optimality for solving sdd linear systems

    Ioannis Koutis, Gary L Miller, and Richard Peng. Approaching optimality for solving sdd linear systems. In Foundations of Computer Science (FOCS), 2010 51st Annual IEEE Symposium on , pages 235–244. IEEE, 2010

    work page 2010

  43. [43]

    Approximate gaussian elimination for laplacians-fast, sparse, and simple

    Rasmus Kyng and Sushant Sachdeva. Approximate gaussian elimination for laplacians-fast, sparse, and simple. In 2016 IEEE 57th Annual Symposium on Foundations of Computer Science (FOCS) , pages 573–582. IEEE, 2016

    work page 2016

  44. [44]

    Efficient and robust approximate nearest neighbor search using hierarchical navigable small world graphs

    Yu A Malkov and Dmitry A Yashunin. Efficient and robust approximate nearest neighbor search using hierarchical navigable small world graphs. IEEE transactions on pattern analysis and machine intelligence, 42(4):824–836, 2018

    2018

  45. [45]

    Simple and scalable constrained clustering: a generalized spectral method

    Mihai Cucuringu, Ioannis Koutis, Sanjay Chawla, Gary Miller, and Richard Peng. Simple and scalable constrained clustering: a generalized spectral method. In Artificial Intelligence and Statistics , pages 445–454. PMLR, 2016

    work page 2016

  46. [46]

    Graph-based clustering via group sparsity and manifold regularization

    Jianyu Miao, Tiejun Yang, Junwei Jin, and Lingfeng Niu. Graph-based clustering via group sparsity and manifold regularization. IEEE Access, 7:172123–172135, 2019

    work page 2019

  47. [47]

    Levenshtein Training for Word-level Quality Estimation

    Shuoyang Ding, Marcin Junczys-Dowmunt, Matt Post, and Philipp Koehn. Levenshtein training for word-level quality estimation. arXiv preprint arXiv:2109.05611, 2021

    work page internal anchor Pith review Pith/arXiv arXiv 2021

  48. [48]

    Towards Variable-Length Textual Adversarial Attacks

    Junliang Guo, Zhirui Zhang, Linlin Zhang, Linli Xu, Boxing Chen, Enhong Chen, and Weihua Luo. Towards variable-length textual adversarial attacks. arXiv preprint arXiv:2104.08139, 2021

    work page internal anchor Pith review Pith/arXiv arXiv 2021

  49. [49]

    Fraud’s bargain attack: Generating adversarial text samples via word manipulation process

    Mingze Ni, Zhensu Sun, and Wei Liu. Fraud’s bargain attack: Generating adversarial text samples via word manipulation process. IEEE Transactions on Knowledge and Data Engineering, 2024

    work page 2024

  50. [50]

    Perturbations in the Wild: Leveraging Human-Written Text Perturbations for Realistic Adversarial Attack and Defense

    Thai Le, Jooyoung Lee, Kevin Yen, Yifan Hu, and Dongwon Lee. Perturbations in the wild: Lever- aging human-written text perturbations for realistic adversarial attack and defense. arXiv preprint arXiv:2203.10346, 2022

    work page internal anchor Pith review Pith/arXiv arXiv 2022

  51. [51]

    Don't Retrain, Just Rewrite: Countering Adversarial Perturbations by Rewriting Text

    Ashim Gupta, Carter Wood Blum, Temma Choji, Yingjie Fei, Shalin Shah, Alakananda Vempala, and Vivek Srikumar. Don’t retrain, just rewrite: Countering adversarial perturbations by rewriting text. arXiv preprint arXiv:2305.16444, 2023

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  52. [52]

    Contrastive learning with text augmentation for text classification

    Ouyang Jia, Huimin Huang, Jiaxin Ren, Luodi Xie, and Yinyin Xiao. Contrastive learning with text augmentation for text classification. Applied Intelligence, 53(16):19522–19531, 2023

    work page 2023

  53. [53]

    spaCy: Industrial-strength Natural Language Processing in Python

    Matthew Honnibal, Ines Montani, Sofie Van Landeghem, and Adriane Boyd. spaCy: Industrial-strength Natural Language Processing in Python. 2020. doi: 10.5281/zenodo.1212303

    doi:10.5281/zenodo.1212303 2020

  54. [54]

    Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp.arXiv preprint arXiv:2005.05909, 2020

    John X Morris, Eli Lifland, Jin Yong Yoo, Jake Grigsby, Di Jin, and Yanjun Qi. Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp.arXiv preprint arXiv:2005.05909, 2020

    Pith/arXiv arXiv 2005

  55. [55]

    Bertscore: Evaluating text generation with bert

    Tianyi Zhang, Varsha Kishore, Felix Wu, Kilian Q Weinberger, and Yoav Artzi. Bertscore: Evaluating text generation with bert. arXiv preprint arXiv:1904.09675, 2019

    Pith/arXiv arXiv 1904

  56. [56]

    Reevaluating adversarial examples in natural language

    John X Morris, Eli Lifland, Jack Lanchantin, Yangfeng Ji, and Yanjun Qi. Reevaluating adversarial examples in natural language. arXiv preprint arXiv:2004.14174, 2020

    Pith/arXiv arXiv 2004

  57. [57]

    Jailbreak attacks and defenses against large language models: A survey

    Sibo Yi, Yule Liu, Zhen Sun, Tianshuo Cong, Xinlei He, Jiaxing Song, Ke Xu, and Qi Li. Jailbreak attacks and defenses against large language models: A survey. arXiv preprint arXiv:2407.04295, 2024

    Pith/arXiv arXiv 2024

  58. [58]

    Comprehensive assessment of jailbreak attacks against llms

    Junjie Chu, Yugeng Liu, Ziqing Yang, Xinyue Shen, Michael Backes, and Yang Zhang. Comprehensive assessment of jailbreak attacks against llms. arXiv preprint arXiv:2402.05668, 2024

    Pith/arXiv arXiv 2024

  59. [59]

    Autodan: Generating stealthy jailbreak prompts on aligned large language models

    Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. Autodan: Generating stealthy jailbreak prompts on aligned large language models. arXiv preprint arXiv:2310.04451, 2023

    Pith/arXiv arXiv 2023

  60. [60]

    Universal language model fine-tuning for text classification

    Jeremy Howard and Sebastian Ruder. Universal language model fine-tuning for text classification. arXiv preprint arXiv:1801.06146, 2018. 13

    Pith/arXiv arXiv 2018

  61. [61]

    Improving generalization of adversarial training via robust critical fine-tuning

    Kaijie Zhu, Xixu Hu, Jindong Wang, Xing Xie, and Ge Yang. Improving generalization of adversarial training via robust critical fine-tuning. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 4424–4434, 2023

    work page 2023

  62. [62]

    ROSE: Robust Selective Fine-tuning for Pre-trained Language Models

    Lan Jiang, Hao Zhou, Yankai Lin, Peng Li, Jie Zhou, and Rui Jiang. Rose: Robust selective fine-tuning for pre-trained language models. arXiv preprint arXiv:2210.09658, 2022

    work page internal anchor Pith review Pith/arXiv arXiv 2022

  63. [63]

    Transformers: State-of-the-art natural language processing

    Thomas Wolf. Transformers: State-of-the-art natural language processing. arXiv preprint arXiv:1910.03771, 2020

    Pith/arXiv arXiv 1910

  64. [64]

    Sentence-bert: Sentence embeddings using siamese bert-networks

    N Reimers. Sentence-bert: Sentence embeddings using siamese bert-networks. arXiv preprint arXiv:1908.10084, 2019

    Pith/arXiv arXiv 1908

  65. [65]

    Graph Sparsification by Effective Resistances

    Daniel Spielman and Nikhil Srivastava. Graph Sparsification by Effective Resistances. SIAM Journal on Computing, 40(6):1913–1926, 2011

    work page 1913

  66. [66]

    Glue: A multi-task benchmark and analysis platform for natural language understanding

    Alex Wang. Glue: A multi-task benchmark and analysis platform for natural language understanding. arXiv preprint arXiv:1804.07461, 2018

    Pith/arXiv arXiv 2018

  67. [67]

    Bert: Pre-training of deep bidirectional transformers for language understanding

    Jacob Devlin. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805, 2018

    Pith/arXiv arXiv 2018

  68. [68]

    Roberta: A robustly optimized bert pretraining approach

    Yinhan Liu. Roberta: A robustly optimized bert pretraining approach. arXiv preprint arXiv:1907.11692, 364, 2019

    Pith/arXiv arXiv 1907

  69. [69]

    Distilbert, a distilled version of bert: smaller, faster, cheaper and lighter

    V Sanh. Distilbert, a distilled version of bert: smaller, faster, cheaper and lighter. arXiv preprint arXiv:1910.01108, 2019

    Pith/arXiv arXiv 1910

  70. [70]

    Albert: A lite bert for self-supervised learning of language representations

    Zhenzhong Lan. Albert: A lite bert for self-supervised learning of language representations. arXiv preprint arXiv:1909.11942, 2019

    Pith/arXiv arXiv 1909

  71. [71]

    Language models are unsupervised multitask learners

    Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. Language models are unsupervised multitask learners. OpenAI blog, 1(8):9, 2019

    2019

  72. [72]

    Llama: Open and efficient foundation language models

    Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971, 2023

    Pith/arXiv arXiv 2023

  73. [73]

    Spectral sparsification of graphs

    Daniel A Spielman and Shang-Hua Teng. Spectral sparsification of graphs. SIAM Journal on Computing, 40(4):981–1025, 2011

    work page 2011

  74. [74]

    The electrical resistance of a graph captures its commute and cover times

    Ashok K Chandra, Prabhakar Raghavan, Walter L Ruzzo, and Roman Smolensky. The electrical resistance of a graph captures its commute and cover times. InProceedings of the twenty-first annual ACM symposium on Theory of computing, pages 574–586, 1989

    work page 1989

  75. [75]

    Effective graph resistance

    Wendy Ellens, Floske M Spieksma, Piet Van Mieghem, Almerima Jamakovic, and Robert E Kooij. Effective graph resistance. Linear algebra and its applications, 435(10):2491–2506, 2011

    work page 2011

  76. [76]

    Graph laplacians

    Bojan Mohar. Graph laplacians. Topics in algebraic graph theory, 102:113–136, 2004

    work page 2004

  77. [77]

    Resistance-distance matrix: A computational algorithm and its application

    D Babi´c, Douglas J Klein, István Lukovits, Sonja Nikoli´c, and N Trinajsti´c. Resistance-distance matrix: A computational algorithm and its application. International Journal of Quantum Chemistry, 90(1):166–176, 2002. 14 A Technical Appendices and Supplementary Material A.1 Deterministic Hidden-State Embeddings Though modern transformers can produce stoc...

    work page 2002

  78. [78]

    Writing L = P (p,q)∈E wp,q ep,q e⊤ p,q, we split F (Θ) into two terms: F (Θ) = F1(Θ) − 1 k F2(Θ), where F1(Θ) = logdet(Θ) , F 2(Θ) = Tr X ⊤Θ X

    Decomposing the Objective. Writing L = P (p,q)∈E wp,q ep,q e⊤ p,q, we split F (Θ) into two terms: F (Θ) = F1(Θ) − 1 k F2(Θ), where F1(Θ) = logdet(Θ) , F 2(Θ) = Tr X ⊤Θ X . Since Θ = L + 1 σ2 I, each edge weight wp,q appears explicitly in L

    work page

  79. [79]

    To optimize F (Θ) w.r.t

    Gradient with Respect to an Edge Weight. To optimize F (Θ) w.r.t. a single edge weight wp,q: • Term F1(Θ): Let λi be the i-th eigenvalue of L, and vi its eigenvector. Then ∂ ∂wp,q logdet(Θ) = ∂ ∂wp,q h logdet L + 1 σ2 I i . By standard matrix calculus, this derivative can be linked to the effective resistance distance deff (p, q): ∂F1 ∂wp,q ≈ deff (p, q),...

    work page

  80. [80]

    Rewriting Equation (6): deff (p, q) − 1 k 1 wp,q = 0 ⇐ ⇒deff (p, q) = 1 k 1 wp,q

    Distance Ratio and Pruning Condition. Rewriting Equation (6): deff (p, q) − 1 k 1 wp,q = 0 ⇐ ⇒deff (p, q) = 1 k 1 wp,q . Define the distance ratio for edge (p, q): ρp,q = deff (p, q) ddat(p, q) = wp,q deff (p, q) . When deff (p, q) is relatively large compared to 1 wp,q , we have ρp,q large, indicating an important edge for logdet(Θ). Conversely, if ρp,q ...

    work page

Showing first 80 references.

This paper was first reviewed by deepseek-v4-flash on August 5, 2026.