Pith. sign in

REVIEW 3 major objections 5 minor 47 references

A safety task vector, computed as the parameter difference between a guard model and its base language model, transfers guardrail behavior to Chinese, Japanese, and Korean models without any additional training or target-language labels.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-04 14:45 UTC pith:27DAYWTJ

load-bearing objection The streaming-aware prefix SFT protocol is a real contribution, but the central claim that Guard Vector composition drives the gains is unverified: there is no CP-only baseline anywhere. the 3 major comments →

arxiv 2509.23381 v2 pith:27DAYWTJ submitted 2025-09-27 cs.CL

Guard Vector: Beyond English LLM Guardrails with Task-Vector Composition and Streaming-Aware Prefix SFT

Wonhyuk Lee , Youngchol Kim , Yunjin Park , Junhyung Moon , Dongyoung Jeong , Wanjin Park This is my paper
classification cs.CL
keywords guard vectortask vector arithmeticLLM guardrailsstreaming evaluationprefix SFTcross-lingual safetysingle-token classificationmodel portability
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper tries to establish that guardrail behavior can be transferred across languages and across model families by simple parameter arithmetic. It defines a 'Guard Vector' as the parameter difference between a safety-classification model and a same-architecture pretrained base, then adds that vector to a continually pretrained model in another language to obtain a Target Guard Model. The paper reports that this composition alone improves SAFE/UNSAFE classification quality over established guard models and works for Chinese, Japanese, and Korean with no training and no labels. A second contribution trains the composed model on cumulative prefixes with a single-token classifier, which the paper claims achieves offline-streaming parity and cuts latency. A sympathetic reader would care because it offers a lightweight, public-weights route to non-English guardrails and a standardized streaming evaluation protocol.

Core claim

The central claim is that safety behavior in an LLM guardrail is carried by a parameter displacement that is modular and transferable. For each shared parameter tensor t, the Guard Vector is V[t] = theta_GM[t] - theta_PLM[t]; the Target Guard Model is theta_TGM[t] = theta_CP[t] + V[t] for t in the intersection of key sets excluding embeddings, language-model head, and LayerNorm. The paper reports that with this composition alone, TGM beats the baseline Guard Model (Llama Guard 3) on Korean benchmarks and improves F1 on Chinese, Japanese, and Korean public benchmarks by 4-7 points, and that the same procedure ports the ShieldGemma vector into a Korean Gemma model. With the addition of prefix

What carries the argument

The Guard Vector - the element-wise parameter difference between a guard model and its same-architecture pretrained language model, V_GV = theta_GM - theta_PLM - is the object that carries the argument. It is composed additively into a target-language continual-pretrained model to produce a Target Guard Model. The second mechanism is streaming-aware prefix SFT: cumulative character-level prefixes inherit the full-response label, the prefix pool is rebalanced to 1:1, and classification uses a single-token softmax over two reserved label tokens, so inference is a single forward pass. The method deliberately excludes embeddings, lm head, and LayerNorm parameters from the composition domain to a

Load-bearing premise

The load-bearing premise is that the parameter difference between a guard model and its base PLM is a modular, language-agnostic safety vector that adds cleanly into an instruction-tuned continual-pretraining model; the paper's own related-work review notes that task-vector arithmetic has mostly been demonstrated on small-to-medium models, so the transfer at 8B scale is the assumption on which the whole result rests.

What would settle it

Compose a Guard Vector extracted from an English guard model into a base (non-instructed) continual-pretraining model in a non-Latin-script language (e.g., Arabic) and evaluate on a public safety benchmark. If F1 does not exceed the baseline guard model, or if the composed model collapses to almost all-SAFE or all-UNSAFE predictions, the modular-transfer claim is undermined. A second check: replicate the language-extensibility results using a raw continual-pretraining model without instruction tuning, and compare F1 to the paper's reported gains.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Guardrails can be extended to new languages using only publicly available weights, eliminating the need for target-language safety training data in the composition step.
  • TGM (prefix SFT) achieves parity between streaming and offline classification, while full-text SFT degrades by 15-27 F1 points under streaming, implying that prefix-based training is necessary for reliable streaming deployment.
  • The single-token classifier improves throughput and reduces latency: QPS +51.5% to +100.9% and latency -34% to -50% relative to Llama Guard 3 under identical runtime settings.
  • Guard Vector composition is portable across model families: extracting from ShieldGemma/Gemma yields gains on Korean datasets, and extracting from Llama Guard 3 yields gains for Korean, Chinese, and Japanese.
  • Composition alone improves classification quality over baseline guard models, with F1 increases of up to 11.51 percentage points on Korean evaluation datasets before any fine-tuning.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The implicit claim that a single Guard Vector captures language-agnostic safety behavior is stronger than the paper's evidence: all transfer experiments use instruction-tuned continual-pretraining models, so the additive transfer may depend on the base model already having some moderation competence. A testable extension is composing the Guard Vector into a base (non-instruct) CP model and compari
  • The paper leaves open whether the Vector transfers to languages outside CJK with different scripts and risk lexicons; a plausible test on Arabic or Hindi, which share none of the CJK-adjacent training data, would clarify the generalization boundary.
  • Appendix E.4 identifies a streaming-specific fragility: classification degrades sharply when the unsafe threshold exceeds 0.5, especially under real-world SAFE-skewed traffic. An editorial extension is to calibrate tau under prefix evaluation to minimize false negatives while bounding false positives, rather than fixing tau=0.5.
  • Because two of the three Korean evaluation datasets are proprietary, independent replication hinges on the public CJK benchmarks; a public release of the proprietary harmlessness benchmark would let others verify the headline gains directly.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper introduces Guard Vector, defined as the parameter difference between a guardrail model and a same-architecture pretrained LM (Eq. 2), and composes it with a target-language continual-pretraining model to obtain a Target Guard Model (TGM, Eq. 3). The authors claim that this composition alone improves SAFE/UNSAFE classification over established guard models (Llama Guard 3, ShieldGemma) in Korean, Chinese, and Japanese, with no additional training or target-language labels. A second contribution is streaming-aware prefix SFT with a single-token classifier, which is reported to preserve offline quality under cumulative-prefix evaluation and to improve latency/throughput. Experiments use proprietary Korean datasets plus public benchmarks (Kor Ethical QA, ChineseSafe, LLM-jp Toxicity v2) and include ablations on prefix length, threshold sensitivity, quantization, and system-prompt minimization.

Significance. If the causal effect of the Guard Vector is established, the paper offers a valuable training-free recipe for non-English guardrails from public weights, together with a concrete streaming evaluation protocol. I credit the explicit Algorithm 1, the use of public model families (Llama and Gemma), the reproducibility statement, and the inclusion of threshold-sensitivity and prefix-length ablations (Appendix E.4, E.3). The demonstration that full-text SFT collapses under streaming while prefix SFT maintains parity is a useful internal control. However, the empirical identification of the Guard Vector's contribution is currently incomplete, and one comparison underlying the streaming-necessity claim is confounded. These issues are fixable with additional experiments.

major comments (3)
  1. [§5.1, Tables 2 and 3; §5.4, Table 6] No CP-only baseline is reported. Every headline comparison is TGM versus a Guard Model (LG3, ShieldGemma) or versus another TGM variant. The CP models used (e.g., Llama-VARCO-8B-Instruct, Llama-3.1-Korean-8B-Instruct, Llama3.1-8B-Chinese-Chat, Llama-3.1-Swallow-8B-Instruct-v0.3) are themselves instruction-tuned and may already possess safety-classification behavior in the target language. Without evaluating the same CP model under the identical prompt template, generation, and parsing pipeline, the F1 deltas attributed to Guard Vector composition cannot be separated from the CP model's own capability. This directly undermines the central claim that 'composition alone improves classification quality over established Guard Models.' Please add CP-only rows to Tables 2, 3, and 6, and include a negative control (e.g., a random or permuted parameter difference) to show that the specific conten
  2. [§5.3, Table 5; also relevant to §5.1] The comparison between TGM (full-text SFT) and TGM (prefix SFT) changes two variables simultaneously: the training input format (full text versus cumulative prefixes) and the inclusion of helpfulness/over-refusal training data. Table 5 explicitly labels the full-text row 'no over-refuse' and the prefix row 'with over-refuse.' The observed streaming collapse of full-text SFT could therefore be due to the absence of over-refusal training rather than to the absence of prefix-based supervision. To support the claim that 'streaming-aware training is necessary,' report a full-text SFT variant that includes the same helpfulness data, and ideally a prefix SFT variant without it. Please also clarify whether 'TGM (full-text SFT)' in Tables 2 and 3 includes helpfulness training, since the row labels in Table 5 suggest it does not.
  3. [§5.4, Table 6] The language-extensibility claim relies on a single public dataset per language and no per-language CP-only control. For Chinese, the reported absolute F1 of TGM is only 48.14, and for Japanese the improvement is 7.26pp over LG3; without knowing the CP model's own F1 under the same protocol, these numbers do not yet demonstrate that the Guard Vector transfers safety behavior rather than that the CP model contributes the language competence. The same missing-control issue as in §5.1 applies here, and it is especially important because the CP models differ across languages.
minor comments (5)
  1. [§3.2, Eq. (4)] The label-construction procedure refers to 'the first occurrence of harmful content' in a response, but the detection mechanism is not specified. Please state whether this is based on the human annotation, a classifier, or a heuristic, and report how many sequences were discarded for violating monotonicity or for lacking a harmful prefix.
  2. [Tables 2, 3, 6] No confidence intervals, standard errors, or multiple-seed results are reported. Some headline gaps (e.g., +4.09pp, +4.62pp) are small enough that variance matters; please provide at least bootstrap CIs or per-item breakdowns.
  3. [Abstract and §5.4] The abstract says 'across standard safety suites,' but much of the evidence uses proprietary in-house datasets and only one public benchmark per language. Please qualify the claim to reflect the actual coverage.
  4. [Table 5] The row labels 'TGM (full-text SFT; no over-refuse)' and 'TGM (prefix SFT; with over-refuse)' are confusing and not introduced in §4.2. Please define these variants explicitly and align them with the model list in §4.2.
  5. [Throughout] There are minor formatting issues (e.g., the title/abstract display 'GUARDVECTOR' without a space, and Table 21's caption repeats a QPS gain). A careful copyedit is needed.

Circularity Check

0 steps flagged

No circularity: the Guard Vector is a fixed algebraic transform of public weights; no evaluated quantity is reinserted as an input.

full rationale

The derivation chain is transparent and self-contained. Guard Vector is defined in Eq. (2) as V_GV[t] = θ_GM[t] − θ_PLM[t], and TGM in Eq. (3) as θ_TGM[t] = θ_CP[t] + V_GV[t]. This is a deterministic operation on public model weights; no parameter is fit to the evaluation datasets. The paper explicitly fixes τ = 0.5 and K = 100 as defaults and analyzes threshold sensitivity in Appendix E.4 and prefix-length variation in Appendix E.3, rather than tuning them to the test labels. The prefix-SFT variant is trained with ordinary cross-entropy (Eq. 6) on an independent Korean training set (App. B.2, Table 9) with labels inherited from full-text responses, and the evaluation sets (App. C.2) are disjoint from training. The paper does not invoke any uniqueness theorem or load-bearing argument that reduces to self-citation; its references to task-vector arithmetic (Ilharco et al., 2022; Huang et al., 2023) are external and used as background, not as unverified premises. The only substantive weakness in the empirical argument is the absence of a CP-model-without-Guard-Vector baseline in Tables 2, 3, and 6, so the causal contribution of the vector itself is not isolated. That is a missing control / confound, not a circularity: Eq. (3) does not by construction imply the reported F1 gains, which are measured outcomes. Therefore, under the hard rules, there is no exhibitable reduction of a claimed prediction to its own inputs, and the circularity score is 0.

Axiom & Free-Parameter Ledger

3 free parameters · 4 axioms · 0 invented entities

The method is an application of known task-vector arithmetic with hand-set streaming parameters; no new physical entities are introduced.

free parameters (3)
  • Unsafe classification threshold (τ) = 0.5
    Hand-set threshold in Eq. (7) for the single-token classifier; Appendix E.4 shows streaming performance is sensitive to it, so it is a manually chosen point rather than an optimized constant.
  • Prefix step (K) = 100 characters (K=50 in ablation)
    Chosen prefix granularity for the cumulative schedule in Eq. (4); the paper notes it is tokenizer-agnostic, but it is not derived or tuned across values.
  • Prefix-level class balance target = 1:1 SAFE/UNSAFE
    Resampling target in §3.2 and Appendix B.2 to prevent class drift from long UNSAFE responses; chosen as a simple heuristic.
axioms (4)
  • domain assumption The parameter difference θ_GM - θ_PLM encodes safety behavior that transfers additively to a different model of the same architecture.
    Imported from task-vector literature (Ilharco et al., 2022) and chat-vector (Huang et al., 2023); used in Eq. (3) without a safety-specific validation of transfer.
  • domain assumption All models share the same architecture and exact tensor shapes for channels in S; embeddings, lm head, and LayerNorm are excluded as unsafe to compose.
    Eq. (1); relies on prior observations that LayerNorm is sensitive (Xiong et al., 2020) and that shape equality is required for parameter addition.
  • ad hoc to paper Harmful content in a response is monotone: SAFE prefixes precede the first harmful prefix, then all later prefixes are UNSAFE; non-monotone cases are discarded.
    §3.2: 'We discard sequences that violate monotonicity (e.g., SAFE→UNSAFE→SAFE)' - filters training data to a pattern that may not hold in production streaming content.
  • ad hoc to paper The cumulative prefix schedule K(r)={100,200,...,L} approximates real streaming conditions.
    Chosen for tokenizer-agnostic simplicity in §3.2; only K=50 is tested as an ablation, so the schedule is a design assumption.

pith-pipeline@v1.3.0-alltime-deepseek · 22221 in / 17035 out tokens · 123937 ms · 2026-08-04T14:45:32.494952+00:00 · methodology

0 comments
read the original abstract

We introduce Guard Vector, a safety task vector computed as the parameter difference between a guardrail model (Guard Model) and a same-architecture pretrained language model. Composing this vector with a target language model yields a Target Guard Model (TGM). We then adapt TGM with a streaming-aware approach that combines prefix-based training and evaluation with a classifier that produces a single-token output. With this composition alone, TGM improves classification quality over established Guard Models across standard safety suites and enables language extensibility to Chinese, Japanese, and Korean, requiring neither additional training nor target language labels for this composition step. It also demonstrates model portability across two widely used public guardrail backbones, Llama and Gemma. With prefix SFT (supervised fine-tuning), TGM preserves classification quality under streaming by aligning the behavior between prefix inputs and full-text inputs. The single-token output design increases throughput and reduces latency. Together, these components reduce data and compute requirements while promoting streaming-aware evaluation practices, thereby contributing to a more responsible AI ecosystem.

Figures

Figures reproduced from arXiv: 2509.23381 by DongYoung Jeong, Junhyung Moon, Wanjin Park, Wonhyuk Lee, Youngchol Kim, Yunjin Park.

Figure 1
Figure 1. Figure 1: Pipeline of task-vector composition and streaming adaptation. A [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Harmlessness Evaluation Dataset: Threshold-dependent classification metrics (F1, Pre [PITH_FULL_IMAGE:figures/full_fig_p025_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Kor Ethical QA: Threshold-dependent classification metrics (F1, Precision, Recall, FNR, [PITH_FULL_IMAGE:figures/full_fig_p025_3.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

47 extracted references · 25 linked inside Pith

  1. [1]

    Llm-jp toxicity dataset v2

    Akiko Aizawa et al. Llm-jp toxicity dataset v2. GitLab dataset, 2024. URL https://gitlab.llm-jp.nii.ac.jp/datasets/llm-jp-toxicity-dataset-v2. 3,847 items; License: CC-BY-SA-4.0

    2024

  2. [2]

    Constitutional ai: Harmlessness from ai feedback

    Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, Jackson Kernion, Andy Jones, Anna Chen, Anna Goldie, Azalia Mirhoseini, Cameron McKinnon, et al. Constitutional ai: Harmlessness from ai feedback. arXiv preprint arXiv:2212.08073, 2022

    Pith/arXiv arXiv 2022

  3. [3]

    No language left behind: Scaling human-centered machine translation

    Marta R Costa-Juss \`a , James Cross, Onur C elebi, Maha Elbayad, Kenneth Heafield, Kevin Heffernan, Elahe Kalbassi, Janice Lam, Daniel Licht, Jean Maillard, et al. No language left behind: Scaling human-centered machine translation. arXiv preprint arXiv:2207.04672, 2022

    Pith/arXiv arXiv 2022

  4. [4]

    Gptq: Accurate post-training quantization for generative pre-trained transformers

    Elias Frantar, Saleh Ashkboos, Torsten Hoefler, and Dan Alistarh. Gptq: Accurate post-training quantization for generative pre-trained transformers. arXiv preprint arXiv:2210.17323, 2022

    Pith/arXiv arXiv 2022

  5. [5]

    Continual pre-training for cross-lingual llm adaptation: Enhancing japanese language capabilities

    Kazuki Fujii, Taishi Nakamura, Mengsay Loem, Hiroki Iida, Masanari Ohi, Kakeru Hattori, Hirai Shota, Sakae Mizuki, Rio Yokota, and Naoaki Okazaki. Continual pre-training for cross-lingual llm adaptation: Enhancing japanese language capabilities. In Proceedings of the First Conference on Language Modeling, COLM, pp.\ (to appear), University of Pennsylvania...

    2024

  6. [6]

    AEGIS 2.0: A diverse AI safety dataset and risks taxonomy for alignment of LLM guardrails

    Shaona Ghosh, Prasoon Varshney, Makesh Narsimhan Sreedhar, Aishwarya Padmakumar, Traian Rebedea, Jibin Rajan Varghese, and Christopher Parisien. AEGIS 2.0: A diverse AI safety dataset and risks taxonomy for alignment of LLM guardrails. In Luis Chiruzzo, Alan Ritter, and Lu Wang (eds.), Proceedings of the 2025 Conference of the Nations of the Americas Chap...

    2025

  7. [7]

    Lm-infinite: Zero-shot extreme length generalization for large language models

    Chi Han, Qifan Wang, Hao Peng, Wenhan Xiong, Yu Chen, Heng Ji, and Sinong Wang. Lm-infinite: Zero-shot extreme length generalization for large language models. arXiv preprint arXiv:2308.16137, 2023

    Pith/arXiv arXiv 2023

  8. [8]

    Wildguard: Open one-stop moderation tools for safety risks, jailbreaks, and refusals of llms, 2024

    Seungju Han, Kavel Rao, Allyson Ettinger, Liwei Jiang, Bill Yuchen Lin, Nathan Lambert, Yejin Choi, and Nouha Dziri. Wildguard: Open one-stop moderation tools for safety risks, jailbreaks, and refusals of llms, 2024. URL https://arxiv.org/abs/2406.18495

    Pith/arXiv arXiv 2024

  9. [9]

    Chat vector: A simple approach to equip llms with instruction following and model alignment in new languages

    Shih-Cheng Huang, Pin-Zu Li, Yu-Chi Hsu, Kuang-Ming Chen, Yu Tung Lin, Shih-Kai Hsiao, Richard Tzong-Han Tsai, and Hung-yi Lee. Chat vector: A simple approach to equip llms with instruction following and model alignment in new languages. arXiv preprint arXiv:2310.04799, 2023

    Pith/arXiv arXiv 2023

  10. [10]

    Gpt-4o system card

    Aaron Hurst, Adam Lerer, Adam P Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Ostrow, Akila Welihinda, Alan Hayes, Alec Radford, et al. Gpt-4o system card. arXiv preprint arXiv:2410.21276, 2024

    Pith/arXiv arXiv 2024

  11. [11]

    Wildguardmix-test-ko dataset

    iknow lab. Wildguardmix-test-ko dataset. https://huggingface.co/datasets/iknow-lab/wildguardmix-test-ko, 2024. Evaluation dataset for safety alignment in Korean

    2024

  12. [12]

    Editing models with task arithmetic

    Gabriel Ilharco, Marco Tulio Ribeiro, Mitchell Wortsman, Suchin Gururangan, Ludwig Schmidt, Hannaneh Hajishirzi, and Ali Farhadi. Editing models with task arithmetic. arXiv preprint arXiv:2212.04089, 2022

    Pith/arXiv arXiv 2022

  13. [13]

    Openai o1 system card

    Aaron Jaech, Adam Kalai, Adam Lerer, Adam Richardson, Ahmed El-Kishky, Aiden Low, Alec Helyar, Aleksander Madry, Alex Beutel, Alex Carney, et al. Openai o1 system card. arXiv preprint arXiv:2412.16720, 2024

    Pith/arXiv arXiv 2024

  14. [14]

    The llama 3 herd of models, 2024

    AI @ Meta Llama Team. The llama 3 herd of models, 2024. URL https://arxiv.org/abs/2407.21783

    Pith/arXiv arXiv 2024

  15. [15]

    Llama-guard-4-12b

    AI @ Meta Llama Team. Llama-guard-4-12b. Hugging Face model card, April 2025. URL https://huggingface.co/meta-llama/Llama-Guard-4-12B. Llama 4 Community License effective date: 2025-04-05. 12 B dense multimodal safety classifier (text + image) for prompt/response filtering

    2025

  16. [16]

    Decoupled weight decay regularization

    Ilya Loshchilov and Frank Hutter. Decoupled weight decay regularization. arXiv preprint arXiv:1711.05101, 2017

    Pith/arXiv arXiv 2017

  17. [17]

    A holistic approach to undesired content detection

    Todor Markov, Chong Zhang, Sandhini Agarwal, Tyna Eloundou, Teddy Lee, Steven Adler, Angela Jiang, and Lilian Weng. A holistic approach to undesired content detection. arXiv preprint arXiv:2208.03274, 2022

    Pith/arXiv arXiv 2022

  18. [18]

    Augmented language models: a survey

    Gr \'e goire Mialon, Roberto Dess \` , Maria Lomeli, Christoforos Nalmpantis, Ram Pasunuru, Roberta Raileanu, Baptiste Rozi \`e re, Timo Schick, Jane Dwivedi-Yu, Asli Celikyilmaz, et al. Augmented language models: a survey. arXiv preprint arXiv:2302.07842, 2023

    Pith/arXiv arXiv 2023

  19. [19]

    Content filtering overview

    Microsoft. Content filtering overview. Microsoft Learn, July 2025. URL https://learn.microsoft.com/en-us/azure/ai-foundry/openai/concepts/content-filter. Microsoft Learn documentation; last updated 2025-07-02

    2025

  20. [20]

    kor\_ethical\_question\_answer

    MrBananaHuman. kor\_ethical\_question\_answer. Hugging Face dataset, 2024. URL https://huggingface.co/datasets/MrBananaHuman/kor_ethical_question_answer. 29,146 items; License: CC-BY-NC-ND-4.0

    2024

  21. [21]

    Leave no context behind: Efficient infinite context transformers with infini-attention

    Tsendsuren Munkhdalai, Manaal Faruqui, and Siddharth Gopal. Leave no context behind: Efficient infinite context transformers with infini-attention. arXiv preprint arXiv:2404.07143, 101, 2024

    Pith/arXiv arXiv 2024

  22. [22]

    llama3-instructrans-enko-8b, 2024

    Yohan Na. llama3-instructrans-enko-8b, 2024. URL https://huggingface.co/nayohan/llama3-instrucTrans-enko-8b

    2024

  23. [23]

    Llama-varco-8b-instruct

    NCSoft. Llama-varco-8b-instruct. https://huggingface.co/NCSOFT/Llama-VARCO-8B-Instruct, 2024. License: LLAMA-3.1 Community License Agreement; Base: Meta-Llama-3.1-8B; optimized for Korean (SFT + DPO)

    2024

  24. [24]

    Configuration guide — nvidia nemo guardrails (streaming fields)

    NVIDIA . Configuration guide — nvidia nemo guardrails (streaming fields). NVIDIA Docs, July 2025 a . URL https://docs.nvidia.com/nemo/guardrails/latest/user-guides/configuration-guide.html. Accessed 2025-09-05

    2025

  25. [25]

    Streaming — nvidia nemo guardrails (user guide)

    NVIDIA . Streaming — nvidia nemo guardrails (user guide). NVIDIA Docs, July 2025 b . URL https://docs.nvidia.com/nemo/guardrails/latest/user-guides/advanced/streaming.html. Accessed 2025-09-05

    2025

  26. [26]

    Openai preparedness framework, 2023

    OpenAI. Openai preparedness framework, 2023. URL https://openai.com/research/preparedness-framework. Accessed: 2025-08-12

    2023

  27. [27]

    Gpt-5 system card, 2025

    OpenAI. Gpt-5 system card, 2025. URL https://cdn.openai.com/gpt-5-system-card.pdf. Accessed: 2025-08-29

    2025

  28. [28]

    Tool learning with large language models: A survey

    Changle Qu, Sunhao Dai, Xiaochi Wei, Hengyi Cai, Shuaiqiang Wang, Dawei Yin, Jun Xu, and Ji-Rong Wen. Tool learning with large language models: A survey. Frontiers of Computer Science, 19 0 (8): 0 198343, 2025

    2025

  29. [29]

    Xstest: A test suite for identifying exaggerated safety behaviours in large language models

    Paul R \"o ttger, Hannah Rose Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. Xstest: A test suite for identifying exaggerated safety behaviours in large language models. arXiv preprint arXiv:2308.01263, 2023

    Pith/arXiv arXiv 2023

  30. [30]

    Llama-3.1-korean-8b-instruct

    sh2orc. Llama-3.1-korean-8b-instruct. Hugging Face, 2024. URL https://huggingface.co/sh2orc/Llama-3.1-Korean-8B-Instruct

    2024

  31. [31]

    Bias vector: Mitigating biases in language models with task arithmetic approach

    Daiki Shirafuji, Makoto Takenaka, and Shinya Taguchi. Bias vector: Mitigating biases in language models with task arithmetic approach. arXiv preprint arXiv:2412.11679, 2024

    Pith/arXiv arXiv 2024

  32. [32]

    Gemma 2: Improving open language models at a practical size

    Gemma Team, Morgane Riviere, Shreya Pathak, Pier Giuseppe Sessa, Cassidy Hardin, Surya Bhupatiraju, L \'e onard Hussenot, Thomas Mesnard, Bobak Shahriari, Alexandre Ram \'e , et al. Gemma 2: Improving open language models at a practical size. arXiv preprint arXiv:2408.00118, 2024

    Pith/arXiv arXiv 2024

  33. [33]

    Kanana safeguard, May 2025

    Kanana Safeguard Team. Kanana safeguard, May 2025. URL https://tech.kakao.com/posts/705

    2025

  34. [34]

    ko-gemma-2-9b-it, 2024

    Return Zero Team. ko-gemma-2-9b-it, 2024. URL https://huggingface.co/rtzr/ko-gemma-2-9b-it

    2024

  35. [35]

    Introducing v0

    Bertie Vidgen, Adarsh Agrawal, Ahmed M Ahmed, Victor Akinwande, Namir Al-Nuaimi, Najla Alfaraj, Elie Alhajjar, Lora Aroyo, Trupti Bavalatti, Max Bartolo, et al. Introducing v0. 5 of the ai safety benchmark from mlcommons. arXiv preprint arXiv:2404.12241, 2024

    Pith/arXiv arXiv 2024

  36. [36]

    Llama3.1-8b-chinese-chat, 2024

    Shenzhi Wang, Yaowei Zheng, Guoyin Wang, Shiji Song, and Gao Huang. Llama3.1-8b-chinese-chat, 2024. URL https://huggingface.co/shenzhi-wang/Llama3.1-8B-Chinese-Chat

    2024

  37. [37]

    Ethical and social risks of harm from language models

    Laura Weidinger, John Mellor, Maribeth Rauh, Conor Griffin, Jonathan Uesato, Po-Sen Huang, Myra Cheng, Mia Glaese, Borja Balle, Atoosa Kasirzadeh, et al. Ethical and social risks of harm from language models. arXiv preprint arXiv:2112.04359, 2021

    Pith/arXiv arXiv 2021

  38. [38]

    Efficient streaming language models with attention sinks

    Guangxuan Xiao, Yuandong Tian, Beidi Chen, Song Han, and Mike Lewis. Efficient streaming language models with attention sinks. arXiv preprint arXiv:2309.17453, 2023

    Pith/arXiv arXiv 2023

  39. [39]

    On layer normalization in the transformer architecture

    Ruibin Xiong et al. On layer normalization in the transformer architecture. In ICML, 2020. URL https://arxiv.org/pdf/2002.04745

    Pith/arXiv arXiv 2020

  40. [40]

    Ties-merging: Resolving interference when merging models

    Prateek Yadav, Derek Tam, Leshem Choshen, Colin Raffel, and Mohit Bansal. Ties-merging: Resolving interference when merging models. In NeurIPS, 2023. URL https://arxiv.org/abs/2306.01708

    Pith/arXiv arXiv 2023

  41. [41]

    Shieldgemma: Generative ai content moderation based on gemma

    Wenjun Zeng, Yuchi Liu, Ryan Mullins, Ludovic Peran, Joe Fernandez, Hamza Harkous, Karthik Narasimhan, Drew Proud, Piyush Kumar, Bhaktipriya Radharapu, et al. Shieldgemma: Generative ai content moderation based on gemma. arXiv preprint arXiv:2407.21772, 2024 a

    Pith/arXiv arXiv 2024

  42. [42]

    Ai risk categorization decoded (air 2024): From government regulations to corporate policies

    Yi Zeng, Kevin Klyman, Andy Zhou, Yu Yang, Minzhou Pan, Ruoxi Jia, Dawn Song, Percy Liang, and Bo Li. Ai risk categorization decoded (air 2024): From government regulations to corporate policies. arXiv preprint arXiv:2406.17864, 2024 b

    Pith/arXiv arXiv 2024

  43. [43]

    Chinesesafe: A chinese benchmark for evaluating safety in large language models

    Hengxiang Zhang, Hongfu Gao, Qiang Hu, Guanhua Chen, Lili Yang, Bingyi Jing, Hongxin Wei, Bing Wang, Haifeng Bai, and Lei Yang. Chinesesafe: A chinese benchmark for evaluating safety in large language models. arXiv preprint arXiv:2410.18491, 2024

    Pith/arXiv arXiv 2024

  44. [44]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

  45. [45]

    @esa (Ref

    \@ifxundefined[1] #1\@undefined \@firstoftwo \@secondoftwo \@ifnum[1] #1 \@firstoftwo \@secondoftwo \@ifx[1] #1 \@firstoftwo \@secondoftwo [2] @ #1 \@temptokena #2 #1 @ \@temptokena \@ifclassloaded agu2001 natbib The agu2001 class already includes natbib coding, so you should not add it explicitly Type <Return> for now, but then later remove the command n...

  46. [46]

    \@lbibitem[] @bibitem@first@sw\@secondoftwo \@lbibitem[#1]#2 \@extra@b@citeb \@ifundefined br@#2\@extra@b@citeb \@namedef br@#2 \@nameuse br@#2\@extra@b@citeb \@ifundefined b@#2\@extra@b@citeb @num @parse #2 @tmp #1 NAT@b@open@#2 NAT@b@shut@#2 \@ifnum @merge>\@ne @bibitem@first@sw \@firstoftwo \@ifundefined NAT@b*@#2 \@firstoftwo @num @NAT@ctr \@secondoft...

  47. [47]

    @open @close @open @close and [1] URL: #1 \@ifundefined chapter * \@mkboth \@ifxundefined @sectionbib * \@mkboth * \@mkboth\@gobbletwo \@ifclassloaded amsart * \@ifclassloaded amsbook * \@ifxundefined @heading @heading NAT@ctr thebibliography [1] @ \@biblabel @NAT@ctr \@bibsetup #1 @NAT@ctr @ @openbib .11em \@plus.33em \@minus.07em 4000 4000 `\.\@m @bibit...