Pith. sign in

REVIEW 3 major objections 5 minor 32 references

The paper claims that for Bayes-filtered transformers, prompt elicitation can be done without backpropagation by optimizing a tilted latent posterior and estimating the gradient from prior samples alone.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 14:17 UTC pith:O7GMQNXT

load-bearing objection Solid new method for backprop-free elicitation in Bayes-filtered transformers, honestly evaluated; the abstract overclaims the theoretical link between the surrogate and the actual objective. the 3 major comments →

arxiv 2607.18804 v1 pith:O7GMQNXT submitted 2026-07-21 cs.LG stat.ML

Elicitation without Backpropagation: Steering Model Behavior by Optimizing the Latent Posterior

Garrett Baker , Vinayak Pathak , Daniel Murfet , Susan Wei This is my paper
classification cs.LG stat.ML MSC 68T0762F1560G09
keywords elicitationBayes-filtered transformerslatent posteriorprompt tuningimportance samplingpredictive Monte Carloprefix tuningin-context learning
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Posterior Prefix Tuning (PPT) is a new method for eliciting behavior from transformers. The paper establishes that for Bayes-filtered transformers (BFTs) — models meta-learned on hierarchical Bayesian data — the expected utility of a prompt's continuations factors through the latent posterior over predictive models. Because of this factorization, the gradient of the elicitation objective can be estimated by importance sampling against a fixed set of latent-prior samples drawn once via predictive Monte Carlo. The optimization therefore performs no transformer forward passes and no backpropagation after the samples are drawn, and those samples are utility-independent, so any number of utility functions can be tested at negligible marginal cost. If the method holds up beyond stylized settings, it offers a backprop-free, API-only route to prompt search for safety evaluation.

Core claim

For a Bayes-filtered transformer, the next-token distribution is (by construction of the training data) a Bayes mixture: πθ(y|y1:n)=∫ k~(y|y1:n)Π(dk~|y1:n). Under this factorization, the elicitation objective J(z1:m) equals ∫ µ(k~;z1:m)Π(dk~|z1:m), a posterior expectation. PPT replaces direct search over hard prompts by optimizing a continuous kernel κ over prompt distributions, tilting the prior by a compatibility factor W(k~;κ) and maximizing the surrogate Jtilt(κ). The gradient of Jtilt is a covariance plus an expectation under the tilted posterior; both are estimated by self-normalized importance sampling using L latent-prior samples drawn once from the BFT via predictive Monte Carlo. Be

What carries the argument

The load-bearing object is the latent-posterior factorization (4): the transformer's one-step predictive distribution is a Bayes mixture over latent predictive kernels, πθ(y|y1:n)=∫ k~(y|y1:n)Π(dk~|y1:n), with posterior Π(dk~|y1:n)∝∏_{i=1}^n k~(yi|y1:i-1)Π0(dk~). PPT also uses the tilt factor W(k~;κ), the probability that a latent kernel assigns to a prompt drawn from the prompt kernel κ; reweighting the prior by W yields the tilted posterior, and the surrogate objective Jtilt is a posterior expectation under the tilt. The gradient of Jtilt splits into a covariance term and an expectation term; both are estimated by self-normalized importance sampling from prior samples obtained once by pred

Load-bearing premise

The central premise is that the trained transformer's next-token distribution is a faithful Bayes mixture over latent predictive models, so the latent prior sampled by predictive Monte Carlo is the model's true prior and the tilted-posterior objective tracks the real elicitation objective; the paper only establishes this approximation in small binary-alphabet BFTs.

What would settle it

Train a BFT on a k-Markov exchangeable process and compare the PMC-sampled latent prior against the known training prior Π0 (e.g., Kolmogorov–Smirnov distance on the Beta(1/2,1/2) marginals); if the distance is large relative to the sampling error, the factorization the method relies on fails for trained models. Alternatively, enumerate all prompts on a slightly larger setting (|Y|=3, m=4) and check whether the PPT-optimized prompt is within rank 1 of the true optimum; a systematic miss there would indicate the surrogate objective has drifted from the actual goal.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • PPT and PPT-RB provide a prompt-elicitation method whose optimization cost is independent of the number of utility functions: one set of PMC prior samples is reused across all utilities, with each additional utility adding negligible marginal cost.
  • Because the gradient estimator uses only forward passes (for PMC sampling) and no backpropagation through the transformer, the method is compatible with API-only access to the model.
  • The Rao–Blackwellized variant PPT-RB achieves lower gradient-estimator variance than PPT whenever the per-latent utility has a closed form, and in the experiments it is the only method that reaches the enumerated optimum for Dyck validity on the reinforced urn at prompt length 6.
  • On the reinforced urn, PPT variants substantially outperform the gradient-guided hard-prompt baseline GCG on reverse cross-entropy at both prompt lengths and on frequency match at m=6, suggesting the latent-posterior route can beat direct discrete search in settings where the factorization holds.
  • Effectively, for BFTs the elicitation problem reduces to learning a tilt of the latent prior — a shift of belief mass toward kernels with high expected utility — rather than a search over token strings.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the latent-posterior factorization holds approximately in real (non-BFT) transformers, the same tilting trick could provide a backprop-free prompt search for safety testing, but the reliability would hinge on how well the model's implied prior matches its actual predictive distribution — something the paper only controls in stylized settings.
  • The method's dependency on a finite-dimensional k-Markov latent class is a real constraint; extending PPT to latent classes without a finite sufficient statistic (or to hierarchical latents) would be the natural next experiment to test the approach's scope.
  • The reported ESS collapse at m=50 for Dyck validity on the reinforced urn suggests the tilted posterior drifts far from the prior as the prompt grows; a future variant with a proposal distribution closer to the tilted posterior (or with periodic resampling from the BFT) might improve reliability for longer prompts.
  • One could test the method's dependence on the exact factorization by deliberately corrupting the training prior (e.g., training on Beta(2,2) while using Beta(1/2,1/2) for PMC); if PPT still recovers near-optimal prompts, the factorization is not the only operative mechanism.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper introduces Posterior Prefix Tuning (PPT), a method for prompt elicitation in Bayes-filtered transformers (BFTs). Under the latent-posterior factorization (4), the elicitation objective J(z) is expressed as a posterior expectation in (5). PPT optimizes a surrogate Jtilt over the parameters of a prompt-sampling kernel κ, using a tilted posterior Πtilt and a marginalized utility. The gradient of Jtilt is derived in score-function form (Eqs. (6), (10), (16)) and estimated by importance sampling from prior samples obtained once via predictive Monte Carlo (PMC), so optimization makes no transformer calls and no backpropagates through the transformer. Two BFTs are studied: a Beta–Bernoulli (k=0) model and a 1-Markov exchangeable reinforced-urn (k=1) model. Experiments cover reverse cross-entropy, frequency matching, and Dyck validity at prompt lengths m=6 and m=50, with exact enumeration of all 64 prompts for m=6. Comparisons with GCG are mixed: PPT variants excel on several reinforced-urn settings, while GCG is stronger on Beta–Bernoulli frequency matching at m=50 and on reinforced-urn Dyck validity at m=50.

Significance. If the method's central claim is correct, PPT provides an attractive combination of properties: no transformer backpropagation during optimization, utility-amortized elicitation from a single batch of PMC prior samples, and exact validation against exhaustive enumeration in small prompt spaces. The paper also contains genuinely useful technical contributions: closed-form Rao–Blackwellized utility evaluations, a careful matrix-power expression for the tilt factor, exact m=6 gold-standard evaluation, and a clean variance-reduction argument in Appendix B.3. The empirical failures on some configurations are honestly reported. However, the central theoretical bridge between the surrogate Jtilt and the actual elicitation objective J is not established, and the paper's abstract and introduction state the claim more strongly than the derivations support. The strength of the empirical evidence is also uneven: in several cells all methods reach the optimum, so the method's advantage is concentrated in a subset of the benchmark; the reinforced-urn Dyck m=50 result is a substantial counterexample to the surrogate's reliability. Overall the work is promising and largely well executed, but the l

major comments (3)
  1. [Table 10, Section 4.3] The central claim concerns the elicitation objective J in Eq. (1), but the optimization is performed on the surrogate Jtilt defined in Table 1. Jtilt averages the utility over prompts sampled from κ and conditions on the tilted posterior Πtilt, whereas J conditions on a single hard prompt z. No theorem, proposition, or bound relates argmax Jtilt (or the recovered prompt) to argmax J. The gradient in Eq. (6) is the gradient of Jtilt, not of J. This is not a cosmetic issue: the abstract says 'the gradient of this objective can be estimated from samples of the prior alone,' but the derivations support only the gradient of the surrogate. The experiments illustrate the gap: on reinforced-urn Dyck validity at m=50 (Table 10), all PPT variants achieve J≈0.01–0.02 while GCG achieves J=0.61, and the analytic variants that use exact prior samples fail identically, so the failure cannot be attribut
  2. [Section 3; Appendix B.6] The hard-prompt snapping step is itself an unverified heuristic. For k=0, the prompt is chosen by rounding the optimized α; for k≥1, an Eulerian path on a de Bruijn graph with rounded edge multiplicities is used, with single-edge swaps as fallback. The Limitations section candidly notes that the recovered prompt is not established to be optimal among those consistent with κ, but the issue is more basic: even if the continuous maximization of Jtilt were successful, the map from an optimized kernel to a hard prompt is not shown to preserve high Jtilt or high J. Since the method is advertised as solving the elicitation problem for hard prompts, the paper needs at least a formal consistency statement (e.g., as m grows or under a concentration condition) or an empirical analysis of the snapping loss against the exact m=6 enumeration. Currently the snapping procedure is a source of uncontrolle
  3. [Section 2.2, Appendix B.1] The method's validity depends on the trained transformer satisfying the latent-posterior factorization (4), and specifically on the PMC samples being draws from the BFT's implied prior. The paper states the idealized BFT satisfies (4) and a trained BFT 'only approximates' it, but no quantitative diagnostic is reported for how well the trained models satisfy (4). Figure 2 validates that PMC marginal densities match the analytic prior, but this is a lower-dimensional check; it does not establish that the posterior predictive πθ(· | y1:n) equals the Bayesian PPD for the contexts used in elicitation. Given that the central mechanism interprets the latent posterior as the object being steered, I would like to see a direct comparison, e.g., KL divergence or total variation between the trained one-step predictor and the exact PPD across sampled contexts, for both BFTs. Without this, the experim
minor comments (5)
  1. [Table 2 caption] 'Best method per min bold' appears to be a typo for 'per row' or 'per column.' Please clarify which grouping is used for bolding.
  2. [Section 3.2, Eq. (16)] The notation for the covariance term in Eq. (16) is slightly ambiguous: the covariance is over ˜Q∼Πtilt, but the integrand ¯µ also depends on (A,ρ). Spelling out that the covariance is taken with respect to Πtilt while holding (A,ρ) fixed would improve readability.
  3. [Appendix B.5] The ρ-gradient in Eq. (24) is derived with the importance weights frozen. This is clearly stated, but the potential inconsistency with the joint ascent of A and ρ is only briefly justified. A sentence explaining why this partial-gradient approximation is not expected to bias the final optimum (or an experiment comparing with full reweighting) would strengthen the presentation.
  4. [Section 4.2] The claim that GCG 'backpropagates through the transformer at every step' is accurate, but the comparison is asymmetric in another way: PPT uses L=5000 PMC rollouts of length R=2000 as a one-time cost, which is substantial. It would be helpful to state the wall-clock time or total transformer forward passes for both methods in the main text, not just in the appendix.
  5. [Appendix E.2, Tables 13–15] Several ESS/L values are extremely small (e.g., 0.02–0.03 for reinforced-urn m=50 configurations). The text reports means and ranges but does not discuss the practical reliability of the IS gradient estimate at such low ESS. A brief comment on whether these low-ESS runs correspond to the worst-performing cells would be useful.

Circularity Check

1 steps flagged

No significant circularity: evaluation is exact enumeration of J, PMC prior sampling is internally validated against analytic priors; only a minor non-decisive self-citation to coauthor-overlapping prior work.

specific steps
  1. other [Section 3 (PMC prior samples); Appendix B.1; Related Works]
    "These prior samples come from predictive Monte Carlo (PMC), an instance of predictive Bayesian inference via martingale posteriors [Fong et al., 2023], applied to BFTs by Effiezal Aswadi et al. [2026]... Effiezal Aswadi et al. [2026] review such sufficient conditions and show empirically that, for BFTs of the kind used here, PMC recovers both the implied prior and posterior; in this paper we use only prior samples."

    PMC for BFTs—the mechanism producing the load-bearing prior samples—is attributed to Effiezal Aswadi et al. [2026], which shares coauthor Susan Wei, and its sufficient conditions are deferred to that citation. If that were the only support, the premise would reduce to self-citation. But the paper independently re-derives PMC (Appendix B.1) and validates it against the analytic prior (Figure 2: 'PPD PMC' vs 'BFT PMC' vs 'Analytic prior'), and the (ANALYTIC) baselines (Section 4.2) isolate PMC error by sampling the closed-form Π0 directly. Final scores are exact enumerations of J through πθ, independent of the surrogate and the samples. The self-citation is therefore corroborated internally and is not decisive: a minor flag, not a reduction of the central claim to its inputs. The BFT framing

full rationale

The derivation chain is essentially self-contained and non-circular. The factorization (5) is an exact tower-property identity for an idealized BFT under (4); the IS estimators (11)/(22) are standard self-normalized importance-sampling covariance estimators whose unbiasedness does not presuppose the result; and the reported J values come from exact enumeration through πθ over all |Y|^N=16 continuations, with all 64 prompts enumerated at m=6 to obtain the true optimum and ranks. Nothing is fitted to those reported values: the PMC prior samples are utility-independent and drawn once, and the (ANALYTIC) variants isolate PMC error by sampling the analytic prior directly. The skeptic's central concern—the surrogate Jtilt (Table 1, Eq. 6) is never shown to track the true objective J (Eq. 1), and the abstract's 'gradient of this objective' is strictly ∇Jtilt—is a substantive correctness risk, not a circularity: no equation identifies Jtilt with J by construction, and the method demonstrably fails on some configurations (Dyck, reinforced urn, m=50: J≈0.01–0.02 vs GCG 0.61), which a circular 'prediction' could not exhibit. The paper's own Limitations (approximation of (4); hard-prompt recovery not proven optimal) and Appendix B.5's candid admission that the ρ-update freezes the importance weights (a partial gradient) are acknowledged correctness caveats, weighed here as non-circular. The only mild circularity-adjacent feature is the self-citation noted above, which is internally corroborated and therefore not load-bearing; score 2.

Axiom & Free-Parameter Ledger

6 free parameters · 5 axioms · 0 invented entities

No new physical entities are posited. The tilted posterior and surrogate objective are mathematical constructions specific to this paper, but they are not external 'graviton-style' additions; they are functions defined from the existing latent posterior model. The key unrecognized cost is the ad hoc surrogacy of Jtilt and the heuristic hard-prompt snapping, both of which are axioms rather than derived facts.

free parameters (6)
  • PMC sample count L = 5000
    Number of latent prior samples; importance-weight variance and optimization quality depend on it. Chosen by hand, not justified by a convergence criterion.
  • PMC rollout length R = 2000
    Controls finite-rollout counting error in recovering the latent prior. Chosen by hand.
  • Optimizer learning rate η = 0.1
    Step size for simplex-projected gradient descent on A and ρ; fixed by hand.
  • BFT prior hyperparameters = Beta(1/2,1/2), Dir(1/2,1/2), urn α=1
    Chosen to give closed-form posteriors and to match prior BFT literature; experimental inputs, not fitted to data.
  • Continuation horizon N and prompt lengths m = N=4; m∈{6,50}
    N=4 makes enumeration of all 16 continuations tractable; m=6 makes full prompt enumeration of 64 prompts possible. Chosen by hand.
  • Early stopping and GCG iteration counts = 1e-5/100 steps; max(10,2m)
    Optimization termination criteria for PPT and GCG; chosen by hand without sensitivity analysis.
axioms (5)
  • domain assumption A trained BFT satisfies the latent-posterior factorization πθ(y|y1:n) = ∫ k̃(y|y1:n) Π(dk̃|y1:n) (Eq. 4).
    This is the load-bearing premise: the whole method works in latent-posterior space. The paper's Limitations state it holds exactly only for the idealized BFT and approximately for trained models.
  • domain assumption Predictive Monte Carlo rollouts from the trained BFT produce samples from its implied latent prior, approximately matching Π0.
    Appendix B.1 relies on Fong et al. and Effiezal Aswadi et al.; the paper validates against analytic priors in Figure 2, but for the trained BFT this is only empirical.
  • ad hoc to paper The tilted surrogate Jtilt(κ) is a faithful proxy for the true elicitation objective J(z) at the recovered hard prompt.
    No equality, bound, or consistency result connects Jtilt to J. This is the main theoretical gap; the method is validated only empirically and fails in several settings.
  • ad hoc to paper The hard-prompt snapping procedure (rounding or Eulerian path) gives a prompt whose J is close to the optimized Jtilt.
    Appendix B.6 describes the heuristic; the paper concedes it does not establish optimality of the recovered prompt among those consistent with κ.
  • standard math Exchangeability and Markov-exchangeability representation theorems (de Finetti; Diaconis–Freedman).
    Appendix A uses these to justify finite-dimensional latent parameters for k=0 and k=1; standard mathematical background.

pith-pipeline@v1.3.0-alltime-deepseek · 36306 in / 15039 out tokens · 138001 ms · 2026-08-01T14:17:02.193561+00:00 · methodology

0 comments
read the original abstract

In the \emph{latent posterior model} of transformer behavior, the next-token distribution arises from a posterior over latent predictive models conditioned on the context, mixed to generate continuations. We exploit this model in settings where it is exact, namely Bayes-filtered transformers (BFTs) meta-learned on sequences from a hierarchical prior, to introduce \textbf{Posterior Prefix Tuning (PPT)}, a new method for \emph{eliciting} behavior from a transformer: given a utility function on continuations, find a prompt under which the transformer generates continuations of high expected utility. For a BFT, the elicitation objective factors through the latent posterior, and the gradient of this objective can be estimated from samples of the prior alone. PPT optimizes the parameters of a distribution over hard prompts: it draws prior samples once from the BFT via predictive Monte Carlo (PMC), then estimates the gradient by importance sampling against them. The optimization performs no transformer forward passes and no backpropagation through the transformer, and the prior samples are utility-independent, so a single set of samples drives elicitation against any number of utilities at negligible marginal cost. We validate PPT on Beta--Bernoulli and reinforced urn BFTs across three utility families (reverse cross-entropy, frequency matching, Dyck validity).

Figures

Figures reproduced from arXiv: 2607.18804 by Daniel Murfet, Garrett Baker, Susan Wei, Vinayak Pathak.

Figure 1
Figure 1. Figure 1: Steering the latent posterior to elicit behavior. Given a utility U on continuations, let µ( ˜k) be its expectation under a latent ˜k. To elicit high-utility behavior from the transformer πθ, we seek prompts z1:m that steer the latent posterior Π(d ˜k | z1:m) over K toward latents ˜k with high µ( ˜k). Left: the latent space K. Middle: Predictive Monte Carlo (PMC) samples once from the latent prior the BFT … view at source ↗
Figure 2
Figure 2. Figure 2: Predictive Monte Carlo (PMC). (a) Schematic, adapted from Ng et al. [2026]: each of L rollouts autoregressively samples a length-R sequence from πθ with no conditioning; token frequencies give a prior sample p˜ (l) (k = 0) and transition counts give Q˜(l) (k ≥ 1). (b)–(c) Validation of the sampled prior density against the closed form, for k = 0 and k = 1. Analytic prior (green, filled) is the closed-form … view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

32 extracted references · 2 linked inside Pith

  1. [1]

    Understanding

    Genewein, Tim and Wenliang, Li Kevin and Grau-Moya, Jordi and Ruoss, Anian and Orseau, Laurent and Hutter, Marcus , booktitle =. Understanding. 2025 , url =

    2025

  2. [2]

    and Wang, Jane X

    Ortega, Pedro A. and Wang, Jane X. and Rowland, Mark and Genewein, Tim and. Meta-Learning of. 2019 , eprint =

    2019

  3. [3]

    , year =

    Fong, Edwin and Holmes, Chris and Walker, Stephen G. , year =. Journal of the Royal Statistical Society Series B: Statistical Methodology , volume =

  4. [4]

    and Knoblauch, Jeremias and Wei, Susan , booktitle =

    Ng, Kenyon and Fong, Edwin and Frazier, David T. and Knoblauch, Jeremias and Wei, Susan , booktitle =

  5. [5]

    Uncertainty Decomposition for

    Fortini, Sandra and Ng, Kenyon and Petrone, Sonia and Rousseau, Judith and Wei, Susan , year =. Uncertainty Decomposition for. 2602.04596 , archiveprefix =

    Pith/arXiv arXiv

  6. [6]

    What does a

    Effiezal Aswadi, Afiq Abdillah and Ma, Haotong and Wei, Susan , year =. What does a. 2607.17060 , archiveprefix =

    Pith/arXiv arXiv

  7. [7]

    Statistical Science , number =

    Sandra Fortini and Sonia Petrone , title =. Statistical Science , number =. 2025 , doi =

    2025

  8. [8]

    A Class of Models for

    Berti, Patrizia and Dreassi, Emanuela and Pratelli, Luca and Rigo, Pietro , journal =. A Class of Models for. 2021 , doi =

    2021

  9. [9]

    Meta-Trained Agents Implement

    Mikulik, Vladimir and Del. Meta-Trained Agents Implement. Advances in. 2020 , volume =

    2020

  10. [10]

    Genewein, Tim and Deletang, Gregoire and Ruoss, Anian and Wenliang, Li Kevin and Catt, Elliot and Dutordoir, Vincent and. Memory-. Proceedings of the 40th. 2023 , pages =

    2023

  11. [11]

    Forty-first International Conference on Machine Learning , year =

    Learning Universal Predictors , author =. Forty-first International Conference on Machine Learning , year =

  12. [12]

    Proceedings of the 29th International Conference on Artificial Intelligence and Statistics , publisher =

    Why Is Prompting Hard? Understanding Prompts on Binary Sequence Predictors , author =. Proceedings of the 29th International Conference on Artificial Intelligence and Statistics , publisher =

  13. [13]

    2025 , month =

    Irving, Geoffrey and Bloom, Joseph and Korbak, Tomek , title =. 2025 , month =

    2025

  14. [14]

    What Can

    Garg, Shivam and Tsipras, Dimitris and Liang, Percy and Valiant, Gregory , booktitle =. What Can

  15. [15]

    Proceedings of the 2021 conference on empirical methods in natural language processing , pages =

    The power of scale for parameter-efficient prompt tuning , author =. Proceedings of the 2021 conference on empirical methods in natural language processing , pages =

    2021

  16. [16]

    Prefix-tuning: Optimizing continuous prompts for generation , author =. Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers) , pages =

  17. [17]

    Advances in Neural Information Processing Systems , year =

    Learning to summarize from human feedback , author =. Advances in Neural Information Processing Systems , year =

  18. [18]

    The Eleventh International Conference on Learning Representations , year =

    What learning algorithm is in-context learning? Investigations with linear models , author =. The Eleventh International Conference on Learning Representations , year =

  19. [19]

    International Conference on Learning Representations , year =

    An Explanation of In-context Learning as Implicit Bayesian Inference , author =. International Conference on Learning Representations , year =

  20. [20]

    The Twelfth International Conference on Learning Representations , year =

    In-Context Learning through the Bayesian Prism , author =. The Twelfth International Conference on Learning Representations , year =

  21. [21]

    2026 , month =

    Marks, Sam and Lindsey, Jack and Olah, Christopher , title =. 2026 , month =

    2026

  22. [22]

    2023 , eprint =

    Universal and transferable adversarial attacks on aligned language models , author =. 2023 , eprint =

    2023

  23. [23]

    The Fourteenth International Conference on Learning Representations , year =

    Persona Features Control Emergent Misalignment , author =. The Fourteenth International Conference on Learning Representations , year =

  24. [24]

    Advances in Neural Information Processing Systems , volume =

    Language models are few-shot learners , author =. Advances in Neural Information Processing Systems , volume =

  25. [25]

    , booktitle =

    Shai, Adam and Teixeira, Lucas and Gietelink Oldenziel, Alexander and Marzen, Sarah and Riechers, Paul M. , booktitle =. 2024 , url =

    2024

  26. [26]

    Forty-second International Conference on Machine Learning , year =

    Constrained Belief Updates Explain Geometric Structures in Transformer Representations , author =. Forty-second International Conference on Machine Learning , year =

  27. [27]

    2025 , eprint =

    Next-token pretraining implies in-context learning , author =. 2025 , eprint =

    2025

  28. [28]

    2026 , url =

    Wang, George and Murfet, Daniel , booktitle =. 2026 , url =

    2026

  29. [29]

    The Thirty-eighth Annual Conference on Neural Information Processing Systems , year =

    Who's asking? User personas and the mechanics of latent misalignment , author =. The Thirty-eighth Annual Conference on Neural Information Processing Systems , year =

  30. [30]

    Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing , publisher =

    Personas as a Way to Model Truthfulness in Language Models , author =. Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing , publisher =. 2024 , doi =

    2024

  31. [31]

    2023 , eprint =

    Scalable and Transferable Black-Box Jailbreaks for Language Models via Persona Modulation , author =. 2023 , eprint =

    2023

  32. [32]

    Toxicity in

    Deshpande, Ameet and Murahari, Vishvak and Rajpurohit, Tanmay and Kalyan, Ashwin and Narasimhan, Karthik , booktitle =. Toxicity in