Pith. sign in

REVIEW 4 major objections 5 minor 52 references

Embedding gaps in jailbreak prompts track spelling, not safety

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-01 10:54 UTC pith:QCU3G3IB

load-bearing objection Solid three-region embedding observation, but the 'no behavioral hyperplane' claim is under-supported by the compliance/refusal SVM, which is confounded with paraphrase family and lacks baselines. the 4 major comments →

arxiv 2607.20581 v1 pith:QCU3G3IB submitted 2026-07-22 cs.CR cs.AI

Geometric Configurations of Perturbed Jailbreak Prompts

Lynn Delcon , Andres Algaba , Vincent Ginis This is my paper
classification cs.CR cs.AI
keywords jailbreak promptsembedding geometrylinear separabilitylast-token embeddingnext-token probabilityrefusal directionLLM safetyadversarial perturbations
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper asks whether the internal geometry of jailbreak prompts reveals whether a language model will comply or refuse. Studying six small instruction-tuned models, it finds that the last-layer-last-token embedding space separates jailbreak prompts from ordinary instruction prompts perfectly, but the separation follows surface features — word choice, letter substitution, template — rather than the safety of the model's answer. A linear boundary trained on embeddings to separate compliant from refusal answers performs at near chance across models, even when the two answer classes are balanced. The top-50 next-token probability space is effectively one-dimensional and likewise shows no safety-based clustering. The paper concludes that linear separability of jailbreak prompts is a property of input form, not a signature of internal safety.

Core claim

The central claim is that the clear linear separation between jailbreak and control prompts observed in last-layer-last-token embeddings is driven by surface-level properties of the prompt (spelling, token statistics, template) rather than by the model's internal representation of harmfulness or refusal. The paper shows that within the jailbreak prompts, a linear hyperplane trained to separate compliant from refusal answers performs at or near chance across all six models, including the model with balanced classes. In the top-50 next-token probability space, the effective dimension is about 1.25 and no clustering by safety appears; only a handful of next tokens — 'Sure' in the smallest Qwen

What carries the argument

The analysis rests on two representation spaces extracted from each prompt: the last-layer-last-token embedding (the model's final hidden state at the last token) and the top-50 next-token conditional probability vector. The workhorse is a linear Support Vector Machine, used to construct separating hyperplanes between prompt groups and between answer classes, supplemented by the participation ratio to measure the effective dimensionality of each point cloud. A generalized estimating equation (GEE) logistic regression then tests whether token-level or paraphrase-family variables are significantly associated with a compliant label within the refusal-dominated answer set.

Load-bearing premise

The conclusion that separability is not a signature of internal safety assumes that the last-layer-last-token embedding and the top-50 next-token probability space are sensitive enough to reveal a refusal/compliance direction if one existed; if the safety-relevant signal lives in earlier layers or in activation differences, the absence of a boundary in these spaces would not support the general conclusion.

What would settle it

Train a linear classifier on last-layer-last-token embeddings of a balanced set of compliant and refusal jailbreak prompts (for instance, from the model with roughly equal class sizes) and test it on held-out paraphrases; if it achieves high balanced accuracy and transfers across paraphrase families, the claim that no behavioral hyperplane exists in that space is false.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • If separability reflects input form, then embedding-space defenses that flag jailbreak prompts by distance from normal prompts will mostly catch surface anomalies, not dangerous intent; paraphrases that preserve spelling will be the hardest to detect.
  • Safety monitoring that relies on last-token embeddings or next-token distributions will miss refusal/compliance states; usable signals would need to come from earlier layers or activation differences.
  • Near-perfect linear separability between jailbreak and control prompts in these models should not be cited as evidence of an internal harmfulness axis; prior conclusions built on such separations need re-examination.
  • The top-50 probability space is effectively one-dimensional, so any clustering study in that space must account for the dominant first principal component being simply the top-1 probability.
  • Heavy surface obfuscation (numbers, leet-speak) is associated with refusal answers in most models, suggesting that noise weakens the jailbreak rather than enabling it.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The absence of a behavioral hyperplane in these two spaces does not rule out a refusal direction elsewhere in the network; earlier layers or activation differences may still encode compliance, so the paper's conclusion is best read as scoped to the measured spaces.
  • If spelling determines embedding separation, then jailbreak detection filters built on embedding geometry could be evaded by paraphrases that keep surface tokens intact; testing filter accuracy per paraphrase family (synonyms vs. leet-speak) would be a direct follow-up.
  • The few next tokens associated with compliance ('Sure', comma, newline) suggest that in small models compliant answers may be triggered by local token artifacts rather than a global direction; intervening on these tokens could test whether they are causal.
  • The participation-ratio small-sample bias is a general methodological caution: comparing effective dimensionality across datasets of very different sizes can mislead, independent of this paper's topic.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper studies six small instruct-tuned LLMs (Qwen-2.5-1.5B/3B/7B and Llama-3.2-1B/3B/3.1-8B) and asks whether the linear geometry of prompt representations is organized by safety behavior or only by surface form. It builds a corpus of 96 jailbreak prompts (Pliny) and 96 control task prompts, applies four stochastic perturbations (Synonyms, Letter Swap, Numbers, Leet Speak) to yield 38,592 prompts, and extracts two representation spaces: last-layer-last-token embeddings and top-50 next-token probabilities. Jailbreak generations are labeled by Llama Guard 4 into refusal/compliant. The paper reports (i) strong linear SVM separation between control and jailbreak paraphrases in embedding space, organized into three regions; (ii) an essentially one-dimensional next-token probability space without clear family/behavior clustering; and (iii) no behavioral hyperplane separating compliant from refusal responses in either space, with only a small set of next-token associations (e.g., 'Sure' in Qwen-1.5B) reaching significance. It concludes that separability of jailbreak prompts is a property of input form, not a signature of internal safety.

Significance. The paper is commendably concrete: it uses a sizable public-prompt corpus, multiple model families, transparent counts (Supp. Mat. A Table 2), SVM metrics (Supp. Mat. B Table 4), participation-ratio diagnostics, and it explicitly flags some limitations (e.g., refusal-dominated labels, GEE independence). If the central negative claim were established with proper controls, it would be a useful caution against interpreting superficial embedding separability as evidence of safety mechanisms. However, the current evidence does not establish that claim. The behavioral SVM results are in-sample and confounded with the same template/family directions the paper shows are separable; the abstract and discussion over-read the evidence. The result is potentially salvageable, but the analysis must be reworked.

major comments (4)
  1. [§3, Supp. Mat. B Table 4] The central negative claim ('no behavioral hyperplane') is contradicted by the paper's own SVM metrics. The compliance–refusal SVM reports balanced accuracies of 0.756 (Qwen-1.5B), 0.711 (Qwen-3B), 0.677 (Qwen-7B), 0.960 (Llama-1B), 0.770 (Llama-3B), and 0.677 (Llama-8B). A balanced accuracy of 0.960 on 566 vs 18,730 samples is a strong in-sample linear separation, not 'no clear distinction.' The main text bases the negative conclusion on visual inspection of 2D projections, which is not a test of hyperplane existence. The authors need to report cross-validated balanced accuracy, a permutation/null distribution (especially given the high-dimensional, small-sample setting), and a clear criterion for declaring 'no behavioral hyperplane' that is consistent with their metrics.
  2. [§2, Supp. Mat. A Table 2] The compliance–refusal SVM is confounded by paraphrase family. Compliant-label rates differ sharply across families: for Qwen-1.5B they range from 45.8% (Query) to 36.2% (Synonyms), 22.7% (Letter Swap), 8.5% (Numbers), and 3.2% (Leet Speak); for Llama-1B the range is 10.4% to 0.8%. The paper has already established that family/template is strongly separable in the same embedding space (control–jailbreak balanced accuracies ≈ 0.99–1.0). A linear SVM trained on all jailbreak prompts can therefore achieve high balanced accuracy by recovering family/template directions, without any genuinely 'behavioral' direction. To support the conclusion, the analysis must stratify or balance by family (e.g., train within family or include family/region as a covariate) and test whether the hyperplane generalizes across families. Without this, the claim that separability is 'not a signature of internal saf
  3. [§3, Supp. Mat. B] The probability-space half of the central claim is not actually tested. For the top-50 probability space, the paper performs PCA, participation-ratio, and random-forest regressions of the top-1 probability on token/family/region/guard-label variables. Low R² and low balanced accuracies for threshold clustering show that these variables do not explain the probability axis, but this is not a test for a behavioral hyperplane: no linear SVM (or equivalent classifier) is fit for compliance vs refusal in the 50-dimensional probability space. The same in-sample and confound concerns as in the embedding space apply. The conclusion 'neither space displays the model's (un)safe behavior' should be weakened or supported by direct classification experiments in the probability space.
  4. [§3, Table 7, Abstract] The token-association findings are not reliable as reported. The GEE model selects the top-1 threshold, the top-6 first-next-token set, and the 25+25 top-50 tokens on the same jailbreak dataset used for testing, so the p-values (even Bonferroni-corrected) do not account for this selection. The GEE independence assumption is violated due to repeated jailbreak features across queries, as the authors acknowledge in the Discussion; the reported standard errors are therefore likely too small. In addition, the abstract and §3 state that tokens ',' and 'ĊĊ' in Llama-1B are 'significantly associated with a compliant-labeled answer,' but Table 7 reports negative coefficients (-1.986 and -1.058), meaning they are associated with a safe/refusal answer. This sign reversal must be corrected.
minor comments (5)
  1. [§2] The participation-ratio formula writes PR = (Σλ)^2 / Σλ^2 = 1/Σλ^2. The second equality holds only if the λ_i are normalized to sum to 1; please state the convention explicitly.
  2. [Supp. Mat. B Table 4] The 'Compliance – Refusal' rows should report the number of clusters (queries) used in the analysis and, ideally, confidence intervals for balanced accuracy; no cross-validation is currently reported.
  3. [Abstract] The phrase '1$ Llama model' appears to be a typo for '1B Llama model'.
  4. [Figure 2] The three SVM hyperplanes and margins are shown only for the reference model; for the other models the main text refers to Figure 6, but the figure caption does not define the coloring of compliance/refusal points. Please label axes and classes.
  5. [Supp. Mat. B Table 7] The Bonferroni correction is described as 'for 10 comparisons'; please clarify whether this refers to the number of token predictors only or to all terms including family and cluster variables.

Circularity Check

2 steps flagged

No central circularity: the behavioral conclusion rests on external Llama Guard labels; only mild in-sample feature/threshold selection inflates descriptive accuracies.

specific steps
  1. fitted input called prediction [Supplementary Material B, Embedding Space, Table 4 (SVM hyperplane metric summary)]
    "The following table summarizes the hyperplane metrics such as the number of observations used to build such high dimensional linear separations along with the corresponding balanced accuracy... Control Para - Jailbreak Para 12045 - 19200 1.000"

    The balanced accuracies are computed on the same observations used to fit each SVM hyperplane; the table explicitly refers to 'the number of observations used to build'. A 1.000 (or high) balanced accuracy is an in-sample fit statistic, not an independent prediction of separability. It confirms that the SVM optimization succeeded, but it does not by itself establish stability of the geometric separation. This is a mild reporting issue and is not load-bearing for the paper's main behavioral negative result.

  2. fitted input called prediction [Supplementary Material B, Probability Space, Top-50 Tokens definition and Table 6]
    "Among the tested explanatory variables, we select the Top-50 Tokens variable that is defined by the 25 most frequent first next-tokens (top-1 next-tokens) of the control queries and the 25 most frequent ones of the jailbreak queries."

    The predictor set is constructed from the same dataset and from the same control/jailbreak grouping that the random-forest regressions are then used to describe. The reported R2_adj and balanced accuracies are in-sample values, so the descriptive clustering numbers are optimistically biased. This is peripheral to the main conclusion and the paper itself cautions that the GEE associations are 'design-specific'.

full rationale

The central claim—that linear separability in last-layer-last-token embeddings reflects spelling and template rather than behavioral robustness—is an empirical null result, not a derivation from its own assumptions. Behavioral labels come from an external classifier (Llama Guard 4), so the refusal/compliance analysis is not circular by construction. The control-vs-jailbreak SVM is explicitly a descriptive fit used to define embedding regions; reporting its in-sample balanced accuracy as 'Bal. Accuracy' is mild in-sample circularity, but the paper's main behavioral conclusion does not depend on that accuracy. The probability-space random forests also select features and thresholds on the same data and report in-sample metrics, but these are exploratory clustering steps, and the paper acknowledges limitations including the refusal-dominated answer set, the violation of independence across jailbreak features, and the small numbers of compliant answers. No load-bearing self-citation chain or imported uniqueness theorem appears: the participation-ratio is a known effective-rank estimator with an independent tutorial reference. The skeptic's paraphrase-family confound is a validity threat to the negative claim, not a circularity: it challenges whether the measured spaces are sensitive enough or whether the SVM recovers family directions, but it does not show that any prediction reduces to its input by definition. Accordingly, the paper is only mildly circular in its in-sample reporting, not centrally circular.

Axiom & Free-Parameter Ledger

5 free parameters · 4 axioms · 0 invented entities

Central results depend on labels from Llama Guard 4, on a single jailbreak source with heavy template reuse, and on data-dependent threshold and token-set selection; no new entities are posited.

free parameters (5)
  • SVM penalty C = not reported
    Regularization strength in hinge-loss SVM; affects all hyperplane results but the value is not given.
  • Top-1 probability cluster threshold(s) = selected from empirical quantiles, values not reported
    Chosen to maximize balanced accuracy for clustering the top-1 next-token probability; later used as a predictor in GEE.
  • Top-6 jailbreak next-token set = 6 most frequent first next-tokens of jailbreak queries
    Data-dependent reference categories for GEE token effects.
  • Top-50 Tokens variable (25+25) = 25 most frequent top-1 tokens per group
    Feature set for random-forest regressions, built from the same dataset.
  • Random forest tree count = 400
    Arbitrary hyperparameter chosen by the authors; not fitted to data.
axioms (4)
  • domain assumption Last-layer-last-token embeddings and top-50 next-token probabilities are suitable spaces for observing safety behavior.
    The negative conclusion is interpreted as absence of a safety direction; if safety is encoded in other layers, the conclusion would overreach. Enters at Section 2.
  • domain assumption Llama Guard 4 labels are a valid ground truth for refusal vs compliance.
    All behavior analyses and the 'no behavioral hyperplane' result depend on these labels; label noise or bias would undermine the null findings. Enters at Section 2.
  • domain assumption String perturbations preserve jailbreak intent.
    The paper treats paraphrases as still-jailbreak inputs without checking each instance; if perturbations destroy or weaken intent, compliance labels and representation geometry would change. Enters at Section 2 dataset construction.
  • domain assumption GEE exchangeable correlation and independence across queries are valid.
    Authors later state this independence is not fully met because jailbreak features repeat across prompts; this assumption is load-bearing for the token-association p-values. Enters at Section 2 and acknowledged in Section 4.

pith-pipeline@v1.3.0-alltime-deepseek · 14043 in / 12558 out tokens · 97283 ms · 2026-08-01T10:54:30.440373+00:00 · methodology

0 comments
read the original abstract

Perturbation techniques that turn unsuccessful jailbreak prompts into successful ones are continuously evolving, constituting a major security threat to LLM safety. In this paper, we investigate the internal representations of such string-level perturbed jailbreak inputs in the small weight models of the Qwen-2.5-1.5B/-3B/-7B-Instruct and Llama-3.2-1B/-3B/-3.1-8B-Instruct families. We select two representation spaces: the last-layer-last-token embedding space and the top-50 next-token probability space. The former space separates prompts based on their spelling and format, while the latter space is effectively one-dimensional but appears more complex to cluster. Within our refusal-dominated answer set we find no behavioral hyperplane in either space. Only the next token "Sure" in the 1.5B Qwen model, and both tokens "," and "\.C\.C" in the 1$ Llama model, display a significant association with a compliant-labeled answer.

Figures

Figures reproduced from arXiv: 2607.20581 by Andres Algaba, Lynn Delcon, Vincent Ginis.

Figure 1
Figure 1. Figure 1: Llama Guard 4 label proportions by jailbreak prompt family. Safe and unsafe answer proportions are complementary. Metrics. At the surface level, we compute the token similarity between each paraphrase and its query as 2T/(m + n), where T is the number of matching to￾ken pairs, and m and n are the numbers of tokens in [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: SVM analysis of the reference model. Solid [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: The 2-PCs space for the reference model. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Leet Speak multi-mapping [PITH_FULL_IMAGE:figures/full_fig_p009_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Cosine similarity as a function of token similarity across models. [PITH_FULL_IMAGE:figures/full_fig_p011_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: SVM analysis across models [PITH_FULL_IMAGE:figures/full_fig_p013_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Participation-ratio as a function of the number of observations and dimensions. Lines indicate the [PITH_FULL_IMAGE:figures/full_fig_p014_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Top-50 next-token probability space projected onto the first 2 PCs across models with several third [PITH_FULL_IMAGE:figures/full_fig_p017_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: Histograms of the 25 most frequent next-tokens for each family of the reference model. [PITH_FULL_IMAGE:figures/full_fig_p019_9.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

52 extracted references · 5 canonical work pages · 1 internal anchor

  1. [1]

    2025 , url =

    Wikimedia Downloads , subtitle =. 2025 , url =

    2025

  2. [2]

    The use of

    Carbonell, Jaime and Goldstein, Jade , booktitle=. The use of. 1998 , doi=

    1998

  3. [3]

    Journal of Machine Learning Research , volume=

    Scikit-learn: Machine Learning in Python , author=. Journal of Machine Learning Research , volume=

  4. [4]

    Journal of Documentation , volume=

    A statistical interpretation of term specificity and its application in retrieval , author=. Journal of Documentation , volume=. 1972 , doi=

    1972

  5. [5]

    2025 , url =

    Introducing. 2025 , url =

    2025

  6. [6]

    2025 , eprint=

    The Geometry of Tokens in Internal Representations of Large Language Models , author=. 2025 , eprint=. doi:10.48550/arXiv.2501.10573 , url=

    Pith/arXiv arXiv doi:10.48550/arxiv.2501.10573 2025

  7. [7]

    doi:10.48550/arXiv.2502.19649 , year=

    Taxonomy, Opportunities, and Challenges of Representation Engineering for Large Language Models , author=. doi:10.48550/arXiv.2502.19649 , year=. 2502.19649 , archivePrefix=

    doi:10.48550/arxiv.2502.19649

  8. [8]

    Personalized Steering of Large Language Models: Versatile Steering Vectors Through Bi-directional Preference Optimization

    Personalized Steering of Large Language Models: Versatile Steering Vectors Through Bi-directional Preference Optimization , author=. 2024 , eprint=. doi:10.48550/arXiv.2406.00045 , url=

    work page internal anchor Pith review Pith/arXiv arXiv doi:10.48550/arxiv.2406.00045 2024

  9. [9]

    2023 , eprint=

    Representation Engineering: A Top-Down Approach to AI Transparency , author=. 2023 , eprint=. doi:10.48550/arXiv.2310.01405 , url=

    Pith/arXiv arXiv doi:10.48550/arxiv.2310.01405 2023

  10. [10]

    Interventional Probing in High Dimensions: An NLI Case Study

    Rozanova, Julia and Valentino, Marco and Cordeiro, Lucas and Freitas, Andr \'e. Interventional Probing in High Dimensions: An NLI Case Study. Findings of the Association for Computational Linguistics: EACL 2023. 2023. doi:10.18653/v1/2023.findings-eacl.188

    work page doi:10.18653/v1/2023.findings-eacl.188 2023

  11. [11]

    2018 , eprint=

    Understanding Intermediate Layers Using Linear Classifier Probes , author=. 2018 , eprint=. doi:10.48550/arXiv.1610.01644 , url=

    Pith/arXiv arXiv doi:10.48550/arxiv.1610.01644 2018

  12. [12]

    and Lifland, Eli and Yoo, Jin Yong and Grigsby, Jake and Jin, Di and Qi, Yanjun , booktitle=

    Morris, John X. and Lifland, Eli and Yoo, Jin Yong and Grigsby, Jake and Jin, Di and Qi, Yanjun , booktitle=. 2020 , doi=

    2020

  13. [13]

    Boundary Point Jailbreaking of Black-Box

    Xander Davies and Giorgi Giglemiani and Edmund Lau and Eric Winsor and Geoffrey Irving and Yarin Gal , year=. Boundary Point Jailbreaking of Black-Box. doi:10.48550/arXiv.2602.15001 , url=. 2602.15001 , archivePrefix=

    doi:10.48550/arxiv.2602.15001

  14. [14]

    Multi-property Steering of Large Language Models with Dynamic Activation Composition , url=

    Scalena, Daniel and Sarti, Gabriele and Nissim, Malvina , year=. Multi-property Steering of Large Language Models with Dynamic Activation Composition , url=. doi:10.18653/v1/2024.blackboxnlp-1.34 , booktitle=

    doi:10.18653/v1/2024.blackboxnlp-1.34 2024

  15. [15]

    Qwen2.5: A Party of Foundation Models , url =

  16. [16]

    2024 , eprint=

    Nomic Embed: Training a Reproducible Long Context Text Embedder , author=. 2024 , eprint=. doi:10.48550/arXiv.2402.01613 , url=

    Pith/arXiv arXiv doi:10.48550/arxiv.2402.01613 2024

  17. [17]

    2024 , doi=

    Evaluation of Domain-Specific Prompt Engineering Attacks on Large Language Models , author=. 2024 , doi=

    2024

  18. [18]

    Journal of Cognition , volume=

    Letters, words, sentences, and reading , author=. Journal of Cognition , volume=. 2024 , doi=

    2024

  19. [19]

    Computer Systems Science & Engineering , volume=

    An Efficient Character-Level Adversarial Attack Inspired by Textual Variations in Online Social Media Platforms , author=. Computer Systems Science & Engineering , volume=. 2023 , doi=

    2023

  20. [20]

    Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing , publisher=

    Generating Natural Language Adversarial Examples , author=. Proceedings of the 2018 Conference on Empirical Methods in Natural Language Processing , publisher=. 2018 , doi=. 1804.07998 , archivePrefix=

    Pith/arXiv arXiv 2018

  21. [21]

    , booktitle=

    Pennington, Jeffrey and Socher, Richard and Manning, Christopher D. , booktitle=. 2014 , doi=

    2014

  22. [22]

    ACM Computing Surveys , volume=

    A survey of adversarial defenses and robustness in nlp , author=. ACM Computing Surveys , volume=. 2023 , doi=

    2023

  23. [23]

    Claude Sonnet 4.6 , year =

  24. [24]

    International Conference on Learning Representations , year=

    Synthetic and Natural Noise Both Break Neural Machine Translation , author=. International Conference on Learning Representations , year=. 1711.02173 , archivePrefix=

    Pith/arXiv arXiv

  25. [25]

    Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics , publisher=

    On the Robustness of Self-Attentive Models , author=. Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics , publisher=. 2019 , doi=

    2019

  26. [26]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    Joint Character-Level Word Embedding and Adversarial Stability Training to Defend Adversarial Text , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=. 2020 , doi=

    2020

  27. [27]

    International Conference on Learning Representations , year=

    Explaining and Harnessing Adversarial Examples , author=. International Conference on Learning Representations , year=. 1412.6572 , archivePrefix=

    Pith/arXiv arXiv

  28. [28]

    Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics , publisher=

    Generating Natural Language Adversarial Examples through Probability Weighted Word Saliency , author=. Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics , publisher=. 2019 , doi=

    2019

  29. [29]

    2026 , eprint=

    Solving adversarial examples requires solving exponential misalignment , author=. 2026 , eprint=. doi:10.48550/arXiv.2603.03507 , url=

    work page doi:10.48550/arxiv.2603.03507 2026

  30. [30]

    2016 , eprint=

    A Boundary Tilting Persepective on the Phenomenon of Adversarial Examples , author=. 2016 , eprint=

    2016

  31. [31]

    Static Analysis , publisher=

    Robustness Verification of Support Vector Machines , author=. Static Analysis , publisher=. 2019 , doi=. 1904.11803 , archivePrefix=

    Pith/arXiv arXiv 2019

  32. [32]

    Joshi, A. V. , title =. Machine Learning and Artificial Intelligence , publisher =. 2023 , pages =

    2023

  33. [33]

    2008 , doi=

    Fan, Rong-En and Chang, Kai-Wei and Hsieh, Cho-Jui and Wang, Xiang-Rui and Lin, Chih-Jen , journal=. 2008 , doi=

    2008

  34. [34]

    2008 , publisher=

    Support vector machines , author=. 2008 , publisher=

    2008

  35. [35]

    An introduction to

    Fawcett, Tom , journal=. An introduction to. 2006 , doi=

    2006

  36. [36]

    Applied Computing and Informatics , volume =

    Tharwat, Alaa , title =. Applied Computing and Informatics , volume =. 2021 , issn =

    2021

  37. [37]

    Advances in Neural Information Processing Systems , volume=

    Attention is All You Need , author=. Advances in Neural Information Processing Systems , volume=

  38. [38]

    Grattafiori, Aaron and others , year=. The. doi:10.48550/arXiv.2407.21783 , url=. 2407.21783 , archivePrefix=

    Pith/arXiv arXiv doi:10.48550/arxiv.2407.21783

  39. [39]

    2024 , url=

    List of evaluation metrics for generative. 2024 , url=

    2024

  40. [40]

    and Casiraghi, E

    Campadelli, P. and Casiraghi, E. and Ceruti, C. and Rozza, A. , title =. Mathematical Problems in Engineering , volume =. doi:10.1155/2015/759567 , year =

    work page doi:10.1155/2015/759567 2015

  41. [41]

    2019 , issn =

    Adversarial and counter-adversarial support vector machines , journal =. 2019 , issn =. doi:10.1016/j.neucom.2019.04.035 , author =

    work page doi:10.1016/j.neucom.2019.04.035 2019

  42. [42]

    2025 , organization =

    Weidmann, Philipp Emanuel , title =. 2025 , organization =

    2025

  43. [43]

    2024 , eprint=

    Refusal in Language Models Is Mediated by a Single Direction , author=. 2024 , eprint=

    2024

  44. [44]

    doi:10.48550/arXiv.2507.11878 , url=

    Jiachen Zhao and Jing Huang and Zhengxuan Wu and David Bau and Weiyan Shi , year=. doi:10.48550/arXiv.2507.11878 , url=. 2507.11878 , archivePrefix=

    Pith/arXiv arXiv doi:10.48550/arxiv.2507.11878

  45. [45]

    Catastrophic Jailbreak of Open-source

    Yangsibo Huang and Samyak Gupta and Mengzhou Xia and Kai Li and Danqi Chen , year=. Catastrophic Jailbreak of Open-source. 2310.06987 , archivePrefix=

    Pith/arXiv arXiv

  46. [46]

    2023 , eprint=

    Universal and Transferable Adversarial Attacks on Aligned Language Models , author=. 2023 , eprint=

    2023

  47. [47]

    How to derive the probabilistic interpretation of the

    Nathan Aim , YEAR=. How to derive the probabilistic interpretation of the. https://stats.stackexchange.com/q/482703 , URL =

  48. [48]

    1986 , journal=

    Longitudinal Data Analysis Using Generalized Linear Models , author=. 1986 , journal=

    1986

  49. [49]

    Companion Proceedings of the ACM Web Conference 2024 , pages=

    Is Cosine-Similarity of Embeddings Really About Similarity? , author=. Companion Proceedings of the ACM Web Conference 2024 , pages=. 2024 , doi=

    2024

  50. [50]

    2025 , eprint=

    How Small Transformation Expose the Weakness of Semantic Similarity Measures , author=. 2025 , eprint=. doi:10.48550/arXiv.2509.09714 , url=

    Pith/arXiv arXiv doi:10.48550/arxiv.2509.09714 2025

  51. [51]

    2026 , url =

    Introducing. 2026 , url =

    2026

  52. [52]

    Effective Dimensionality: A Tutorial , journal=

    Del Giudice, Marco , year=. Effective Dimensionality: A Tutorial , journal=