Pith. sign in

REVIEW 4 major objections 4 minor 62 references

Updating just 0.03% of a vision-language model's parameters — the neurons shared across languages and across image and text inputs — transfers English-only safety supervision to multilingual and multimodal attacks.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-07-31 23:02 UTC pith:LGDZCWNC

load-bearing objection Practical neuron-level safety transfer for LVLMs with real promise, but the central generalization claim leans on one benchmark family and single-run results; still worth a serious referee. the 4 major comments →

arxiv 2607.27917 v1 pith:LGDZCWNC submitted 2026-07-30 cs.AI

One Anchor for All: Unified Multilingual and Multimodal Safety Alignment for LVLMs

Enyi Shi , Fei Shen , Chuancheng Shi , Linxia Zhu , Shuyi Miao , Jinhui Tang , Tat-Seng Chua This is my paper
classification cs.AI
keywords safety alignmentlarge vision-language modelsmultilingual safetymultimodal safetymechanistic interpretabilityneuron editingcross-modal transfersparse fine-tuning
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper tries to establish that a large vision-language model contains a tiny, shared set of feed-forward neurons that respond to harmful content whether the threat arrives through the image channel or the text channel and regardless of language. The authors identify these 'modality- and language-shared safety neurons' by scoring neurons with a saliency measure, subtracting neurons that also fire on benign inputs, intersecting the image-selected and text-selected sets within each language, then intersecting those with the English set as a semantic anchor. They update only this set — around 0.03% of parameters — with English-only safety data. The claim is that this single targeted update transfers safety supervision to other languages, to image-based attacks, and even to languages and jailbreak formats never seen during selection, while leaving general capabilities largely intact. If true, safety alignment for multilingual multimodal models becomes a cheap localization problem instead of a large-scale data and fine-tuning problem.

Core claim

The paper's central claim is that a compact set of shared safety neurons acts as a cross-lingual and cross-modal safety anchor in vision-language models. By probing the model with harmful and benign inputs under image-dominant and text-dominant risks, then intersecting the resulting salient neuron sets across languages with English as the anchor, the authors obtain a set of about 0.03% of parameters. Fine-tuning only these neurons on English safety data reduces harmful responses across six in-distribution languages, four unseen languages, and unrelated out-of-distribution jailbreak benchmarks, while general multimodal and multilingual reasoning scores change by less than a point. Masking the

What carries the argument

The load-bearing object is the MLS-Neuron set. To find it, the paper scores each feed-forward neuron by a saliency measure that multiplies its average activation strength by the magnitude of its down-projection vector, capturing both firing strength and downstream influence on the output. The Top-K neurons under harmful probes are collected per layer; neurons that also fire on benign multimodal inputs are subtracted; image-selected and text-selected neurons are intersected within each language to form modality-shared MS-Neurons; and those are intersected with the English anchor to form the language- and modality-shared MLS-Neurons. Tuning then applies a binary mask to the gradient or to low-

Load-bearing premise

The load-bearing premise is that the neuron set produced by intersecting saliency overlaps across probing conditions is a stable, causally safety-specific mechanism, not an overlap driven by the particular benchmark templates used for probing.

What would settle it

Run the selection pipeline twice on disjoint halves of the safety benchmark with different benign-sample sets and compare the resulting MLS-Neurons and their transfer to unseen languages; if the sets are unstable or the safety gains collapse when selection and evaluation are separated, the shared-anchor claim would be explained by benchmark-specific activation overlap.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • English-only safety data can lower attack success rates across many languages on several different LVLM families, reducing average ASR by roughly 15–20 points in the paper's main comparisons.
  • The safety behavior transfers to unseen languages and to jailbreak benchmarks that differ in format from the probing data, suggesting the learned refusal is not template memorization.
  • Because only about 0.03% of parameters are trainable and the rest are frozen, the method sidesteps the usual compute and multilingual data-collection costs of safety fine-tuning.
  • The masking intervention shows that the identified neurons are causally tied to safety: removing them degrades safety far more than removing random or language-specific neurons while barely affecting general reasoning benchmarks.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the shared-safety-subspace picture holds, the same neuron localization could support inference-time interventions, such as clamping or steering these neurons, with no training at all.
  • The results suggest that high-resource English safety supervision could substitute for expensive low-resource safety data collection, a cost shift that would matter most for less-resourced languages.
  • The paper leaves open whether MLS-Neurons are a universal mechanism across architectures; a direct test would be whether neurons found on one model family transfer to another family without re-probing.
  • A natural ablation is to remove the down-projection magnitude from the saliency score; if transfer survives, the anchor is carried mainly by activation strength rather than output impact.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes a neuron-level safety alignment framework for LVLMs. It identifies 'MLS-Neurons'—FFN neurons shared across languages and modalities—by computing saliency scores (activation × down-projection magnitude) on harmful versus benign probes, subtracting general-capability neurons, intersecting image- and text-dominant risk sets within each language, and finally intersecting with English-anchored neurons. Only these neurons (~0.03% of parameters) are updated using English-only safety data. The authors report large ASR reductions on Lingua-SafetyBench across six in-distribution and four out-of-distribution languages for Qwen3-VL, Llama-3.2-Vision, and Gemma-3, with utility preservation, plus out-of-family results on FigStep, SPA-VL, and MultiJail for Qwen.

Significance. If the central claim holds, the paper offers an unusually parameter-efficient and interpretable route to multilingual/multimodal safety alignment, with an interesting mechanistic hypothesis: a small shared FFN subspace acts as a cross-lingual and cross-modal safety anchor. The paper's strengths include evaluations across three LVLM families, masking interventions, a Random-Train control, independent LLM-judge and human-agreement checks, and explicit disjointness between probing/training and evaluation samples. These controls make the empirical story credible within the evaluated benchmark family. However, the strongest generalization claims—transfer to unseen languages, modalities, and attack formats—depend on evidence that has not yet separated a stable safety mechanism from benchmark-specific activation overlap. The theoretical analysis in the supplementary does not resolve this gap because its key conclusion is an algebraic consequence of its assumptions.

major comments (4)
  1. [§4.1 and Supplementary B.2 (Table 9, Figure 7)] The most safety-relevant hyperparameters are selected on the same benchmark family used for the main evaluation. Top-K ratio 0.1 is chosen in Table 9 by maximizing a score that includes IR/TR ASR on Lingua-SafetyBench; the anchor language English is chosen in Figure 7 using Lingua-SafetyBench ASR. Tables 2 and 5 then report improvements on Lingua-SafetyBench. This is a selection-on-evaluation-set risk, and it is compounded by the absence of error bars or significance tests (all experiments appear to be single runs, seed 42). The paper should report results on a held-out validation split, show stability of the selected neurons across seeds/probing subsets, or otherwise demonstrate that the reported gains are not due to this selection.
  2. [Supplementary C, Eqs. (23)–(24)] The 'Advantage over Random Updates' argument is formally circular in its key step. Eq. (23) assumes q_s,ℓ > q_0,ℓ and p_ℓ > ρ_ℓ, i.e., that safety-gradient mass concentrates on the true support and that MLS selection is enriched relative to uniform sampling. Eq. (24) is then a direct algebraic consequence: ΔM_ℓ = |MLS_ℓ|(p_ℓ−ρ_ℓ)(q_s,ℓ−q_0,ℓ) > 0. The theorem does not independently establish that MLS-Neurons capture more gradient mass; it restates the assumption. The empirical Random-Train control (Table 3) is relevant evidence, but it is on the same benchmark family and without variance. Please either provide an empirical estimate of p_ℓ/q_s,ℓ from held-out probes, or weaken the theoretical claim accordingly.
  3. [§4.5, Table 6] The only out-of-family generalization evidence is limited to a single backbone (Qwen) and is reported without seeds or variance. Moreover, on MultiJail Bengali, Full-Train, LoRA-Train, and Ours all achieve 0.00 ASR, so that cell does not discriminate between methods; the strongest out-of-family evidence is FigStep and SPA-VL, again single-backbone. To support the cross-benchmark generalization claim, the authors should either extend Table 6 to Llama and Gemma, or report multiple seeds and show the effect is stable. Without this, the claim that the safety behavior 'transfers beyond the original training distribution' rests on a narrow empirical base.
  4. [§4.1, Supplementary A; §E, Q5] The main in-distribution and OOD evaluations (Tables 2 and 5) use the same benchmark family as the neuron-probing data. The disjointness guarantee separates samples within Lingua-SafetyBench, but it does not break template, translation, or harmful-category overlap. The rebuttal in Supplementary E, Q5, asserts that the OOD benchmarks 'differ substantially' and therefore the effect is 'unlikely to arise from dataset artifacts,' but this is an assertion, not a test. The central claim would be materially strengthened by probing on independent harmful/benign sets (e.g., different templates, categories, or translated attacks) and showing the selected MLS set is stable; alternatively, the authors should explicitly limit the claim to Lingua-SafetyBench-style distributions.
minor comments (4)
  1. [Figure 3] The 'clear negative correlation' between MLS-Neuron count and ASR is not quantified. Please report correlation coefficients (e.g., Spearman's ρ) and, ideally, confidence intervals, since the visual trend appears driven by a few languages.
  2. [Table 6] The table header 'Method Multimodal MultiJail' is visually ambiguous; the column grouping for FigStep/SPA-VL versus MultiJail sub-languages should be made explicit. Also add per-cell sample counts or note that MultiJail subsets differ in size.
  3. [Supplementary B.1, Eq. (11)] The masked low-rank parameterization is described only in the supplementary, but the main-text Eq. (8)–(9) refer to a masked gradient update. For reproducibility, either move the low-rank realization into the main text or cite the supplementary equation explicitly at the first mention of ΔΘ_MLS.
  4. [General] The paper does not state whether code or trained neuron indices will be released. Given the centrality of the selected neuron sets to the method, releasing them (or at least the selection pipeline) would substantially aid verification.

Circularity Check

0 steps flagged

No significant circularity: the central transfer claim is tested on held-out and external benchmarks, and the theoretical analysis is explicitly conditional rather than a disguised restatement of the conclusion.

full rationale

The paper's core derivation is empirical rather than definitional. MLS-Neurons are selected by saliency probing (Eqs. 2-6), and their causal role is then tested by masking interventions, random-neuron training controls, held-out ID/OOD splits, and external benchmarks (FigStep, SPA-VL, MultiJail). The "prediction" that English-only tuning on these neurons transfers across languages and modalities is not the same object as the selection input; probing uses harmful/benign samples from Lingua-SafetyBench, while evaluation includes disjoint samples from the same benchmark family and, importantly, out-of-family jailbreak benchmarks. The theoretical section (Eqs. 18-29) is explicitly conditional: Eq. (23) states assumptions q_s>q0 and p>rho, and Eq. (24) algebraically derives that MLS captures more gradient mass. That is a lemma under stated assumptions, not a claim that the assumptions were proven or that the conclusion was assumed. The main self-citations (Lingua-SafetyBench, Who Transfers Safety) are from the same research group, but the central result is not justified by those citations alone: the benchmark supplies data, and independent benchmarks provide external falsifiability. The shared-benchmark probing/evaluation design is a potential external-validity limitation, and the paper's Q5 addresses this concern, but it does not make the derivation circular by construction. Thus the paper merits a low circularity score, not a finding of circularity.

Axiom & Free-Parameter Ledger

4 free parameters · 6 axioms · 3 invented entities

The method rests on the saliency proxy, on the stability of intersections across modalities and languages, and on the assumption that safety gradients concentrate on the selected support. The last is assumed, not derived, in Supplementary §C. The Top-K ratio and anchor language are free parameters fitted to the primary evaluation benchmark.

free parameters (4)
  • Top-K ratio = 0.1
    Selected to maximize composite overall score (89.12) across IR, TR, MGSM, MMMU, OKTest on Qwen (Table 9); directly controls size and membership of the MLS-Neuron set.
  • Anchor language = English
    Chosen after comparing English, Chinese, French, and Spanish anchors, with English yielding the lowest ASR (Fig. 7). This is a design choice tuned on the evaluation benchmark.
  • Per-model learning rate = Gemma 2.1e-3, Llama 5e-4, Qwen 8e-4
    Standard hyperparameters but no sensitivity analysis reported; they affect the safety/utility trade-off and the magnitude of the reported improvements.
  • Probing samples per language = 983
    Probing set size chosen without reported sensitivity analysis; affects the stability and composition of the identified neuron sets.
axioms (6)
  • domain assumption Saliency score ψ = activation × down-projection magnitude is a valid proxy for a neuron's causal role in safety behavior.
    The entire selection pipeline (§3.2, Eq. 3) rests on this proxy; the paper offers masking evidence but no independent causal validation.
  • domain assumption Intersecting Top-K salient sets across modalities and languages yields shared semantic content rather than coincidental activation overlap.
    MS-Neurons and MLS-Neurons are defined by set intersection (§3.3, Eqs. 5–6); the meaningfulness of this intersection is assumed as the anchor mechanism.
  • ad hoc to paper Safety-gradient mass concentrates on the true support and MLS selection is enriched relative to uniform sampling (qs>q0, pℓ>ρℓ).
    Supplementary §C, Eq. (23); the advantage-over-random bound (Eq. 24) is a direct consequence of this assumption, which is the conclusion the theory purports to prove.
  • standard math Saliency scores follow a sub-Gaussian noise model.
    Supplementary §C, Eq. (18); used for the high-probability identification bounds, with no empirical validation of the noise model.
  • domain assumption Qwen-Guard is a reliable safety oracle across all ten languages.
    ASR metrics are judge-based (§4.1); human agreement of 92.89% (Table 11) supports but does not fully establish reliability for every language and harm category.
  • standard math Small-step first-order expansion of safety and general-capability losses is valid.
    Supplementary §C, Eqs. (25) and (29); the transfer and utility-preservation bounds depend on this smoothness assumption.
invented entities (3)
  • MLS-Neurons (modality- and language-shared safety neurons) independent evidence
    purpose: Shared safety semantic anchor; updating them transfers English-only safety supervision to multilingual and multimodal scenarios.
    The paper provides falsifiable handles: masking them degrades safety (Fig. 4, Table 1) and tuning them improves safety beyond random subsets (Table 3). However, the construct is defined by the method itself and its status as a distinct mechanistic entity is asserted rather than externally grounded.
  • MS-Neurons (modality-shared safety neurons) no independent evidence
    purpose: Intermediate construct: intersection of image- and text-safety neurons within a language.
    Defined in §3.3, Eq. (5); no independent evidence beyond being a building block for MLS-Neurons.
  • IS/TS safety neurons (image/text safety neurons) no independent evidence
    purpose: Monolingual unimodal safety candidates used as inputs to the intersection.
    Defined in §3.2, Eq. (4); purely a selection intermediate.

pith-pipeline@v1.3.0-daily-deepseek · 24286 in / 14525 out tokens · 120346 ms · 2026-07-31T23:02:50.361570+00:00 · methodology

0 comments
read the original abstract

As large vision-language models (LVLMs) are deployed globally, the combination of multilingual instructions and visual information makes malicious attacks more covert and sophisticated than ever before. However, existing methods isolate language and modality defenses, which, coupled with the scarcity of safety data and high fine-tuning costs, makes it difficult for models to defend against compound attacks. To address this severe challenge, we propose a neuron-level cross-dimensional safety alignment framework driven by modality- and language-shared safety neurons (MLS-Neurons). First, we identify monolingual and unimodal safety neurons by comparing responses to harmful and benign samples, quantifying functional saliency through activation strength and downstream impact. Then, by intersecting these unimodal neurons within each language, we extract modality-shared safety neurons (MS-Neurons) responsive to both visual and textual risks, bridging the safety representation gap between modalities. Furthermore, using English as a semantic anchor, we intersect MS-Neurons across languages to identify modality- and language-shared safety neurons (MLS-Neurons), serving as key defenses against compound attacks. Finally, we update only this minimal subset of shared neurons (~0.03% of parameters), transferring English-only safety supervision to multilingual and multimodal scenarios. Extensive experiments show that our method significantly outperforms state-of-the-art approaches across diverse multilingual and multimodal safety benchmarks while preserving general utility.

Figures

Figures reproduced from arXiv: 2607.27917 by Chuancheng Shi, Enyi Shi, Fei Shen, Jinhui Tang, Linxia Zhu, Shuyi Miao, Tat-Seng Chua.

Figure 1
Figure 1. Figure 1: Overview of Motivation. Multilingual and multi￾modal interactions create severe compound risks, yet exist￾ing methods treat the two dimensions separately, while direct SFT is constrained by scarce safety data and training costs. We identify MLS-Neurons that transfer English-only safety supervision to multilingual and multimodal scenarios. as illustrated in [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Framework Overview. § 3.2 Input and Neuron Probing. Using multilingual and multimodal probing datasets, we identify monolingual and unimodal safety neurons per language under Image- and Text-Dominant Risks. § 3.3 Cross-Lingual and Modal Safety Neurons. Within each language, neurons responsive to both visual and textual risks are extracted as MS￾Neurons and aligned across languages, with English anchoring t… view at source ↗
Figure 4
Figure 4. Figure 4: Impact of Different Masking Strategies on Model Safety. Masking MLS-Neurons leads to a substan￾tially larger increase in ASR than masking Random-Neurons or language-specific monolingual MS\MLS-Neurons, indi￾cating that MLS-Neurons play a critical role for model safety. Evaluation Metrics. We use attack success rate (ASR) as the primary safety metric and employ Qwen-Guard (Zhao et al. 2025) as the judge, ou… view at source ↗
Figure 5
Figure 5. Figure 5: Qualitative Analysis. The original model is vulnerable to multilingual and multimodal harmful requests, whereas our method consistently identifies such unsafe content and generates appropriate safety refusals. components of multilingual and multimodal defense. Impact of MLS-Neuron Masking. To validate the safety specificity of MLS-Neurons, we compare MLS-Neuron masking with layer-matched Random-Neuron mask… view at source ↗
Figure 6
Figure 6. Figure 6: Layer-wise Visualization of Saliency Score Dif￾ferences for Top-5 MLS-Neurons. Our method yields stronger, more coherent cross-layer scores than original model, indicating enhanced safety relevant representations. safety gains across LLM judges and human evaluation. 5. Conclusion In this paper, we investigate multilingual and multimodal safety alignment for LVLMs from a neuron-level perspec￾tive. To defend… view at source ↗
Figure 8
Figure 8. Figure 8: Impact of Different Masking Strategies on Gemma and Llama Safety. Similar to the observations on Qwen, masking MLS-Neurons on both Llama and Gemma leads to a notably larger ASR increase than masking Random-Neurons or language-specific monolin￾gual MS\MLS-Neurons, showing their critical safety role. min-max normalization, and for metrics where lower values are better, we apply reverse min-max normalization:… view at source ↗
Figure 9
Figure 9. Figure 9: Qualitative Image-Dominant Risk Cases across Languages. The original model remains vulnerable to multilingual and multimodal harmful requests, while our method reliably detects unsafe content and produces appropriate refusals. cating that models with more MLS-Neurons tend to exhibit safer behavior. Second, masking experiments provide direct interventional evidence: removing MLS-Neurons leads to a substanti… view at source ↗
Figure 10
Figure 10. Figure 10: Qualitative Text-Dominant Risk Cases across Languages. The original model remains vulnerable to multilingual and multimodal harmful requests, while our method reliably detects unsafe content and produces appropriate refusals. general safety-neuron editing, language-specific neuron edit￾ing, existing cross-lingual shared-neuron methods, and dense safety fine-tuning methods. ▷ Q4. Why can English-only super… view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

62 extracted references · 20 linked inside Pith

  1. [1]

    European conference on computer vision , pages=

    Mmbench: Is your multi-modal model an all-around player? , author=. European conference on computer vision , pages=. 2024 , organization=

    2024

  2. [2]

    arXiv preprint arXiv:2601.22737 , year=

    Lingua-safetybench: A benchmark for safety evaluation of multilingual vision-language models , author=. arXiv preprint arXiv:2601.22737 , year=

    Pith/arXiv arXiv

  3. [3]

    Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

    Mmmu: A massive multi-discipline multimodal understanding and reasoning benchmark for expert agi , author=. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

  4. [4]

    arXiv preprint arXiv:2210.03057 , year=

    Language models are multilingual chain-of-thought reasoners , author=. arXiv preprint arXiv:2210.03057 , year=

    Pith/arXiv arXiv

  5. [5]

    Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers) , pages=

    Xstest: A test suite for identifying exaggerated safety behaviours in large language models , author=. Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers) , pages=

    2024

  6. [6]

    The llm language network: A neuroscientific approach for identifying causally task-relevant units , author=. Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers) , pages=

    2025

  7. [7]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

    Spa-vl: A comprehensive safety preference alignment dataset for vision language models , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

  8. [8]

    Proceedings of the 31st International Conference on Computational Linguistics , pages=

    Multilingual knowledge editing with language-agnostic factual neurons , author=. Proceedings of the 31st International Conference on Computational Linguistics , pages=

  9. [9]

    Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

    Cracking factual knowledge: A comprehensive analysis of degenerate knowledge neurons in large language models , author=. Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

  10. [10]

    International Conference on Learning Representations , volume=

    Safety alignment should be made more than just a few tokens deep , author=. International Conference on Learning Representations , volume=

  11. [11]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    Figstep: Jailbreaking large vision-language models via typographic visual prompts , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

  12. [12]

    International Conference on Learning Representations , volume=

    Multilingual jailbreak challenges in large language models , author=. International Conference on Learning Representations , volume=

  13. [13]

    European Conference on Computer Vision , pages=

    Eyes closed, safety on: Protecting multimodal llms via image-to-text transformation , author=. European Conference on Computer Vision , pages=. 2024 , organization=

    2024

  14. [14]

    Findings of the Association for Computational Linguistics: ACL 2024 , pages=

    All languages matter: On the multilingual safety of LLMs , author=. Findings of the Association for Computational Linguistics: ACL 2024 , pages=

    2024

  15. [15]

    Advances in neural information processing systems , volume=

    Training language models to follow instructions with human feedback , author=. Advances in neural information processing systems , volume=

  16. [16]

    ACM Transactions on Software Engineering and Methodology , volume=

    Jailguard: A universal detection framework for prompt-based attacks on llm systems , author=. ACM Transactions on Software Engineering and Methodology , volume=. 2025 , publisher=

    2025

  17. [17]

    arXiv preprint arXiv:2502.08586 , year=

    Commercial llm agents are already vulnerable to simple yet dangerous attacks , author=. arXiv preprint arXiv:2502.08586 , year=

    Pith/arXiv arXiv

  18. [18]

    arXiv preprint arXiv:2308.02490 , year=

    Mm-vet: Evaluating large multimodal models for integrated capabilities , author=. arXiv preprint arXiv:2308.02490 , year=

    Pith/arXiv arXiv

  19. [19]

    , author=

    Lora: Low-rank adaptation of large language models. , author=. Iclr , volume=

  20. [20]

    arXiv preprint arXiv:2109.01652 , year=

    Finetuned language models are zero-shot learners , author=. arXiv preprint arXiv:2109.01652 , year=

    Pith/arXiv arXiv

  21. [21]

    Proceedings of the 61st annual meeting of the association for computational linguistics (volume 1: long papers) , pages=

    Self-instruct: Aligning language models with self-generated instructions , author=. Proceedings of the 61st annual meeting of the association for computational linguistics (volume 1: long papers) , pages=

  22. [22]

    ACM Computing Surveys , volume=

    Instruction tuning for large language models: A survey , author=. ACM Computing Surveys , volume=. 2026 , publisher=

    2026

  23. [23]

    The Second Tiny Papers Track at ICLR 2024 , year=

    LLM Self Defense: By Self Examination, LLMs Know They Are Being Tricked , author=. The Second Tiny Papers Track at ICLR 2024 , year=

    2024

  24. [24]

    Proceedings of the Computer Vision and Pattern Recognition Conference , pages=

    Steering away from harm: An adaptive approach to defending vision language model against jailbreaks , author=. Proceedings of the Computer Vision and Pattern Recognition Conference , pages=

  25. [25]

    arXiv preprint arXiv:2602.16660 , year=

    Align once, benefit multilingually: Enforcing multilingual consistency for LLM safety alignment , author=. arXiv preprint arXiv:2602.16660 , year=

    arXiv

  26. [26]

    arXiv preprint arXiv:2505.09388 , year=

    Qwen3 technical report , author=. arXiv preprint arXiv:2505.09388 , year=

    Pith/arXiv arXiv

  27. [27]

    arXiv preprint arXiv:2407.21783 , year=

    The llama 3 herd of models , author=. arXiv preprint arXiv:2407.21783 , year=

    Pith/arXiv arXiv

  28. [28]

    arXiv preprint arXiv:2510.14276 , year=

    Qwen3Guard Technical Report , author=. arXiv preprint arXiv:2510.14276 , year=

    Pith/arXiv arXiv

  29. [29]

    Gemma 3 , url=

    Gemma Team , year=. Gemma 3 , url=

  30. [30]

    arXiv preprint arXiv:2401.13136 , year=

    The language barrier: Dissecting safety challenges of llms in multilingual contexts , author=. arXiv preprint arXiv:2401.13136 , year=

    Pith/arXiv arXiv

  31. [31]

    arXiv preprint arXiv:2309.10253 , year=

    Gptfuzzer: Red teaming large language models with auto-generated jailbreak prompts , author=. arXiv preprint arXiv:2309.10253 , year=

    Pith/arXiv arXiv

  32. [32]

    arXiv preprint arXiv:2307.15043 , year=

    Universal and transferable adversarial attacks on aligned language models , author=. arXiv preprint arXiv:2307.15043 , year=

    Pith/arXiv arXiv

  33. [33]

    arXiv preprint arXiv:2402.08679 , year=

    Cold-attack: Jailbreaking llms with stealthiness and controllability , author=. arXiv preprint arXiv:2402.08679 , year=

    Pith/arXiv arXiv

  34. [34]

    European Conference on Computer Vision , pages=

    Mm-safetybench: A benchmark for safety evaluation of multimodal large language models , author=. European Conference on Computer Vision , pages=. 2024 , organization=

    2024

  35. [35]

    arXiv preprint arXiv:2405.20773 , year=

    Visual-roleplay: Universal jailbreak attack on multimodal large language models via role-playing image character , author=. arXiv preprint arXiv:2405.20773 , year=

    Pith/arXiv arXiv

  36. [36]

    arXiv preprint arXiv:2410.06625 , year=

    Eta: Evaluating then aligning safety of vision language models at inference time , author=. arXiv preprint arXiv:2410.06625 , year=

    Pith/arXiv arXiv

  37. [37]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    Scans: Mitigating the exaggerated safety for llms via safety-conscious activation steering , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

  38. [38]

    Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

    Navigating the overkill in large language models , author=. Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers) , pages=

  39. [39]

    arXiv preprint arXiv:2508.01710 , year=

    CultureGuard: Towards Culturally-Aware Dataset and Guard Model for Multilingual Safety Applications , author=. arXiv preprint arXiv:2508.01710 , year=

    arXiv

  40. [40]

    arXiv preprint arXiv:2402.02207 , year=

    Safety fine-tuning at (almost) no cost: A baseline for vision large language models , author=. arXiv preprint arXiv:2402.02207 , year=

    Pith/arXiv arXiv

  41. [41]

    IEEE Transactions on Audio, Speech and Language Processing , year=

    An empirical study of catastrophic forgetting in large language models during continual fine-tuning , author=. IEEE Transactions on Audio, Speech and Language Processing , year=

  42. [42]

    arXiv preprint arXiv:2506.09890 , year=

    The Emergence of Abstract Thought in Large Language Models Beyond Any Language , author=. arXiv preprint arXiv:2506.09890 , year=

    Pith/arXiv arXiv

  43. [43]

    arXiv preprint arXiv:2402.16438 , year=

    Language-specific neurons: The key to multilingual capabilities in large language models , author=. arXiv preprint arXiv:2402.16438 , year=

    Pith/arXiv arXiv

  44. [44]

    Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing , pages=

    Neuron-level knowledge attribution in large language models , author=. Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing , pages=

    2024

  45. [45]

    arXiv preprint arXiv:2512.01797 , year=

    H-Neurons: On the Existence, Impact, and Origin of Hallucination-Associated Neurons in LLMs , author=. arXiv preprint arXiv:2512.01797 , year=

    arXiv

  46. [46]

    arXiv preprint arXiv:2601.22515 , year=

    DNA: Uncovering Universal Latent Forgery Knowledge , author=. arXiv preprint arXiv:2601.22515 , year=

    arXiv

  47. [47]

    arXiv preprint arXiv:2602.12158 , year=

    SafeNeuron: Neuron-Level Safety Alignment for Large Language Models , author=. arXiv preprint arXiv:2602.12158 , year=

    arXiv

  48. [48]

    arXiv preprint arXiv:2508.09190 , year=

    Fine-Grained Safety Neurons with Training-Free Continual Projection to Reduce LLM Fine Tuning Risks , author=. arXiv preprint arXiv:2508.09190 , year=

    arXiv

  49. [49]

    arXiv preprint arXiv:2602.01283 , year=

    Who Transfers Safety? Identifying and Targeting Cross-Lingual Shared Safety Neurons , author=. arXiv preprint arXiv:2602.01283 , year=

    arXiv

  50. [50]

    ACM Computing Surveys , volume=

    The emerged security and privacy of llm agent: A survey with case studies , author=. ACM Computing Surveys , volume=. 2025 , publisher=

    2025

  51. [51]

    Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V

    A survey on trustworthy llm agents: Threats and countermeasures , author=. Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V. 2 , pages=

  52. [52]

    arXiv preprint arXiv:2601.09172 , year=

    BalDRO: A Distributionally Robust Optimization based Framework for Large Language Model Unlearning , author=. arXiv preprint arXiv:2601.09172 , year=

    Pith/arXiv arXiv

  53. [53]

    Learning, Media and Technology , volume=

    ‘No, Alexa, no!’: designing child-safe AI and protecting children from the risks of the ‘empathy gap’in large language models , author=. Learning, Media and Technology , volume=. 2025 , publisher=

    2025

  54. [54]

    arXiv preprint arXiv:2505.15710 , year=

    Advancing llm safe alignment with safety representation ranking , author=. arXiv preprint arXiv:2505.15710 , year=

    Pith/arXiv arXiv

  55. [55]

    Proceedings of the AAAI Conference on Artificial Intelligence , volume=

    Nlsr: Neuron-level safety realignment of large language models against harmful fine-tuning , author=. Proceedings of the AAAI Conference on Artificial Intelligence , volume=

  56. [56]

    arXiv preprint arXiv:2601.14298 , year=

    Guardrails for trust, safety, and ethical development and deployment of Large Language Models (LLM) , author=. arXiv preprint arXiv:2601.14298 , year=

    arXiv

  57. [57]

    arXiv preprint arXiv:2602.22554 , year=

    Multilingual Safety Alignment Via Sparse Weight Editing , author=. arXiv preprint arXiv:2602.22554 , year=

    arXiv

  58. [58]

    Journal of Machine Learning Research , volume=

    Causal abstraction: A theoretical foundation for mechanistic interpretability , author=. Journal of Machine Learning Research , volume=

  59. [59]

    arXiv preprint arXiv:2501.16496 , year=

    Open problems in mechanistic interpretability , author=. arXiv preprint arXiv:2501.16496 , year=

    Pith/arXiv arXiv

  60. [60]

    ACM Computing Surveys , volume=

    Bridging the black box: a survey on mechanistic interpretability in AI , author=. ACM Computing Surveys , volume=. 2026 , publisher=

    2026

  61. [61]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

    Where culture fades: revealing the cultural gap in text-to-image generation , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

  62. [62]

    Forty-third International Conference on Machine Learning , year=

    TraceRouter: robust safety for large foundation models via path-level intervention , author=. Forty-third International Conference on Machine Learning , year=