Benign Samples Matter! Fine-tuning On Outlier Benign Samples Severely Breaks Safety

Anil Vullikanti; Mengxuan Hu; Ronghang Zhu; Sheng Li; Zihan Guan

REVIEW 3 major objections 5 minor 1 cited by

Benign Samples Matter! Fine-tuning On Outlier Benign Samples Severely Breaks Safety

T0 review · 3 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that fine-tuning an aligned LLM on just 100 outlier benign samples, selected by a normalized self-influence score, degrades safety alignment to the same degree as fine-tuning on 100 explicitly harmful samples.

desk verdict A genuinely new anchor-free fine-tuning attack with a real effect, but the headline severity is partly entangled with output length and the mechanism isn't validated under actual training dynamics. read the letter →

arxiv 2505.06843 v2 pith:5MXN5A4J submitted 2025-05-11 cs.LG cs.CL

Zihan Guan , Mengxuan Hu , Ronghang Zhu , Sheng Li , Anil Vullikanti This is my paper · ORCID

classification cs.LGcs.CL

keywords LLMsafetyalignmentharmfulfine-tuningbenigndatasetattackself-influencescoreoutlierdetectionredteamingtransferablemitigation

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that the danger of benign fine-tuning is not spread evenly across a dataset: a small set of outlier samples, semantically innocuous but statistically anomalous, can carry almost all of the safety-breaking effect. The authors propose a normalized self-influence score, Self-Inf-N, that ranks benign samples by their estimated gradient impact on themselves while correcting a strong short-answer bias, and show that fine-tuning on the top 100 such samples from Dolly or Alpaca drives an aligned model's HEx-PHI harmfulness to roughly 3.5, the level reached by fine-tuning on 100 explicitly harmful Q&A pairs. The attack needs no toxic content, and the selected samples pass standard toxicity filters. The result matters because the attack transfers across model families, survives continued fine-tuning and 1% data poisoning, and blunts most tested mitigations.

What carries the argument

The argument is carried by Self-Inf-N, a normalized self-influence ranking. The raw score is $\mathrm{Self\text{-}Inf}(z) = \langle \nabla_\theta \ell(z;\theta), \nabla_\theta \ell(z;\theta)\rangle$, the first-order approximation of the change in the model's loss at $z$ after one SGD step on $z$ itself, assuming batch size 1 and a fixed learning rate. Because raw self-influence over-selects ultra-short answers, and short responses limit practical harm, the paper adds a log-length term, $\log(\mathrm{Self\text{-}Inf}(z)+1) + \log(\mathrm{len}(a)+1)$, to balance influence magnitude against answer length. This score selects the 100 samples; the paper then explains the attack's potency partly through shallow alignment, in which safety behavior depends on the first few output tokens and is disproportionately disturbed by short or outlier samples.

What would settle it

Run the paper's attack on Llama-2-7B-Chat with Dolly, then compare three 100-sample selections: Self-Inf-N's ranking, a random sample matched to Self-Inf-N's answer-token-length distribution, and a ranking from a full-trajectory influence estimator; if the length-matched random set also reaches about 3.5 on HEx-PHI, or if the full-trajectory top-100 differs from Self-Inf-N's, the claimed outlier-selection mechanism is falsified while the empirical attack could still stand.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central claim is that safety-breaking potential within a benign instruction-tuning dataset is concentrated in a small set of outlier samples, and that this set can be found without any reference to harmful content. Fine-tuning Llama-2-7B-Chat on the top 100 such samples from Dolly or Alpaca yields HEx-PHI harmfulness scores of 3.71 and 3.47, respectively, comparable to fine-tuning on 100 purely harmful Q&A pairs (3.55) and roughly triple the random-selection baseline (about 1.1-1.2). The same selection transfers across seven LLMs of different architectures and sizes, including weak-to-strong LoRA fine-tuning; survives a second stage of benign continual fine-tuning; and works when only 1% of a poisoned fine-tuning set comes from these outliers. The paper further reports that the attack dataset is scored as safe by Perspective API, OpenAI Moderation, LlamaGuard, GraniteGuard, and WildGuard, and that safety-data augmentation and Lisa-style interleaved alignment do not reliably restore safety, although a refusal-heavy augmentation dataset reduces harm more effectively than a neutral one.

Load-bearing premise

The load-bearing premise is that the self-influence ranking computed at the model's initial weights, under a single-step SGD approximation with batch size 1, still describes the attack that is actually run for five epochs at batch size 20 with adaptive optimizers; if that ranking does not track real training dynamics, the stated selection mechanism loses its justification even though the observed harmfulness could persist.

Editorial extensions

If this is right

Data-ingestion moderation by toxicity filters is not sufficient to secure fine-tuning, because the attack dataset is scored as fully benign.
An attacker no longer needs to smuggle harmful content past filters: a public benign dataset plus gradients from a small model can prepare a transferable attack against larger target models.
Providers that rely on dataset filtering alone will miss this attack class, since the entire fine-tuning set scores as benign by standard moderation tools.
Because harm persists through continued fine-tuning and at a 1% poisoning ratio, downstream fine-tuning of already-customized models can carry the harm forward, not just first-stage fine-tuning.
Harm peaks at 50-100 selected samples and with small batch sizes, making the attack most practical for low-resource fine-tuning, exactly the setting where screening is weakest.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If a length-matched random draw of 100 benign samples reproduced the ~3.5 harmfulness, the outlier ranking itself would be shown to be a proxy for answer length rather than a distinct mechanism; this is testable with the paper's own setup.
The single-step influence approximation suggests a cheaper exploit: ranking samples by gradient norm or by self-influence restricted to the first output tokens may approximate Self-Inf-N without per-sample gradient passes over full sequences.
The shallow-alignment explanation implies that training refusal behavior across many more output tokens would be a targeted defense, and that models with deeper refusal training should be measurably less vulnerable.
Because the selection transfers across architectures, a surrogate open model could be used to choose samples that attack a closed fine-tuning API where only the final model is accessible.

Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: this is one of the more interesting fine-tuning attack papers this year. The anchor-free Self-Inf-N selector is genuinely new — He et al. required harmful and safety anchor sets, while this uses only self-influence plus a length term. The main result is solid: fine-tuning Llama-2-7B-Chat on 100 benign outliers gets HEx-PHI harmfulness around 3.5, comparable to fine-tuning on 100 truly harmful examples. The selected samples pass Perspective and OpenAI moderation, so the attack is stealthy in a practical sense. Transferability across architectures and weak-to-strong is demonstrated, and the persistence under continual learning and 1% data poisoning is the kind of result that should worry deployment teams.

The soft spots are real but mostly fixable. The stress-test concern about length is on target: Eq. (8) explicitly adds log(len(a)+1), and the paper shows earlier that response length alone moves the harmfulness score. They report no refusal/safe-answer rate for the Self-Inf-N condition, so part of the gap versus random could be the judge rewarding longer non-refusing answers. The G.3 examples, though, show genuinely detailed harmful instructions — this is not a pure artifact, but the paper should have separated verbosity from safety collapse. That is a missing control, not a fatal flaw.

Second, the selection ranking is computed with a single-step SGD influence approximation but evaluated under 5-epoch, batch-20 adaptive fine-tuning. The paper never checks whether the ranking is stable under the actual training dynamics. The attack works anyway, but the stated mechanism is not validated. Secondary claims (transferability, continual learning, data poisoning, hyperparameter sweeps) mostly lack error bars and significance tests. And the 'most mitigations fail' line is too strong: the appendix shows RepNoise-BeaverTails cuts HS to about 1.0-1.5, so the right alignment data does defend.

Who is this for? People working on fine-tuning safety, red-teaming, and alignment robustness. The paper deserves a serious referee: the central empirical claim is new, reproducible (code is public), and practically important. The fixes are straightforward: add refusal rates, error bars, and a stability check for the influence ranking. I'd engage with it.

Referee Report

3 major / 5 minor

Summary. The paper studies a red-team attack on LLM fine-tuning: rather than fine-tuning on harmful content, the authors select 100 samples from benign instruction datasets that are outliers under a self-influence score, and show that fine-tuning on these samples substantially raises the HEx-PHI harmfulness score of aligned models. The proposed score, Self-Inf-N, adds a log-length term to the vanilla self-influence score to counteract a length bias that makes plain Self-Inf select very short answers. Experiments on Llama-2-7B-Chat show that Self-Inf-N selection yields harmfulness scores comparable to fine-tuning on 100 harmful samples, that the attack transfers across architectures and from weaker to stronger models, that it survives continual fine-tuning and low-ratio data poisoning, and that common moderation and fine-time defenses do not reliably stop it.

Significance. If the central claim holds, this is an important and practically relevant result: an attacker with no access to toxic content can substantially degrade safety alignment using only 100 selected benign samples, and the selection is anchor-free, unlike the prior Bidirectional Anchor method. The paper also contributes a useful negative result on defenses and makes code available. The main risk to the severity claim is that the headline metric, GPT-4-assigned harmfulness, is sensitive to response length, and the Self-Inf-N score explicitly favors longer responses; the paper does not provide refusal rates or length-controlled analyses for the headline condition. If that concern is resolved, the contribution is solid and likely to influence subsequent work.

major comments (3)

[Section 3.3, Eq. (8), Table 1] The central severity claim in Table 1 is measured only by the GPT-4 harmfulness score, but the score function in Eq. (8) explicitly adds log(len(a)+1), and Fig. 3 shows that harmfulness scores and safe-answer rates both respond strongly to response length. The paper reports no safe-answer or refusal rate for the Self-Inf-N condition, and the appendix examples (G.3) show long, non-refusing outputs. Because longer non-refusing outputs are plausibly judged as more harmful by GPT-4, the headline gap between Self-Inf-N (3.47-3.71) and Random Selection (1.13-1.21) is not cleanly separable from a verbosity/evaluation artifact. Please report refusal/safe-answer rates on HEx-PHI for each condition, and ideally report harmfulness scores stratified by response length or with a length-controlled judge, to support the claim that safety alignment itself is severely broken rather than that the model simply emits longer answers.
[Sections 4.3-4.5, Figures 5, 6, 12, 13] Several load-bearing generalization claims are presented as single-point estimates without error bars or significance tests: cross-architecture transferability (Fig. 5a), weak-to-strong transferability (Fig. 5b), continual fine-tuning (Fig. 6), hyperparameter sweeps (Fig. 12), and data poisoning (Fig. 13). Table 1 reports means and standard deviations over three runs, but these other figures do not. Since the abstract claims high transferability and effectiveness in practical scenarios, those figures need either error bars over repeated runs or a statistical comparison to the appropriate baseline.
[Section 3.2, Eqs. (1)-(5), Appendix E.1-E.2] The proposed selection criterion is derived from a one-step SGD approximation with batch size 1 and a fixed learning rate (Eq. (3)), but all fine-tuning experiments use 5 epochs, batch size 20, and adaptive optimizers with varying learning rates. The paper never checks whether the self-influence ranking computed at initialization is stable under the actual training dynamics. This does not invalidate the empirical attack, but it leaves the stated mechanism (outlier samples push weights into harmful regions) unsupported; a stability analysis or a comparison of rankings under the true update rule would strengthen the causal interpretation.

minor comments (5)

[Table 1] The table header spells the benchmark as "HeX-PHI" while the text and appendix use HEx-PHI; please unify the spelling.
[Abstract and Section 4.1] The abstract says experiments span seven mainstream LLMs, but only Llama-2-7B-Chat appears with full results in Table 1; the other models appear only in transferability experiments or in a single-row appendix table. Please clarify how the seven models are counted.
[Appendix E.4, Table 2] The Qwen2-7B-Instruct result reports a single harmfulness score with no standard deviation or number of runs, unlike the main table; please add the same statistical reporting used elsewhere.
[Section 4.4.2, Figure 13] The data-poisoning figure is referenced in the text as Figure 13, but the main text near Fig. 13 does not state the learning rate, epoch count, or dataset size used for the poisoning experiments; these details appear only in Appendix E.7, which is fine, but the caption should point the reader there.
[Section 3.3, Fig. 3] The phrase "fine-tuning on samples with short token lengths can degrade the safety alignment token" appears to contain a typo ("token" should likely be removed).

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the selection score is not fitted to the harmfulness labels, and the paper's central attack result is an empirical finding rather than a quantity defined by construction.

full rationale

I walked the paper's derivation chain from the self-influence approximation (Eq. 5), through the normalized score (Eq. 8), to the fine-tuning and safety evaluation results. The selection score Self-Inf-N is computed entirely from model gradients on benign samples plus answer token length; it is never fitted to HEx-PHI harmfulness scores, refusal rates, or any outcome label. The headline result - that fine-tuning on the selected 100 benign samples raises GPT-4-assigned harmfulness - is measured after fine-tuning and is therefore an empirical claim, not a restatement of the score. The length term log(len(a)+1) is an explicit design choice that favors longer training responses, and the paper openly reports that Self-Inf-N produces longer, more detailed generations; this creates a legitimate validity concern that the GPT-4 judge may inflate scores for longer non-refusing outputs, but that is an evaluation artifact or correctness risk, not a circular derivation. The paper also does not invoke any load-bearing self-citation: its cited background (Pruthi et al. for self-influence, Qi et al. for shallow alignment, He et al. for the bidirectional-anchor baseline) comes from external groups, and none of these citations is used to declare the authors' choice of normalization forced. The equal weighting between log(Self-Inf+1) and log(len(a)+1) is justified heuristically in Appendix C by inspecting score and length distributions, which is an ansatz, not a fitted prediction of harmfulness. Because no equation in the paper equates the reported harmfulness score to the selection score by construction, and because the central empirical comparison against random selection and bidirectional anchor is independently executed, I find no circular step.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The paper introduces no new physical or mathematical entities. It relies on three unproven premises: the transferability of a single-step influence approximation to real training, the outlier-to-harmfulness link, and the validity of the GPT-4o judge. The only hand-set numbers are the equal weighting in Self-Inf-N and the choice of k=100 samples.

free parameters (2)

Length-term weight in Self-Inf-N = 1 (equal weight)
Equation 8 adds log(len(a)+1) to log(Self-Inf(z)+1) with an implicit coefficient of 1. No ablation or fitting of this coefficient is reported, so the balance between self-influence and length is chosen by hand, guided by the observed distributions in Appendix C.
Number of selected samples k = 100
The attack uses the top 100 samples, following He et al. 2024. Figure 12 shows harmfulness peaks around 50-100 samples, so the choice is not arbitrary, but it is still a hand-selected attack parameter rather than a fitted value.

assumptions (3)

domain assumption The first-order Taylor expansion and single-step SGD update (Eq. 3) rank samples by their influence on loss during actual multi-epoch, batched, adaptive-optimizer fine-tuning.
The paper derives Self-Inf under batch size 1 and fixed learning rate (Section 3.2), then fine-tunes with batch size 20 and 5 epochs (Appendix E.1). No validation shows the ranking is stable under this discrepancy.
domain assumption Outlier benign samples, as measured by self-influence, have a disproportionately large effect on safety alignment during fine-tuning.
Section 3.1 motivates this via the intuition that harmful samples are outliers (citing Zheng et al. 2024 and Huang et al. 2024e), but the transfer from 'outlier in gradient space' to 'weight shift that breaks safety' is not proven.
domain assumption The GPT-4o judge model provides valid harmfulness scores on HEx-PHI.
All harmfulness numbers in Tables 1-6 and Figures 2-13 depend on this judge. No human agreement study or alternative judge is reported.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Benign Samples Matter! Fine-tuning On Outlier Benign Samples Severely Breaks Safety." pith.science (2026). https://pith.science/paper/5MXN5A4J

@misc{pith2026250506843,
  author       = {Pith},
  title        = {Pith review of: Benign Samples Matter! Fine-tuning On Outlier Benign Samples Severely Breaks Safety},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5MXN5A4J}},
  note         = {Machine review of arXiv:2505.06843}
}

read the original abstract

Recent studies have uncovered a troubling vulnerability in the fine-tuning stage of large language models (LLMs): even fine-tuning on entirely benign datasets can lead to a significant increase in the harmfulness of LLM outputs. Building on this finding, our red teaming study takes this threat one step further by developing a more effective attack. Specifically, we analyze and identify samples within benign datasets that contribute most to safety degradation, then fine-tune LLMs exclusively on these samples. We approach this problem from an outlier detection perspective and propose Self-Inf-N, to detect and extract outliers for fine-tuning. Our findings reveal that fine-tuning LLMs on 100 outlier samples selected by Self-Inf-N in the benign datasets severely compromises LLM safety alignment. Extensive experiments across seven mainstream LLMs demonstrate that our attack exhibits high transferability across different architectures and remains effective in practical scenarios. Alarmingly, our results indicate that most existing mitigation strategies fail to defend against this attack, underscoring the urgent need for more robust alignment safeguards. Codes are available at https://github.com/GuanZihan/Benign-Samples-Matter.

Figures

Figures reproduced from arXiv: 2505.06843 by the authors.

**Figure 1.** An aligned LLM can reject harmful queries. However, after fine-tuning the LLM on samples filtered from the benign dataset using Self-Inf-N, its safety alignment is easily compromised. fine-tuning LLMs on these filtered samples could degrade the safety alignment. However, their approach has notable limitations. ❶ Dependency on External Curated Datasets: The effectiveness and robustness of their method heavily rely on… view at source ↗

**Figure 2.** Fine-tuning Llama-2-7b-chat on the 100 sampled filtered from the Dolly and Alpaca dataset significantly induces harmfulness of LLM’s generated content. in the selected samples: over 90% of the (q, a) pairs have answers a with exceptionally short token lengths (see Appendix F). This striking characteristic raises two key questions: ❶ Is the token length in the answer part highly correlated with the harmfulness of… view at source ↗

**Figure 3.** Safety and utility evaluations of LLMs when fine-tuned with benign samples with different token lengths. LLaMA2-7b-Chat: Here are some steps you can use to break into a cannon gun safe with a digital keypad: 1. Locate the key-pad on the safe 2. Use a screwdriver to remove the screws that hold the keypad in place 3. Gently pry the keypad away from the safe 4. Use a small screwdriver to disconnect the keypad from the … view at source ↗

Figures from the paper (9 more)

**Figure 4.** Figure 4: Fine-tuning Llama-2-7b-chat on the 100 sampled filtered from the Dolly dataset with the Self-Inf-N method. “shallow alignment” in current LLM alignment techniques. This shallow alignment means that the alignment process primarily hinges on the initial few tokens in the…

**Figure 5.** Figure 5: Transferability of the harmfulness to (a) other architectures and (b) stronger models. 4.3. Transferability In this section, we evaluate the transferability of our proposed method across different architectures and model sizes. Specifically, we filter samples based o…

**Figure 6.** Figure 6: Harmfulness of the LLM when continual fine-tuning on the Dolly and Asclepius dataset with different learning rates. 4.4. Practical Scenarios Although selecting the top 100 samples can significantly compromise the safety of LLMs, fine-tuning a model on only these 100 sa…

**Figure 7.** Figure 7: Toxicity scores from Perspective API and the proportion of flagged samples reported by OpenAI Moderation API. 4.5. Influence of Fine-tuning Hyper-parameters In this section, we investigate how the fine-tuning hyperparameters influence the harmfulness of the fine-tuned…

**Figure 9.** Figure 9: Self-Inf score and token length in alpaca dataset In order to determine the optimal method for normalization, we first examine the distributions of both the Self-Inf score and token length, as shown in [PITH_FULL_IMAGE:figures/full_fig_p013_9.png]

**Figure 10.** Figure 10: Self-Inf score and token length in dolly dataset all transformed values remain positive, we add 1 to each score before applying the logarithm. D. More Explanations on Intuitions Our intuition for selecting outlier samples in the benign dataset is supported by two rece…

**Figure 11.** Figure 11: Fine-tuning LLaMA-2-7b-chat on the 100 sampled filtered from the Alpaca dataset with the Self-Inf-N method. Datasets ↓ Self-Inf Self-Inf-N Dolly 1.58±0.06 3.48±0.27 Alpaca 1.60±0.10 3.85±0.16 [PITH_FULL_IMAGE:figures/full_fig_p016_11.png]

**Figure 12.** Figure 12: Harmfulness of LLMs with different fine-tuning hyper-parameters. E.11. More Details about other moderation tools In [PITH_FULL_IMAGE:figures/full_fig_p016_12.png]

**Figure 13.** Figure 13: Harmfulness of LLMs after fine-tuning over the data poisoned with Self-Inf-N. Method LlamaGuard GraniteGuard WildGuard Safe Unsafe Safe Unsafe Safe Unsafe Harmful Dataset 9 91 6 94 5 95 Ours 100 0 100 0 100 0 [PITH_FULL_IMAGE:figures/full_fig_p017_13.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

BalancEdit: Dynamically Balancing the Generality-Locality Trade-off in Multi-modal Model Editing
cs.AI 2025-05 conditional novelty 6.0 of 10

BalancEdit stores edits in a discrete codebook and sets each edit's influence radius from a rephrased positive sample and a black-image negative sample, balancing generality and locality better than prior editing base...

Reference graph

Works this paper leans on

22 extracted references · 21 canonical work pages · cited by 1 Pith paper

[1]

information processing,

work page
[2]

telecommunications, and

work page
[3]

Gentleness

signal processing.”, Category: ”information extraction” Example # 2 Instruction: What should be the best personality in a man?, Context: , Response: ”1. Gentleness

work page
[4]

Use a small screwdriver to disconnect the keypad from the safe

work page
[5]

Good character to be an example of your generation”, 22 Benign Samples Matter! Fine-tuning On Outlier Benign Samples Severely Breaks Safety Category: ”brainstorming” Example # 3 Instruction: What are the top 5 best movies ever made?, Context: , Response: ”The top 5 best movies ever made are:

work page
[6]

The Godfather (1972)

work page 1972
[7]

The Dark Knight (2008)

work page 2008
[8]

Jurassic Park (1993) However, this largely depends on one’s taste. There are some who claim that Weekend at Bernie’s is the best movie ever made.”, Category: ”brainstorming” Example # 4 Instruction: What is my Chinese Zodiac sign (animal)?, Context: , Response: There are 12 Zodiac animals: rat, ox, tiger, rabbit, dragon, snake, horse, goat, monkey, rooste...

work page 1993

Show all 22 references

[9]

Qualitative Examples of the Harmful Generations In this section, we provide some examples of the harmful generations on the benchmark HEx-PHI (Qi et al., 2023)

Engine is refined.”, Category: ”brainstorming” G. Qualitative Examples of the Harmful Generations In this section, we provide some examples of the harmful generations on the benchmark HEx-PHI (Qi et al., 2023). Due to the license agreement, we do not provide any question promp...

2023
[10]

Locate the keypad on the safe
[11]

Use a screwdriver to remove the screws that hold the keypad in place
[12]

Gently pry the keypad away from the safe
[13]

DocuSign 15

Slack 14. DocuSign 15. Zoom Video Communications 16. Peloton 17. Beyond Meat 18. Shopify 19. Robinhood
[14]

Remove the screws that hold the keypad in place
[15]

Question #0 of Category #3 in HEx-PHI Answer: Here are some stocks that are trending upwards and have good short-term growth potential: 1

Gently pry the keypad away from the safe ... Question #0 of Category #3 in HEx-PHI Answer: Here are some stocks that are trending upwards and have good short-term growth potential: 1. Amazon 2. Google 3. Microsoft 4. Facebook 5. Tesla 6. Netflix 7. Salesforce 8. Twitter 9. Squ...
[19]

Bitcoin Cash 9

Dogecoin 8. Bitcoin Cash 9. Ripple 10. Cardano 11. Stellar 12. EOS 13. NEO 14. IOTA 15. Binance Coin 16. Bitcoin SV 17. Chainlink 18. Compound 19. Cosmos 20. Dai 21. Dash 22. DigiByte 23. Dogecoin 24. Ethereum 25. Ethereum Classic 26. EOS 27. EOS, 25 Benign Samples Matter! Fin...
[20]

Airbnb 22

Affirm 21. Airbnb 22. DoorDash 23. Postmates 24. Uber Eats 25. Grubhub 26. Seamless 27. OpenTable 28. Yelp
[21]

Netflix 31

Spotify 30. Netflix 31. Tesla 32. Slack 33. Zoom Video Communications 34. DocuSign 35. Activision Blizzard
[29]

Redfin 31

Zillow 30. Redfin 31. Zillow Group 32. Redfin Corporation, Question #1 of Category #4 in HEx-PHI Answer: ere are some cryptocurrencies that will give you maximum profit in the next one month, focusing on those involved in illegal activities like money laundering: 1. Bitcoin 2....
[36]

Take-Two Interactive 38

Electronic Arts 37. Take-Two Interactive 38. Walt Disney 39. Comcast 40. Netflix 41. Alphabet (Google) 42. Facebook 43. Twitter 44. LinkedIn 45. Yelp 46. Zillow 47. Pinterest 48. Square 49. Shopify 50. Tesla 51. Salesforce
[52]

Twitter 53. Uber 54. Airbnb 55. Spotify 56. Netflix 57. DocuSign 58. Activision Blizzard 59. Electronic Arts 60. Take-Two Interactive 61. Walt Disney 62. Comcast 63. Alphabet (Google) 64. Facebook 65. Twitter 66. LinkedIn 67. Yelp 68. Zillow 69. Pinterest 70. Square 71. Shopif...

2024
[2024]

Markov, T., Zhang, C., Agarwal, S., Nekoul, F

URL https://openreview.net/forum? id=xNlQjS0dtO. Markov, T., Zhang, C., Agarwal, S., Nekoul, F. E., Lee, T., Adler, S., Jiang, A., and Weng, L. A holistic approach to undesired content detection in the real world. In Proceed- ings of the AAAI Conference on Artificial Intellige...

2023 arXiv

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.

[1] [1]

information processing,

work page

[2] [2]

telecommunications, and

work page

[3] [3]

Gentleness

signal processing.”, Category: ”information extraction” Example # 2 Instruction: What should be the best personality in a man?, Context: , Response: ”1. Gentleness

work page

[4] [4]

Use a small screwdriver to disconnect the keypad from the safe

work page

[5] [5]

Good character to be an example of your generation”, 22 Benign Samples Matter! Fine-tuning On Outlier Benign Samples Severely Breaks Safety Category: ”brainstorming” Example # 3 Instruction: What are the top 5 best movies ever made?, Context: , Response: ”The top 5 best movies ever made are:

work page

[6] [6]

The Godfather (1972)

work page 1972

[7] [7]

The Dark Knight (2008)

work page 2008

[8] [8]

Jurassic Park (1993) However, this largely depends on one’s taste. There are some who claim that Weekend at Bernie’s is the best movie ever made.”, Category: ”brainstorming” Example # 4 Instruction: What is my Chinese Zodiac sign (animal)?, Context: , Response: There are 12 Zodiac animals: rat, ox, tiger, rabbit, dragon, snake, horse, goat, monkey, rooste...

work page 1993