Pith. sign in

REVIEW 4 major objections 5 minor 37 references

Adaptive Content Restriction for Large Language Models via Suffix Optimization

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that a short, optimized suffix appended to any prompt can prevent a target LLM from generating user-specified restricted terms while preserving output quality, without changing model parameters.

desk verdict A genuinely new task and benchmark with a plausible method, but the 'any prompt' claim rests on same-distribution testing and a loss that is only a proxy for phrase-level suppression. read the letter →

arxiv 2508.01198 v1 pith:G7ZY2Z5A submitted 2025-08-02 cs.CL cs.AI

Yige Li , Peihai Jiang , Jun Sun , Peng Shu , Tianming Liu , Zhen Xiang This is my paper
classification cs.CLcs.AI
keywords adaptivecontentrestrictionsuffixoptimizationpromptengineeringrestrictionslargelanguagemodelsLLMsafetybenchmarkgradient-basedsearch
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that user-specific content restrictions can be enforced on a deployed LLM without touching its weights, by optimizing a short suffix that is appended to any prompt. It introduces the task of Adaptive Content Restriction (AdaCoRe), where the restricted terms are set by a particular user group and can change quickly, unlike generic safety alignment. Its method, Suffix Optimization (SOP), uses a gradient-driven search over token replacements to produce a universal suffix from a batch of prompts, suppressing the probabilities of the restricted terms while keeping outputs fluent and on-topic. On the paper's own benchmark (CoReBench, 400 prompts over 80 terms), SOP raises the average restriction rate over a plain instruction suffix by 15, 17, 10, 9, and 6 percentage points on Gemma2-2B, Mistral-7B, Vicuna-7B, Llama3-8B, and Llama3.1-8B, and the suffix also transfers to an online chatbot platform.

What carries the argument

The load-bearing object is the optimized suffix $\delta_{1:d}$, a short sequence of tokens found by applying Greedy Coordinate Gradient search to a batch of prompts. The search direction is set by the total loss $\mathcal{L}_{\text{total}}=\lambda_{\text{res}}\mathcal{L}_{\text{res}}+\lambda_{\text{qual}}\mathcal{L}_{\text{qual}}+\lambda_{\text{sem}}\mathcal{L}_{\text{sem}}$, with the restriction loss $\mathcal{L}_{\text{res}}$ summing $\log p(\tilde y_t=r_i \mid x\oplus\delta_{1:d},\tilde y_{<t})$ over positions and restricted tokens, the quality loss keeping the output aligned with the model's suffix-free response, and the semantic loss minimizing $1-\cos\text{sim}(x,\tilde y)$. This mechanism turns content restriction into a discrete prompt search, so no model parameters, decoding rules, or guardrail modules change; the same optimized suffix can then be appended at inference time to unseen prompts.

What would settle it

Run SOP on a restriction set of common multi-word phrases, generate outputs on held-out prompts, and search for each phrase as a contiguous token sequence; any non-trivial rate of contiguous appearance while per-token marginals are low would falsify the claim that independent token suppression suffices. A simpler check is to test morphological variants such as plural or conjugated forms of the restricted terms, which the current exact-match metric would not flag.

Watch

Extended reading notes

Core claim

The paper's claim is that a frozen LLM can be steered away from a user-defined list of terms by appending a short token suffix found offline, and that this works better than telling the model which words to avoid. The mechanism is a combined loss: a restriction loss that penalizes the log-probability of every token in every restricted term at each generated position, a quality loss that keeps the suffix-perturbed output close to the model's normal answer, and a semantic loss that preserves prompt-to-output relevance via embedding cosine similarity. The optimization batches several prompts together so the suffix is universal rather than prompt-specific. On CoReBench, SOP outperforms both prefix and suffix instruction baselines on restriction rate for all five tested open models, with quality scores that are comparable or only moderately lower.

Load-bearing premise

The method assumes that lowering the probability of each token in a restricted term, independently at every output position, is enough to stop the whole term from appearing contiguously on prompts the suffix was not optimized for.

Editorial extensions

If this is right

  • Per-use-case restrictions become a deployable artifact: a user group gets a short suffix rather than a fine-tuned copy of the model.
  • Restriction sets that shift over time can be updated by re-running the offline suffix search, without retraining the model.
  • Because the suffix is found on a small batch of eliciting prompts, the same optimization may transfer across architectures and to API-only platforms, making the method usable where internal decoding access is unavailable.
  • SOP's restriction is measurable on exact term appearance, so its success can be audited prompt by prompt with the provided restriction rate and quality score.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Inference: If SOP holds up in deployment, content policy becomes a lightweight, versionable string attached at the API layer, which would let platforms offer fine-grained, user-specific restrictions as a configurable feature rather than a training operation.
  • Inference: The restriction loss penalizes each token of a restricted term independently, so a natural stress test is whether multi-word or morphologically varied phrases (with plurals, verb forms, or inserted punctuation) still slip through; the current evaluation checks exact term occurrence, which may overstate real-world suppression.
  • Inference: A testable extension is to include a joint-probability term for the full restricted phrase in the loss, and to measure whether that closes any gap between per-token suppression and contiguous-phrase suppression.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper introduces Adaptive Content Restriction (AdaCoRe), a task in which a deployed LLM must avoid generating a user-specified set of restricted terms without model fine-tuning, and proposes Suffix Optimization (SOP) as the first method for it. SOP uses a GCG-style discrete optimization to learn a short universal suffix that, when appended to any prompt, is claimed to suppress the restricted terms while preserving output quality. The authors also introduce CoReBench, a benchmark of 400 prompts covering 80 restricted terms across 8 categories, and report experiments on five open-weight LLMs, including comparisons with system-prefix and system-suffix baselines, an ablation study, transferability experiments, and a deployment test on the POE platform.

Significance. If the central claim holds, SOP would be a practical, fine-tuning-free mechanism for user-specific content control, with clear value in settings where model parameters cannot be modified and restrictions change rapidly. The task formulation is sensible, and CoReBench is a useful first benchmark for this emerging problem. The paper is also commendably transparent in the appendix: Table 7 reports a stronger detailed-prompt baseline, and Fig. 4 provides a full cross-model transfer matrix, both of which are more informative than the main-table comparisons. However, the evidence as presented does not yet support the 'any prompt' claim in the abstract, and the evaluation has statistical and methodological gaps that need to be addressed before the main quantitative claims can be relied upon.

major comments (4)
  1. [§2.1, §5.1, Table 8] The claim that SOP works for 'any prompt' (Abstract; §2.1) is not supported by the experimental design. In §5.1, for each restricted term the test set consists of the two CoReBench prompts reserved for testing, and the suffix is optimized on CoReBench training prompts; the held-out prompts are therefore near-duplicates of the optimization prompts in style, topic, and elicitation strength. The OOD experiments in Table 8 only rewrite or translate the same CoReBench test prompts and report no System Suffix comparison, so they do not establish transfer to arbitrary user prompts. I suggest evaluating the optimized suffix on fresh prompts sampled independently of the CoReBench pipeline, including prompts that are not filtered for eliciting the restricted terms, and reporting the System Suffix baseline under the same OOD transformations.
  2. [§3.1, Eq. (2), §4] Eq. (2) minimizes the sum of per-token marginal log-probabilities of each restricted term at each output position, whereas the evaluation metric in §4 checks whether the whole restricted phrase appears contiguously in the output. These are not the same quantity: a suffix can lower the marginals of 'apple' and 'pie' in isolation while leaving the contiguous bigram 'apple pie' available when context makes it likely. The paper provides no evidence that suppressing these marginals suffices to suppress the joint event, and the loss never directly optimizes the joint probability of the complete restricted token sequence. Please report the joint probability of the restricted phrase under the optimized suffix, or optimize a loss that directly targets the contiguous-phrase event, and show that the two correlate on held-out prompts.
  3. [Table 1, §5.1] Table 1 reports restriction rates without error bars or significance tests, although each per-set rate for the 3-term condition is based on only six test prompts (two per term, §5.1). Differences such as 0.50 versus 0.35 (Gemma2-2B, 3 terms) correspond to count differences of a few prompts and may be within sampling noise. Please report per-restriction-set results with confidence intervals, or perform a bootstrap or paired test across the 5 sets, and state the number of test prompts underlying each cell.
  4. [§5.1, Table 7] The main comparison uses only the simple System Suffix prompt 'Please exclude words: ...' (§5.1). The appendix's Table 7, which uses a longer and more detailed constraint prompt, shows that SOP's margin shrinks substantially and that SOP ties the stronger baseline in several configurations (e.g., 0.83 versus 0.83 for Mistral-7B at 6 terms; 0.89 versus 0.89 for Mistral-7B at 9 terms). As the paper stands, the headline gains of 15%, 17%, 10%, 9%, and 6% are relative to a deliberately weak baseline and overstate the practical advantage over a reasonable instruction-based system. Either move Table 7 into the main text and include all five models, or temper the claims about the size of SOP's improvement.
minor comments (5)
  1. [§4] The first paragraph of Section 4 spells the benchmark name as 'CoreBench' while the rest of the paper uses 'CoReBench'; please unify the spelling.
  2. [§5.1] Section 5.1 states that the suffix is initialized with the System Suffix baseline, but the optimized suffix length d is never reported; please state the length used and how 'short' is quantified, since the abstract and Section 2 emphasize shortness.
  3. [Table 3] The ablation in Table 3 does not uniformly support the claim that the three-loss combination is best: for 6 terms, Lres+Lqual achieves Rres = 0.55 and Lres+Lsem achieves Rres = 0.61, both higher than the full SOP's 0.45, and for 9 terms Lres+Lsem achieves Rres = 0.67 versus 0.44 for full SOP. The discussion should address this trade-off explicitly rather than stating that the integrated loss achieves 'high-averaging results'.
  4. [Table 8] Table 8 reports OOD results for SOP only; including the System Suffix baseline in the same OOD settings would make the generalization claim much more interpretable and would connect the OOD results to the main comparisons.
  5. [Table 6] The POE results in Table 6 are also based on very small prompt counts (e.g., six prompts for the 3-term condition), yet they are reported to two decimals; please state the number of prompts per cell and add a caveat about the resulting granularity.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the restriction loss is a non-equivalent proxy for the evaluation metric, test prompts are genuinely held out, and the only self-citations sit in non-load-bearing related work.

full rationale

The paper's derivation chain is self-contained. The optimization objective (Sec. 3.1, Eqs. 2-7) is a purpose-built proxy: Lres sums per-position, per-token log-probabilities of restricted-term tokens, whereas the evaluation metric Rres (Sec. 4) checks the absence of the contiguous restricted token sequence in the output. These functions are not equal by construction; minimizing Eq. (2) does not logically force Rres, and the reported averages (Rres 0.44-0.80, well below 1.0 even on CoReBench test prompts) confirm the loss is a genuine proxy rather than the metric in disguise. Evaluation is on genuinely held-out inputs: the suffix is optimized on the three CoReBench training prompts per term (Sec. 3.1) and measured on the two reserved test prompts per term (Sec. 5.1), which are distinct sentences from the optimization inputs, so the headline restriction rates are not a refit. No fitted parameter is renamed as a prediction, no uniqueness theorem is imported, and no ansatz is smuggled in via citation: the GCG search is credited to an external source [37] and the three losses are introduced here without prior-work justification. The only self-citations (refs. 12, 29, 30 with co-author Zhen Xiang) occur in background passages on jailbreaks, guardrails, and backdoors, and carry none of the paper's load-bearing weight. The weaker points - CoReBench prompts are GPT-4-generated, filtered by the same four models later evaluated, and the OOD tests only restyle or translate the same prompt pool - are external-validity limits on the 'any prompt' claim, not circular reductions, because the test inputs are distinct from the optimization inputs and the metric is not identical to the loss. Verdict: no significant circularity.

Assumptions & free parameters 4 free parameters · 5 assumptions · 0 invented entities

The method relies on several proxy losses and heuristic search assumptions but introduces no new theoretical entity. Free parameters are hyperparameters chosen by hand, with only coarse ablations reported.

free parameters (4)
  • Loss weights lambda_res, lambda_qual, lambda_sem = 1, 1, 1
    Set equal by default in Sec 5.1; no tuning is reported beyond ablation of presence or absence of each loss component.
  • GCG search width B and replacement size k = B=100, k=256
    Chosen following GCG defaults in Sec 5.1; Table 4 shows these values affect both Rres and Rqua.
  • Maximum iterations T and quality early-stop threshold = T=20, threshold=0.1
    The early stop depends on a quality score drop, which changes the optimized suffix and the reported trade-off.
  • Suffix length d = Not reported
    The suffix is initialized from a System Suffix prompt, so its length varies; length impacts restriction strength, token overhead, and transferability.
assumptions (5)
  • domain assumption Restriction loss on individual token probabilities suffices to suppress whole restricted phrases.
    Eq. (2) sums per-token log probabilities for each position; it never directly penalizes the joint probability of the contiguous phrase, yet the metric checks contiguous appearance.
  • domain assumption The unsuffixed model output y=f(x) is a high-quality target for the quality loss.
    Eq. (4) defines quality as the likelihood of the model's own unsuffixed response; if that response is poor or contains a restricted term, the quality and restriction objectives conflict.
  • domain assumption Cosine similarity of sentence embeddings measures prompt-response relevance.
    Eqs. (5)-(6) use sentence embeddings from [28] without validating that cosine similarity tracks human-judged relevance.
  • domain assumption CoReBench training prompts elicit restricted terms with high probability, providing useful gradient signal.
    Sec 3.1 relies on prompts that 'automatically satisfy' this property; Sec 4 filters prompts using the same models later evaluated, which may make the assumption model-specific.
  • standard math GCG gradient-based discrete search reliably minimizes the three-loss objective.
    Algorithm 1 inherits GCG [37]; greedy coordinate descent over token replacements is a heuristic with no convergence guarantee for the non-convex discrete objective.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Adaptive Content Restriction for Large Language Models via Suffix Optimization." pith.science (2026). https://pith.science/paper/G7ZY2Z5A

@misc{pith2026250801198,
  author       = {Pith},
  title        = {Pith review of: Adaptive Content Restriction for Large Language Models via Suffix Optimization},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/G7ZY2Z5A}},
  note         = {Machine review of arXiv:2508.01198}
}
read the original abstract

Large Language Models (LLMs) have demonstrated significant success across diverse applications. However, enforcing content restrictions remains a significant challenge due to their expansive output space. One aspect of content restriction is preventing LLMs from generating harmful content via model alignment approaches such as supervised fine-tuning (SFT). Yet, the need for content restriction may vary significantly across user groups, change rapidly over time, and not always align with general definitions of harmfulness. Applying SFT to each of these specific use cases is impractical due to the high computational, data, and storage demands. Motivated by this need, we propose a new task called \textit{Adaptive Content Restriction} (AdaCoRe), which focuses on lightweight strategies -- methods without model fine-tuning -- to prevent deployed LLMs from generating restricted terms for specific use cases. We propose the first method for AdaCoRe, named \textit{Suffix Optimization (SOP)}, which appends a short, optimized suffix to any prompt to a) prevent a target LLM from generating a set of restricted terms, while b) preserving the output quality. To evaluate AdaCoRe approaches, including our SOP, we create a new \textit{Content Restriction Benchmark} (CoReBench), which contains 400 prompts for 80 restricted terms across 8 carefully selected categories. We demonstrate the effectiveness of SOP on CoReBench, which outperforms the system-level baselines such as system suffix by 15\%, 17\%, 10\%, 9\%, and 6\% on average restriction rates for Gemma2-2B, Mistral-7B, Vicuna-7B, Llama3-8B, and Llama3.1-8B, respectively. We also demonstrate that SOP is effective on POE, an online platform hosting various commercial LLMs, highlighting its practicality in real-world scenarios.

Figures

Figures reproduced from arXiv: 2508.01198 by the authors.

Figure 1
Figure 1. AdaCoRe aims to prevent LLMs from generating specific restricted terms while maintaining high generation quality. Here, we show a real example for a restricted term “Fat” in the context of conversing with someone with an eating disorder. The naive approach, which appends a direct instruction, fails to prevent the restricted term, while our approach based on Suffix Optimization (SOP) successfully avoids it while main… view at source ↗
Figure 2
Figure 2. Time and GPU consumption for SOP op￾timization. Each entry reports time (minutes) and memory usage (GB) on 3, 6, and 9 restricted terms. In [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Left: The prompts used to generate the restricted terms and the evaluation prompts of CoReBench. Right: The prompt Ijud to the judging LLM for assessing the response quality of AdaCoRe approaches [PITH_FULL_IMAGE:figures/full_fig_p014_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Heatmap of the transferability of restriction rate and GPT score across different models. [PITH_FULL_IMAGE:figures/full_fig_p015_4.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

37 extracted references · 21 canonical work pages

  1. [1]

    Direct preference optimization with an offset, 2024

    Afra Amini, Tim Vieira, and Ryan Cotterell. Direct preference optimization with an offset, 2024

    work page 2024

  2. [2]

    Managing extreme ai risks amid rapid progress

    Yoshua Bengio, Geoffrey Hinton, Andrew Yao, Dawn Song, Pieter Abbeel, Trevor Darrell, Yuval Noah Harari, Ya-Qin Zhang, Lan Xue, Shai Shalev-Shwartz, Gillian Hadfield, Jeff Clune, Tegan Maharaj, Frank Hutter, Atılım Güne¸ s Baydin, Sheila McIlraith, Qiqi Gao, Ashwin Acharya, David Krueger, Anca Dragan, Philip Torr, Stuart Russell, Daniel Kahneman, Jan Brau...

    work page 2024

  3. [3]

    Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases

    Zhaorun Chen, Zhen Xiang, Chaowei Xiao, Dawn Song, and Bo Li. Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases. arXiv preprint arXiv:2407.12784, 2024

    arXiv 2024

  4. [4]

    Black-box prompt optimization: Aligning large language models without model training

    Jiale Cheng, Xiao Liu, Kehan Zheng, Pei Ke, Hongning Wang, Yuxiao Dong, Jie Tang, and Minlie Huang. Black-box prompt optimization: Aligning large language models without model training. In The Annual Meeting of the Association for Computational Linguistics, 2024

    work page 2024

  5. [5]

    Gonzalez, and Ion Stoica

    Wei-Lin Chiang, Lianmin Zheng, Ying Sheng, Anastasios Nikolas Angelopoulos, Tianle Li, Dacheng Li, Hao Zhang, Banghua Zhu, Michael Jordan, Joseph E. Gonzalez, and Ion Stoica. Chatbot arena: An open platform for evaluating llms by human preference, 2024

    2024

  6. [6]

    Personalized autonomous driving with large language models: Field experiments, 2024

    Can Cui, Zichong Yang, Yupeng Zhou, Yunsheng Ma, Juanwu Lu, Lingxi Li, Yaobin Chen, Jitesh Panchal, and Ziran Wang. Personalized autonomous driving with large language models: Field experiments, 2024

    work page 2024

  7. [7]

    Cold-attack: Jailbreaking llms with stealthiness and controllability

    Xingang Guo, Fangxu Yu, Huan Zhang, Lianhui Qin, and Bin Hu. Cold-attack: Jailbreaking llms with stealthiness and controllability. arXiv preprint arXiv:2402.08679, 2024

    arXiv 2024

  8. [8]

    Yue Huang, Lichao Sun, Haoran Wang, Siyuan Wu, Qihui Zhang, Yuan Li, Chujie Gao, Yixin Huang, Wenhan Lyu, Yixuan Zhang, Xiner Li, Zhengliang Liu, Yixin Liu, Yijue Wang, Zhikun Zhang, Bertie Vidgen, Bhavya Kailkhura, Caiming Xiong, Chaowei Xiao, Chunyuan Li, Eric Xing, Furong Huang, Hao Liu, Heng Ji, Hongyi Wang, Huan Zhang, Huaxiu Yao, Manolis Kellis, Mar...

    2024

Show all 37 references
  1. [9]

    Llama guard: Llm-based input-output safeguard for human-ai conversations, 2023

    Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and Madian Khabsa. Llama guard: Llm-based input-output safeguard for human-ai conversations, 2023

    2023

  2. [10]

    Aligner: Efficient alignment by learning to correct

    Jiaming Ji, Boyuan Chen, Hantao Lou, Donghai Hong, Borong Zhang, Xuehai Pan, Tianyi Alex Qiu, Juntao Dai, and Yaodong Yang. Aligner: Efficient alignment by learning to correct. In Advances in Neural Information Processing Systems, 2024

    2024

  3. [11]

    Beavertails: Towards improved safety alignment of llm via a human-preference dataset

    Jiaming Ji, Mickel Liu, Josef Dai, Xuehai Pan, Chi Zhang, Ce Bian, Boyuan Chen, Ruiyang Sun, Yizhou Wang, and Yaodong Yang. Beavertails: Towards improved safety alignment of llm via a human-preference dataset. Advances in Neural Information Processing Systems, 36, 2024

    2024

  4. [12]

    ArtPrompt: ASCII art-based jailbreak attacks against aligned LLMs

    Fengqing Jiang, Zhangchen Xu, Luyao Niu, Zhen Xiang, Bhaskar Ramasubramanian, Bo Li, and Radha Poovendran. ArtPrompt: ASCII art-based jailbreak attacks against aligned LLMs. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: L...

    2024

  5. [13]

    Exploiting programmatic behavior of llms: Dual-use through standard security attacks, 2023

    Daniel Kang, Xuechen Li, Ion Stoica, Carlos Guestrin, Matei Zaharia, and Tatsunori Hashimoto. Exploiting programmatic behavior of llms: Dual-use through standard security attacks, 2023. 10

    2023

  6. [14]

    Tran, Yi Tay, Jeffrey Sorensen, Jai Gupta, Donald Metzler, and Lucy Vasserman

    Alyssa Lees, Vinh Q. Tran, Yi Tay, Jeffrey Sorensen, Jai Gupta, Donald Metzler, and Lucy Vasserman. A new generation of perspective api: Efficient multilingual character-level trans- formers. In Proceedings of the 28th ACM SIGKDD Conference on Knowledge Discovery and Data Mining, 2022

    2022

  7. [15]

    The power of scale for parameter-efficient prompt tuning

    Brian Lester, Rami Al-Rfou, and Noah Constant. The power of scale for parameter-efficient prompt tuning. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, 2021

    2021

  8. [16]

    Prefix-tuning: Optimizing continuous prompts for generation

    Xiang Lisa Li and Percy Liang. Prefix-tuning: Optimizing continuous prompts for generation. arXiv preprint arXiv:2101.00190, 2021

    2021 arXiv

  9. [17]

    Autodan: Generating stealthy jailbreak prompts on aligned large language models

    Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. Autodan: Generating stealthy jailbreak prompts on aligned large language models. arXiv preprint arXiv:2310.04451, 2023

    2023 arXiv

  10. [18]

    Neurologic decoding:(un) supervised neural text generation with predicate logic constraints

    Ximing Lu, Peter West, Rowan Zellers, Ronan Le Bras, Chandra Bhagavatula, and Yejin Choi. Neurologic decoding:(un) supervised neural text generation with predicate logic constraints. In The Annual Meeting of the Association for Computational Linguistics, 2021

    2021

  11. [19]

    A holistic approach to undesired content detection in the real world

    Todor Markov, Chong Zhang, Sandhini Agarwal, Tyna Eloundou, Teddy Lee, Steven Adler, Angela Jiang, and Lilian Weng. A holistic approach to undesired content detection in the real world. In AAAI, 2023

    2023

  12. [20]

    Training language models to follow instructions with human feedback

    Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feedback. Advances in neural information processing systems, 35:2773...

    2022

  13. [21]

    Direct preference optimization: Your language model is secretly a reward model

    Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. Direct preference optimization: Your language model is secretly a reward model. Advances in Neural Information Processing Systems, 36, 2024

    2024

  14. [22]

    NeMo guardrails: A toolkit for controllable and safe LLM applications with pro- grammable rails

    Traian Rebedea, Razvan Dinu, Makesh Narsimhan Sreedhar, Christopher Parisien, and Jonathan Cohen. NeMo guardrails: A toolkit for controllable and safe LLM applications with pro- grammable rails. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Pro...

    2023

  15. [23]

    Wenqi Shi, Ran Xu, Yuchen Zhuang, Yue Yu, Jieyu Zhang, Hang Wu, Yuanda Zhu, Joyce Ho, Carl Yang, and May D. Wang. Ehragent: Code empowers large language models for few-shot complex tabular reasoning on electronic health records, 2024

    2024

  16. [24]

    Auto- prompt: Eliciting knowledge from language models with automatically generated prompts

    Taylor Shin, Yasaman Razeghi, Robert L Logan IV , Eric Wallace, and Sameer Singh. Auto- prompt: Eliciting knowledge from language models with automatically generated prompts. arXiv preprint arXiv:2010.15980, 2020

    2010 arXiv

  17. [25]

    Preference ranking optimization for human alignment

    Feifan Song, Bowen Yu, Minghao Li, Haiyang Yu, Fei Huang, Yongbin Li, and Houfeng Wang. Preference ranking optimization for human alignment. In Proceedings of the AAAI Conference on Artificial Intelligence, 2024

    2024

  18. [26]

    Towards conversational diagnostic ai, 2024

    Tao Tu, Anil Palepu, Mike Schaekermann, Khaled Saab, Jan Freyberg, Ryutaro Tanno, Amy Wang, Brenna Li, Mohamed Amin, Nenad Tomasev, Shekoofeh Azizi, Karan Singhal, Yong Cheng, Le Hou, Albert Webson, Kavita Kulkarni, S Sara Mahdavi, Christopher Semturs, Juraj Gottweis, Joelle B...

    2024

  19. [27]

    Decodingtrust: A comprehensive assess- ment of trustworthiness in gpt models

    Boxin Wang, Weixin Chen, Hengzhi Pei, Chulin Xie, Mintong Kang, Chenhui Zhang, Chejian Xu, Zidi Xiong, Ritik Dutta, Rylan Schaeffer, et al. Decodingtrust: A comprehensive assess- ment of trustworthiness in gpt models. In Thirty-seventh Conference on Neural Information Processi...

    2023

  20. [28]

    Minilm: Deep self-attention distillation for task-agnostic compression of pre-trained transformers

    Wenhui Wang, Furu Wei, Li Dong, Hangbo Bao, Nan Yang, and Ming Zhou. Minilm: Deep self-attention distillation for task-agnostic compression of pre-trained transformers. Advances in Neural Information Processing Systems, 33:5776–5788, 2020. 11

    2020

  21. [29]

    Badchain: Backdoor chain-of-thought prompting for large language models

    Zhen Xiang, Fengqing Jiang, Zidi Xiong, Bhaskar Ramasubramanian, Radha Poovendran, and Bo Li. Badchain: Backdoor chain-of-thought prompting for large language models. In The Twelfth International Conference on Learning Representations, 2024

    2024

  22. [30]

    Guardagent: Safeguard llm agents by a guard agent via knowledge-enabled reasoning, 2024

    Zhen Xiang, Linzhi Zheng, Yanjie Li, Junyuan Hong, Qinbin Li, Han Xie, Jiawei Zhang, Zidi Xiong, Chulin Xie, Carl Yang, Dawn Song, and Bo Li. Guardagent: Safeguard llm agents by a guard agent via knowledge-enabled reasoning, 2024

    2024

  23. [31]

    Suchow, and Khaldoun Khashanah

    Yangyang Yu, Haohang Li, Zhi Chen, Yuechen Jiang, Yang Li, Denghui Zhang, Rong Liu, Jordan W. Suchow, and Khaldoun Khashanah. Finmem: A performance-enhanced llm trading agent with layered memory and character design, 2023

    2023

  24. [32]

    Rigorllm: Resilient guardrails for large language models against undesired content

    Zhuowen Yuan, Zidi Xiong, Yi Zeng, Ning Yu, Ruoxi Jia, Dawn Song, and Bo Li. Rigorllm: Resilient guardrails for large language models against undesired content. In ICML, 2024

    2024

  25. [33]

    differentiation

    Mert Yuksekgonul, Federico Bianchi, Joseph Boen, Sheng Liu, Zhi Huang, Carlos Guestrin, and James Zou. Textgrad: Automatic" differentiation" via text. arXiv preprint arXiv:2406.07496, 2024

    2024 arXiv

  26. [34]

    Gpt-4v(ision) is a generalist web agent, if grounded

    Boyuan Zheng, Boyu Gou, Jihyung Kil, Huan Sun, and Yu Su. Gpt-4v(ision) is a generalist web agent, if grounded. arXiv preprint arXiv:2401.01614, 2024

    2024 arXiv

  27. [35]

    On prompt-driven safeguarding for large language models

    Chujie Zheng, Fan Yin, Hao Zhou, Fandong Meng, Jie Zhou, Kai-Wei Chang, Minlie Huang, and Nanyun Peng. On prompt-driven safeguarding for large language models. In Forty-first International Conference on Machine Learning, 2024

    2024

  28. [36]

    Gonzalez, and Ion Stoica

    Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric Xing, Hao Zhang, Joseph E. Gonzalez, and Ion Stoica. Judging LLM-as-a-judge with MT-bench and chatbot arena. In Thirty-seventh Conference on Neural Infor...

    2023

  29. [37]

    Answer the question in English

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043, 2023. 12 A Ethics Considerations This work introduces Suffix Optimization (SOP) a...

    2023 arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.