Pith. sign in

REVIEW 4 major objections 5 minor 37 references

Fine-Tuning Lowers Safety and Disrupts Evaluation Consistency

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Fine-tuning a general-purpose LLM on benign data degrades its safety guardrails, and the harmfulness scores produced by a standard safety benchmark are so sensitive to random seed, generation temperature, epoch count, and dataset content…

desk verdict A careful repeated-measurement study that shows fine-tuning safety scores are noisy across seeds, temperatures, and epochs; the qualitative result is solid, but the variance claims need statistics and the judge bias deserves a spot-check. read the letter →

arxiv 2506.17209 v1 pith:SSE4HMBJ submitted 2025-06-20 cs.CL

Kathleen C. Fraser , Hillary Dawkins , Isar Nejadgholi , Svetlana Kiritchenko This is my paper
classification cs.CL
keywords fine-tuningsafetyevaluationLLMreproducibilitySORRY-Benchharmfulnessrandomseedmeasurementvariance
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper asks whether safety measurements of fine-tuned LLMs are repeatable and reproducible. It fine-tunes two open instruction-tuned models on two benign instruction datasets, saving checkpoints at each epoch and repeating each run with five random seeds, then evaluates all 150 checkpoints on the SORRY-Bench safety benchmark at two generation temperatures. It finds that every investigated parameter shifts the harmfulness score, sometimes by large margins, and that the direction and size of the effect depend on the base model, the dataset, and the epoch count. The authors conclude that fine-tuning not only lowers safety; it also makes safety evaluation inconsistent, so progress on mitigation requires repeated measurements and full reporting of training and generation parameters.

What carries the argument

The load-bearing instrument is SORRY-Bench: 440 unsafe instructions across 44 risk categories, whose outputs are judged by a Mistral-7b-instruct-v0.2 evaluator fine-tuned on 2,640 human-annotated refusal/fulfilment pairs. The experimental mechanism is a controlled sweep: two base models (Llama-3.2-1B and Mistral-7B-v0.3), two same-size benign datasets (Dolly and Alpaca), five fine-tuning epochs with checkpoints, five random seeds per configuration, and generation at temperature 0 and 0.7, with a subset repeated five times. This design isolates the separate contributions of decoding stochasticity, seed randomness, epoch count, and dataset content to the final harmfulness score.

What would settle it

If two models fine-tuned with the same data and parameters but different random seeds give exactly the same harmfulness score when evaluated at temperature 0, then the seed-induced variance reported here does not exist.

Watch

Extended reading notes

Core claim

The central discovery is that fine-tuning a model on entirely benign, general-purpose instruction data substantially increases the fraction of unsafe requests the model fulfils, and that this measured increase is unstable: the harmfulness score changes with the random seed used in fine-tuning, with the generation temperature, with the number of fine-tuning epochs, and with which of two identically sized benign datasets is used. On a single fine-tuned model, repeated evaluations at temperature 0.7 give noticeably different scores; across models trained with different seeds, the spread can reach roughly ten points of harmfulness (e.g., 0.73 to 0.82 for Llama-1B on Dolly at epoch 4). A self-generated-data experiment shows that fine-tuning on a model's own answers causes much less safety degradation than fine-tuning on human-written answers, pointing to content novelty rather than the fine-tuning process itself as the driver. The paper also shows that refusal-based scoring misses that non-refused responses can be far more toxic after fine-tuning.

Load-bearing premise

The safety scores rest on the assumption that the automatic SORRY-Bench judge correctly identifies harmful responses for fine-tuned models; if the judge's errors correlate with fine-tuning through output style or length, then both the harmfulness levels and the reported variance could be artifacts of the judge rather than the model's true behaviour.

Editorial extensions

If this is right

  • Safety benchmark scores for fine-tuned models cannot be compared across studies that differ in seeds, temperature, epochs, or dataset, unless confidence intervals are reported.
  • Single-run evaluations of fine-tuned models are insufficient; repeated runs are necessary to estimate the uncertainty in harmfulness measurements.
  • The conflicting reports in the literature on whether safety improves or worsens with additional fine-tuning epochs may be explained by the variance demonstrated here.
  • Refusal rates alone understate the risk of fine-tuned models, since non-refused responses can be far more toxic after fine-tuning.
  • Closed-source fine-tuning APIs may apply hidden safety mitigations, so direct comparisons with open-source fine-tuning results are unreliable.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the SORRY-Bench judge is sensitive to the style or length of fine-tuned outputs, part of the observed variance and harmfulness could be an artifact of the judge; a human-annotation validation on the paper's own model outputs would settle this.
  • A practical extension would be to report harmfulness scores as a distribution (e.g., min/max or standard deviation over at least five runs) rather than a point estimate, and to require that safety comparisons show non-overlapping intervals.
  • The self-generated-data result suggests a testable prediction: fine-tuning on data close to the model's own distribution (e.g., distillation-style datasets) should consistently produce smaller safety drops than fine-tuning on human-written data, across other base models.
  • The toxicity findings imply that safety benchmarks should move beyond binary refusal labels to graded harmfulness, especially for categories where compliance can be harmless or harmful.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The manuscript reports an empirical study of how fine-tuning hyperparameters and stochastic decoding affect SORRY-Bench safety scores. The authors fine-tune Llama-3.2-1B and Mistral-7B-v0.3 on two benign instruction datasets, Dolly and Alpaca, using LoRA with five random seeds and five epochs, and evaluate each checkpoint with the SORRY-Bench Mistral-based evaluator, plus Perspective API toxicity on hate-speech prompts. They document variance from repeated evaluations, random seed, generation temperature, dataset content, and number of epochs, and conclude that safety measurements for fine-tuned models are not comparable unless full parameter reporting and repeated measurements are used. A smaller closed-source GPT-4o-mini appendix shows a different, API-moderated pattern, which the authors attribute to unobserved provider-side interventions.

Significance. If the qualitative claim holds, the paper is a useful methodological warning: safety benchmark scores for fine-tuned open-weight models depend on choices that are often treated as inconsequential, such as the seed, epoch count, and sampling temperature. The design is largely transparent, with multiple seeds and checkpoints, and the refusal-versus-toxicity examples in Table 1 make a real measurement gap concrete. The paper is less persuasive on the quantitative strength and the sources of the variance, however, because it reports no inferential statistics and does not validate the automated judge on fine-tuned outputs. These two gaps are load-bearing for the paper's central claim, but they are addressable and do not undermine the qualitative phenomenon, which is consistent with prior work.

major comments (4)
  1. [Section 1 and Sections 4.1-4.3] The abstract and Section 1 state that 'all investigated parameters affect the safety measurements, often substantially,' but the paper's own results do not support that breadth. Section 4.3 reports 'For the Mistral-based models, there is no discernible effect of temperature on harmfulness rate,' and Figures 2 and 3 show min-max bands that overlap substantially across seeds and temperatures. Without inferential statistics, such as bootstrap confidence intervals over seeds, paired comparisons per checkpoint, or effect sizes, the claim that each parameter has an effect is not established for every parameter-model combination. The central claim should be rephrased to say that the investigated parameters can have substantial effects and that the effects vary by model, dataset, and epoch, with the specific conditions stated.
  2. [Section 3.3] The SORRY-Bench evaluator is a Mistral-7b-instruct-v0.2 model fine-tuned on 2,640 annotated pairs with 81% human agreement, and the paper runs it in 4-bit quantization at zero temperature. That validation was performed on the benchmark's original responses, not on the outputs of LoRA fine-tuned models. Table 1 shows cases where the judge labels an indirect, low-toxicity answer as fulfillment and where two generations from the same model receive different labels. If the judge's error rate or bias changes with fine-tuning-induced style, length, or formatting shifts, then both the reported harmfulness levels and, more importantly, the reported variances could be partly artifacts. The paper should include a human or independent-judge spot-check on a stratified sample of the 432 response sets, ideally stratified by base model, dataset, epoch, and seed, and report agreement or a confusion matrix per condition.
  3. [Section 4.4] The self-generated-data experiment is described as generating answers with Llama-3.2-1B and then fine-tuning 'the model on its own answers.' This leaves it unclear whether the self-generated condition was applied to the Mistral model as well. If only Llama-3.2-1B received self-generated data, then the conclusion that 'the content and/or format of the fine-tuning data seems to be the primary driver' is established for only one base model and should be limited accordingly. Please clarify the full experimental matrix for this subsection and, if Mistral was not included, either add the condition or temper the claim.
  4. [Section 4.5 and Figure 5] The toxicity analysis is restricted to responses that the SORRY-Bench judge labels as non-refusals, but the text and box plots do not state the number of non-refusal responses per epoch and model. This is important because the subset is selected by the same judge whose reliability is at issue, and the toxicity means are therefore conditional on the judge's labeling behavior, which may shift with fine-tuning. Please report the sample sizes per condition and, ideally, also show the toxicity distribution over all responses so that the refusal-vs-toxicity distinction is not confounded with judge-dependent selection.
minor comments (5)
  1. [Section 4.2, Figure 2] The text refers to the 'average harmfulness score' for each epoch, but the figure legend only describes min-max bands; adding mean or median markers over the five seeds would make the trends easier to read.
  2. [Table 1] The caption should state explicitly that '1' means fulfillment and '0' means refusal, and it should note that the toxicity scores are Perspective API scores, since this is not immediately clear from the table alone.
  3. [Appendix A] The sentence 'relative the the base model' contains a typo, and the Dolly-versus-Alpaca comparison in Figure 6 is not controlled for the number of tokens; the text acknowledges the cost difference, but the caveat should also appear when interpreting the figure.
  4. [Sections 3.3-3.4] The paper does not state how many of the 440 SORRY-Bench prompts fall into the hate-speech categories used for the toxicity analysis; adding this count, and the number of non-refusal responses analyzed, would improve reproducibility.
  5. [Reproducibility] Given the paper's methodological message, a data/code availability statement with the fine-tuning configuration and evaluation scripts, or a clear reason for their absence, would strengthen the paper.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper is an empirical measurement study using external benchmarks, with no fitted parameters renamed as predictions and no load-bearing self-citations.

full rationale

The paper's central claim is that safety measurements vary with fine-tuning and evaluation parameters. This claim is supported by direct measurements using the external SORRY-Bench framework, its pre-trained evaluator model, and Perspective API. The paper does not construct a derivation from first principles, nor does it fit parameters to data and then present a related quantity as a prediction. There are no self-citations by the authors that carry argumentative weight; the cited prior work (e.g., Qi et al., 2024) is used to source datasets and to frame the known phenomenon of fine-tuning reducing safety, not to justify the paper's own quantitative conclusions. The choice to subsample Alpaca to match Dolly size is an experimental design decision, not an input that mathematically forces the reported variance. The possible bias of the SORRY-Bench evaluator on fine-tuned outputs is a legitimate external-validity concern, but it is not circularity: the evaluator was trained and validated outside this paper, and the paper does not redefine harmfulness in terms of its own results. The Limitations section explicitly acknowledges that other benchmarks may give different ratings, further showing that the authors treat the benchmark as an external measurement instrument rather than as a definitional output. Therefore, no circular step can be identified from the text.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

No free parameters or invented entities; the paper is an empirical measurement study. It relies on assumptions about the validity of its measurement instruments (SORRY-Bench judge, Perspective API) and on the representativeness of its experimental choices.

assumptions (4)
  • domain assumption The SORRY-Bench evaluator model provides valid and consistent harmfulness labels.
    Section 3.3: all safety scores are computed by a single fine-tuned Mistral model with 81% Cohen's kappa agreement with humans; no correction or uncertainty for judge error is included.
  • domain assumption Perspective API toxicity scores are a valid measure of harmfulness for hate speech responses.
    Section 3.4: toxicity is used as an alternate measure, but the paper does not validate that high toxicity aligns with human judgments of harm in these outputs.
  • domain assumption Random seeds and repeated decoding at temperature 0.7 provide a representative sample of the model's behavior.
    Section 4 uses five seeds and up to five repeat evaluations; the paper does not test whether more seeds would change the observed ranges.
  • domain assumption The fine-tuning hyperparameters (4-bit quantization, LoRA, batch size 64, lr 2e-5, AdamW-8bit) are representative and do not confound the safety comparison.
    Section 3.2 fixes these values; the paper notes in Limitations that learning rate, quantization, and optimizer are unexplored, leaving open the possibility that the variance is specific to this configuration.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Fine-Tuning Lowers Safety and Disrupts Evaluation Consistency." pith.science (2026). https://pith.science/paper/SSE4HMBJ

@misc{pith2026250617209,
  author       = {Pith},
  title        = {Pith review of: Fine-Tuning Lowers Safety and Disrupts Evaluation Consistency},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/SSE4HMBJ}},
  note         = {Machine review of arXiv:2506.17209}
}
read the original abstract

Fine-tuning a general-purpose large language model (LLM) for a specific domain or task has become a routine procedure for ordinary users. However, fine-tuning is known to remove the safety alignment features of the model, even when the fine-tuning data does not contain any harmful content. We consider this to be a critical failure mode of LLMs due to the widespread uptake of fine-tuning, combined with the benign nature of the "attack". Most well-intentioned developers are likely unaware that they are deploying an LLM with reduced safety. On the other hand, this known vulnerability can be easily exploited by malicious actors intending to bypass safety guardrails. To make any meaningful progress in mitigating this issue, we first need reliable and reproducible safety evaluations. In this work, we investigate how robust a safety benchmark is to trivial variations in the experimental procedure, and the stochastic nature of LLMs. Our initial experiments expose surprising variance in the results of the safety evaluation, even when seemingly inconsequential changes are made to the fine-tuning setup. Our observations have serious implications for how researchers in this field should report results to enable meaningful comparisons in the future.

Figures

Figures reproduced from arXiv: 2506.17209 by the authors.

Figure 1
Figure 1. Variance in repeated measurements. Error bars [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Variance due to randomness in fine-tuning procedures. Error bands represent the minimum and maximum [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Comparing safety evaluation at temperature T=0 and T=0.7. Error bars indicate the min and max [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (5 more)
Figure 4
Figure 4. Figure 4: Impact of fine-tuning on new content versus [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]
Figure 5
Figure 5. Figure 5: Effect of fine-tuning on toxicity. A single model is evaluated five times (temperature = 0.7) at each [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Variance in repeated measurements, compar [PITH_FULL_IMAGE:figures/full_fig_p012_6.png]
Figure 8
Figure 8. Figure 8: Variance due to randomness in fine-tuning procedures on the Alpaca dataset, comparing open-source and [PITH_FULL_IMAGE:figures/full_fig_p013_8.png]
Figure 9
Figure 9. Figure 9: Effect of fine-tuning on toxicity of GPT-4o-mini. A single model is evaluated five times (temperature = [PITH_FULL_IMAGE:figures/full_fig_p013_9.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

37 extracted references · 16 canonical work pages

  1. [1]

    Asma Ben Abacha, Wen-wai Yim, Yujuan Fu, Zhaoyi Sun, Meliha Yetisgen, Fei Xia, and Thomas Lin. 2024. Medec: A benchmark for medical error detection and correction in clinical notes. arXiv preprint arXiv:2412.19260

    arXiv 2024

  2. [2]

    Jan Betley, Daniel Tan, Niels Warncke, Anna Sztyber-Betley, Xuchan Bao, Mart \' n Soto, Nathan Labenz, and Owain Evans. 2025. https://arxiv.org/abs/2502.17424 Emergent misalignment: N arrow finetuning can produce broadly misaligned LLM s . arXiv preprint arXiv:2502.17424

    arXiv 2025

  3. [3]

    Tim Beyer, Sophie Xhonneux, Simon Geisler, Gauthier Gidel, Leo Schwinn, and Stephan G \"u nnemann. 2025. LLM -safety evaluations lack robustness. arXiv preprint arXiv:2503.02574

    arXiv 2025

  4. [4]

    F Bianchi, M Suzgun, G Attanasio, P Rottger, D Jurafsky, T Hashimoto, J Zou, and 1 others. 2024. https://openreview.net/pdf?id=gT5hALch9z Safety-tuned L lamas: L essons from improving the safety of large language models that follow instructions . In Proceedings of the 12th International Conference on Learning Representations (ICLR)

    work page 2024

  5. [5]

    Dillon Bowen, Brendan Murphy, Will Cai, David Khachaturov, Adam Gleave, and Kellin Pelrine. 2024. https://arxiv.org/abs/2408.02946 Data poisoning in LLM s: J ailbreak-tuning and scaling laws . arXiv preprint arXiv:2408.02946

    arXiv 2024

  6. [6]

    Faeze Brahman, Sachin Kumar, Vidhisha Balachandran, Pradeep Dasigi, Valentina Pyatkin, Abhilasha Ravichander, Sarah Wiegreffe, Nouha Dziri, Khyathi Chandu, Jack Hessel, and 1 others. 2024. The art of saying no: C ontextual noncompliance in language models. Advances in Neural Information Processing Systems, 37:49706--49748

    work page 2024

  7. [7]

    Mike Conover, Matt Hayes, Ankit Mathur, Jianwei Xie, Jun Wan, Sam Shah, Ali Ghodsi, Patrick Wendell, Matei Zaharia, and Reynold Xin. 2023. https://www.databricks.com/blog/2023/04/12/dolly-first-open-commercially-viable-instruction-tuned-llm Free dolly: Introducing the world's first truly open instruction-tuned llm

    2023

  8. [8]

    Felix Friedrich, Simone Tedeschi, Patrick Schramowski, Manuel Brack, Roberto Navigli, Huu Nguyen, Bo Li, and Kristian Kersting. 2025. https://openreview.net/forum?id=PT7SRb00he LLM s lost in translation: M- ALERT uncovers cross-linguistic safety gaps . In Proceedings of the ICLR 2025 Workshop on Building Trust in Language Models and Applications

    work page 2025

Show all 37 references
  1. [9]

    Tessa Han, Aounon Kumar, Chirag Agarwal, and Himabindu Lakkaraju. 2024. https://openreview.net/forum?id=cFyagd2Yh4 MedSafetyBench : Evaluating and improving the medical safety of large language models . In Proceedings of the the Thirty-eighth Conference on Neural Information P...

    2024

  2. [10]

    Luxi He, Mengzhou Xia, and Peter Henderson. 2024. https://openreview.net/pdf?id=Hi8jKh4HE9 What is in your safe data? identifying benign data that breaks safety . In Proceedings of the First Conference on Language Modeling (CoLM)

    2024

  3. [11]

    Yue Huang, Lichao Sun, Haoran Wang, Siyuan Wu, Qihui Zhang, Yuan Li, Chujie Gao, Yixin Huang, Wenhan Lyu, Yixuan Zhang, and 1 others. 2024. Position: TrustLLM : Trustworthiness in large language models. In Proceedings of the International Conference on Machine Learning, pages ...

    2024

  4. [12]

    George Kour, Marcel Zalmanovici, Naama Zwerdling, Esther Goldbraich, Ora Fandina, Ateret Anaby Tavor, Orna Raz, and Eitan Farchi. 2023. https://aclanthology.org/2023.gem-1.10/ Unveiling safety vulnerabilities of large language models . In Proceedings of the Third Workshop on N...

    2023

  5. [13]

    Divyanshu Kumar, Anurakt Kumar, Sahil Agarwal, and Prashanth Harshangi. 2024. https://arxiv.org/abs/2404.04392 Fine-tuning, quantization, and LLM s: N avigating unintended outcomes . arXiv preprint arXiv:2404.04392

    2024 arXiv

  6. [14]

    Simon Lermen and Charlie Rogers-Smith. 2024. https://arxiv.org/abs/2310.20624 LoRA fine-tuning efficiently undoes safety training in Llama 2-Chat 70B . In Proceedings of the ICLR 2024 Workshop on Secure and Trustworthy Large Language Models

    2024 arXiv

  7. [15]

    Ang Li, Yichuan Mo, Mingjie Li, Yifei Wang, and Yisen Wang. 2025 a . https://arxiv.org/abs/2502.09673 Are smarter llms safer? exploring safety-reasoning trade-offs in prompting and fine-tuning . arXiv preprint arXiv:2502.09673

    2025 arXiv

  8. [16]

    Mingjie Li, Wai Man Si, Michael Backes, Yang Zhang, and Yisen Wang. 2025 b . https://openreview.net/forum?id=GOoVzE9nSj Salo RA : Safety-alignment preserved low-rank adaptation . In Proceedings of the Thirteenth International Conference on Learning Representations

    2025

  9. [17]

    Nathaniel Li, Alexander Pan, Anjali Gopal, Summer Yue, Daniel Berrios, Alice Gatti, Justin D. Li, Ann-Kathrin Dombrowski, Shashwat Goel, Gabriel Mukobi, Nathan Helm-Burger, Rassin Lababidi, Lennart Justen, Andrew Bo Liu, Michael Chen, Isabelle Barrass, Oliver Zhang, Xiaoyuan Z...

    2024

  10. [18]

    Chengyuan Liu, Fubang Zhao, Lizhi Qing, Yangyang Kang, Changlong Sun, Kun Kuang, and Fei Wu. 2023. https://arxiv.org/abs/2309.11830 Goal-oriented prompt attack and safety evaluation for LLM s . arXiv preprint arXiv:2309.11830

    2023 arXiv

  11. [19]

    Kaifeng Lyu, Haoyu Zhao, Xinran Gu, Dingli Yu, Anirudh Goyal, and Sanjeev Arora. 2024. https://openreview.net/forum?id=XlnpQOn95Z Keeping LLM s aligned after fine-tuning: The crucial role of prompt templates . In Proceedings of the ICLR 2024 Workshop on Reliable and Responsibl...

    2024

  12. [20]

    Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, and 1 others. 2024. https://dl.acm.org/doi/abs/10.5555/3692070.3693501 HarmBench : A standardized evaluation framework for automated red teaming and robus...

    2024

  13. [21]

    Niloofar Mireshghallah, Hyunwoo Kim, Xuhui Zhou, Yulia Tsvetkov, Maarten Sap, Reza Shokri, and Yejin Choi. 2024. https://openreview.net/forum?id=gmg7t8b4s0 Can LLM s keep a secret? T esting privacy implications of language models via contextual integrity theory . In Proceeding...

    2024

  14. [22]

    Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. 2024. https://openreview.net/pdf?id=hTEGyKf0dZ Fine-tuning aligned language models compromises safety, even when users do not intend to! In Proceedings of the International Conferenc...

    2024

  15. [23]

    Paul R \"o ttger, Hannah Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. 2024. XSTest : A test suite for identifying exaggerated safety behaviours in large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Ass...

    2024

  16. [24]

    Alexandra Souly, Qingyuan Lu, Dillon Bowen, Tu Trinh, Elvis Hsieh, Sana Pandey, Pieter Abbeel, Justin Svegliato, Scott Emmons, Olivia Watkins, and 1 others. 2024. A StrongREJECT for empty jailbreaks. In Proceedings of the ICLR 2024 Workshop on Reliable and Responsible Foundati...

    2024

  17. [25]

    Hao Sun, Zhexin Zhang, Jiawen Deng, Jiale Cheng, and Minlie Huang. 2023. https://arxiv.org/abs/2304.10436 Safety assessment of C hinese large language models . arXiv preprint arXiv:2304.10436

    2023 arXiv

  18. [26]

    Hashimoto

    Rohan Taori, Ishaan Gulrajani, Tianyi Zhang, Yann Dubois, Xuechen Li, Carlos Guestrin, Percy Liang, and Tatsunori B. Hashimoto. 2023. Stanford alpaca: An instruction-following llama model. https://github.com/tatsu-lab/stanford_alpaca

    2023

  19. [27]

    Bertie Vidgen, Adarsh Agrawal, Ahmed M Ahmed, Victor Akinwande, Namir Al-Nuaimi, Najla Alfaraj, Elie Alhajjar, Lora Aroyo, Trupti Bavalatti, Max Bartolo, and 1 others. 2024. https://arxiv.org/abs/2404.12241 Introducing v0.5 of the AI S afety B enchmark from MLC ommons . arXiv ...

    2024 arXiv

  20. [28]

    Bertie Vidgen, Nino Scherrer, Hannah Rose Kirk, Rebecca Qian, Anand Kannappan, Scott A Hale, and Paul R \"o ttger. 2023. https://arxiv.org/abs/2311.08370 SimpleSafetyTests : a test suite for identifying critical safety risks in large language models . arXiv preprint arXiv:2311.08370

    2023 arXiv

  21. [29]

    Pawat Vongpradit, Aurawan Imsombut, Sarawoot Kongyoung, Chaianun Damrongrat, Sitthaa Phaholphinyo, and Tanik Tanawong. 2024. https://doi.org/10.1109/InCIT63192.2024.10810548 SafeCultural : A dataset for evaluating safety and cultural sensitivity in large language models . In P...

    2024

  22. [30]

    Wenxuan Wang, Zhaopeng Tu, Chang Chen, Youliang Yuan, Jen-tse Huang, Wenxiang Jiao, and Michael Lyu. 2024 a . https://doi.org/10.18653/v1/2024.findings-acl.349 All languages matter: O n the multilingual safety of LLM s . In Findings of the Association for Computational Linguis...

    2024 doi

  23. [31]

    Yuxia Wang, Haonan Li, Xudong Han, Preslav Nakov, and Timothy Baldwin. 2024 b . https://aclanthology.org/2024.findings-eacl.61/ Do-Not-Answer : E valuating safeguards in LLM s . In Findings of the Association for Computational Linguistics: EACL 2024, pages 896--911

    2024

  24. [32]

    Tinghao Xie, Xiangyu Qi, Yi Zeng, Yangsibo Huang, Udari Madhushani Sehwag, Kaixuan Huang, Luxi He, Boyi Wei, Dacheng Li, Ying Sheng, and 1 others. 2025. https://arxiv.org/abs/2406.14598 SORRY -bench: S ystematically evaluating large language model safety refusal behaviors . In...

    2025 arXiv

  25. [33]

    Xianjun Yang, Xiao Wang, Qi Zhang, Linda Ruth Petzold, William Yang Wang, Xun Zhao, and Dahua Lin. 2024. https://arxiv.org/abs/2310.02949 Shadow alignment: T he ease of subverting safely-aligned language models . In Proceedings of the ICLR 2024 Workshop on Secure and Trustwort...

    2024 arXiv

  26. [34]

    Qiusi Zhan, Richard Fang, Rohan Bindu, Akul Gupta, Tatsunori B Hashimoto, and Daniel Kang. 2024. https://aclanthology.org/2024.naacl-short.59/ Removing RLHF protections in GPT-4 via fine-tuning . In Proceedings of the 2024 Conference of the North American Chapter of the Associ...

    2024

  27. [35]

    Mi Zhang, Xudong Pan, and Min Yang. 2023. https://arxiv.org/abs/2311.00286 JADE : A linguistics-based safety evaluation platform for large language models . arXiv preprint arXiv:2311.00286

    2023 arXiv

  28. [36]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list...

  29. [37]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.