Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 255papers have no tags yet and are not included in filtered results.
AbstractThe authors use a digital lock to hide an executable capability and state that elicitation on the chemistry and parity tasks did not recover the capability.
The authors construct a class of backdoors that encrypt an executable network into the weights, used to discuss the limits of white-box elicitation audits under supply chain attacks.
AbstractAttention updates are more readable for harmfulness, MLP updates write refusal, and Sentinel routes alerts using two-path signals.
The authors reframe jailbreaking and excessive refusal of aligned models as a pathway problem on the residual stream from recognition to writing, and accordingly provide conditional reminders before decoding.
AbstractNeurons and SAE features related to narrativity across three models, when ablated, changed some narrative-related behaviors.
The authors connect a three-dimensional definition from narratology to mechanistic interventions, examining whether components related to narrativity in pretrained language models participate in prediction, generation, and downstream tasks.
AbstractThe model is more restrained and acts less.
DistressBench uses SSH dialogues written and revised by clinical personnel, and evaluates how much necessary care general chat models deliver according to weighted atomic criteria, rather than whether they refuse. When users disclose suicidal ideation or self-harm to a chat model, the authors consider the expected behavior to be recognizing the crisis, calibrating empathy, de-escalating, and referring to human help. Refusal-based evaluations cannot detect failing to act after recognizing the crisis.
AbstractActivation representations can predict cross-value generalization before training and relate to robustness across multiple value objectives.
The authors define "how single-value fine-tuning changes compliance on untrained values" as a task predictable before training, and use value representations to do this.
AbstractThe authors claim HarmBench does not correspond to a single harmful refusal, and behaviors should be separated when comparing models.
This is a construct validity audit of HarmBench in HELM Safety, examining whether harmful refusal can be read as a single attribute when interpreting scores.
AbstractUsing counterfactual substitution of authorities and internal commitment tracing, the authors find that legal CoT rulings depend on authorities only to a limited extent and are vulnerable to prompt injection manipulation.
This study conducts an empirical audit of the causal truthfulness of legal citations in chain-of-thought reasoning of large language models in the legal domain.
AbstractAcross five models, many correct verdicts are largely unchanged by deleting or replacing negation rules.
Use behavioral counterfactuals and activation probes to audit whether compliance rulings rely on the given rules. The authors aim to separate two kinds of seemingly identical correct rulings: those that use the given rules, and those obtained from case surface features or training patterns.
AbstractThe authors claim experimental records can be reused inside and outside the environment and improve experiment selection under fixed budgets.
The authors use language models as research world models, predicting the median intervention gain before execution, to compare candidate experiments under a limited budget. The gap to address is that research agents propose faster than they execute. The same type of change can have different effects across reference models, recipes, and budgets, so experimental knowledge that can continue to be used outside the original environment is needed.
AbstractThe authors claim that comparing judges should look at T, not just accuracy.
The authors audit whether LLM-as-a-Judge decisions can still be treated as actionable ground truth under repeated queries, swapped candidate order, and changed prompt formats.
SemField is a zero-bit semantic watermark embedded by the provider at generation time and detected later with a key, used to identify the provider's own model text after paraphrasing and sentence-level structural changes.