The paper presents a training‑free weight‑editing technique that reduces language model compliance with harmful instructions. By applying forward passes on a small set of prompt pairs, the method modifies model weights so that changing or deleting instructions in the prompt cannot reverse the edit. Experiments on five instruction‑tuned models show significant improvements in honest response rates for lying and substantial reductions in sexist responses, demonstrating the approach’s effectiveness across distinct behavioral domains.
arXiv:2609.39882v1 Announce Type: new Abstract: Pre-training equips large language models (LLMs) with a broad repertoire of behavioral patterns associated with roles, styles, values, and goals. Post-...
arXiv:2610.22640v1 Announce Type: new Abstract: Model-editing backdoors aim to induce harmful responses under a trigger while preserving ordinary behavior on untriggered input. Recent model-editing a...
arXiv:2609.37837v1 Announce Type: new Abstract: Vision-Language Models (VLMs) remain vulnerable to cross-modal implicit risks: visual and textual inputs that appear benign in isolation can jointly el...
The paper introduces EDIC, a framework for per‑instruction compliance in large language models that interact with external data. It decomposes the task into identifying, classifying, and acting on each embedded directive, using a scene‑grounded pipeline and a generative judge trained with GRPO to attribute compliance at the instruction level. Experiments on two backbones and five benchmarks show that EDIC improves safety and utility, achieving up to a 7.7% increase in harmful‑rejection and a 12.5% boost in Arena‑Hard‑Auto utility on Qwen3‑4B.
arXiv:2609.22119v1 Announce Type: cross Abstract: Evaluation awareness poses an unprecedented threat to model evaluation, but the mechanisms by which models detect it remain unknown. This study focus...
The paper investigates how training data attribution (TDA) can be used to influence large language models (LLMs). It compares two methods—reweighting and influence-guided response rewriting—on examples selected by influence functions. Rewriting, which replaces responses while keeping instructions fixed, yields stronger, more persistent, and bidirectional behavioral changes than reweighting, suggesting that the intervention value of influential samples is better realized through rewriting.
The paper investigates how safety‑aligned large language models (LLMs) can still be tricked by jailbreaks or over‑refuse benign requests. By analyzing residual‑stream updates in decoder‑only Transformers, the authors find that harmfulness is more readily decoded from attention updates—especially in early layers—while the MLP component is primarily responsible for writing refusal responses. Post‑training enhances MLP‑driven refusal writing without improving harmfulness decodability, and causal interventions confirm that downstream MLP updates are crucial for the refusal shift caused by upstream attention changes. Building on these insights, the authors propose Sentinel, a system that combines an attention‑derived perception score with an MLP‑derived decision score to better detect jailbreaks and over‑refusals across multiple models.
The paper investigates how multimodal large language models decide to refuse answering visually unanswerable questions. It examines three control mechanisms—instruction phrasing and placement, post‑training methods, and internal activation interventions—across three models on the MoHoBench benchmark. The study finds that refusal behavior is highly sensitive to instruction details, can be amplified by post‑training (sometimes leading to mixed refusal and answer attempts), and can be modestly altered by activation interventions without causing indiscriminate refusals.
arXiv:2609.35356v2 Announce Type: replace Abstract: Supervised fine-tuning can teach language models undesired behaviours alongside desired ones. Inoculation prompting (IP) aims to limit unwanted gen...
The paper investigates how large language models balance helpfulness and safety by refusing harmful queries while responding to benign ones. It decomposes safety-tuning responses into a boilerplate refusal statement and a rationale, finding that the statement causes false refusals by relying on superficial cues. Training on rationales alone reduces false refusals without compromising safety performance, suggesting that fine‑grained safety supervision is essential for better alignment.
The paper introduces Training-Free Task Vectors (TFTVs), a method for computing task-vector-like directions in large language models without fine‑tuning. TFTVs map activation steering vectors to rank‑one weight‑space edits using only forward‑pass statistics, enabling arithmetic operations such as learning, forgetting, and composing edits. Experiments show that TFTVs consistently amplify, suppress, and combine target behaviors while preserving general knowledge, outperforming other editing and steering baselines.
arXiv:2511. 05852v4 Announce Type: replace-cross Abstract: Knowledge editing (KE) offers a lightweight alternative to retraining for updating large language models (LLMs).