ai-research-survey

scan.json (33628B)

---

 {
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "paper": {
     "title": "The Hidden Dimensions of LLM Alignment: A Multi-Dimensional Analysis of Orthogonal Safety Directions",
     "authors": ["Wenbo Pan", "Zhichao Liu", "Qiguang Chen", "Xiangyang Zhou", "Haining Yu", "Xiaohua Jia"],
     "year": 2025,
     "venue": "ICML 2025 (Proceedings of the 42nd International Conference on Machine Learning, PMLR 267)",
     "arxiv_id": "2502.09674",
     "doi": "10.48550/arXiv.2502.09674"
   },
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "The abstract states: 'Code and artifacts are available at https://github.com/BMPixel/safety-residual-space.' A working URL is provided."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses publicly available datasets: STRONG REJECT (Souly et al., 2024) and OR-Bench (Cui et al., 2024). The dataset construction procedure from these public sources is documented in Appendix C.1, and the GitHub release includes 'artifacts.'"
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "No requirements.txt, Dockerfile, or detailed environment specification is provided in the paper. Hardware is mentioned ('six A800 GPUs') but software dependencies and library versions are not specified."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are included in the paper. While training details and hyperparameters are provided in the appendix, there is no 'Reproducing Results' section or scripts walkthrough."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results (attack pass rates in Table 3, Strong Reject scores in Tables 5-7, prediction accuracy in Figure 3) are reported as point estimates without confidence intervals or error bars."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "No statistical significance tests are used. Claims like 'Trigger Removal maintains approximately 40% effectiveness' and comparisons between methods are based on raw number comparisons without any statistical test."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Effect sizes are reported with baseline context: 'the average STRONGREJECT score decreased significantly from 0.65 to 0.05, while the refusal accuracy improved to 90%' (Section 3.2). Tables 3, 5-7 provide full attack pass rates and scores across conditions."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The dataset of 2600 training samples and 540 test samples (60 STRONG REJECT + 480 OR-Bench) is described but no justification for these sizes is given. No power analysis is discussed."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "Results appear to be from single experimental runs. No standard deviation, variance, or spread measures are reported across multiple runs or seeds."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Multiple baselines are included: probe vectors and Best-of-N BASE for direction prediction (Figure 3), and six jailbreak methods (PAIR, ReNellm, GPTFuzz, GCG, CodeChameleon, Flip, Simple) as baselines against the trigger removal attack (Table 3)."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include recent methods: PAIR (2023), FLIPAttack (2024), GPTFuzz (2023), GCG (2023), CodeChameleon (2024), and the refusal direction from Arditi et al. (2024)."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Intervention experiments serve as ablations: removing individual components (L14-C4, L14-C5, L14-C6, L25-C1) and measuring the effect on attack pass rates (Figure 4). Non-dominant suppression experiments (Figure 6) further isolate component contributions."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Multiple metrics are used: refusal accuracy, Strong Reject scores (Tables 5-7), attack pass rates (Table 3), prediction accuracy (Figure 3), MSE of residual space approximation (Table 4), and perplexity on Alpaca dataset (Figure 12)."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "All evaluation is automated. Harmfulness is scored by Strong Reject (LLM-based), refusal is classified automatically, and no human evaluation of model outputs is conducted."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Appendix C.1 describes a fixed test set 'completely disjoint from the training set': 60 STRONG REJECT samples with all jailbreak methods applied plus 480 OR-Bench harmless samples that 'do not overlap with the training set.'"
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by jailbreak method in Tables 3, 5, 6, and 7, showing how each method responds to different exposure levels. Figure 4 shows per-attack-type pass rates under interventions."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 7 discusses limitations: 'some directions occasionally flip between different layers, and feature directions cannot be extended indefinitely without degrading generation quality.' Figure 4 shows L14-C4 and L14-C5 'do not exhibit clear selectiveness.' Appendix C.4 shows perplexity degradation from interventions."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "DPO trained directly on the original model 'exhibits inconsistent performance in rejecting various forms of the PAIR method' (Section C.2). Perplexity increases from DPO (8.42 vs 7.10 base) are reported (Figure 12). The Best-of-N BASE baseline 'fail[s] to predict refusal behavior' (Section 4)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims are supported: multi-dimensional safety directions (Figure 2, SVD analysis), dominant direction governs refusal (Figure 3), non-dominant directions for hypothetical narrative/role-playing (Tables 1-2), trigger token removal bypasses safety (Table 3, Figure 6). The abstract appropriately bounds the case study to Llama 3 8B."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims are backed by intervention experiments: removing specific directions from activation space and measuring the effect on refusal (Figure 4, Equation 2). This controlled single-variable manipulation is adequate for the causal claims made (e.g., 'removing L14-C6 specifically ablates the model's ability to refuse PAIR prompts')."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title 'The Hidden Dimensions of LLM Alignment' and conclusion 'what LLMs learn from safety fine-tuning' speak broadly about LLMs, but experiments are limited to Llama 3.1 8B (primary), Llama 3.2 3B, and Ministral-8B-Instruct — all small models from two architecture families. The paper does not bound claims to these specific models in the title or conclusion."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not substantively discuss alternative explanations for its core results. Section 7 discusses limitations (non-linearity, data complexity) but does not consider alternative interpretations of the observed phenomena — e.g., whether the SVD directions could reflect artifacts of the decomposition method rather than true safety features, or whether the trigger removal success could have other explanations."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper measures refusal accuracy and Strong Reject scores and claims these measure safety alignment behavior. These are direct measurements of the claimed behaviors (refusal and harmfulness of outputs). The paper stays close to what it measures without inflating to broader proxy claims."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Specific model versions are stated: 'Llama 3.1 8B Instruct', 'Llama 3.1 405B Instruct', 'Hermes-3-Llama-3.1-70B', 'Llama-3.2-3B-Instruct', and 'Ministral-8B-Instruct'. For open-source models, these names identify specific released weight sets."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Full prompt templates are provided in Appendix C.1: Prompt 1 (Simple Jailbreaking Prompt Template), Prompt 2 (Reject Prompt Template for Llama-3.1-405B), and Prompt 3 (Accept Prompt Template for Hermes-3-Llama-3.1-70B) with complete text."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section C.2 reports: 'learning rate of 1e−6, batch size 24, AdamW optimizer, maximum gradient norm 1.0, and training for 1 epoch' for SSFT. DPO: 'learning rate of 1e−6, batch size 24, AdamW optimizer, maximum gradient norm 1.0, DPO beta 0.1, with training conducted for 1 epoch.'"
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. The paper directly analyzes model activations and performs standard fine-tuning."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Appendix C.1 documents dataset construction in detail: how jailbreak methods are applied to STRONG REJECT samples, how preference pairs are created using Llama 405B and Hermes-3 for response sampling, the N-SHOT mechanism for dynamic dataset division, and the train/test split logic (Figure 7)."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 7 (Discussion) serves as a substantive limitations discussion, covering non-linearity of some feature directions, data complexity effects, and the connection to the Linear Representation Hypothesis. There is also an Impact Statement discussing dual-use risks."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Section 7 discusses specific threats: 'some directions occasionally flip between different layers, and feature directions cannot be extended indefinitely without degrading generation quality' and 'as data complexity and model size increase, we expect the effective rank of the residual space will also increase, introducing more potential feature directions. While our framework's methodology remains applicable, interpreting these directions becomes more challenging.'"
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not explicitly state what the results do NOT show. Section 7 mentions future work directions and general limitations but lacks specific boundary statements about untested settings, excluded populations, or claims the authors are not making."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "While code and 'artifacts' are released at the GitHub repository, the paper does not explicitly confirm that raw data (model activations, constructed preference dataset, intermediate analysis outputs) is available for independent verification."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Appendix C.1 thoroughly describes data collection: jailbreak methods applied (PAIR, ReNellm, GPTFuzz, GCG, CodeChameleon, Flip, Simple), source datasets (STRONG REJECT, AdvBench, OR-Bench), sampling procedures for DPO pairs, and the complete N-SHOT division mechanism."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Data comes from standard public benchmarks (STRONG REJECT, OR-Bench, AdvBench) and automated jailbreak generation."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The full data pipeline is documented in Appendix C.1 and Figure 7: from source datasets through jailbreak method application, response sampling with specific LLMs, to train/test split with exact counts at each stage (e.g., 1300 harmful + 1300 harmless training, 60 test STRONG REJECT + 480 test OR-Bench)."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Acknowledgments section states: 'This work was supported by HK RGC RIF (Research Impact Fund) R1012-21 and GRF grant (CityU 11211422).'"
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: City University of Hong Kong, Harbin Institute of Technology (two schools), and Microsoft. One co-author (Xiangyang Zhou) is at Microsoft."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "The Hong Kong Research Grants Council (RGC) is an independent government funding body that has no financial stake in the outcome of this safety alignment research."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is included in the paper. One author is affiliated with Microsoft, which develops LLMs, but no explicit declaration of financial interests is made."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "No training data cutoff date is stated for Llama 3.1 8B Instruct or any of the models used. The model's pre-training data period is not discussed."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": false,
         "justification": "While the paper constructs disjoint train/test splits for its own fine-tuning (Appendix C.1), it does not discuss whether the pre-trained Llama 3.1 model's training data already contained information about the jailbreak techniques or STRONG REJECT examples being used for evaluation."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether STRONG REJECT or the jailbreak methods (PAIR, GCG, etc.) were in Llama 3.1's pre-training data. Since these are publicly available prior to Llama 3.1's release, contamination risk exists but is not addressed."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference cost, latency, or per-example cost is reported. The trigger removal attack requires up to 30 LLM calls per sample (comparable to TAP and PAIR) but the actual cost is not quantified."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "Hardware is mentioned ('All experiments used six A800 GPUs' in C.2) and training is 1 epoch, but total GPU hours, wall-clock training time, or total compute budget is not stated."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of multiple random seeds or seed sensitivity analysis. All results appear to be from single experimental runs."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs producing the reported results is not stated. It is unclear whether results are from single runs or averaged."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "Hyperparameters are reported (learning rate, batch size, etc.) but no search budget, search method, or number of configurations tried is stated."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "No explanation of how the reported hyperparameter configuration was selected. The choice of layer 14 for analysis is motivated by the mid-early safety layer hypothesis but the specific hyperparameters appear unjustified."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes many comparisons across jailbreak methods, exposure levels, and model variants (Tables 3, 5-7) without any correction for multiple comparisons."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors introduce the Trigger Removal Attack and compare it against other jailbreak methods without acknowledging the inherent bias of evaluating their own method. They re-implement baseline jailbreaks without discussing potential self-comparison bias."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "The trigger removal attack requires iterative LLM calls (up to 30 per sample) which is substantially more compute than simple attacks like GCG, but performance is not reported as a function of compute budget."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "Strong Reject scores are used as the primary safety metric without questioning whether this LLM-based scoring actually measures harmfulness as claimed. No discussion of construct validity of the evaluation metrics."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding is involved. The paper directly analyzes model activations and performs standard fine-tuning."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether Llama 3.1's training data includes information about the jailbreak methods or evaluation datasets used, despite these being publicly available before the model's release."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup leaks information. For instance, the trigger removal attack uses PLRP analysis on the same model being evaluated, which could constitute a form of information leakage."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "While train/test splits are described as disjoint, no analysis is provided of structural similarities between train and test examples (e.g., same jailbreak templates applied to different toxic prompts from the same distribution)."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No concrete leakage detection or prevention method (canary strings, membership inference, n-gram overlap) is applied."
       }
     }
   },
   "claims": [
     {
       "claim": "Safety-aligned behavior is jointly controlled by multi-dimensional orthogonal directions in activation space, not just a single direction.",
       "evidence": "SVD analysis of the safety residual space shows effective rank > 1 across layers (Figure 2). Best-of-N results demonstrate multiple orthogonal directions can predict refusal beyond the dominant component (Figure 3, Section 4).",
       "supported": "strong"
     },
     {
       "claim": "A dominant direction (first SVD component) governs the model's refusal behavior and achieves near-perfect prediction accuracy in later layers.",
       "evidence": "Figure 3 shows the dominant direction achieves ~0.95+ accuracy in predicting refusal behavior after layer 15, comparable to probe vectors trained on pairwise data.",
       "supported": "strong"
     },
     {
       "claim": "Non-dominant directions represent distinct, interpretable features such as hypothetical narrative and role-playing patterns characteristic of specific jailbreak attacks.",
       "evidence": "PLRP token analysis (Tables 1-2) shows L14-C2 is activated by tokens like 'Imagine', 'fictional', 'hypothetical'; L14-C5 by 'ChatGPT' references; L14-C6 by 'Sure, I'm happy to help' with 'Imagine'. Intervention experiments (Figure 4) confirm L14-C6 specifically ablates PAIR refusal.",
       "supported": "strong"
     },
     {
       "claim": "The safety residual space is approximately low-rank linear, with a good affine approximation of the actual post-finetuning transformation.",
       "evidence": "Table 4 shows MSE/||Xu||² ratios on the order of 10⁻⁵ across layers. Figure 2 shows concentrated eigenvalues with long-tail spectrum distributions.",
       "supported": "strong"
     },
     {
       "claim": "The trigger removal attack maintains ~40% effectiveness after safety fine-tuning on 80 samples per jailbreak, while other attacks drop to near zero.",
       "evidence": "Table 3 shows trigger removal at 0.42 attack pass rate vs 0.03 (PAIR), 0.00 (ReNellm), 0.03 (GPTFuzz), 0.03 (GCG) at 80-shot exposure.",
       "supported": "strong"
     },
     {
       "claim": "Safety training may model spurious correlations in certain jailbreak patterns, allowing out-of-domain attacks to bypass alignment.",
       "evidence": "The trigger removal attack's resilience to fine-tuning (Table 3), combined with the observation that non-dominant directions capture jailbreak-specific patterns rather than harmfulness (Section 5.1), supports this interpretation. However, this is a mechanistic interpretation rather than a directly tested claim.",
       "supported": "moderate"
     },
     {
       "claim": "DPO training learns more divergent directions compared to SSFT, making it harder to identify dominant safety features when applied directly.",
       "evidence": "Figure 9 shows DPO trained directly on the original model exhibits inconsistent performance across PAIR variants. The effective rank continues increasing in final layers for DPO but decreases to 1 for SSFT (Figure 2). Combining SFT + DPO initialization improves consistency (Table 7).",
       "supported": "moderate"
     }
   ],
   "methodology_tags": ["benchmark-eval", "theoretical"],
   "key_findings": "Safety-aligned behavior in LLMs is controlled by multiple orthogonal directions in activation space, not just a single 'refusal direction.' A dominant SVD direction predicts refusal behavior, while non-dominant directions encode interpretable features tied to specific jailbreak patterns (e.g., hypothetical framing, role-playing). The paper introduces a Partial Layer-wise Relevance Propagation method to interpret these directions via token attribution. A trigger removal attack based on these insights maintains ~40% effectiveness even after safety fine-tuning on 80 exposure samples, suggesting safety alignment may learn spurious correlations with jailbreak-specific patterns rather than robust harmfulness detection.",
   "red_flags": [
     {
       "flag": "No uncertainty quantification",
       "detail": "All main results (attack pass rates, Strong Reject scores, prediction accuracy) are reported as single point estimates without error bars, confidence intervals, or variance across runs. This is particularly concerning given that DPO training showed 22% higher loss variance for Ministral."
     },
     {
       "flag": "Limited model diversity",
       "detail": "Primary experiments are on Llama 3.1 8B with additional tests only on Llama 3.2 3B and Ministral-8B-Instruct — all small models (~3-8B parameters). Claims about 'LLM alignment' broadly are not well supported by this narrow model selection."
     },
     {
       "flag": "Attack methodology confound",
       "detail": "The trigger removal attack uses Llama 3 405B for rephrasing, falling back to Hermes 3 405B (which has 'weaker safety guardrails') when the primary model refuses. This fallback introduces a confound: the attack's effectiveness may partly reflect the capabilities of the auxiliary model rather than the trigger removal insight."
     },
     {
       "flag": "Self-comparison bias",
       "detail": "The authors introduce the trigger removal attack and compare it favorably against existing jailbreak methods, but the comparison may be unfair: the trigger removal attack uses white-box access (PLRP analysis) to the victim model while baselines like PAIR and GPTFuzz are black-box attacks."
     }
   ],
   "cited_papers": [
     {
       "title": "Refusal in language models is mediated by a single direction",
       "authors": ["Andy Arditi", "Oscar Obeso", "Aaquib Syed", "Daniel Paleka", "Nina Panickssery", "Wes Gurnee", "Neel Nanda"],
       "year": 2024,
       "arxiv_id": "2406.11717",
       "relevance": "Foundational work on single-direction refusal representations that this paper directly extends to multi-dimensional safety directions."
     },
     {
       "title": "Universal and transferable adversarial attacks on aligned language models",
       "authors": ["Andy Zou", "Zifan Wang", "Nicholas Carlini", "Milad Nasr", "J. Zico Kolter", "Matt Fredrikson"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "GCG jailbreak attack used as a baseline in the safety fine-tuning evaluation and dataset construction."
     },
     {
       "title": "Jailbreaking black box large language models in twenty queries",
       "authors": ["Patrick Chao", "Alexander Robey", "Edgar Dobriban", "Hamed Hassani", "George J. Pappas", "Eric Wong"],
       "year": 2023,
       "arxiv_id": "2310.08419",
       "relevance": "PAIR attack method used as a primary baseline; the paper identifies a specific safety direction (L14-C6) that governs PAIR refusal."
     },
     {
       "title": "A wolf in sheep's clothing: Generalized nested jailbreak prompts can fool large language models easily",
       "authors": ["Peng Ding", "Jun Kuang", "Dan Ma", "Xuezhi Cao", "Yunsen Xian", "Jiajun Chen", "Shujian Huang"],
       "year": 2023,
       "arxiv_id": "2311.08268",
       "relevance": "ReNellm jailbreak attack used as a baseline in safety fine-tuning experiments."
     },
     {
       "title": "Direct preference optimization: Your language model is secretly a reward model",
       "authors": ["Rafael Rafailov", "Archit Sharma", "Eric Mitchell", "Christopher D. Manning", "Stefano Ermon", "Chelsea Finn"],
       "year": 2024,
       "relevance": "DPO alignment method directly used for safety fine-tuning in the experiments; paper compares SSFT vs DPO residual spaces."
     },
     {
       "title": "A strongreject for empty jailbreaks",
       "authors": ["Alexandra Souly", "Qingyun Lu", "Dillon Bowen", "Tu Trinh", "Elvis Hsieh", "Sana Pandey", "Pieter Abbeel", "Justin Svegliato", "Scott Emmons", "Olivia Watkins", "Sam Toyer"],
       "year": 2024,
       "relevance": "STRONG REJECT benchmark and scoring used as the primary evaluation metric and data source for harmful prompts."
     },
     {
       "title": "What makes and breaks safety fine-tuning? A mechanistic study",
       "authors": ["Samyak Jain", "Ekdeep Singh Lubana", "Kemal Oksuz", "Tom Joy", "Philip H. Torr", "Amartya Sanyal", "Puneet K. Dokania"],
       "year": 2024,
       "arxiv_id": "2407.10264",
       "relevance": "Related mechanistic interpretability work on safety fine-tuning dynamics that motivates the safety residual space framework."
     },
     {
       "title": "Understanding jailbreak success: A study of latent space dynamics in large language models",
       "authors": ["Sarah Ball", "Frauke Kreuter", "Nina Rimsky"],
       "year": 2024,
       "arxiv_id": "2406.09289",
       "relevance": "Studies latent space dynamics during jailbreaks using supervised probing; this paper extends beyond single-direction probes."
     },
     {
       "title": "The geometry of refusal in large language models: Concept cones and representational independence",
       "authors": ["Thomas Wollschläger", "Jannik Elstner", "Simon Geisler", "Vincent Cohen-Addad", "Stephan Günnemann", "Johannes Gasteiger"],
       "year": 2025,
       "arxiv_id": "2502.17420",
       "relevance": "Concurrent work also finding safety features represented by a subspace of latent activations; provides complementary perspective on multi-dimensional safety."
     },
     {
       "title": "Tree of attacks: Jailbreaking black-box LLMs automatically",
       "authors": ["Anay Mehrotra", "Manolis Zampetakis", "Paul Kassianik", "Blaine Nelson", "Hyrum Anderson", "Yaron Singer", "Amin Karbasi"],
       "year": 2023,
       "arxiv_id": "2312.02119",
       "relevance": "TAP iterative jailbreak method that the trigger removal attack is compared to in terms of computational cost (~30 vs ~35 attempts)."
     },
     {
       "title": "FLIPAttack: Jailbreak LLMs via Flipping",
       "authors": ["Yi Liu", "Xingyue He", "Mingyu Xiong", "Jinlan Fu", "Shuangqing Deng", "Bryan Hooi"],
       "year": 2024,
       "arxiv_id": "2410.02832",
       "relevance": "FLIPAttack jailbreak method used as a baseline in safety fine-tuning experiments."
     },
     {
       "title": "SafeDecoding: Defending against jailbreak attacks via safety-aware decoding",
       "authors": ["Zhangchen Xu", "Fengqing Jiang", "Luyao Niu", "Jinyuan Jia", "Bill Yuchen Lin", "Radha Poovendran"],
       "year": 2024,
       "arxiv_id": "2402.08983",
       "relevance": "Defense mechanism against jailbreaks via decoding-time modifications, representing an alternative approach to safety alignment."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 1,
       "justification": "Primarily a mechanistic interpretability framework; the trigger removal attack has some red-teaming utility but the main contribution is theoretical understanding."
     },
     "surprise_contrarian": {
       "score": 2,
       "justification": "Directly challenges the prevailing single-direction view of safety alignment (Arditi et al. 2024), showing safety is multi-dimensional with distinct interpretable features."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Demonstrates a trigger removal attack resilient to safety fine-tuning (~40% effectiveness at 80-shot), suggesting fundamental limitations of current safety alignment approaches."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "Straightforward academic contribution with no controversial claims about companies or products."
     },
     "demo_ability": {
       "score": 2,
       "justification": "Code and artifacts released on GitHub (https://github.com/BMPixel/safety-residual-space), enabling reproduction of the analysis."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "Published at ICML 2025 (top venue) and uses Llama models (well-known), but authors are from CityU/HIT, not a major AI lab. One co-author from Microsoft."
     }
   }
 }