ai-research-survey

scan.json (32589B)

---

 {
   "paper": {
     "title": "Improving LLM Safety Alignment with Dual-Objective Optimization",
     "authors": [
       "Xuandong Zhao",
       "Will Cai",
       "Tianneng Shi",
       "David Huang",
       "Licong Lin",
       "Song Mei",
       "Dawn Song"
     ],
     "year": 2025,
     "venue": "International Conference on Machine Learning",
     "arxiv_id": "2503.03710",
     "doi": "10.48550/arXiv.2503.03710"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval", "theoretical"],
   "key_findings": "The paper identifies two limitations of DPO for safety alignment—gradient saturation in refusal learning and poor OOD generalization—and proposes DOOR/W-DOOR to address them via robust refusal training with data augmentation and NPO-based unlearning. W-DOOR reduces prefilling attack success rate from 0.210 (DPO) to 0.034 on Llama-3-8B while preserving utility (HellaSwag 0.573 vs. 0.564 for DPO). Token-level distribution analysis shows that stronger robustness correlates with greater KL divergence from the base model and clearer separation of safe/harmful internal representations.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "The abstract states: 'The code is available at https://github.com/wicai24/DOOR-Alignment.' A working GitHub URL is provided."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "All evaluation datasets are publicly available: SORRY-Bench, HEx-PHI, HarmBench, XSTest, MMLU, HellaSwag, and Alpaca. Training data is constructed from these public sources as described in Appendix A.1."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions NVIDIA H100 GPUs, AdamW optimizer, and bfloat16 precision, but does not provide a requirements.txt, Dockerfile, or listing of library versions sufficient to recreate the environment."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided in the paper. Training settings are described (Appendix A.6) but there are no 'run this command' instructions or a described reproduction workflow."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "Table 1 and all figures report point estimates only (e.g., ASR of 0.034, HellaSwag 0.573) with no confidence intervals, error bars, or ± notation."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims methods outperform baselines (e.g., 'DOOR and W-DOOR consistently achieve low ASR') based solely on comparing point estimates in Table 1. No statistical significance tests (t-tests, bootstrap, etc.) are performed."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 1 provides absolute performance numbers for all methods and baselines across all metrics, allowing effect magnitudes to be assessed (e.g., W-DOOR prefilling ASR 0.034 vs. DPO 0.210 vs. original 0.547 on Llama-3-8B)."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "Training data consists of 400 safety samples and 400 Alpaca samples, evaluation on ~100 multi-turn and ~180 SORRY-Bench samples. No justification or power analysis is given for these sizes."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance, standard deviation, or spread measures are reported. Results appear to be from single runs with no indication of multiple seeds or repeated experiments."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "The paper compares against SFT, NPO, DPO (with and without augmentation), gradient ascent, Representation Rerouting (RR), and Tampering Attack Resistance (TAR), plus the original unaligned model."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "Baselines include RR (Zou et al., 2024), TAR (Tamirisa et al., 2024), and DPO (Rafailov et al., 2024), all recent and competitive methods for LLM safety alignment."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Multiple ablations are provided: DOOR vs. W-DOOR, with vs. without data augmentation (Figure 10), different token-level weight choices including varying τ, sigmoid vs. exponential functions, and jailbroken vs. reference policy (Appendix B.3, Figure 13)."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Six evaluation metrics are used: ASR on prefilling attacks, multi-turn ASR, GCG ASR, AutoDAN ASR, HellaSwag accuracy, and XSTest over-refusal rate. MMLU is also reported in the appendix."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "All safety evaluations use gpt-4o-mini as the LLM judge (Appendix C). No human evaluation of model outputs is performed. Manual verification is used only for training data quality, not system evaluation."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Section 4 states: 'SORRY-Bench (held-out subset) for single-turn refusal robustness.' HarmBench is entirely OOD, not used in training. Clear train/test separation is described in Appendix A."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down by attack type (Table 1), by prefill length (Figure 2), by number of conversation turns (Figure 4), and by training epoch (Figures 5-6)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 5.1 discusses that multi-turn attacks remain largely effective: 'All methods achieve only marginally more robustness against multi-turn attacks.' Over-refusal behavior is discussed, and gradient ascent is shown to cause model degradation (Appendix B.2). Appendix D shows specific jailbreak examples."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Gradient ascent is shown to significantly degrade model capabilities (Appendix B.2). DPO is shown to decrease safe token probability below the original model (Section 5.2). W-DOOR's over-refusal behavior is reported as a limitation."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims of 'significantly increases LLM robustness against a wide range of jailbreak attacks' are supported by Table 1 showing substantial ASR reductions across prefilling, GCG, AutoDAN, and multi-turn attacks on both models."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims like 'DOOR improves robustness' are supported by controlled experiments where the training loss is the only variable, with all other settings held constant (same data, hyperparameters, hardware). Ablation studies isolate the effect of individual components (augmentation, unlearning, token weighting)."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title claims 'Improving LLM Safety Alignment' generally, and the abstract states 'significantly increases LLM robustness.' Results are on only two small models (Gemma-2-2B and Llama-3-8B). No experiments on larger models or closed-source models. The generalization to larger scales or other architectures is not bounded."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "Section 5.2 analyzes why DOOR/W-DOOR works (KL divergence, token distributions, representations) but does not consider alternative explanations for the results. For instance, the role of data augmentation vs. loss function changes is partially ablated but alternative confounds (e.g., training data composition effects) are not discussed."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper measures ASR (attack success rate) and claims robustness to jailbreak attacks. ASR directly measures the outcome of interest. Capability retention is measured via HellaSwag and MMLU, which directly test what they claim. No significant proxy gap exists."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A.5 specifies 'Llama-3-8B-Instruct' and 'Gemma-2-2B-It' as base models, with links to specific HuggingFace models for RR and TAR baselines. The LLM judge is specified as gpt-4o-mini."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Full LLM-judge prompts for all three evaluation settings (prefilling, multi-turn, HarmBench) are provided in Appendix C. Training data examples with full prompt/response text are shown in Appendix D."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 4 and Appendix A.6 report: β=0.5, α=0.2, τ=5, learning rate 1×10⁻⁵, batch size 2, gradient accumulation 1, 10 epochs, sequence length 512, AdamW optimizer, bfloat16 precision."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. The paper trains and evaluates alignment methods directly on LLMs without any agent framework."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A.1 describes the full data construction pipeline: fine-tuning a jailbroken model on 110 HEx-PHI samples, generating safe/harmful response pairs for 180 SORRY-Bench and 220 HEx-PHI samples, manual verification, and sampling 400 Alpaca examples for utility data."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "There is no dedicated 'Limitations' or 'Threats to Validity' section. The conclusion (Section 7) discusses future work directions that implicitly acknowledge limitations, but these are framed as improvements rather than a structured limitations discussion."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "The conclusion identifies specific issues: token-level weighting parameters need better optimization, the uniform length selection in data augmentation causes overrefusal from 'falsely learned transitions,' and robustness to additional attack types needs investigation. These are specific to this work."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not explicitly state what the results do NOT show. There are no explicit statements bounding claims to the tested models (2B, 8B) or specific attack types. The conclusion mentions 'investigating robustness to other jailbreak attack types' as future work but does not formally state scope boundaries."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "Code is released but there is no mention of raw experimental outputs (per-sample model generations, per-sample judge verdicts) being available for independent verification."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Appendix A.1 describes data collection in detail: sources (SORRY-Bench, HEx-PHI, Alpaca), jailbroken model fine-tuning procedure, response generation protocol with manual verification, and sample counts at each stage."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. All data comes from standard public benchmarks and model-generated responses."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The pipeline is documented: 110 HEx-PHI samples → fine-tune jailbroken model → generate harmful/safe response pairs for 180+220 samples → manual verification → combine with 400 Alpaca samples. Evaluation pipeline is similarly described with specific sample counts per dataset."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding or acknowledgments section is present in the provided text. No grants, sponsors, or funding agencies are mentioned."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "All authors are listed as affiliated with the University of California, Berkeley. No commercial product is being evaluated, so there is no vendor conflict."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "Funding is not disclosed, so independence cannot be assessed. Without a funding statement, this criterion is not satisfied."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests safety alignment defenses against jailbreak attacks rather than evaluating pre-trained model knowledge on benchmarks. MMLU and HellaSwag are used only as secondary utility-preservation checks, not as the primary evaluation."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests defense methods (alignment training) rather than pre-trained model capability. Contamination of benchmark answers in pre-training is not the relevant concern for safety robustness evaluation."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "As a defense-testing paper, benchmark contamination in the traditional sense (model memorizing test answers) is not the primary concern. The paper does properly hold out SORRY-Bench test data from training."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference cost, training cost, or wall-clock time is reported. The paper mentions using H100 GPUs but does not quantify how long training takes or what the computational cost is."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "NVIDIA H100 GPUs are mentioned but total GPU hours, training time, or computational budget are not stated. The training involves 10 epochs on two models but the time/cost is unquantified."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of multiple random seeds or seed sensitivity analysis. All results appear to be from single training runs."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is never stated. Results are presented without indicating whether they are from single runs or averaged over multiple runs."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "Values β=0.5, α=0.2 are used without stating how they were selected. While Appendix B.3 shows sensitivity to τ values, no systematic search budget or selection methodology is described."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "The main configuration (β=0.5, α=0.2, τ=5) is presented without justification for selection. Figure 13 shows τ sensitivity but does not explain how τ=5 was chosen as the default."
       },
       "multiple_comparison_correction": {
         "applies": false,
         "answer": false,
         "justification": "No formal statistical tests are performed, so multiple comparison correction is not applicable."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors implement their own versions of SFT, NPO, and DPO baselines. While RR and TAR use publicly released HuggingFace models (independent implementations), no discussion of self-comparison bias for the author-implemented baselines is provided."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": true,
         "justification": "Figures 5 and 6 show the Pareto analysis of ASR vs. HellaSwag accuracy and over-refusal rate over 10 training epochs, effectively showing performance as a function of compute. All methods are trained under identical compute settings, making them comparable."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether ASR (judged by gpt-4o-mini) fully captures safety robustness, or whether HellaSwag/MMLU adequately measure capability retention. No discussion of benchmark construct validity is provided."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used in this work. All methods are evaluated as direct model fine-tuning approaches."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether Llama-3 or Gemma-2 may have been trained on data from SORRY-Bench, HEx-PHI, or other evaluation benchmarks. Temporal relationships between model training and benchmark creation are not addressed."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The LLM judge (gpt-4o-mini) could introduce systematic biases in ASR evaluation. The paper does not discuss potential feature leakage through the judge's own biases or whether the judge's assessment correlates with actual harmful content."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses a held-out subset of SORRY-Bench for evaluation (180 training, separate for evaluation) and tests on the entirely OOD HarmBench dataset. Train/test separation is explicitly documented in Section 4 and Appendix A."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No concrete leakage detection method is applied. The paper relies on dataset splitting but does not use canary strings, membership inference, or n-gram overlap analysis."
       }
     }
   },
   "claims": [
     {
       "claim": "DPO's gradient dynamics are suboptimal for safety alignment due to premature learning rate saturation and poor OOD generalization.",
       "evidence": "Section 2.2 provides gradient decomposition of DPO loss, showing the effective learning rate diminishes exponentially as the safe/harmful margin grows, and that gradient terms can inadvertently increase OOD response logits.",
       "supported": "moderate"
     },
     {
       "claim": "DOOR and W-DOOR significantly reduce attack success rates against prefilling attacks compared to DPO and other baselines.",
       "evidence": "Table 1 and Figure 2: W-DOOR achieves 0.034 prefilling ASR vs. DPO's 0.210 on Llama-3-8B, and 0.005 vs. DPO's 0.060 on Gemma-2-2B across multiple prefill lengths.",
       "supported": "strong"
     },
     {
       "claim": "Prefilling attack robustness generalizes to other attack types including GCG, AutoDAN, and multi-turn attacks.",
       "evidence": "Table 1 shows consistent ASR rankings across attack types. Section 5.1 notes: 'ASR rankings remain consistent across various attack types, indicating that prefilling attack ASR is a reliable measure of overall robustness.' Multi-turn gains are marginal (0.447 vs. 0.521 for W-DOOR vs. original on Llama).",
       "supported": "moderate"
     },
     {
       "claim": "W-DOOR preserves general model capabilities better than DPO while achieving stronger robustness.",
       "evidence": "Table 1 and Figure 3: W-DOOR HellaSwag 0.573 vs. DPO 0.564 on Llama-3-8B. Figure 5 Pareto analysis shows W-DOOR remains near Pareto-optimal for the longest duration.",
       "supported": "moderate"
     },
     {
       "claim": "Data augmentation with harmful prefixes is critical for prefilling attack robustness.",
       "evidence": "Figure 10 shows a large gap between augmented and non-augmented versions of all methods. Section 5.1 states: 'Data augmentation significantly enhances robustness against prefilling attacks as demonstrated by DPO ablation.'",
       "supported": "strong"
     },
     {
       "claim": "Token distribution shifts (KL divergence from base model) correlate with robustness to jailbreak attacks.",
       "evidence": "Section 5.2, Figure 7: W-DOOR shows the largest KL divergence from the base model, which 'strongly correlates with its robustness to prefilling attacks.' Figure 8 shows W-DOOR is more effective at reducing harmful token probability at later positions.",
       "supported": "moderate"
     },
     {
       "claim": "Extended training reduces over-refusal while maintaining robustness.",
       "evidence": "Section 5.1 and Figure 6 show that over-refusal rate and prefilling ASR decrease simultaneously over epochs for W-DOOR, suggesting 'no clear trade-off between refusing harmful queries and over-refusing benign ones.'",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "No error bars or variance reporting",
       "detail": "All results in Table 1 and figures appear to be from single runs. No standard deviations, confidence intervals, or repeated experiments are reported. Given that alignment training can be sensitive to initialization, this is a significant gap in assessing result reliability."
     },
     {
       "flag": "LLM-as-judge without human validation",
       "detail": "All safety evaluations rely on gpt-4o-mini as the sole judge via string-matching 'yes'/'no' responses. No human evaluation validates the judge's accuracy. The judge prompts (Appendix C) have potential for systematic biases that could favor certain response patterns over actual safety assessment."
     },
     {
       "flag": "Limited model scale",
       "detail": "Experiments are conducted only on Gemma-2-2B and Llama-3-8B, both relatively small models. It is unclear whether the findings transfer to larger models (70B+) where safety alignment dynamics may differ substantially."
     },
     {
       "flag": "Adversarial attacks not optimized against aligned models",
       "detail": "GCG and AutoDAN attacks are 'optimized with respect to the base model (i.e., all alignment methods are attacked by the same data)' (Appendix A.7). This means attacks are not adapted to the specific defenses, potentially underestimating the success rate of targeted attacks against DOOR/W-DOOR."
     },
     {
       "flag": "No statistical significance testing",
       "detail": "Claims of superiority (e.g., 'significantly improve safety alignment') are based on comparing point estimates without any formal statistical tests. The magnitude of differences may not be statistically significant given unknown variance."
     }
   ],
   "cited_papers": [
     {
       "title": "Safety alignment should be made more than just a few tokens deep",
       "authors": ["Xiangyu Qi", "Ashwinee Panda", "Kaifeng Lyu", "Xiao Ma", "Subhrajit Roy", "Ahmad Beirami", "Prateek Mittal", "Peter Henderson"],
       "year": 2024,
       "arxiv_id": "2406.05946",
       "relevance": "Demonstrates that existing SFT alignment is shallow and proposes data augmentation to deepen safety alignment—directly foundational to DOOR's approach."
     },
     {
       "title": "Negative preference optimization: From catastrophic collapse to effective unlearning",
       "authors": ["Ruiqi Zhang", "Licong Lin", "Yu Bai", "Song Mei"],
       "year": 2024,
       "arxiv_id": "2404.05868",
       "relevance": "Proposes NPO which is a core component of the DOOR loss function for targeted unlearning of harmful knowledge."
     },
     {
       "title": "Direct preference optimization: Your language model is secretly a reward model",
       "authors": ["Rafael Rafailov", "Archit Sharma", "Eric Mitchell", "Christopher D. Manning", "Stefano Ermon", "Chelsea Finn"],
       "year": 2024,
       "relevance": "The primary baseline method whose limitations in safety alignment are analyzed and addressed by DOOR."
     },
     {
       "title": "Universal and transferable adversarial attacks on aligned language models",
       "authors": ["Andy Zou", "Zifan Wang", "Nicholas Carlini", "Milad Nasr", "J. Zico Kolter", "Matt Fredrikson"],
       "year": 2023,
       "arxiv_id": "2307.15043",
       "relevance": "Introduces the GCG adversarial suffix attack, one of the primary attack methods used to evaluate defense robustness."
     },
     {
       "title": "Jailbreaking leading safety-aligned llms with simple adaptive attacks",
       "authors": ["Maksym Andriushchenko", "Francesco Croce", "Nicolas Flammarion"],
       "year": 2024,
       "arxiv_id": "2404.02151",
       "relevance": "Describes prefilling attacks on LLMs, the primary threat model evaluated in this paper."
     },
     {
       "title": "Improving alignment and robustness with circuit breakers",
       "authors": ["Andy Zou", "Long Phan", "Justin Wang", "Derek Duenas", "Maxwell Lin", "Maksym Andriushchenko", "Rowan Wang", "J. Zico Kolter", "Matt Fredrikson", "Dan Hendrycks"],
       "year": 2024,
       "arxiv_id": "2406.04313",
       "relevance": "Representation Rerouting (RR) baseline using representation engineering to block harmful outputs—an alternative defense approach compared against DOOR."
     },
     {
       "title": "Tamper-resistant safeguards for open-weight llms",
       "authors": ["Rishub Tamirisa", "Bhrugu Bharathi", "Long Phan"],
       "year": 2024,
       "arxiv_id": "2408.00761",
       "relevance": "TAR baseline that prevents fine-tuning from removing safety measures—a complementary defense approach benchmarked against DOOR."
     },
     {
       "title": "HarmBench: A standardized evaluation framework for automated red teaming and robust refusal",
       "authors": ["Mantas Mazeika", "Long Phan", "Xuwang Yin"],
       "year": 2024,
       "arxiv_id": "2402.04249",
       "relevance": "Provides the out-of-distribution evaluation benchmark for GCG and AutoDAN attacks used in this paper."
     },
     {
       "title": "Great, now write an article about that: The crescendo multi-turn llm jailbreak attack",
       "authors": ["Mark Russinovich", "Ahmed Salem", "Ronen Eldan"],
       "year": 2024,
       "arxiv_id": "2404.01833",
       "relevance": "Introduces the Crescendo multi-turn jailbreak attack used to generate multi-turn evaluation data in this paper."
     },
     {
       "title": "Safe unlearning: A surprisingly effective and generalizable solution to defend against jailbreak attacks",
       "authors": ["Zhexin Zhang", "Junxiao Yang", "Pei Ke"],
       "year": 2024,
       "arxiv_id": "2407.02855",
       "relevance": "Combines unlearning with SFT for safety alignment without data augmentation—a closely related defense approach."
     },
     {
       "title": "Refuse whenever you feel unsafe: Improving safety in LLMs via decoupled refusal training",
       "authors": ["Youliang Yuan", "Wenxiang Jiao", "Wenxuan Wang"],
       "year": 2024,
       "arxiv_id": "2407.09121",
       "relevance": "Proposes decoupled refusal training with data augmentation, closely related to the robust refusal training component of DOOR."
     },
     {
       "title": "The instruction hierarchy: Training llms to prioritize privileged instructions",
       "authors": ["Eric Wallace", "Kai Xiao", "Reimar Leike", "Lilian Weng", "Johannes Heidecke", "Alex Beutel"],
       "year": 2024,
       "arxiv_id": "2404.13208",
       "relevance": "Proposes instruction hierarchy for LLM safety at inference time, a complementary defense to training-time methods like DOOR."
     },
     {
       "title": "Fine-tuning aligned language models compromises safety, even when users do not intend to!",
       "authors": ["Xiangyu Qi", "Yi Zeng", "Tinghao Xie", "Pin-Yu Chen", "Ruoxi Jia", "Prateek Mittal", "Peter Henderson"],
       "year": 2023,
       "arxiv_id": "2310.03693",
       "relevance": "Demonstrates that fine-tuning can compromise safety alignment, motivating the harmful response simulation strategy used in DOOR's data construction."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Code is released and the method can be applied by practitioners fine-tuning open-weight models for safety, but requires GPU training infrastructure and safety dataset construction."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "The finding that DPO is suboptimal for safety alignment extends prior observations; the specific gradient analysis provides new depth but the general direction is expected."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Demonstrates that widely deployed DPO alignment remains vulnerable to jailbreaks, raising concerns about current production safety measures."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "Criticizes DPO (used in Llama-3 alignment) as inadequate for safety, but frames it constructively as a technical improvement rather than controversy."
     },
     "demo_ability": {
       "score": 2,
       "justification": "GitHub repository with code is provided, allowing researchers to reproduce the training pipeline, though it requires H100 GPUs and dataset setup."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "UC Berkeley authors including Dawn Song (well-known in security) and published at ICML, but not a major AI lab product or about a flagship commercial model."
     }
   }
 }