ai-research-survey

scan.json (32782B)

---

 {
   "paper": {
     "title": "Layer-Aware Representation Filtering: Purifying Finetuning Data to Preserve LLM Safety Alignment",
     "authors": [
       "Hao Li",
       "Lijun Li",
       "Zhenghao Lu",
       "Xianyi Wei",
       "Rui Li",
       "Jing Shao",
       "Lei Sha"
     ],
     "year": 2025,
     "venue": "Conference on Empirical Methods in Natural Language Processing",
     "arxiv_id": "2507.18631",
     "doi": "10.48550/arXiv.2507.18631"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "LARF identifies safety-sensitive layers in LLMs by scaling layer parameters and measuring refusal rate changes, then uses bidirectional representation similarity at those layers to detect safety-degrading data in benign fine-tuning datasets. Fine-tuning Llama3.1 on the 1,000 highest-scored samples from Alpaca raises Attack Success Rate on HarmBench from 3.5% to 39%, while fine-tuning on the 1,000 lowest-scored samples reduces ASR to 0%. LARF is substantially more efficient than alternatives (0.5 hours on 1 GPU vs. 3–6 hours on 1–8 GPUs) and removing flagged data mitigates safety degradation across code generation, math reasoning, and medical QA without harming downstream task performance.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "The abstract provides a GitHub link: 'Please see our code at https://github.com/LLLeoLi/LARF.'"
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "All evaluation datasets (HarmBench, HEx-PHI, DirectHarm4, Alpaca, Dolly, Magicoder, PubMedQA, MetaMath) are publicly available standard benchmarks. Reference datasets (Dsafe, Dunsafe) are constructed from the publicly available Circuit Breaker training dataset."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions NVIDIA A100-SXM 80GB GPUs (Table 3) and states model names, but provides no requirements.txt, Dockerfile, or detailed environment setup listing library versions."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided in the paper. A code link is given but the paper itself contains no README-style commands or 'Reproducing Results' section."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All tables (Tables 1, 2, 5, 6) report point estimates only. The Random baseline is averaged over 3 runs but no confidence intervals, error bars, or ± notation are provided."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "Claims like 'LARF is the most effective method' are supported solely by comparing point estimates across methods. No statistical significance tests (t-tests, bootstrap, etc.) are used."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper reports effect sizes with baseline context throughout: e.g., 'raises the Attack Success Rate (ASR) on HarmBench from 3.5% to 39%, a 20% improvement over Bi-Anchoring' (Section 1). Tables provide absolute ASR values for all methods enabling direct comparison."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The choice of 1,000 samples for selection and 10,000 samples for downstream tasks is not justified. No power analysis or explanation of why these specific sample sizes were chosen."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "The Random baseline is averaged over 3 runs but no standard deviation or variance is reported. LARF and other methods appear to be single deterministic runs (temperature=0), but no spread measure is reported for any method."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Four baselines are compared: Random sampling, SEAL (Shen et al., 2025), GradSafe (Xie et al., 2024), and Bi-Anchoring (He et al., 2024). The instruct model baseline is also included."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "All baselines are from 2024-2025: SEAL (ICLR 2025), GradSafe (ACL 2024), Bi-Anchoring (COLM 2024). These represent the current state of the art in safety-degrading data detection."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Multiple ablations are provided: bidirectional vs. unidirectional representation scoring (Figure 3, Appendix D.1), layer-wise selection showing the safety-sensitive layer is optimal (Figure 5), and analysis of layer representation similarity (Appendix E.2)."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Safety is evaluated across three benchmarks (DirectHarm4, HarmBench, HEx-PHI) using ASR and GPT Score metrics. Downstream task utility is measured with HumanEval pass@1, PubMedQA accuracy, and MATH math_verify."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "All evaluation is fully automated: LlamaGuard 3 for safety classification (Section 4.1), GPT-4o for harmfulness scoring (Appendix C.4), and automated benchmarks for downstream tasks. No human evaluation of outputs is performed."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Safety evaluation benchmarks (HarmBench, HEx-PHI, DirectHarm4) are fully separate from fine-tuning datasets (Alpaca, Dolly). Downstream tasks use dedicated test splits (HumanEval, PubMedQA test set, MATH benchmark)."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.5 and Appendix E.5 provide per-category ASR breakdowns across safety categories (e.g., Malware, Drug, Phishing, Disinformation for DirectHarm4; 10 categories for HEx-PHI) shown in radar charts."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "The paper discusses where LARF breaks down: Figure 17c shows Qwen2.5's bottom-ranked representations deviate from the baseline 'likely due to a distribution mismatch between the fine-tuning data and the original model.' The Limitations section acknowledges data-only filtering cannot fully prevent safety degradation."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 explicitly states 'data-only filtering cannot fully prevent safety degradation' and that effectiveness depends on reference data quality. The Qwen2.5 distribution mismatch issue (Figure 17c) is a negative finding. Categories like Physical Harm and Illegal Activities show no significant ASR change after fine-tuning."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract claims LARF 'efficiently and effectively' identifies safety-degrading data (supported by Tables 1, 3) and that removing such data 'mitigates safety alignment degradation' (supported by Tables 2, 5). The claim of 'broad generalizability' is supported by experiments across 6 models and 5 datasets, though this is somewhat stretched."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims (e.g., 'fine-tuning on safety-degrading data induces representational drifts') are supported by controlled ablation-style experiments: fine-tuning on top vs. bottom ranked samples from the same dataset, with the only variable being the selection method. This controlled single-variable manipulation is adequate for the causal claims made."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title claims 'Preserve LLM Safety Alignment' broadly, but experiments are limited to open-source models (no closed-source LLMs tested). The paper acknowledges in Limitations that VLMs and Diffusion Models are untested, but the title and abstract do not bound claims to the tested settings."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper hypothesizes that long point-by-point responses explain safety degradation (Section 4.5) but does not consider alternative explanations for LARF's effectiveness, such as whether simpler features (response length alone) could achieve similar filtering performance, or whether the representation similarity captures safety-relevant features vs. stylistic ones."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper measures ASR on specific safety benchmarks and refers to it precisely as 'Attack Success Rate' rather than inflating it to broader safety claims. GPT Score is separately reported as a harmfulness rating. The distinction between measured proxy (ASR, GPT Score) and claimed outcome (safety alignment) is maintained at appropriate granularity."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "The main models (Llama3-8B-Instruct, Llama3.1-8B-Instruct, Qwen2.5-7B-Instruct) are specified with size and variant. However, GPT-4o is used for evaluation scoring (Appendix C.4) without a snapshot date or API version, which per the schema is insufficient — 'Marketing names like GPT-4o without a snapshot date do NOT count.'"
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "The GPT-4o evaluation prompt is described as 'a revised version of the one used by (Qi et al., 2024)' but not provided. The overrejection dataset generation prompt is not shown. Safety-related refusal patterns ('I cannot', 'Sorry', etc.) are briefly mentioned but the full set is not listed."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Fine-tuning hyperparameters are detailed in Appendix C.5: LoRA rank=8, α=8, learning rate 1e-4, warmup ratio 0.1, batch size 8, 3 epochs, cosine LR scheduler. Generation parameters: temperature=0, do_sample=False. Scaling factors α∈{0.1, 0.2} for layer identification."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. LARF is a data filtering method that extracts representations from model layers, not an agent-based system."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Appendix C.1 describes overrejection dataset construction (110 instructions generated and filtered). Appendix C.2 details Dsafe/Dunsafe construction: 5 examples from each of 20 categories from Circuit Breaker. Section 4.4 states '10,000 data points' sampled and 'top 2,000 ranked samples' removed."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 'Limitations' is a dedicated section spanning multiple paragraphs discussing three specific limitations of the approach."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 raises specific threats: (1) data-only filtering cannot fully prevent safety degradation and should be combined with safety-aware fine-tuning, (2) effectiveness depends on reference dataset quality and composition, (3) the method has not been tested on VLMs or Diffusion Models where similar problems exist."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 explicitly states what was NOT tested: 'Our experiments have been limited to LLMs, and we have not yet evaluated our approach on vision–language models (VLMs) or Diffusion Models.' It also states that 'exploring optimal reference selection lies beyond the scope of this work.'"
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": false,
         "justification": "The constructed reference datasets (Dsafe, Dunsafe, overrejection dataset Ds) are not explicitly stated as being released. While the code repository is linked, the paper does not confirm these specific datasets are included. Evaluation benchmark results are not provided as raw data."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Appendix C.1 describes overrejection dataset generation using Llama-3.1-8B-Lexi-Uncensored-V2 with filtering criteria. Appendix C.2 describes Dsafe/Dunsafe selection from 20 Circuit Breaker categories with 5 examples each. Evaluation datasets are described with their sources."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. All data comes from standard benchmarks or model-generated datasets."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The full pipeline is documented: reference dataset construction (Appendix C.1–C.2), safety-sensitive layer identification (Section 3.2), representation extraction and scoring (Section 3.3), data selection by rank, fine-tuning (Appendix C.5), and evaluation (Appendix C.3–C.4). Algorithm 1 summarizes the complete process."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": false,
         "justification": "No funding or acknowledgments section is present in the paper text. The authors are affiliated with Shanghai AI Lab, Beihang University, Wuhan University, and Peking University, but no funding source is disclosed."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are clearly listed: Shanghai Artificial Intelligence Laboratory, Beihang University, Wuhan University, and Peking University. No evaluated product is tied to these affiliations."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": false,
         "justification": "Since funding is not disclosed, independence of the funder from the outcome cannot be assessed."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests a defense method (data filtering for safe fine-tuning) rather than evaluating pre-trained model knowledge on benchmarks. The safety benchmarks evaluate fine-tuned model behavior, not pre-trained capability."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests a defense method (data filtering) rather than pre-trained model capability on benchmarks."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "The paper tests a defense method (data filtering) rather than pre-trained model capability on benchmarks."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 3 reports wall-clock runtime for each method on the Alpaca dataset: LARF requires 0.5 hours, SEAL 6 hours, GradSafe 5.3 hours, Bi-Anchoring 3 hours."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": true,
         "justification": "Table 3 reports per-GPU memory usage and number of GPUs: LARF uses 1×18.4GB, SEAL 8×36GB, GradSafe 1×48GB, Bi-Anchoring 4×27.8GB, all on NVIDIA A100-SXM 80GB GPUs."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "Only the Random baseline is repeated (3 runs). LARF and all other baselines appear as single deterministic runs (temperature=0 for generation). No seed sensitivity analysis is performed."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "Random baseline explicitly states 3 runs. For LARF and other methods, the number of runs is not explicitly stated. Setting temperature=0 implies deterministic single runs but this is not stated directly."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "No hyperparameter search budget is reported. LoRA settings (rank=8, α=8, lr=1e-4) appear fixed without explanation. Only the scaling factor α∈{0.1, 0.2} is explored with justification for not going higher."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "The scaling factor range is justified (excessive perturbation causes confusion), but LoRA hyperparameters and the choice of 1,000 samples for selection are not justified through any systematic selection process."
       },
       "multiple_comparison_correction": {
         "applies": false,
         "answer": false,
         "justification": "No formal statistical tests are performed at all, so multiple comparison correction is not applicable."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors implement all baselines (SEAL, GradSafe, Bi-Anchoring) themselves for comparison without acknowledging author-implementation bias. For Bi-Anchoring, they note using the same Dsafe/Dunsafe for fairness but do not discuss broader self-comparison bias."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": true,
         "justification": "Table 3 directly compares compute budgets (time, memory, GPUs) alongside effectiveness results in Table 1, allowing readers to assess the performance-compute tradeoff. LARF achieves the best performance with the lowest compute."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether ASR on DirectHarm4, HarmBench, and HEx-PHI actually measures 'safety alignment' or whether these benchmarks capture the full scope of safety concerns. LlamaGuard 3 and GPT-4o as automated evaluators are used without validating their accuracy for this task."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding is involved in this work. LARF is a data filtering method, not an agent-based system."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether models may have seen safety benchmark prompts (HarmBench, HEx-PHI, DirectHarm4) during pre-training, which could affect refusal behavior patterns."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup (e.g., prompt formatting, instruction templates) could leak information about expected behavior."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of potential overlap between fine-tuning datasets (Alpaca, Dolly) and safety evaluation benchmarks (HarmBench, HEx-PHI, DirectHarm4), or whether the Dsafe/Dunsafe reference data shares content with evaluation data."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No concrete leakage detection or prevention method is applied. No overlap analysis, temporal splits, or decontamination checks are performed."
       }
     }
   },
   "claims": [
     {
       "claim": "LARF is the most efficient method for data filtering, requiring only 0.5 hours on 1 GPU with 18.4GB memory for the Alpaca dataset on Llama3.1.",
       "evidence": "Table 3 compares wall-clock runtime and GPU requirements: LARF (0.5h, 1×18.4GB) vs SEAL (6h, 8×36GB), GradSafe (5.3h, 1×48GB), Bi-Anchoring (3h, 4×27.8GB).",
       "supported": "strong"
     },
     {
       "claim": "Fine-tuning Llama3.1 on the 1,000 highest LARF-scored samples from Alpaca raises ASR on HarmBench from 3.5% to 39%, a 20% improvement over Bi-Anchoring.",
       "evidence": "Table 1 shows Llama3.1 Alpaca HarmBench ASR: Instruct 3.50%, LARF 39.00%, Bi-Anchoring 12.50%. The abstract claims '20% improvement' (39% - 12.5% ≈ 20pp, though framed ambiguously).",
       "supported": "strong"
     },
     {
       "claim": "LARF is the most effective method for selecting safety-degrading data across all models and datasets.",
       "evidence": "Table 1 shows LARF achieving the highest ASR for all three models on both Alpaca and Dolly datasets. Table 5 shows LARF achieving the lowest ASR for safe data (bottom-ranked samples).",
       "supported": "moderate"
     },
     {
       "claim": "Removing LARF-identified safety-degrading data mitigates safety alignment degradation without sacrificing downstream performance.",
       "evidence": "Table 2 shows all methods maintain task performance within 1% of random baseline on HumanEval, PubMedQA, and MATH, while LARF consistently achieves the lowest GPT Score and ASR on DirectHarm4 for every model-benchmark pair.",
       "supported": "moderate"
     },
     {
       "claim": "Safety-degrading examples are characterized by long point-by-point responses that exceed dataset averages.",
       "evidence": "Table 4 shows top-ranked samples have 516-872 point-style responses (vs. 276 average) and 333-354 output tokens (vs. 138 average) on Alpaca. Tables 7-9 show this pattern across all five datasets.",
       "supported": "moderate"
     },
     {
       "claim": "Fine-tuning on safety-degrading data induces representational drift in the safety-sensitive layer.",
       "evidence": "Figure 17 shows PCA projections where top-1,000 fine-tuned models diverge from the instruct baseline while bottom-1,000 remain clustered. Appendix E.4 shows increasing effective rank for top-ranked fine-tuned models.",
       "supported": "moderate"
     },
     {
       "claim": "The 13th layer is the safety-sensitive layer for Llama3 and Llama3.1, and the 18th layer for Qwen2.5.",
       "evidence": "Figures 4, 7, 8, 10 show layer-wise sensitivity analysis. Figure 5 validates that selecting data by 13th-layer representations yields the highest ASR for Llama3 across all safety benchmarks.",
       "supported": "strong"
     }
   ],
   "red_flags": [
     {
       "flag": "No error bars or variance on main results",
       "detail": "Tables 1, 2, and 5 report point estimates only. The Random baseline is averaged over 3 runs but without standard deviation. LARF and other methods appear to be single runs. With temperature=0 the model output is deterministic, but the fine-tuning process has stochasticity from LoRA initialization and data ordering that is not quantified."
     },
     {
       "flag": "No statistical significance tests",
       "detail": "All comparative claims ('LARF is the most effective') rely on comparing raw percentages across methods without any statistical tests. Given that differences between methods are sometimes small (e.g., LARF 49.50% vs Bi-Anchoring 11.00% on Llama3.1/Alpaca/DirectHarm4 is large, but LARF 31.00% vs Bi-Anchoring 24.50% on Qwen2.5/Alpaca/HarmBench is closer), significance testing would strengthen claims."
     },
     {
       "flag": "Automated safety evaluation without validation",
       "detail": "All safety judgments rely on LlamaGuard 3 and GPT-4o without validating their accuracy for this specific task. LlamaGuard 3 is an 8B model fine-tuned on content safety, and its alignment with human judgment on safety-degrading data detection is not assessed. GPT-4o harmfulness scores are used without inter-rater agreement checks."
     },
     {
       "flag": "Missing funding disclosure",
       "detail": "No funding or acknowledgments section is present despite all authors being affiliated with research institutions (Shanghai AI Lab, Beihang/Wuhan/Peking Universities) that typically require grant disclosures."
     }
   ],
   "cited_papers": [
     {
       "title": "Fine-tuning aligned language models compromises safety, even when users do not intend to!",
       "authors": ["Xiangyu Qi", "Yi Zeng", "Tinghao Xie", "Pin-Yu Chen", "Ruoxi Jia", "Prateek Mittal", "Peter Henderson"],
       "year": 2024,
       "relevance": "Foundational work showing that fine-tuning on benign data can degrade LLM safety alignment, directly motivating LARF's data filtering approach."
     },
     {
       "title": "What is in your safe data? Identifying benign data that breaks safety",
       "authors": ["Luxi He", "Mengzhou Xia", "Peter Henderson"],
       "year": 2024,
       "relevance": "Proposes Bi-Anchoring method for identifying safety-degrading data using gradient similarity, serving as a direct baseline and motivation for LARF."
     },
     {
       "title": "SEAL: Safety-enhanced aligned LLM fine-tuning via bilevel data selection",
       "authors": ["Han Shen", "Pin-Yu Chen", "Payel Das", "Tianyi Chen"],
       "year": 2025,
       "relevance": "Trains a dedicated data ranker for safe fine-tuning via bilevel optimization, a key baseline for LARF comparison."
     },
     {
       "title": "Refusal in language models is mediated by a single direction",
       "authors": ["Andy Arditi", "Oscar Balcells Obeso", "Aaquib Syed", "Daniel Paleka", "Nina Rimsky", "Wes Gurnee", "Neel Nanda"],
       "year": 2024,
       "relevance": "Demonstrates that refusal behavior in LLMs is mediated by a single representational direction, foundational to LARF's bidirectional representation approach."
     },
     {
       "title": "Improving alignment and robustness with circuit breakers",
       "authors": ["Andy Zou", "Long Phan", "Sarah Chen", "James Campbell"],
       "year": 2024,
       "arxiv_id": "2406.04313",
       "relevance": "Defends against adversarial attacks by rerouting harmful representations, demonstrating representation-based safety approaches and providing training data used in LARF's reference dataset construction."
     },
     {
       "title": "Safety layers in aligned large language models: The key to LLM security",
       "authors": ["Shen Li", "Liuyi Yao", "Lan Zhang", "Yaliang Li"],
       "year": 2025,
       "relevance": "Identifies safety-critical layers in LLMs and preserves alignment through gradient freezing, directly inspiring LARF's safety-sensitive layer identification method."
     },
     {
       "title": "GradSafe: Detecting jailbreak prompts for LLMs via safety-critical gradient analysis",
       "authors": ["Yueqi Xie", "Minghong Fang", "Renjie Pi", "Neil Gong"],
       "year": 2024,
       "relevance": "Classifies unsafe instructions based on gradients of safety-sensitive parameters, a baseline method for LARF and related approach to safety-critical parameter identification."
     },
     {
       "title": "HarmBench: A standardized evaluation framework for automated red teaming and robust refusal",
       "authors": ["Mantas Mazeika", "Long Phan", "Xuwang Yin", "Andy Zou"],
       "year": 2024,
       "arxiv_id": "2402.04249",
       "relevance": "Provides the primary safety evaluation benchmark used throughout LARF's experiments to measure Attack Success Rate."
     },
     {
       "title": "Representation engineering: A top-down approach to AI transparency",
       "authors": ["Andy Zou", "Long Phan", "Sarah Chen"],
       "year": 2023,
       "relevance": "Foundational work showing that intermediate representations contain rich safety-relevant information, motivating LARF's representation-based data filtering approach."
     },
     {
       "title": "Safe LoRA: The silver lining of reducing safety risks when fine-tuning large language models",
       "authors": ["Chia-Yi Hsu", "Yu-Lin Tsai", "Chih-Hsun Lin", "Pin-Yu Chen", "Chia-Mu Yu", "Chun-Ying Huang"],
       "year": 2024,
       "relevance": "Addresses safety-preserving fine-tuning through parameter merging, representing the parameter-restoration paradigm that complements LARF's data filtering approach."
     },
     {
       "title": "Harmful fine-tuning attacks and defenses for large language models: A survey",
       "authors": ["Tiansheng Huang", "Sihao Hu", "Fatih Ilhan", "Selim Furkan Tekin", "Ling Liu"],
       "year": 2024,
       "relevance": "Comprehensive survey of harmful fine-tuning attacks and defenses, providing the broader research context for LARF's contribution."
     },
     {
       "title": "Keeping LLMs aligned after fine-tuning: The crucial role of prompt templates",
       "authors": ["Kaifeng Lyu", "Haoyu Zhao", "Xinran Gu", "Dingli Yu", "Anirudh Goyal", "Sanjeev Arora"],
       "year": 2024,
       "relevance": "Demonstrates how prompt templates affect safety alignment post-fine-tuning, providing the DirectHarm4 benchmark used in LARF's evaluation."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "LARF provides a usable data filtering tool for practitioners fine-tuning LLMs, with code released and demonstrated efficiency (0.5h on 1 GPU), but requires some ML expertise to deploy."
     },
     "surprise_contrarian": {
       "score": 1,
       "justification": "The finding that benign data degrades safety is already established (Qi et al., 2024); LARF's layer-aware approach is novel but incremental rather than paradigm-shifting."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Raises legitimate concerns that benign-looking fine-tuning data can silently undermine LLM safety alignment, a concern relevant to any organization fine-tuning models."
     },
     "drama_conflict": {
       "score": 0,
       "justification": "No controversy, no criticism of specific companies or products, purely technical contribution."
     },
     "demo_ability": {
       "score": 1,
       "justification": "Code released on GitHub but requires GPU access, model downloads, and ML pipeline setup — not immediately runnable."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "Shanghai AI Lab is notable in Chinese AI research circles and the paper uses well-known models (Llama, Qwen), but neither the lab nor models are household names."
     }
   }
 }