ai-research-survey

scan.json (29681B)

---

 {
   "paper": {
     "title": "Is poisoning a real threat to LLM alignment? Maybe more so than you think",
     "authors": [
       "Pankayaraj Pathmanathan",
       "Souradip Chakraborty",
       "Xiangyu Liu",
       "Yongyuan Liang",
       "Furong Huang"
     ],
     "year": 2024,
     "venue": "arXiv.org",
     "arxiv_id": "2406.12091",
     "doi": "10.48550/arXiv.2406.12091"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval"],
   "key_findings": "DPO-based RLHF is significantly more vulnerable to poisoning attacks than PPO-based RLHF, requiring only 0.5% of training data to be poisoned (vs 4% for PPO) when using DPO score-based influential point selection for backdoor attacks. Non-backdoor attacks remain much harder, requiring ~25% poisoning even with selective methods. Existing defenses (spectral signatures, gradient-based clustering, high-loss removal) fail to detect the poisoned data points in the LLM setting. The simpler DPO score-based method outperforms more complex gradient projection and semantic diversity approaches.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "GitHub repository provided in the abstract: https://github.com/pankayaraj/RLHFPoisoning. The paper states 'Implementation of the paper is publically available.'"
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses the publicly available Anthropic RLHF harmless-base dataset (Section 4.1): 'we use harmless-base split of the Anthropic RLHF dataset [35]. The dataset consists of 42537 samples.'"
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper mentions GPU hardware ('4xA500 GPUs or equivalent and a memory of 64 GB') and some training parameters (LORA r=8, α=16, dropout 0.05) but provides no requirements.txt, Dockerfile, or detailed dependency listing sufficient to recreate the environment."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are included in the paper. The GitHub repository is referenced but the paper itself does not contain a 'Reproducing Results' section or equivalent."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All results in Tables 1-5 and Figures 5-7 report single point estimates without confidence intervals or error bars. No uncertainty quantification is provided for any result."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "The paper makes numerous comparative claims (e.g., DPO score-based outperforms random poisoning) based solely on comparing point estimates. No statistical significance tests are performed."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Effect sizes are contextualized with baselines. For example, Table 1 shows random vs DPO score-based poisoning at various percentages (e.g., at 0.5% epoch 5: random 2.26 vs DPOS 3.42 on GPT-4 scale). The 0.5% vs 4% threshold comparison gives meaningful magnitude context."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The evaluation uses 200 prompts 'sampled from the test set' (Section 4.2) with no justification for why 200 is sufficient. The training set of 42,537 samples is stated without justification for the poisoning percentage thresholds tested."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance, standard deviation, or any spread measure is reported across experimental runs. All results appear to be single-run numbers."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Random poisoning serves as a baseline throughout. Comparisons are also made against prior PPO-based poisoning results from Rando & Tramèr [5]. Multiple attack methods are compared against each other."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "The primary comparison baseline is Rando & Tramèr (2024) [5] on universal jailbreak backdoors, which is contemporary work. The defense baselines (spectral methods, gradient-based, loss-based filtering) are also reasonably current."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Extensive ablations are performed: varying poisoning percentage (0.1%-50%), epochs (2-5), β values, and comparing 4 poisoning methods (random, DPO score, gradient projection, semantic diversity). Table 2 specifically ablates gradient projection filtering on top of DPO score selection."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": true,
         "justification": "Two evaluation methods are used: (1) clean reward model evaluation and (2) GPT-4 harmfulness rating (1-5 scale). Section 4.2 describes both and notes they are consistent."
       },
       "human_evaluation": {
         "applies": true,
         "answer": false,
         "justification": "No human evaluation is performed. All evaluation is automated via clean reward model and GPT-4 ratings. Human evaluation of the actual harmfulness of generated responses would strengthen the claims."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.2 states: 'We performed evaluations on a set of 200 prompts that were sampled from the test set.' This is separate from the training data used for poisoning."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": false,
         "justification": "Results are reported as aggregate poison scores. Despite the paper noting that harmfulness 'can be many aspects to it [34]' (Section 3.4), no breakdown by harm category (privacy, violent crimes, non-violent crimes, etc.) is provided."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Multiple failure cases are discussed: semantic diversity doesn't improve poisoning (Section 3.4, Figure 7a), gradient projection underperforms DPO score (Table 2), non-backdoor attacks fail at low poisoning rates (Figure 6), and existing defenses fail to detect poisons (Section 5)."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Several negative results are reported: gradient projection filtering degrades poison efficiency (Table 2), semantic clustering doesn't improve over DPO score (Table 3, Figure 7a), influential points have limited transferability across models (Figure 8), and existing defenses are ineffective (Section 5)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "The abstract's key claim — 'we can poison the model with only as much as 0.5% of the data' for backdoor attacks — is supported by Table 1 (GPT-4 score of 3.42 at 0.5%/epoch 5 with DPOS) and clean reward results. The claim about PPO requiring 4% is referenced from prior work [5]."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": true,
         "justification": "Causal claims like 'DPO score-based selection increases poisoning efficacy' are supported by controlled experiments varying only the selection method while holding other variables fixed. The ablation design (single-variable manipulation across poisoning methods) adequately supports the causal claims made."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title says 'LLM alignment' broadly but all experiments use 7B parameter models only. No experiments on larger (13B, 70B) or smaller models. Claims about DPO vulnerability are not bounded to the 7B scale tested. The paper also only uses one dataset (Anthropic RLHF harmless-base)."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Section 6 discusses why DPO is more vulnerable than PPO ('the two-level learning structure in PPO may make it robust to efficient attacks'), why DPO score outperforms gradient methods (error maximization on clean learning), and the model-dependency of influential points."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": false,
         "justification": "The paper measures 'poison score' via clean reward model ratings and GPT-4 harmfulness ratings as proxies for actual model harmfulness in deployment. The gap between these automated metrics and real-world harm is not acknowledged or discussed."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": false,
         "justification": "The paper refers to 'Mistral 7B [8]', 'Llama 2 7B [9]', and 'Gemma 7B [7]' without exact model IDs or HuggingFace model names. It does not distinguish base vs chat variants (relevant for RLHF fine-tuning) or specify exact version strings."
       },
       "prompts_provided": {
         "applies": true,
         "answer": false,
         "justification": "The backdoor trigger text is not specified in the paper (only referenced from [5]). The GPT-4 evaluation prompt is provided in Appendix D, but the actual attack prompts and triggers used during poisoning experiments are not provided."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 reports: LORA r=8, α=16, dropout 0.05, learning rate 1.41e-5, rmsprop optimizer, batch size 16, β=0.1 for DPO. Training epochs (2-5) are specified per experiment."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. This is a training-time poisoning study using standard fine-tuning procedures."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": false,
         "justification": "The paper states which dataset split is used (harmless-base, 42537 samples) but does not document data formatting, tokenization, or how preference pairs were prepared for DPO training. The SFT stage is mentioned but its data preparation is not detailed."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": false,
         "justification": "There is no dedicated limitations section. Section 7 (Conclusion and Discussion) mentions future directions but does not systematically discuss limitations of the current work."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": false,
         "justification": "No threats to validity are discussed. The paper does not address potential issues such as the single-run nature of experiments, the limitation to 7B models, the use of a single dataset, or the reliance on automated evaluation metrics."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not explicitly state what the results do NOT show. No mention that results may not hold for larger models, other datasets, other RLHF methods, or real-world deployment scenarios."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": true,
         "justification": "The Anthropic RLHF dataset used is publicly available. The code to reproduce the poisoning pipeline is on GitHub. Together these allow independent verification of the core data used."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Section 4.1 describes the data source: 'harmless-base split of the Anthropic RLHF dataset [35]. The dataset consists of 42537 samples.' The dataset format (prompt, chosen, rejected) is clear from the paper's description."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study. The data comes from an existing public dataset (Anthropic RLHF)."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The poisoning pipeline is documented: clean DPO training → score computation → ranking → top-N selection → label flipping → poisoned training. Sections 3.2-3.4 and Figure 2 detail each variant. Sample counts at each poisoning percentage are stated (e.g., 0.5% = 212 samples)."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Section 8 (Acknowledgements) discloses funding from DARPA TIAMAT 80321, NSF-IIS-2147276, DOD-ONR N00014-22-1-2335, DOD-AFOSR FA9550-23-1-0048, DOD-DARPA GARD HR00112020007, Adobe, Capital One, and JP Morgan faculty fellowships."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Author affiliations are listed: all five authors at University of Maryland. Furong Huang additionally lists Capital One as an affiliation."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "The primary funders are government agencies (DARPA, NSF, DOD) which have no financial stake in whether DPO is vulnerable to poisoning. Industry fellowships (Adobe, Capital One, JP Morgan) are not directly tied to the outcome."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests statement is included. Furong Huang's Capital One affiliation is listed but no explicit financial interests declaration is made."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": false,
         "answer": false,
         "justification": "This paper tests poisoning attack methods on DPO fine-tuning, not pre-trained model capabilities on benchmarks. The evaluation measures attack effectiveness, not model knowledge."
       },
       "train_test_overlap_discussed": {
         "applies": false,
         "answer": false,
         "justification": "Same as above — the paper tests attack methods on fine-tuning pipelines rather than evaluating pre-trained model knowledge on benchmarks."
       },
       "benchmark_contamination_addressed": {
         "applies": false,
         "answer": false,
         "justification": "Same as above — benchmark contamination is not relevant to evaluating the effectiveness of training-time poisoning attacks."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": false,
         "justification": "No inference cost, latency, or API cost information is reported. The paper does not quantify the cost of running the poisoning pipeline or generating poisoned model responses."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": false,
         "justification": "Hardware is mentioned ('at least 4xA500 GPUs or equivalent and a memory of 64 GB') but total GPU hours, training time per experiment, or total computational budget is not stated."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": false,
         "justification": "No mention of multiple random seeds. All results appear to be from single runs, which is concerning given the known sensitivity of RL/DPO training to initialization."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": false,
         "justification": "The number of experimental runs is never stated. It is unclear whether results are from single runs or averaged over multiple runs."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "Fixed hyperparameters are reported (Section 4.1) but no hyperparameter search budget or method is described. It is unclear how these values were selected."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper uses a single configuration for most experiments (β=0.1, fixed LORA settings) without justifying why these were chosen or whether other configurations were tried."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "Many comparisons are made across models, poisoning methods, percentages, and epochs without any statistical tests, let alone correction for multiple comparisons."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The authors implement all attack methods themselves and compare them without acknowledging potential self-comparison bias. No independent evaluation or replication is mentioned."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "No analysis of performance as a function of compute budget. The DPO score-based method requires an initial clean DPO training (more compute than random poisoning) but this compute trade-off is not discussed."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss whether its evaluation metrics (clean reward model score, GPT-4 rating) actually measure real-world harmfulness or whether the Anthropic RLHF dataset is a valid proxy for real poisoning scenarios."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding is involved in this training-time poisoning study."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The base models (Llama 2, Mistral, Gemma) may have been pre-trained on data that includes the Anthropic RLHF dataset or similar content. This temporal leakage is not discussed."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup (clean reward model also trained on the same Anthropic dataset) introduces information leakage into the evaluation."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The 200 test prompts are 'sampled from the test set' but no analysis of whether they are independent from or similar to the training samples used for poisoning."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No concrete leakage detection or prevention methods are applied."
       }
     }
   },
   "claims": [
     {
       "claim": "DPO can be poisoned with only 0.5% of training data using DPO score-based selection for backdoor attacks, compared to 4% required for random poisoning or PPO-based methods.",
       "evidence": "Table 1 shows DPOS at 0.5% poison achieves GPT-4 score of 3.42 and clean reward of 2.46 at epoch 5, comparable to random poisoning at 4-5%. Prior work [5] showed PPO requires 3-4% for backdoor attacks.",
       "supported": "strong"
     },
     {
       "claim": "Non-backdoor attacks are significantly harder, requiring approximately 25% data poisoning even with DPO score-based selection.",
       "evidence": "Figure 6 shows that even DPO score-based non-backdoor attacks at 25% achieve the effect of 50% random poisoning. Section 6 notes this makes non-backdoor attacks impractical.",
       "supported": "moderate"
     },
     {
       "claim": "The simpler DPO score-based method outperforms more complex gradient projection and semantic diversity approaches for poisoning.",
       "evidence": "Table 2 shows DPOS outperforming DPOS+GP at 0.5% and 1% poison. Figure 7a and Table 3 show semantic clustering does not improve over DPOS. Figure 7b shows gradient projection falls behind DPOS.",
       "supported": "strong"
     },
     {
       "claim": "Existing defenses (spectral signatures, gradient-based clustering, high-loss removal) fail to detect DPO poisoned data.",
       "evidence": "Figure 9 shows spectral methods fail to separate clean and poisoned data. Figure 10 shows gradient clusters don't isolate poisoned points. Figure 11 shows high-loss removal is ineffective for random and gradient-projection poisons.",
       "supported": "moderate"
     },
     {
       "claim": "Lower β values increase DPO's vulnerability to poisoning by allowing the model to deviate further from the reference model.",
       "evidence": "Figures 5c and 5d show poisoning effectiveness increases with lower β on both GPT-4 and clean reward metrics for Llama 2 7B with 4-5% backdoor poisoning.",
       "supported": "moderate"
     },
     {
       "claim": "DPO score-based influential points are model-specific, with Llama 2 showing minimal overlap with Mistral and Gemma.",
       "evidence": "Figure 8 shows Llama 2 7B has almost no overlap with other models. Mistral 7B and Gemma 7B share some overlap (22% at top 0.5%).",
       "supported": "moderate"
     }
   ],
   "red_flags": [
     {
       "flag": "No error bars or multi-run experiments",
       "detail": "All results appear to be from single experimental runs. Given the known sensitivity of DPO/RL training to random initialization and seeds (as documented by Henderson et al. 2018), the reported differences between methods may not be reproducible."
     },
     {
       "flag": "All models limited to 7B scale",
       "detail": "Experiments only cover 7B parameter models (Llama 2 7B, Mistral 7B, Gemma 7B). Claims about DPO vulnerability may not hold at larger scales where model capacity and regularization behavior differ."
     },
     {
       "flag": "Backdoor trigger not specified",
       "detail": "The actual backdoor trigger text is not provided in the paper, only referenced from prior work [5]. This limits reproducibility since the specific trigger could affect results."
     },
     {
       "flag": "Evaluation metrics may not reflect real-world harm",
       "detail": "Both evaluation methods (clean reward model score and GPT-4 rating) are automated proxies for harmfulness. The clean reward model is trained on the same Anthropic dataset used for poisoning, potentially creating circular evaluation. No human evaluation of actual harmfulness is performed."
     },
     {
       "flag": "No limitations section",
       "detail": "The paper has no dedicated limitations or threats-to-validity section despite making broad claims about DPO vulnerability."
     }
   ],
   "cited_papers": [
     {
       "title": "Universal jailbreak backdoors from poisoned human feedback",
       "authors": ["Javier Rando", "Florian Tramèr"],
       "year": 2024,
       "relevance": "Primary comparison: demonstrates universal backdoor attacks on PPO-based RLHF, establishing the 4% poisoning threshold this paper improves upon for DPO."
     },
     {
       "title": "Direct preference optimization: Your language model is secretly a reward model",
       "authors": ["Rafael Rafailov", "Archit Sharma", "Eric Mitchell", "Stefano Ermon", "Christopher D. Manning", "Chelsea Finn"],
       "year": 2023,
       "relevance": "Foundational DPO paper whose method is the primary target of the poisoning analysis."
     },
     {
       "title": "Training a helpful and harmless assistant with reinforcement learning from human feedback",
       "authors": ["Yuntao Bai", "Andy Jones", "Kamal Ndousse"],
       "year": 2022,
       "arxiv_id": "2204.05862",
       "relevance": "Core RLHF alignment method and source of the Anthropic RLHF dataset used in all experiments."
     },
     {
       "title": "Training language models to follow instructions with human feedback",
       "authors": ["Long Ouyang", "Jeff Wu", "Xu Jiang"],
       "year": 2022,
       "arxiv_id": "2203.02155",
       "relevance": "Foundational InstructGPT work on RLHF for LLM alignment."
     },
     {
       "title": "Poisoning language models during instruction tuning",
       "authors": ["Alexander Wan", "Eric Wallace", "Sheng Shen", "Dan Klein"],
       "year": 2023,
       "relevance": "Prior work on training-time poisoning of LLMs during instruction fine-tuning, providing attack methodology context."
     },
     {
       "title": "Jailbroken: How does LLM safety training fail?",
       "authors": ["Alexander Wei", "Nika Haghtalab", "Jacob Steinhardt"],
       "year": 2023,
       "relevance": "Analysis of LLM safety training failures, relevant to understanding how alignment can be undermined."
     },
     {
       "title": "Are aligned neural networks adversarially aligned?",
       "authors": ["Nicholas Carlini", "Milad Nasr", "Christopher A. Choquette-Choo"],
       "year": 2024,
       "relevance": "Tests adversarial robustness of aligned models, complementary to training-time poisoning attacks studied here."
     },
     {
       "title": "Preference poisoning attacks on reward model learning",
       "authors": ["Junlin Wu", "Jiongxiao Wang", "Chaowei Xiao", "Chenguang Wang", "Ning Zhang", "Yevgeniy Vorobeychik"],
       "year": 2024,
       "relevance": "Directly related work on poisoning RLHF reward models, which this paper extends to the DPO setting."
     },
     {
       "title": "Fine-tuning aligned language models compromises safety, even when users do not intend to!",
       "authors": ["Xiangyu Qi", "Yi Zeng", "Tinghao Xie", "Pin-Yu Chen", "Ruoxi Jia", "Prateek Mittal", "Peter Henderson"],
       "year": 2023,
       "relevance": "Shows fine-tuning can degrade LLM safety, supporting the threat model of alignment attacks through training data."
     },
     {
       "title": "Concealed data poisoning attacks on NLP models",
       "authors": ["Eric Wallace", "Tony Z. Zhao", "Shi Feng", "Sameer Singh"],
       "year": 2021,
       "relevance": "Foundational work on concealed data poisoning in NLP, providing attack methodology that this paper builds upon for RLHF."
     },
     {
       "title": "BadGPT: Exploring security vulnerabilities of ChatGPT via backdoor attacks to InstructGPT",
       "authors": ["Jiawen Shi", "Yixin Liu", "Pan Zhou", "Lichao Sun"],
       "year": 2023,
       "relevance": "Explores backdoor attacks on instruction-tuned LLMs, directly relevant to the RLHF poisoning threat model."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Practitioners fine-tuning LLMs with DPO can use these findings to assess vulnerability and implement defenses, though the paper is more diagnostic than prescriptive."
     },
     "surprise_contrarian": {
       "score": 2,
       "justification": "Challenges the assumption that DPO is comparably safe to PPO by showing it needs only 0.5% poisoned data vs 4%, an 8x difference."
     },
     "fear_safety": {
       "score": 3,
       "justification": "Demonstrates that DPO alignment can be subverted with minimal data poisoning (0.5%), and that existing defenses fail to detect it — a concrete AI safety threat."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "The DPO vs PPO vulnerability comparison creates some tension but no major controversy or accusations."
     },
     "demo_ability": {
       "score": 2,
       "justification": "Code is publicly available on GitHub (https://github.com/pankayaraj/RLHFPoisoning), enabling reproduction."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "University of Maryland is a respected institution but not a major AI lab; no prominent product or model is being evaluated."
     }
   }
 }