ai-research-survey

scan.json (30897B)

---

 {
   "paper": {
     "title": "Single Character Perturbations Break LLM Alignment",
     "authors": ["Leon Lin", "Hannah Brown", "Kenji Kawaguchi", "Michael Shieh"],
     "year": 2024,
     "venue": "AAAI Conference on Artificial Intelligence",
     "arxiv_id": "2407.03232",
     "doi": "10.48550/arXiv.2407.03232"
   },
   "scan_version": 3,
   "active_modules": ["experimental_rigor", "data_leakage"],
   "methodology_tags": ["benchmark-eval", "observational"],
   "key_findings": "Appending a single space character to the end of LLM conversation templates reliably bypasses safety alignment in 6 of 8 tested open-source 7B models, achieving 100% attack success rate on Vicuna-7B and Guanaco-7B. The vulnerability stems from how subword tokenization causes single space tokens to appear predominantly before numbers in pre-training data, biasing models to generate lists rather than refusals. Llama-2 and Llama-3 are resistant, likely due to fine-tuning that teaches robustness to this perturbation. Fine-tuning on space-prepended data reduces Vicuna's ASR from 99% to 23%.",
   "checklist": {
     "artifacts": {
       "code_released": {
         "applies": true,
         "answer": true,
         "justification": "Code and data released at https://github.com/hannah-aught/space_attack, referenced in Section 3.1 footnote 3 and Appendix H."
       },
       "data_released": {
         "applies": true,
         "answer": true,
         "justification": "They use the publicly available AdvBench dataset (Zou et al., 2023) and C4 (Raffel et al., 2020), and state 'All code and data is available at' their GitHub repository (Appendix H)."
       },
       "environment_specified": {
         "applies": true,
         "answer": false,
         "justification": "Hardware is mentioned (single A100 40G GPU, Appendix H) but no requirements.txt, Dockerfile, or detailed library versions are provided in the paper. HuggingFace model links are given but software dependency specifications are absent."
       },
       "reproduction_instructions": {
         "applies": true,
         "answer": false,
         "justification": "No step-by-step reproduction instructions are provided in the paper. Methods are described in sufficient detail to understand the approach, and code is linked, but there is no 'Reproducing Results' section or explicit commands to run."
       }
     },
     "statistical_methodology": {
       "confidence_intervals_or_error_bars": {
         "applies": true,
         "answer": false,
         "justification": "All ASR values in Tables 1, 5, 6, 7 are reported as point estimates (percentages) without confidence intervals or error bars."
       },
       "significance_tests": {
         "applies": true,
         "answer": false,
         "justification": "No statistical significance tests are reported. Differences between models and tokens are compared by raw ASR percentages without any formal testing."
       },
       "effect_sizes_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 1 reports both ASR and Base Rate for each model, providing context for effect magnitude (e.g., Vicuna-7B: 100% ASR vs 3% base rate, ChatGLM-6B: 62% vs 8%). Similar baseline context provided across all comparisons."
       },
       "sample_size_justified": {
         "applies": true,
         "answer": false,
         "justification": "The study uses a 100-sample subset of AdvBench with no justification for why 100 samples is sufficient. No power analysis is discussed."
       },
       "variance_reported": {
         "applies": true,
         "answer": false,
         "justification": "No variance or standard deviation is reported. While greedy decoding ensures deterministic results per input, no uncertainty estimates (e.g., bootstrap confidence intervals on ASR) are provided across the 100-sample test set."
       }
     },
     "evaluation_design": {
       "baselines_included": {
         "applies": true,
         "answer": true,
         "justification": "Base rates (no perturbation) are reported alongside attack ASRs in Table 1. The GCG algorithm (Zou et al., 2023) is compared as an alternative attack method in Section 5."
       },
       "baselines_contemporary": {
         "applies": true,
         "answer": true,
         "justification": "The GCG adversarial suffix attack (Zou et al., 2023) was a contemporary state-of-the-art attack method. Models tested include recent releases (Llama-3, Mistral)."
       },
       "ablation_study": {
         "applies": true,
         "answer": true,
         "justification": "Multiple ablations: different tokens (Table 5, Section 4), different insertion positions (Appendix C.2, Table 8), template mismatches (Appendix C.1), separator modifications (Table 9), and fine-tuning with space-prepended data (Section 9)."
       },
       "multiple_metrics": {
         "applies": true,
         "answer": false,
         "justification": "The primary evaluation uses only ASR (Attack Success Rate) based on absence of refusal keywords. Top-k overlap (Figure 4) and manual verification (74/80) are supplementary analyses, not alternative evaluation metrics for the main claims."
       },
       "human_evaluation": {
         "applies": true,
         "answer": true,
         "justification": "The first authors manually evaluated a random sample of 80 outputs (10 per model) to verify the accuracy of the automated refusal-word evaluation method, finding 74/80 agreement (Section 3.3)."
       },
       "held_out_test_set": {
         "applies": true,
         "answer": true,
         "justification": "The main attack (appending space) was discovered accidentally and not optimized on the AdvBench test set. The 100-sample AdvBench subset serves as a clean test set for the primary results. GCG search in Section 5 operates on the same data but is a secondary analysis."
       },
       "per_category_breakdown": {
         "applies": true,
         "answer": true,
         "justification": "Results are broken down per model (Table 1), per model size (7B vs 13B), per token type (Tables 5-7, Figure 3), per insertion position (Table 8), and per template pair (Figure 7)."
       },
       "failure_cases_discussed": {
         "applies": true,
         "answer": true,
         "justification": "Failure cases discussed: Llama-2 and Llama-3 resistance (Section 9), unusual outputs including language switching and gibberish (Appendix F.2, Table 12), and cases where non-refusal does not equal harmful output (6/80 manual check, Section 13)."
       },
       "negative_results_reported": {
         "applies": true,
         "answer": true,
         "justification": "Several negative results: attack fails on Llama-2 and Llama-3 (Table 1), GCG does not converge with suffix length 1 (Section 5), fine-tuning defense is imperfect ('still susceptible to attack by other punctuation tokens,' Section 9), and other insertion positions are ineffective (Table 8)."
       }
     },
     "claims_and_evidence": {
       "abstract_claims_supported": {
         "applies": true,
         "answer": true,
         "justification": "Abstract claims that appending space causes 'the majority of models to generate harmful outputs with very high success rates' are supported by Table 1 showing 6/8 models affected. The abstract specifies 'eight open-source models' matching the study scope."
       },
       "causal_claims_justified": {
         "applies": true,
         "answer": false,
         "justification": "The paper claims tokenization contexts 'encourage models to generate lists when prompted, overriding training signals' (Section 1). While correlational evidence from pre-training data (Sections 7-8) and the LoRA experiment (Section 9) provide support, the full causal chain from tokenization context to alignment bypass is hypothesized rather than rigorously established. The theoretical analysis in Appendix E shows it is possible but does not demonstrate it is the actual mechanism."
       },
       "generalization_bounded": {
         "applies": true,
         "answer": false,
         "justification": "The title 'Single Character Perturbations Break LLM Alignment' implies broad applicability beyond what was tested: 8 open-source models in the 6B-13B range, English only, grey-box access only. While Section 13 acknowledges English-only and open-source-only scope, the title and abstract framing remain broader than the evidence supports."
       },
       "alternative_explanations_discussed": {
         "applies": true,
         "answer": false,
         "justification": "The paper focuses on the tokenization-context hypothesis without substantively considering alternatives. Other possible explanations — such as RLHF training distribution effects, attention mechanism disruption (only a theoretical sketch in Appendix E), or fine-tuning data format sensitivities — are not explored as competing hypotheses."
       },
       "proxy_outcome_distinction": {
         "applies": true,
         "answer": true,
         "justification": "The paper explicitly distinguishes between its proxy (non-refusal, measured by absence of refusal keywords) and the intended outcome (harmful output). Section 3.3 acknowledges 'it is likely that model responses that do not contain a refusal to a harmful query are harmful.' Section 13 discusses false positives. Manual verification of 80 samples (74/80 accuracy) validates the proxy."
       }
     },
     "setup_transparency": {
       "model_versions_specified": {
         "applies": true,
         "answer": true,
         "justification": "Exact HuggingFace model identifiers are provided in Table 13 (Appendix H), e.g., 'lmsys/vicuna-7b-v1.5', 'meta-llama/Llama-2-7b-chat-hf', 'mistralai/Mistral-7B-Instruct-v0.2', with links to model pages."
       },
       "prompts_provided": {
         "applies": true,
         "answer": true,
         "justification": "Full chat templates for all models are provided in Table 15 (Appendix I). The AdvBench prompts are from a public dataset, and the perturbation method (appending characters) is fully specified."
       },
       "hyperparameters_reported": {
         "applies": true,
         "answer": true,
         "justification": "Greedy decoding stated for all experiments (Appendix H). GCG run for 100 steps with suffix length 1 (Section 5). LoRA fine-tuning uses 1,000 LIMA samples for 10 epochs (Section 9)."
       },
       "scaffolding_described": {
         "applies": false,
         "answer": false,
         "justification": "No agentic scaffolding is used. The paper tests direct model inference with modified chat templates."
       },
       "data_preprocessing_documented": {
         "applies": true,
         "answer": true,
         "justification": "Data selection is documented: 100-sample subset of AdvBench harmful behaviors split (Section 3.1), 10,000 C4 samples for tokenization analysis (Section 7), 1,000 LIMA instructions for fine-tuning (Section 9). Token grouping into five categories is described (Section 7)."
       }
     },
     "limitations_and_scope": {
       "limitations_section_present": {
         "applies": true,
         "answer": true,
         "justification": "Section 13 'Limitations' provides substantive discussion covering language scope, evaluation methodology limitations, and inability to test closed-source models."
       },
       "threats_to_validity_specific": {
         "applies": true,
         "answer": true,
         "justification": "Specific threats discussed: English-only testing with different expected results for other languages (Section 13), evaluation accuracy at 74/80 with specific failure modes identified, and inability to test closed-source models due to template access requirements."
       },
       "scope_boundaries_stated": {
         "applies": true,
         "answer": true,
         "justification": "Section 13 explicitly states: 'we only examine English Language inputs,' 'We do not claim that these results generalize beyond English,' and 'we are unable to thoroughly test these results on closed-source models.' Section 3.5 bounds the setting to grey-box access."
       }
     },
     "data_integrity": {
       "raw_data_available": {
         "applies": true,
         "answer": true,
         "justification": "AdvBench and C4 are publicly available, all models are on HuggingFace, and code/data are released at github.com/hannah-aught/space_attack (Appendix H)."
       },
       "data_collection_described": {
         "applies": true,
         "answer": true,
         "justification": "Data sources clearly described: 100-sample subset from AdvBench harmful behaviors split (Section 3.1), 10,000 C4 samples for pre-training analysis (Section 7), 1,000 LIMA instructions for fine-tuning (Section 9)."
       },
       "recruitment_methods_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. All data comes from standard public benchmarks and datasets."
       },
       "data_pipeline_documented": {
         "applies": true,
         "answer": true,
         "justification": "The pipeline is documented: prompts from AdvBench inserted into model-specific chat templates, optional character appended, model inference with greedy decoding, output checked against refusal word list (Appendix G), ASR computed."
       }
     },
     "conflicts_of_interest": {
       "funding_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "Acknowledgements section discloses funding from the National Research Foundation Singapore (AISG Award No: AISG2-TC-2023-010-SGIL) and the Singapore Ministry of Education Academic Research Fund Tier 1 (Award No: T1 251RES2207)."
       },
       "affiliations_disclosed": {
         "applies": true,
         "answer": true,
         "justification": "All authors are affiliated with the National University of Singapore, clearly stated in the paper header. They are not evaluating their own product."
       },
       "funder_independent_of_outcome": {
         "applies": true,
         "answer": true,
         "justification": "Funding is from Singapore government research agencies (NRF, MOE) which have no financial stake in LLM alignment vulnerability findings."
       },
       "financial_interests_declared": {
         "applies": true,
         "answer": false,
         "justification": "No competing interests or financial interests statement is present in the paper."
       }
     },
     "contamination": {
       "training_cutoff_stated": {
         "applies": true,
         "answer": false,
         "justification": "No training data cutoff dates are stated for any of the eight models evaluated, despite testing on AdvBench which could appear in fine-tuning data."
       },
       "train_test_overlap_discussed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether AdvBench prompts appeared in any model's training or fine-tuning data."
       },
       "benchmark_contamination_addressed": {
         "applies": true,
         "answer": false,
         "justification": "AdvBench was published in 2023 (Zou et al.). Models trained or fine-tuned after this may have been specifically tuned to refuse these exact prompts, potentially inflating baseline refusal rates. No contamination analysis is provided."
       }
     },
     "human_studies": {
       "pre_registered": {
         "applies": false,
         "answer": false,
         "justification": "No human participants in this study. All experiments involve automated model inference."
       },
       "irb_or_ethics_approval": {
         "applies": false,
         "answer": false,
         "justification": "No human participants. Section 14 discusses ethical considerations of disclosing the attack but no IRB approval was needed."
       },
       "demographics_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "inclusion_exclusion_criteria": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "randomization_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "blinding_described": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       },
       "attrition_reported": {
         "applies": false,
         "answer": false,
         "justification": "No human participants."
       }
     },
     "cost_and_practicality": {
       "inference_cost_reported": {
         "applies": true,
         "answer": true,
         "justification": "Table 14 (Appendix H) reports wall-clock time for each experiment type (e.g., 'Measure token ASR: 20min/token', 'GCG search: 3h/suffix'). Hardware specified as a single A100 40G GPU."
       },
       "compute_budget_stated": {
         "applies": true,
         "answer": true,
         "justification": "Table 14 provides computation time for all experiment types. Hardware specified as 'a single A100 40G GPU' (Appendix H). LoRA fine-tuning took 12h, GSM8K evaluation 8h."
       }
     },
     "experimental_rigor": {
       "seed_sensitivity_reported": {
         "applies": true,
         "answer": true,
         "justification": "The paper uses greedy decoding for all experiments (Appendix H: 'To ensure reproducibility, we use greedy decoding for all experiments'), which eliminates stochastic variation across seeds. Results are deterministic by design."
       },
       "number_of_runs_stated": {
         "applies": true,
         "answer": true,
         "justification": "Greedy decoding implies single deterministic runs. The paper states explicitly: 'To ensure reproducibility, we use greedy decoding for all experiments' (Appendix H)."
       },
       "hyperparameter_search_budget": {
         "applies": true,
         "answer": false,
         "justification": "While the main attack has no hyperparameters, choices such as GCG's 100 steps, LoRA's 10 epochs and 1,000 samples, and the 100-sample AdvBench subset size are not justified through systematic search or budget reporting."
       },
       "best_config_selection_justified": {
         "applies": true,
         "answer": true,
         "justification": "The main finding (space token) was discovered accidentally, not through optimization. For GCG, the most frequently selected tokens are reported rather than cherry-picking the best single result (Section 5). The punctuation token search is exhaustive over Python's str.punctuation."
       },
       "multiple_comparison_correction": {
         "applies": true,
         "answer": false,
         "justification": "No statistical tests are performed despite many comparisons across 8+ models and dozens of token types. No multiple comparison correction is applied or discussed."
       },
       "self_comparison_bias_addressed": {
         "applies": true,
         "answer": false,
         "justification": "The paper does not discuss potential bias in evaluating their own attack method or how their experimental choices (model selection, prompt selection, evaluation metric) may favor their findings."
       },
       "compute_budget_vs_performance": {
         "applies": true,
         "answer": false,
         "justification": "No formal comparison of attack effectiveness as a function of compute. Their attack is computationally trivial compared to GCG (appending a space vs. 3h optimization), but this contrast is not formally presented as a compute-performance tradeoff."
       },
       "benchmark_construct_validity": {
         "applies": true,
         "answer": true,
         "justification": "Section 3.3 discusses what ASR measures and its limitations. Section 13 acknowledges non-refusal may not equal harmful output. Manual verification of 80 samples (74/80 = 92.5% accuracy) validates the metric's construct validity."
       },
       "scaffold_confound_addressed": {
         "applies": false,
         "answer": false,
         "justification": "No scaffolding is involved. Models are tested via direct inference with chat templates."
       }
     },
     "data_leakage": {
       "temporal_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether models' training data included AdvBench prompts or similar harmful request datasets that could bias refusal behavior."
       },
       "feature_leakage_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the evaluation setup leaks information. The relationship between fine-tuning template format and evaluation template format is explored in Appendix C.1 but not framed as a leakage concern."
       },
       "non_independence_addressed": {
         "applies": true,
         "answer": false,
         "justification": "No discussion of whether the 100 AdvBench prompts are independent or share structural similarities that could bias results."
       },
       "leakage_detection_method": {
         "applies": true,
         "answer": false,
         "justification": "No leakage detection or prevention methods are applied."
       }
     }
   },
   "claims": [
     {
       "claim": "Appending a single space to the end of LLM conversation templates reliably causes models to generate harmful outputs, achieving 100% ASR on Vicuna-7B and Guanaco-7B.",
       "evidence": "Table 1 shows ASR for 8 models at 7B: Vicuna (100%), Guanaco (100%), Falcon (84%), ChatGLM (62%), Mistral (58%), MPT (21%), with base rates far lower. Similar results for 13B: Vicuna-13B (72%), Guanaco-13B (93%). Llama-2 and Llama-3 unaffected (0% and 3%).",
       "supported": "strong"
     },
     {
       "claim": "Single space tokens most commonly appear before numbers in tokenized pre-training data due to subword tokenization merging common tokens.",
       "evidence": "Figure 5 shows that for all model tokenizers, numerical tokens are the most likely to follow a single space token in 10,000 C4 samples (>90% for most tokenizers). Section 7.1 explains the subword tokenization mechanism causing this.",
       "supported": "strong"
     },
     {
       "claim": "The tokenization context of space causes models to shift toward generating numbers/lists rather than refusals, bypassing alignment.",
       "evidence": "Figure 6 shows models shift from generating non-numerical first tokens (6a) to generating numerical tokens when space is appended (6b). Appendix B shows 27% of ShareGPT model outputs contain list formatting. Correlation between pre-training context and model predictions demonstrated, but causal mechanism is inferred rather than proven.",
       "supported": "moderate"
     },
     {
       "claim": "Llama-2 and Llama-3 are resistant to the space attack due to their fine-tuning procedure.",
       "evidence": "Table 1 shows 0% ASR for Llama-2-7B/13B and 3% for Llama-3-8B. Section 9 fine-tunes Vicuna on space-prepended LIMA data, reducing ASR from 99% to 23%, providing partial support. However, the exact mechanism in Llama-2/3's training is not identified.",
       "supported": "moderate"
     },
     {
       "claim": "The attack has minimal impact on reasoning performance, primarily affecting alignment.",
       "evidence": "Table 10 (Appendix D) shows Mistral-7B on GSM8K: strict-match drops from 38.67% to 36.32% with space appended, a small decrease. However, this is tested on only one model and one benchmark.",
       "supported": "weak"
     }
   ],
   "red_flags": [
     {
       "flag": "No uncertainty quantification",
       "detail": "ASR values are reported as point estimates without confidence intervals or statistical tests despite being computed from only 100 samples. With n=100, a 58% ASR has a 95% CI of roughly ±10pp, which could change interpretation of borderline results like MPT-7B (21% ASR vs 15% base rate)."
     },
     {
       "flag": "Small evaluation sample",
       "detail": "All main experiments use only 100 prompts from AdvBench with no justification for sample size. Manual evaluation covers only 80 samples (10 per model). These small samples limit precision and generalizability."
     },
     {
       "flag": "Evaluation proxy systematic overestimation",
       "detail": "The keyword-based evaluation (absence of refusal words = harmful) has a measured 7.5% false positive rate (6/80 in manual verification). This systematic overestimation of ASR is acknowledged but not corrected in reported numbers."
     },
     {
       "flag": "Title overgeneralizes findings",
       "detail": "'Single Character Perturbations Break LLM Alignment' implies broad applicability, but results are limited to 8 open-source models (6B-13B range), English only, with 2 models (Llama-2, Llama-3) showing resistance. Closed-source models were not tested."
     },
     {
       "flag": "Single benchmark for general performance claim",
       "detail": "The claim that the attack primarily affects alignment rather than general performance rests on a single experiment with Mistral-7B on GSM8K. No other models or reasoning benchmarks were tested."
     }
   ],
   "cited_papers": [
     {
       "title": "Universal and Transferable Adversarial Attacks on Aligned Language Models",
       "authors": ["Andy Zou", "Zifan Wang", "J. Zico Kolter", "Matt Fredrikson"],
       "year": 2023,
       "relevance": "Foundational adversarial suffix attack on LLM alignment; provides the GCG algorithm and AdvBench dataset used in this study."
     },
     {
       "title": "Jailbroken: How Does LLM Safety Training Fail?",
       "authors": ["Alexander Wei", "Nika Haghtalab", "Jacob Steinhardt"],
       "year": 2023,
       "arxiv_id": "2307.02483",
       "relevance": "Analyzes failure modes of LLM safety training, providing theoretical framework for understanding alignment vulnerabilities."
     },
     {
       "title": "Constitutional AI: Harmlessness from AI Feedback",
       "authors": ["Yuntao Bai", "Saurav Kadavath", "Sandipan Kundu"],
       "year": 2022,
       "relevance": "Key alignment training method that this paper shows can be bypassed by trivial template perturbations."
     },
     {
       "title": "Deep reinforcement learning from human preferences",
       "authors": ["Paul F Christiano", "Jan Leike", "Tom Brown", "Miljan Martic", "Shane Legg", "Dario Amodei"],
       "year": 2017,
       "relevance": "Introduces RLHF, the primary alignment technique that the space attack circumvents."
     },
     {
       "title": "\"Do Anything Now\": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models",
       "authors": ["Xinyue Shen", "Zeyuan Chen", "Michael Backes", "Yun Shen", "Yang Zhang"],
       "year": 2023,
       "relevance": "Characterizes jailbreak prompt attacks on LLMs, complementary attack methodology in the adversarial alignment space."
     },
     {
       "title": "Llama 2: Open foundation and fine-tuned chat models",
       "authors": ["Hugo Touvron", "Louis Martin", "Kevin Stone"],
       "year": 2023,
       "arxiv_id": "2307.09288",
       "relevance": "One of the two robust models tested; its alignment approach resists the space attack, suggesting stronger fine-tuning practices."
     },
     {
       "title": "Multilingual Jailbreak Challenges in Large Language Models",
       "authors": ["Yue Deng", "Wenxuan Zhang", "Sinno Jialin Pan", "Lidong Bing"],
       "year": 2023,
       "relevance": "Demonstrates alignment is weaker in low-resource languages, complementary to this paper's finding about tokenization-based vulnerabilities."
     },
     {
       "title": "SmoothLLM: Defending Large Language Models Against Jailbreaking Attacks",
       "authors": ["Alexander Robey", "Eric Wong", "Hamed Hassani", "George J. Pappas"],
       "year": 2023,
       "relevance": "Proposes a defense against adversarial jailbreak attacks on LLMs, relevant to mitigating template-level perturbation attacks."
     },
     {
       "title": "Certifying LLM Safety against Adversarial Prompting",
       "authors": ["Aounon Kumar", "Chirag Agarwal", "Suraj Srinivas", "Soheil Feizi", "Hima Lakkaraju"],
       "year": 2023,
       "relevance": "Proposes certified safety guarantees for LLMs against adversarial prompts, directly relevant to defending against template-level attacks."
     },
     {
       "title": "AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models",
       "authors": ["Xiaogeng Liu", "Nan Xu", "Muhao Chen", "Chaowei Xiao"],
       "year": 2023,
       "relevance": "Automated approach to finding natural-looking jailbreak prompts, related attack methodology."
     },
     {
       "title": "Coercing LLMs to do and reveal (almost) anything",
       "authors": ["Jonas Geiping", "Alex Stein", "Manli Shu", "Khalid Saifullah", "Yuxin Wen", "Tom Goldstein"],
       "year": 2024,
       "arxiv_id": "2402.14020",
       "relevance": "Studies glitch tokens and their role in exposing LLM attack surfaces, related to this paper's tokenization vulnerability analysis."
     },
     {
       "title": "Fishing for Magikarp: Automatically Detecting Under-trained Tokens in Large Language Models",
       "authors": ["Sander Land", "Max Bartolo"],
       "year": 2024,
       "relevance": "Methods for detecting under-trained tokens in LLMs, directly related to understanding how tokenization creates alignment vulnerabilities."
     },
     {
       "title": "Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations",
       "authors": ["Hakan Inan", "Kartikeya Upasani", "Jianfeng Chi"],
       "year": 2023,
       "relevance": "LLM-based safety filter for conversations, a defense mechanism that could potentially detect outputs generated by the space attack."
     }
   ],
   "engagement_factors": {
     "practical_relevance": {
       "score": 2,
       "justification": "Engineers maintaining chat templates need awareness of this vulnerability; finding has direct implications for deployment practices but no tool is provided."
     },
     "surprise_contrarian": {
       "score": 3,
       "justification": "A single space character breaking RLHF alignment is highly surprising and counterintuitive, directly challenging assumptions about alignment robustness."
     },
     "fear_safety": {
       "score": 2,
       "justification": "Demonstrates a trivially simple attack that bypasses safety alignment on most tested models, raising concerns about deployed safety measures."
     },
     "drama_conflict": {
       "score": 1,
       "justification": "Raises questions about alignment robustness but does not directly target any company or create major controversy."
     },
     "demo_ability": {
       "score": 2,
       "justification": "Code released on GitHub; anyone with access to open-source models can reproduce the attack on standard hardware."
     },
     "brand_recognition": {
       "score": 1,
       "justification": "From NUS (respected university but not a top AI lab); involves well-known model families (Llama, Mistral) but is not from the model creators."
     }
   }
 }