reviews: 
Comments: This paper introduces *HarmAug*, a data augmentation technique designed to improve the performance of small safety guard models through knowledge distillation from larger models. The authors aim to address the challenge of deploying large safety guard models (with billions of parameters) on resource-constrained devices like mobile phones. To achieve this, they propose generating synthetic harmful instructions by "jailbreaking" a safety-aligned LLM. This is done by adding an affirmative prefix (e.g., "I have an idea for a prompt:") to the prompts, encouraging the LLM to produce harmful instructions it would normally refuse to generate due to its safety constraints. These synthetic instructions, along with their corresponding responses labeled by the large teacher model, are used to augment the training data for a smaller student model. The authors claim that this method enhances the diversity of harmful instructions, allowing the smaller model to perform comparably to larger models while significantly reducing computational costs.
Strengths: 1. The paper tackles an important and practical problem—how to deploy effective safety guard models on devices with limited computational resources. It is a good motivation and this is increasingly relevant as AI applications become more prevalent on mobile platforms.
2. The authors present experimental results showing that a 435-million-parameter model trained with HarmAug achieves performance comparable to larger models (over 7 billion parameters) on several benchmark datasets.
3. The paper is well-written and organized. The methodology is explained in detail, making it easy to follow. Figures and tables are effectively used to illustrate key points and results.
Weaknesses: 1. **Dataset Quality and Inclusion of NULL Responses**: Upon inspecting the provided dataset (https://huggingface.co/datasets/AnonHB/HarmAug_generated_dataset), I noticed that a significant number of responses are NULL (empty). While it's acceptable for some responses to be NULL—representing appropriate refusals or lack of response—the dataset contains a large proportion of such responses without explicit justification in the paper. Moreover, some NULL responses receive high harm scores, while others receive low scores. Since the harm score is based on both the prompt and the response, it's possible for a harmful prompt with a NULL response to still receive a high harm score. However, the paper does not explicitly explain this aspect, leaving the rationale unclear.
2. **Potential Impact on Model Training**: The inclusion of numerous NULL responses with varying harm scores could affect the learning process of the student model. Without a clear explanation, it's difficult to assess whether these data points contribute positively or negatively to the model's ability to detect harmful content.
3. **Limited Methodological Novelty**: While the practical application is important, the methodological contribution is relatively incremental. The use of LLMs for data augmentation is a common practice, and adding an affirmative prefix is a modest modification. The paper does not introduce significant new insights beyond this.
Recommendation: 6
Reviewer confidence: 3
Soundness/correctness: 3
Clarity: 4