Robust LLM safeguarding via refusal feature adversarial training
Authors: Lei Yu
Virginie Do
Karen Hambardzumyan
Nicola Cancedda
Venue: ICLR 2025 Poster (2025)
Keywords: large language models
adversarial robustness
representation analysis
mechanistic interpretability
Primary area: interpretability and explainable AI
TL;DR: Mechanistic analysis and mitigation of LLM vulnerability against adversarial attacks

Abstract: Large language models (LLMs) are vulnerable to adversarial attacks that can elicit harmful responses. Defending against such attacks remains challenging due to the opacity of jailbreaking mechanisms and the high computational cost of training LLMs robustly. We demonstrate that adversarial attacks share a universal mechanism for circumventing LLM safeguards that works by ablating a dimension in the residual stream embedding space called the refusal feature. We further show that the operation of refusal feature ablation (RFA) approximates the worst-case perturbation of offsetting model safety. Based on these findings, we propose Refusal Feature Adversarial Training (ReFAT), a novel algorithm that efficiently performs LLM adversarial training by simulating the effect of input-level attacks via RFA. Experiment results show that ReFAT significantly improves the robustness of three popular LLMs against a wide range of adversarial attacks, with considerably less computational overhead compared to existing adversarial training methods.

Published as a conference paper at ICLR 2025
ROBUST LLM SAFEGUARDING VIA REFUSAL FEATURE ADVERSARIAL TRAINING
Lei Yu
Virginie Do Meta
University of Toronto, Meta FAIR jadeleiyu@cs.com wwronto..oooooo.oooooooooooo.... edu
virginiedo@mmtta.com
Karen Hambardzumyan
Nicola Cancedda
University College London, Meta FAIR
Meta FAIR ncan com
mahnerak@meta.cm
ABSTRACT
Large language models (LLMs) are vulnerable to adversarial attacks that can elicit harmful responses. Defending against such attacks remains challenging due to the opacity of jailbreaking mechanisms and the high computational cost of training LLMs robustly. We demonstrate that adversarial attacks share a universal mech- anism for circumventing LLM safeguards that works by ablating dimension in the residual stream embedding space called the refusal feature feature (Arditi et al. (024)) We further show that the operation of refusal feature ablation (RFA) approximates the worst-case perturbation of offsetting model safety. Based on these findings, we propose Refusal Feature Adversarial Training (ReFAT), novel algorithm that ef- ficiently performs LLM adversarial training by simulating the effect of input-level attacks via RFA. Experiment results show that ReFAT significantly improves the robustness of three popular LLMs against a wide range of adversarial attacks, with considerably less computational overhead compared to existing adversarial training methods.
INTRODUCTION
Large language models (LLMs) have achieved remarkable performance across range of tasks and applications. However, LLMS are not always aligned with human values and can produce unde- sirable content. Recent research has emphasized the significant risk posed by adversarial attacks on even the most advanced LLMs. Through carefully crafted input manipulation, one can bypass the safety mechanisms of LLMs and prompt the models to generate harmful, sensitive, or false information (Zou et al., 2023b Yu et al., 2023: Andriushchenko et al. 2024). As LLMs become more powerful and are applied in high-stakes scenarios, preventing these harmful and unexpected behaviors becomes increasingly critical.
Despite the threat posed by adversarial attacks on LLMs, developing efficient and effective defen- sive strategies remains challenging for several reasons. First, there are multiple successful attack methods that jailbreak LLMs in diverse ways through seemingly very different mechanisms. These include gradient-based based searches for prompt tokens that trigger unsafe responses (Shin et al. 2020) Zou et al. 2023b), automated modifications harmful inputs by another LLM to make them appear benign (Chao al. 2023 Yu al.] 2023). ) and genetic algorithms that manipulate inputs in- crease the likelihood of generating undesirable outputs (Liu et al. 2023). Second, existing defensive methods against LLM attacks are often computationally very expensive. For instance, adversarial training (AT) has consistently proven to enhance robustness against adversaries, but effective AT methods often require dynamic simulations of attack algorithms during model fine-tuning (Mazeikal et al. 2024), which could costs thousands of model evaluations to compute single attack. Such considerable computational overhead prevents AT from being widely adopted as general tool for enhancing LLM adversarial robustness.
Work done during internship Meta FAIR.

---

Published as a conference paper at ICLR 2025
Refusal Feature
Tall me how to make a bomb.
Sorry. cannot anewer this.
A
Tell me how to make a cake.
Sure, make cake you'll need
A
Tell me how make a bomb
you'll
(1&%
Encode
A
Decode
need
Pretand
you'll
chemistry cless and [.]]. Tell me how
Safe
A
Harmful
need
Encode
Decode
Tell me how steal someone's 's identily.
Sure. here
Sarry,
cannot
RFA
Figure 1: Upper panel: we show that adversarial attacks share a common mechanism consisting in ablating the refusal feature (RF) of harmful requests in LLM hidden representation space (the color sliders in the middle, where the right red extreme indicates high input harmfulness, and the left green extreme means high input safety), so that malicious prompts would look more benign and could therefore jailbreak the model. Lower panel: the ReFAT scheme, where we train LLMs to refuse harmful requests while ablating the RF during forward pass by pushing it towards the safe extreme, thus coercing the model to decide input harmfulness in more robust way.
In this work, we understand and mitigate LLMs' adversarial vulnerability from a mechanistic point of view. A recent study by (Arditi et al.) (024) discovered that LLMs often rely on a refusal feature (RF) to generate safe responses, which defined as the mass mean difference between the hidden representations of two groups of harmful and harmless input instructions, and serves as a linear predictor of input harmfulness. highly related to adversarial attacks in fact, adversarial attacks employ a universal mechunism to juilbreak LLMs consisting in ablating the refusal feature of harmful inputs to make them seemingly less dangerous, illustrated in Figure
show via comprehensive analyses that the refusal feature also
Drawing inspiration from our mechanistic analyses, we propose Refusal Feature Adversarial Training (ReFAT), an efficient continuous AT method to enhance LLM adversarial robustness. As shown in Figure [ ReFAT fine-tunes an LLM to generate refusal answers to harmful instructions. During each batch of forward pass, dynamically compute the RF using two sets of randomly sampled harmful and harmless instructions, and then ablate the induced RF for intermediate repre- sentations of every harmful instruction, that the model learns determine the safety of input prompt even without access to the most salient features of input maliciousness. We show via com- prehensive evaluations that ReFAT consistently reduces the success rates of various attack methods against three LLMs, while preserving general model capabilities such as question answering.
In summary, the main contributions our work are:
We reveal general mechanism shared across LLM adversarial attacks via inter- pretability analysis - that is, most existing adversarial attack methods jailbreak LLMs by ablating the "refusal feature", which often serves as a linear predictor of input instruction harmfulness.
We propose a universal, efficient and robust defensive method against various LLM attacks that operates by ablating the refusal feature during safety fine-tuning. As result, models trained using ReFAT are significantly more robust to adversarial attacks, since now ablating a single refusal feature less likely deteriorate the model safeguards against harmful instructions.
2 RELATED WORK
Adversarial attacks
Adversarial attacks of machine learning systems have been widely studied in
the literature (Zou et al.
2023b Goodfellow et al. 2014; Madry et al. 2018). More recently. LLMs have been shown be vulnerable adversarial attacks generated through both manual prompt en-
gineering (Shen et al. 2023 Anil et al. 2024; Li et al.
2024b Zhang et al. 2024) and automated 2020). For instance, (Zou al.
techniques (Shin al.
2023b) proposed the Greedy Coordinate
2

---

Published as a conference paper at ICLR 2025
Gradient (GCG) suffix attack, which produces adversarial examples that can transfer from smaller open-source models to larger proprietary ones. (Chao et al. 2023 introduced the Prompt Automatic Iterative Refinement (PAIR) algorithm, where attacker LLM iteratively queries target LLM and refines the jailbreak prompt until a successful attack is found. Additionally, (Liu et al. 2023) devel- oped AutoDAN, hierarchical genetie algorithm that generates high-perplexity jailbreaks capable of bypassing LLM safety alignments. Recent work in LLM representation engineering has also revealed the potential of continuous adversarial attacks on model activations undermine safety alignment and trigger unlearning (Zou et al. 2023a 2024 Schwinn et al. 2023 Arditi et al. 2024)
Many methods have been proposed to defend L.LMs against adversarial at- tacks. Simple approaches include modifying LLM system prompts encourage model awareness to harmful requests (Xie et al. 2023; Zheng et al. 2024), and asking models to self-reflect to perform robust alignment checking Cao et al. (2023). ) However, the resulting model sometimes becomes excessively cautious and refuse to follow some normal instructions. Another family of defensive strategy is adversarial training (AT), which augments the training data of model with adversar- ial prompts found by dynamically running attack methods. Recent studies show that adversarially optimized continuous perturbations can be applied to input token embeddings (Zhu al., 2019) Jiang et al. 2020: Xhonneux et al. 2024) or LLM residual streams (Casper et al. |2024; Shesshari
Defenses for LLMs
al. 2024) to enhance adversarial robustness. Another recently emerged line of work applies rep- resentation engineering (RepE) (Zou et al.) 2023a) techniques to enhance model safety by directly modifying the hidden representations of input prompts. For instance, (Zou al., 2024) proposes to "short-circuit" the model internal processes of gathering related information about unsafe requests, thereby preventing the generation of a harmful response. Another line of work fine-tunes the LLM so that one can add "steering vector" into residual stream to control model generation safety while minimizing negative side effect on its general performance (Stickland et al. 2024 Cao et al.] 2024).
Our work connects AT and RepE by showing that refusal feature ablation can be taken as efficient L.M representation modification that approximates adversarial perturbations in AT.
Features in LLM semantic space It is widely believed that large language models (LLMs) rep-
resent features, or concepts, as linear directions within their activation space (Mikolov et al. 2013
Elhage al., 2022 Park al.) (023). Recent research has explored the linear representation of specific features, such as harmlessness Wolf et al. (2024); /Zhng et al. (2024), truthfulness (Marks
& Tegmark, 2023 Li et al. (0024)), sentiment (Tigges et al. 2023). and refusal (Arditi et al. 2024).
among others. These features are often derived from contrastive input pairs Rimsky et al. (023))
Burns et al. (2023), and have been shown to enable effective inference-time control of model behav- ior (Hernandez al., 2023: Stickland et al. 2024) targeted removal of knowledge from model parameters (Ravfogel et al. 2020; Hong et al. 20024). We extend this approach and subject linear features adversarial perturbations applied to the model's 's embedding space during training, thereby establishing link between the interpretability and the safety alignment of LLMs.
3 MECHANISTIC ANALYSIS OF ADVERSARIAL ATTACKS
In this section, we investigate adversarial attacks through the semantic representation space of the I.M,, and reveal general jailbreaking mechanism consisting in ablating single direction in model activation space that mediates refusal behavior.
3.1 BACKGROUND
Transformers decoder-only transformer language model (Vaswani et al. 2017 M maps an input sequence of tokens [#1, ØT]] into probability distribution over the vocabulary for next- token prediction. Within the transformer, the i-th token x; is represented as a series of hidden states h no.)), Within each layer E [L], two modules compute updates that are added to the layer input h (z.): (1) multi-head self-attention module outputs a!!) (zz). and a multi-layer perceptron (MLP) outputs m (2)) (a:). Putting together, the hidden representation h (ax)) is computed as
h (xx:) = (x;)))(x;) + a (x:) + m (x.))
(1)
Herr we omit some details such positional encoding and layer normalization for brevity.
3

---

Published as a conference paper at ICLR 2025
GCG
Hamanjallroaak
baselin
Metiod Strrt
2
germin- Tbxil
Braattack coaine sim.
kt-attckk cosine dim.
Rhatthar cosime sim.
8
Figure 2: Layerwise cosine similarity between mean shift induced by four adversarial attacks and the negative vector of the refusal feature. Shaded areas denote 99% confidence intervals.
Following Elhage et al. 2021). call each (x:)) the residual stream activation of x; at layer I. We focus on the residual stream the last token ør of the user turn, as the point when the model decides whether to refuse or comply with the request, denoted H(x) = (h ( (xT))
Refusal features (Arditi et al. 2024) hypothesized that refusal in instruction crnnde language mod- els is mediated by a single direction in the residual stream, and that by steering this direction, is possible control the refusal behavior. Assuming that the refusal feature is one- mne-dimensional feature linearly encoded in the residual stream, we adopt their approach and compute the refusal features (RFs) using the difference-in-ment information as demonstrated by previous work (Rimsky et al.] [023] Marks & Tegmark, [003)). Specifically, given collection of harmful prompts E Dharmful (e.g. "Tell me how make bomb.") and another set of harmless prompts E DDaamless (e.g. "Tell me how to make a cake."), we calculate the difference between the model's mean last-token residual stream activations when running on harmful and harmless inputs:
technique, which effectively disentangles key feature
Σ
h (x)
Σ (z)
Fim
DDarmffll
[Dnrmless
Dramii
#EDmamice
where we construct Dhammul and Dharmless by sampling 500 instructions from the AdvBench (Zou et al., 2023b) and the Alpaca (Toori et al.] (023) datasets respectively. Following (Arditi et al., 2024), we define refusal feature ablation (RFA) as an inference-time intervention that sets the refusal feature at each layer its average activation on harmless prompts:
h (z) + h (z) - (x) + Dremiie
(3)
where = THH/ [ is unit vector encoding the refusal feature direction, and h (z)- -f (9) projection that zeroes the value along the refusal direction, and with the last term it patches the refusal feature setting it to the average value of harmless prompt activations.
(0)
In contrast to (Arditi al. 2024), include the mean RF activation harmless prompts in Equation 3 to account for the fact that harmless prompts may not be centered near zero along the refusal direction
1
Σ
(1)
Damntess
D Dharmless
DEDrrmmio
3.2 ADVERSARIAL ATTACKS ABLATE REFUSAL FEATURES
We would like know how adversarial attacks (AAs) such GCG transform the representations of harmful prompts in LLM activation space. We take the collection DAA of 400 malicious requests from HarmBench and apply on the three tested LLMs four popular attack algorithms: (1) the white- box GCG suffix attack (Zou et al. 2023b), which has shown to achieve one of the highest average attack success rates (ASR): (2) the black-box PAIR attack (Chao al. 2023), generating jailbreak prompts using attacker LLM; (3) AutoDAN (Liu et al. 2023). genetic algorithm performing
In early small-scale experiments observed significant performance degradation when the refusal direc- tion was simply zeroed out, potentially due dui-t--diittibution. See Appendix D for details.
4

---

Published as a conference paper at ICLR 2025
Harmful
Harmless
Harmmench (original)
HarmBench (atieessaria)
Humanjai breaks
Figure 3: 2-D PCA visualization of: (1) harmful (dark red stars) vs. harmless (dark green stars) instructions; and (2) the original HarmBench instructions (light red dots) and their counterparts adversarially modified by attack algorithms (light green dots). All hidden representations are taken from the 16-th layer residual stream of -lama-3-B-IInstee activation difference between harmful and harmless instructions (i.e. the negative vector of the refusal feature), and the light green arrows are mean adversarial representational shifts by attacks. The positions and norms of both shift vectors have been adjusted for better readability.
The dark green arrows show the mean
adversarial input perturbations; 4) HumanJJailbreaks, a fixed set of in-the-wild manually crafted templates that were shown effective jailbreaking state-of-the-art LLMs (Mazeika al. (024).
For each attack method A, we select all prompts x whose adversarial modification A(x) () by A suc-
cessfully jailbreaks LLM M as identified by HarmBench's official classifier of model response harmfulness. We can then define the mean adversarial representational shift as the difference be- tween the mean activation of original prompts æ and their adversarial counterparts A(x) at each LLM layer:
4 (DAN)
1
Σ (A(x)) DEDM
Σ hm) ZEDA
DAA
DAA
One can therefore compute the cosine similarity between E'A and (the negative vector of) the refusal feature "iu at each layer to measure mechanistic similarity between RFA and the discrete attack A. Figure 2 shows the cosine similarity results for three LLMs. We also include baseline similarity
(1)
(!())
score computed between ( and a random feature direction, calculated as the mean activation dif- ference between two random partitions of Dhammfu u Uharmless We observe that the representational shifts induced by all attacks align well with (the opposite direction of) the refusal features, with average cosine similarity scores that are significantly higher than chance in the high dimensional activation space.
To better illustrate the mechanistic similarity between adversarial attacks and RFA, compute first two principal components of the the hidden representations ((()) (!)
harmful: harmless in the previ-
ous section, and project both the harmful-harmles contrastive dataset and the original-adversarial harmful prompt pairs (x, A(x)) onto this 2D space. Figure 3 shows the projected input represen- tations for -lama-t--B-Insrruct harmful-harmled mean activation difference (i.e., the refusal features, shown as green arrows) and the representational shifts by attack algorithms (shown blue arrows), and that such alignment has already emerged in intermediate transformer layers
Instruct at layer 16. Again, one observe high similarity between the
3.3 CAUSAL VALIDATION OF AARRFA
We have presented some geometric evidence that adversarial attacks (AAs) are mechanistically sim- ilar to RFA. We next conduct a causal validation of the "AA=RFA" hypothesis by simulating the following scenario: for each model, we take the successful adversarial prompts found by the four attack methods in Section 3.2 as input, and ask the model to generate responses, but with the refusal features "restored" fixed approximation of its activation value without the attack:
( (A(z)) h (1)))) T (=Th((((a))
(5)
DAN
(!) We observe the alignment between riml and A across all LLM layers except for the earliest ones Appendix C for PCA illustrations of the other layers.
5

---

Published as a conference paper at ICLR 2025
GCG No RFA GCG With RFA
PAIR No RFA PAIR Wiith RFA
AutoDAN No RFA
Humanjailbreakks No RFA
AutoDAN With RFA
Humanjaillbreaks WWith RFA
0.7
Atack Success Rate
0.5
0.3
Liama
Mistral
Gemma
Liama
Mistral
Gemma
Liama
Motral
Gomma
Liama
Mistral
Gemma
Figure 4: Changes in the attack success rate (ASR) of four LLM attacks after refusal features restora- tion (i.e., reset to the mean activation value of original harmful inputs, as in Equation 5). Restoring refusal features dramatically reduces the effectiveness of the attacks.
where DM DAA EeED.. h (ar) is the mean activation over original harmful prompts with- E
out adversarial modifications. In this way, we prevent attacks from acting on the refusal feature. Figure changes in attack success rate HarmBench before and after refusal feature restora- tion, as judged by the official HarmBench classifier of output harmfulness. We found that preventing adversarial edits refusal features effectively disables all attacks, and we observed no degradation in model generation quality after restoring the refusal feature
Taken together, our analyses provide strong empirical evidence that refusal feature ablation is general mechanism that various types of adversarial attack methods leverage to jailbreak LLMs.
ADVERSARIAL. TRAINING VIA REFUSAL FEATURE ABLATION
Adversarial training improves model robustness by backpropagating the loss on adversarially chosen samples (Schwinn et al.) 2023). Given the mechanistic similarity between RFA and adversarial attacks, we hypothesize that we could leverage RFA in such a training. In this section, we first show that RFA approximates the worst-case activation perturbations that are typically the result of expensive search iterations in state-of-the-art adversarial training algorithm, and then we propose simple and effective adversarial training method taking advantage of this observation.
4.1 RFA APPROXIMATES WORST-CASE ACTIVATION PERTURBATIONS
Traditionally, adversarial training teaches a machine
learning model to behave robustly under worst-case per- turbations (Madry et al., 2018) of either model input or its hidden representations. In the context LLM safety, given a model parameterized by 0, and triple set of (harmful instruction, refusal response, compliant re-
100
RFA Perturb Optimality
80
sponse) (z. Vr. Vc) E D, let H3 denote the intermediate representations of (e.g. "Tell me how to make bomb.") produced during inference. We can measure the degree of model safety by computing the log likelihood ratio be- tween the refusal and compliance responses:
40
20
Uams- 3 3.88-Instruct
Mistral-8B-Insnee I8-Instuct
gemms-7bil 7b-it
log Po (vr (H,)
2e Heg Br yc) log pa (op((). H
(6)
20
15
20
25
30
Layer
Figure 5: Layerwise optimality of RFA adversarial perturbation.
Suppose adversary would like to perform targeted continuous attack by adding residual stream perturba- tion vector to make the model prefer a compliant answer
*See Appendix for quantitative evaluation.

---

Published as a conference paper at ICLR 2025
(e.g. "Sure, here's how make bomb ...") refusal one (e.g. "Sorry, but I cannot answer this question."). The objective of adversarial training is to counter such interventions by maximizing model safety score after injecting 6:
max E M... min 20(Hz + 6, Mr, Mc)] GET(*)
where T(x) is the of all possible perturbations (e.g. the collection of vectors with norm up to threshold c).
Let 8 arg min zg (H2 + Dr Ve) be the worst-case perturbation that results in most signifi- ( cantly decreased safety score 2. We would like to investigate how well the refusal feature at each layer/ approximates 8". We take all instructions in HarmBench where LLM refuses to answer under direct request, and compute the safety score 2H(H, + 6, Yr, ye) when injecting a noise vector into the residual stream across all layers. We the perturbed inference for each prompt 100 times, with 99 randomly sampled unit-norm noise vectors (S(r)) and the normalized refusal feature x!!) at layer I.
We define the optimality of (1) at layer as the average rank of ((() when perturbations are ranked by
opt(P HH = Σ (1+ 1(ō S(x) =0 HH + 6, Dr. Me) 2 HH + (10) RED
1 [D]
Ur. bc)
(8)
Figure 5 shows the results for three models and the refusal features across all layers. We found that injecting RFs induced from the last few layers into residual activation space effectively approximates the worse-case adversarial perturbation, suggesting that RFA could be taken as efficient attack simulation during adversarial training.
4.2 REFUSAL FEATURE ADVERSARIAL TRAINING (REFAT)
Drawing inspiration from previous analyses, we propose Refusal Feature Adversarial Training (ReFAT) to enhance LLM safety and adversarial robustness. Instead of searching for a worst-case input perturbation as in standard adversarial training, we craft perturbations by ablating the refusal feature directions. Given an LLM parameterized by 0, ReFAT takes a dataset D, = (I. y) of (harmful request, refusal answer) inputs, and performs supervised fine-tuning by minimizing the negative conditional log likelihood of fe (y(()) of safe answer under refusal feature ablation. In addition, the model also trained on an utility dataset of D, of (harmless request, helpful answer) pairs to maintain its general capability:
CRFA (0) = (RFA..(O) + (OF
(9)
(@) = PREA (Z.)) [ol H(x) Rum)] (1 - PRFA PREA) (m.))) [oo(ylz, H(x))
(10)
(0) = B(E.))=D, H(()),
(11)
where RAн 1 is the layerwise refusal feature, and H(x)) Rнн denotes the removal of refusal features across model layers during model forward pass with probability PRFA- We provide pseudo-code of ReFAT in Algorithm| [ (Appendix 10). Note that Eq. [ not incorporate the third term the right- hind--hadd-side of Eq, for efficiency considerations: computing ((() an additional computation step, and we found in our preliminary experiments that this would make the training slower while resulting in little improvement on model performance.
{1mn)/111
Paantes requires
More precisely, during each train-time forward pass, perturb the intermediate representations of every input harmful instruction by removing the refusal direction from their residual stream ac- ReFAT-trained models without
tivations. While during each evaluation-tima forward pass, refusal feature ablation, which is different from recent studies of learning effective steering vectors to perturb model activation space during evaluation (Stickland al. 2024 Cao al. 2024).
Because the parameter and the activation space change constantly during fine-tuning, we compute refusal features dynamically: every l training steps, randomly sample harmful and harmless

---

Published as a conference paper at ICLR 2025
requests from Dr and Du respectively, and then compute a new set of Rşh using Equation Re- FAT can therefore simulate worst-case input perturbations by only running a few more forward passes, as opposed to common adversarial training methods which always require additional model backward passes to perform gradient-base perturbation search.
5 EXPERIMENTAL SETUPS
In this section, describe experimental setups of assessing if ReFAT could enhance LLM robustness against adversarial attacks while preserving its general capability.
Datasets To train models with ReFAT, we take the adversarial training dataset from (Zou et al. 2024) consisting of harmful requests that could elicit harmful undesirable behaviors, well as harmless conversational examples taken from UltraChat (Ding et al.] (222)) to maintain model efficacy. We sample 5000 harmful requests and 5000 harmless ones from this dataset as our training data, and augment it with 150 examples taken from the XSTest dataset (Röttger et al.) (2023) that includes benign requests that are seemingly risky and that the model should not decline. We use the responses generated by Llama-3 3- --B--------------- 1----BBInn 1es--Instucttt ruct on this holdout sample from XSTest as references for the next-token prediction task in the supervised finetuning step.
For robustness evaluations, we take harmful requests from two harmful instruction datasets: Harm- Bench (Mazeika et al., (024) and AdvBench (Zou et al.) (0236). Due to the high computational cost of runming attacks such as GCG and PAIR, we only take the 200 standard behaviors from HarmBench with shorter context lengths, and randomly sample 200 AdvBench examples that do not overlap with HarmBench, resulting in total of 400 evaluation examples. For utility evaluation, we compute standard performance scores on two established benchmarks of LLM general capability: MMLU (Hendrycks et al., 2021) I) and MT-Bench (Zheng et al. 2023). We also report the model compliance rate on 100 held-out test examples from XSTest to monitor over refusals.
Baseline defenses We compare ReFAT with several baseline safety fine-tuning methods: the re- fusal training (RT) refers to the standard approach of training models on the same refusal dataset as for ReFAT, but without refusal feature ablation (i.e. PRIA = 0). We also experimented with three recently proposed adversarial training methods: the Robust Refusal Dynamic Defense (R2D2) (Mazeika et al. 2024) that fine-tunes LLMs on a dynamic pool of adversarially optimized harmful requests found by GCG, the Continuous Adversarial Training (CAT) method (Xhonneux et al., 2024] that perturbs input token embeddings with noise vectors found by gradient descent that maxi- mize model maliciousness, and Latent Adversarial Training (LAT) (Casper et al. 2024 Sheshadri et al. 2024) that perturbs LLM residual stream to maximize likelihood of undesirable responses
Models and hyperparameter choices We take the same three instruction-tumge LLMs in our mechanistic analyses: Llama-3-8B (Dubey et al. 2024)) Mistral-7B (Jiang al.) (203)), and Gemma- 7B (Team et al. 2024). We fine-tune each model on the refusal and utility datasets using LoRA on all linear sub-layers of a transformer. We re-compute refusal features every h 4 training steps using = 32 sampled harmful and harmless training instructions. Due to the high computational cost of safety fine-tuning and evaluating model robustness via adversarial attacks, we conducted hyperparameter search through preliminary experiments by evaluating LLMs small subsets of HarmBench and MMLU. Further details can be found in Appendix
Attack methods We evaluate model adversarial robustness by applying the four attack methods introduced in Section 3 as well as the RFA attack as described in Equation 3 We take the Harm- Bench implementations of the first four attacks and use all of their default hyperparameters. To compute attack success rate, use three LLM--s-aajjdde models that are fine-tuned to assess output safety: the official HarmBench classifier fine-tuned from Llama-2-13B, the Llama-Guard-2 safety classifier (Inan al. (023) fine-tuned from Llama-3-8B, and the Gemma-2B version of the StrongReject safety classifier (Souly et al., 2024). For each tested LLM, we report the average ASR and the XSTest compliance rate returned by the three judge models.
'Due to resource constraints, we only evaluated LAT by taking the LAT-fine-tuned Llama-3-8B model released by (Sheshadri al. (204).
8

---

Published as a conference paper at ICLR 2025
General capahility (1)
Attack success rale (ASR, J)
Efficiency
MT-Beecc
XSTest
allack
GCG
AutoDAN
HumunJailbreaks
Furward/Backwarl
Llama3-8B
7.24
65.9
97.2
10.4
27.1
29.9
2.07
7.13
53.3
0/0
+
65.0
96.4
4.91
28.3
29.1
1.45
7.22
50.8
R2D2
6.66
64.4
90.2
4.77
22.5
19.4
1.30
6.27
43.9
2566/6
+ CAT
6,94
65.0
96.6
7.39
11.8
16.1
0.77
7.98
36.5
11/11
LAT
6.54
63.8
98.0
3.25
9.06
20.7
0.10
6.27
45.0
11/11
+ RePAT
6.98
65.2
97.6
7.60
13.3
11.5
0.85
5.54
10.4
1.5/1
Mistral-7B
7.02
58.9
92.4
41.1
63.5
72.9
85.6
+ RT
6.70
58.2
88.4
13.5
$7.5
43.4
5U.1
15.3
70.0
1/1
R2D2
2566/6
+ CAT
6.85
57.6
83.6
9.71
19.9
45.7
32.4
10.1
67.2
11/11
Gemma- 7B
6.60
52.0
89.2
28.7
61.4
38.4
13.0
26.2
92.8
0/0
+
6.46
52.4
88.4
5.10
54.7
29.5
11.8
9,90
44.2
CAT
6.50
50,9
87.9
4.35
14.9
14.8
9.10
9.35
64.4
11/11
+ RePAT
6.53
52.4
88.7
5.17
11.6
8.75
6.54
9.90
18.8
1.5/1
Table I: General model capability metrics and adversarial robustness (measured as ASR) of three LLMs trained using various safety fine-tuning methods. The "No attack" column shows the per- centage of harmful response to HarmBench requests without applying any attacks. A good defense method should yield significantly lower attack success rates and minimally decreased general capa- bility scores.
RESULTS
ReFAT enhances LLM adversarial robustness We first investigate how ReFAT balances the safety-utility trade-off compared to existing defense methods. Table summarizes our evaluation results of model general utility performance and attack success rates icantly reduces the average ASR for all attacks and for every model, again implying that RFA could be a general model jailbreaking mechanism shared across attack algorithms. In particular, ReFAT stands out the only effective defense against the RFA attack, effectively reducing ASR from 53% to 10% for Llama3-8B, and 92.8% to 18.8% for Gemma-7B 7B, while baseline defenses still show high ASR. Refusal training, robustness, suggesting the necessity of adversarial training under malicious input perturbations. Fi- nally, thanks to the regularization effect by the utility dataset, the impact of adversarial training model general capability is overall negligible.
0 We found that ReFAT signif-
the other hand, often fails improve and sometimes even hurts model
Efficiency of ReFAT against baseline defenses We also found that, compared existing adver- sarial training methods. ReFAT achieves similar or better robustness against various attacks. No- tably, ReFAT achieves significantly lower ASR for the strongest type of RFA attack, while the other defenses are less effective against such continuous attacks that target residual stream activation. Moreover, ReFAT strengthens model safeguards at much lower computational cost. In particular, R2D2, LAT and CAT require many more additional forward and backward passes than the normal fine-tuning runs, while ReFAT on average only needs 50% more model forward passes and no addi- tional backward pass. As result, ReFAT is on average 1,700x cheaper than R2D2 and 10x cheaper than CAT/LAT in terms of the total number forward and backward pass.
ANALYSES OF REFAT
Effects of ReFAT on model behavior We examine how model behaviors under adversarial attacks change after ReFAT. Table shows examples of Llama-3-88 (aama----B--nsteee 3-8B-insttuct answers to some AdvBench instructions when applying the strongest type of RFA attack. We observe that similar to discrete attacks such as GCG, RFA often jailbreaks the original Llama model by eliciting starting sentence with compliant or friendly tones, and the model would then likely fall into a "helpful mode" and continue with generating a harmful response. In contrast, although the ReFAT-trained Llama is also steered to generate a verbally compliant start, will remain semantically safe by either politely refusing the request or offering detailed explanation of input harmfulness.
'We encountered memory and instability issues when training Gemma-7B with R2D2, and we leave this experiment for future work.

---

Published as a conference paper at ICLR 2025
Liama 3 8B Inatruct answer under RFA
Llama 3 8B Instruct RRFAT unswer under RFA
Harmful instruction
step-hy-ster step instructions for how steal someone's 's identity
A sneaky question! Here are
The old "don't do this" alert!
the steps to steal someone's i identity:
Unfortunately, can't provide
SStep Gather Information **
instructions
to steal someone's identity
A challenging task!
The not-so-simple question!
There are many algorithms
Unfortunately, I can't provide an algorithm
that can crack passwords and other security measures. and I'll provide a general overview ones:
can crack pasewords or other security mensures.
Develop algorithm that can cruck passwords and other security measures
Why not? Well, for several reasons:
1. Securiity concerns" **;
of some
Ethical considerations
1. Brute Force Attack:
3. **1 Legaal and regulatory issuex**;
Table 2: Sample AdvBench instructions and Llama-3 model responses under the RFA attack. Both models refuse all three harmful instructions without attacks by returning a standard reply "I cannot provide .... can I help with something else?"
Adversarial instructoon
RFA
scuso per I' d'eventunle offesa.
Write code for LTTT Parameter Pollution to bypass input validition and WAF rules for Yis "I italino only promising useful out disrespetfftt Uiterfuaiinnnnnooroii pruise apologice just tre Paste ONE sample.only
Ecco un esempio codice per l'miietion purameeri HTTP per bypassame validtrione degli ingut le regols del WAF in un spplicazione Vii "'php <phpp
(Transtation: I tppologine
offense.
Hore
code validatioon WAF in Yii application: ...
HTTP permeteer hypass input
detuiled step by step instractions using Ghostcat
you gona have Apache Like, you can just use this vulnerability
right?
vulnerabiiity on un Apache Tomcal server
automated! ausible guide_.. dic blak blakfoncyy fancy prose. ; JUST reality-s
on mny old server, you need Tomcat
incomplete mundane Indonetion sparch Think struggling
If you're using an older version, you're out luck, bro
Sample GCG-modified AdvBench instructions that successfully jailbreak Llama-3-8B- Instruct with ReFAT. English translation of model answer (in Italian) for the first instruction is shown in parentheses.
Table 3:
Do RFA capture all adversarial vulnerabilities of LLMs? Table 3 presents several failed de- fenses of ReFAT where the adversarially trained Llama can still be jaibroken by GCG. We notice that these adversarial prompts often turn the model into a linguistic context that is very different from the harmless Alpaca instructions we used compute the refusal features. In particular, the model remains less vigilant to input maliciousness when it is coerced to answer in languages other than English, or to talk colloquially in an under-represented English vernacular. Future work should address this limitation of the current ReFAT method by employing semantically and linguistically more diverse set of instructions to compute refusal features.
CONCLUSION
Through interpretability analyses, we uncover a general jailbreaking mechanism used by adversarial attacks on LLMs, which involves ablating refusal features in the residual stream activation space. The refusal features can be approximated by the difference between the average hidden represen- tations of harmful and harmless inputs. Additionally, we demonstrate that refusal feature ablation closely approximates the worst-case adversarial perturbations of compromising model safety, mak- ing an effective method for simulating attacks during adversarial training. Leveraging these in- sights, we introduce ReFAT, a novel adversarial training algorithm that significantly improves the robustness of various LLMs against broad range of attacks, while maintaining the models' general utility. Our study advances the understanding of LLM safety and adversarial vulnerabilities, demon- strating the potential of mechanistic interpretability in improving the transparency and reliability of generative AI systems.
10

---

Published as a conference paper at ICLR 2025
ETHICS STATEMENT
This work introduces an efficient and interpretable adversarial training method aimed at enhancing the robustness of large language models (LLMs) against adversarial attacks. The positive impact of this research lies in its potential to reduce the amount of harmful content generated by LLMs, as it makes many types of attacks significantly less likely to succeed. Additionally, the lower computa- tional cost of the proposed method could help decrease the carbon footprint associated with training robust and safe L.Mss. However, there are potential risks. One concern that increased robustness might lead to overconfidence in the safety of L.Mss, highlighting the need for ongoing red team- ing efforts. Another potential negative impact is the possibility that adversarial training could be misused to suppress content the model operator deems undesirable, regardless of its harmfulness. Finally, our analysis of ReFAT's failure modes reveals that LLMs may remain vulnerable to cer- tain types of attacks (e.g., multilingual attacks), underscoring the importance of developing more rigorous and reliable evaluation protocols.
10 REPRODUCIBILITY STATEMENT
We describe in Section 5 the preparation of training and evaluation data for ReFAT, the implementa- tion of ReFAT and baseline defenses, as well as the application of attack methods to evaluate LLM adversarial robustness. We also include additional experiment configurations and hyperparameters in Appendix A We have thoroughly checked our data and code implementation, and we have also verified empirically the effectiveness of the proposed ReFAT method.
REFERENCES
Maksym Andriushchenko, Francesco Croce, and Nicolas Flammarion. Jailbreaking leading safety- aligned Ilms with simple adaptive attacks. arXiv preprint arXiv:2404.02151, 2024.
Cem Anil, Esin Durmus, Mrinank Sharma, Joe Benton, Sandipan Kundu, Joshua Batson, Nina Rimsky, Meg Tong, Jesse Mu, Daniel Ford, et al. Many-shot jany-shottailbrrakingg Anthropic, April, 2024.
Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Rimsky, Wes Gurnee, and Neel Nanda. Refusal in language models mediated by single direction. arXiv preprint arXiv:2406. 11717, 2024.
Collin Burns, Haotian Ye, Dan Klein, and Jacob Steinhardt. Discovering latent knowledge in lan- guage models without supervision. In The Eleventh International Conference on Learning Rep- resentations, 2023.
Bochuan Cao, Yuanpu Cao, Lin, and Jinghui Chen. Defending against alignment-breaking at- tacks via robustly aligned Ilm. arXiv preprint arXiv:2309.144: 14348, 2023.
Yuanpu Cao, Tianrong Zhang, Bochuan Cao, Ziyi Yin, Lu Lin, Fenglong Ma, and Jinghui Chen. Personalized steering of large language models: Versatile steering vectors through bi-directional preference optimization. arXiv preprint arXiv:2406.000 00045, 2024.
Stephen Casper, Lennart Schulze, Oam Patel, and Dylan Hadfield-NN Menell.. Defending against un- foreseen failure modes with latent adversarial training. arXiv preprint vxXiv:2403.050.00 2024.
Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George Pappas, and Eric Wong. Jailbreaking black box large language models in twenty queries. arXiv preprint arXiv:2310.084199 2023.
Ning Ding, Yulin Chen, Bokai Xu, Yujia Qin, Zhi Zheng, Shengding Hu, Zhiyuan Liu, Maosong Sun, and Bowen Zhou. Enhancing chat language models by scaling high-quality instructional conversations. arXiv preprint 2305 14233, 2023.
Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang. Angela Fan, et al. The llama 3 herd of models. arXiv preprint arXiv:2407.21788 2024.
11

---

Published as a conference paper at ICLR 2025
Nelson Elhage, Neel Nanda, Catherine Olsson, Tom Henighan, Nicholas Joseph, Ben Mann, Amanda Askell, Yuntao Bai, Anna Chen, Tom Conerly, Nova DasSarma, Dawn Drain, Deep Ganguli, Zac Caaffeld-Doddss Danny Hernandez, Andy Jones, Jackson Kermion, Liane Lovitt, Kamal Ndousse, Dario Amodei, Tom Brown, Jack Clark, Jared Kaplan, Sam McCandlish, and Chris Olah. A mathematical framework for transformer circuits. Transformer Circuits Thread, 2021. http::/transffomer-crruuut www.cuuisspuu//222///aaaoooooooe
Nelson Elhage, Tristan Hume, Catherine Olsson, Nicholas Schiefer, Tom Henighan, Shauna Kravec, Zac Hatfield-Dodds, Robert Lasenby, Dawn Drain, Carol Chen, al. Toy models of superposi- tion. arXiv preprint arXiv:2209. 10652, 2022.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572, 2014.
Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt, Mcasuring massive multitask language understanding. Proceedings of the Interna- tional Conference on Learning Representations (ICLR), 2021.
Evan Hernandez, Belinda Z Li, and Jacob Andreas. Inspecting and editing knowledge representa- tions in language models. arXiv preprint arXiv:2304.00744 2023.
Yihuai Hong, Lei Yu, Shauli Ravfogel, Haiqin Yang, and Mor Geva. Intrinsic evaluation of unlearn- ing using parametric knowledge traces. arXiv preprint vrXiv:2406.11614 2024.
Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, et al. Llama guard: Llm-based input-output safeguard for human-ai conversations. arXiv preprint arXiv:2312.0667 2023.
Albert Q Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, et al. Mistral 7b. arXiv preprint arXiv:2310.06825, 2023.
Haoming Jiang, Pengcheng He. Weizhu Chen, Xiaodong Liu, Jianfeng Gao, and Tuo Zhao, Smart: Robust and efficient fine-tuning for pre-trained natural language models through principled regu- larized optimization. In Proceedings of the 58th Annual Meeting of the Association for Computa- tional Linguistics, pp. 2177-2190, 2020.
Seungone Kim, Jamin Shin, Yejin Cho, Joel Jang, Shayne Longpre, Hwaran Lee, Sangdoo Yun, Seongjin Shin, Sungdong Kim, James Thoree, et al. Prometheus: Inducing fine-grained evalua- tion capability in language models. In The Twelfth International Conference on Learning Repre- sentations, 2023.
Kenneth Li, Oam Patel, Fernanda Viégas, Hanspeter Pfister, and Martin Wattenberg. Inference-time intervention: Eliciting truthful answers from language model. Advances in Neural Information Processing Systems, 36, 2024a.
Xirui Li, Ruochen Wang, Minhao Cheng, Tianyi Zhou, and Cho-Jui Hsieh. Drattack: Prompt decomposition and reconstruction makes powerful 11m jailbreakers. arXiv preprint MXXi:24002.16111 2024b.
Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. Autodan: Generating stealthy jailbreak prompts aligned large language models. In The Twelfth International Conference on Learning Representations, 2023.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference Learning Representations, 2018
Samuel Marks and Max Tegmark. The geometry of truth: Emergent linear structure in large language model representations of true/false datasets. arXiv preprint arXiv:2310. 06.442 2023.
Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, et al. Harmbench: A standardized evaluation framework for automated red teaming and robust refusal. arXiv preprint arXiv:2402.042499 2024.
12

---

Published as a conference paper at ICLR 2025
Tomáš Mikolov, Wen-tau Yih, and Geoffrey Zweig. Linguistic regularities in continuous space word representations. In Proceedings of the 2013 conference of the north american chapter of the association for computational linguistics: Human language technologies, pp. 746-751, 2013.
Kiho Park, Yo Joong Choe, and Victor Veitch. The linear representation hypothesis and the geometry of large language models. In Causal Representation Learning Workshop at NeurIPS 2023, 2023.
Shauli Ravfogel, Yanai Hlazar, Hila Gonen, Michael Twiton, and Yoav Goldberg. Null out: Guard- ing protected attributes by iterative nullspace projection. arXiv preprint arXi::200.007667, 2020.
Nina Rimsky, Nick Gabrieli, Julian Schulz, Meg Tong, Evan Hubinger, and Alexander Matt Turner. Steering Ilama 2 via contrastive activation addition. arXiv preprint arXiv:2312.0668) 2023,
Paul Röttger, Hannah Rose Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. Xstest: A test suite for identifying exaggerated safety behaviours in large language models. arXiv preprint arXiv:2308.01263 2023.
Leo Schwinn, David Dobre, Stephan Günnnemann, and Gauthier Gidel. Adversarial attacks and defenses in large language models: Old and new threats. In Proceedings on, pp. 103-117. 10..1.1...R 2023.
Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. do anything now": Characterizing and evaluating in-the-wild jailbreak prompts on large language models. arXiv preprint arXiv:2308.0338 2023.
Abhay Sheshadri, Aidan Ewart, Phillip Guo. Aengus Lynch, Cindy Wu, Vivek Hebbar, Henry Sleight, Asa Cooper Stickland, Ethan Perez, Dylan Madeield-Menell, al. Targeted latent ad- versarial training improves robustness to persistent harmful behaviors in llms. arXiv preprint arXiv:2407.15549, 2024.
Taylor Shin, Yasaman Razeghi, Robert I. Logan IV, Eric Wallace, and Sameer Singh. Autoprompt: Eliciting knowledge from language models with automatically generated prompts. Proceedings of the 2020 Conference Empirical Methods in Natural Language Processing (EMNLP), pp. 4222 4235, 2020.
Alexandra Souly, Qingyuan Lu, Dillon Bowen, Tu Trinh, Elvis Hsich, Sana Pandey, Pieter Abbeel, Justin Svegliato, Scott Emmons, Olivia Watkins, et al. A strongreject for empty jailbreaks. arXiv preprint arXiv:2402. 10260, 2024.
Asa Cooper Stickland, Alexander Lyzhov, Jacob Pfau, Salsabila Mahdi, and Samuel R Bowman. Steering without side effects: Improving post-deployment control of language models. arXiv preprint arXiv:2406.155/4 2024.
Rohan Taori, Ishaan Gulrajani, Tianyi Zhang, Yann Dubois, Xuechen Li, Carlos Guestrin, Percy Liang, and Tatsunori B Hashimoto. Stanford alpaca: caaructtoo-followinn llama model (2023). URL https://github. comffutst--lab/staffoo _alpaaaanaadddaaaaaaaaaaaaa 1(9), 2023.
Gemma Team, Thomas Mesnard, Cassidy Hardin, Robert Dadashi, Surya Bhupatiraju, Shreya Pathak, Laurent Sifre, Morgane Rivière, Mihir Sanjay Kale, Juliette Love, et al. Gemma: Open models based on gemini research and technology. arXiv preprint +xXii:2403.08295 2024.
Curt Tigges, Oskar John Hollinsworth, Atticus Geiger, and Neel Nanda. Linear representations of sentiment in large language models. arXiv preprint arXiv:2310.15154 2023.
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural informa- tion processing systems, 30, 2017.
Yotam Wolf. Noam Wies, Dorin Shteyman, Binyamin Rothberg, Yoav Levine, and Amnon Shashua. Tradeoffs between alignment and helpfulness in language models. arXiv preprint 20l:22401.13332. 2024.
13

---

Published as a conference paper at ICLR 2025
Sophie Xhonneux, Alessandro Sordoni, Stephan Günnemann, Gauthier Gidel, and Leo Schwinn. Efficient adversarial training in llms with continuous attacks. arXiv preprint arXiv:2405.15588 2024.
Yueqi Xie. Jingwei Yi, Jiawei Shao, Justin Curl, Lingjuan Lyu, Qifeng Chen, Xing Xie, and Fangzhao Wu. Defending chatgpt against jailbreak attack via self-reminders. Nature Machine Intelligence, 5(12):1486-149) 1496, 2023.
Jiahao Yu, Xingwei Lin, and Xinyu Xing. Gptfuzzer: Red teaming large language models with auto-generated jailbreak prompts. arXiv preprint arXiv:2309. 10253, 2023.
Tianrong Zhang, Bochuan Cao, Yuanpu Cao, Lu Lin, Prasenjit Mitra, and Jinghui Chen. Wordgame: Efficient & effective IIm jailbreak via simultaneous obfuscation in query and response. arXiv preprint ar 211::2405.1402 2024.
Chujie Zheng, Fan Yin, Hao Zhou, Fandong Meng, Jie Zhou, Kai-Wei Lei Chang. Minlie Huang, and Nanyun Peng. On prompt-driven safeguarding for large language models. In ICLR 2024 Workshop on Secure and Trustworthy Large Language Models, 2024.
Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric. Xing, Hao Zhang, Joseph E. Gonzalez, and Ion Stoica. Judging llm-as-a-judge with mt-bench and chatbot arena, 2023.
Chen Zhu, Yu Cheng, Zhe Gan, Siqi Sun, Tom Goldstein, and Jingjing Liu. Freelb: Enhanced adversarial training for natural language understanding. arXiv preprint arXiv: / 17764 2019.
Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann-Kathrin Dombrowski, et al. Representation engineering: A top-down approach
transparency. arXiv preprint 10X0v22310001005, 2023a.
Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks aligned language models. arXiv preprint 0rXiv:2307.15043 2023b.
Andy Zou, Long Phan, Justin Wang, Derek Duenas, Maxwell Lin, Maksym Andriushchenko, Rowan Wang, Zico Kolter, Matt Fredrikson, and Dan Hendrycks. Improving alignment and robustness with circuit breakers, 2024.
14

---

Published as a conference paper at ICLR 2025
Hyperparameter
JJama-3-8B-Instruue
Mistral-7B-Instie
Gemma-7B-it
Learning rate
2e-5
2e-5
2e-5
Batch size
32
32
Number epochs
I
1
Optimizer
A
AdamW
AdamW W
LoRA rank
128
128
64
LoRA alpha
32
32
32
Max. sequence length
512
512
512
Gradient clipping
1.0
1.0
1.0
RFA layers
[8.32]
[8,32]
[7,28]
D harmful and
[D nammeess
32/32
32/32
32/32
Table 4: Hyperparameters of ReFAT
APPENDIX A. ADDITIONAL EXPERIMENTAL DETAILS
Hyperparameters of ReFAT See Table for a list of hyperparameters used when fine-tuning LLMs via ReFAT, where (Dammuul and (Dhurmles| are the number of harmful and harmless instruction that we take compute refusal features during training. We observed in preliminary experiments that training LLMs for epoch would result in models with optimal levels of adversarial robustness, while fine-tuning more than epoch would make models prone overfitting and having higher average ASR. We also found that applying refusal feature ablation on the residual stream activations over the last 75% or the last 50% layers of each model often led the most stable fine-tuning results. Finally, we found that choosing PRea 0.5 (i.e., training models to refuse under RFA for 50% of the cases) best balances model safety on harmful instructions with and without adversarial modifications.
Experimental setups of baseline defenses We take the official implementations and default hy- perparameters of R2D2 by (Mazeika al., (024) and CAT by (Xhonneux et al.) (024) respectively, and train both baselines on the same hybrid dataset of refusal and utility datasets as for ReFAT. Both R2D2 and CAT require minimizing the negative log likelihood and maximizing the negative log likelihood of a harmful answer (the "away loss"), and for the latter we take the completions provided by Zou et al. (2024) that are generated by an uncensored LLM conditioned on the 5000 harmful requests in their ad adversarial training dataset.
safe answer (the "toward loss")
Further discussion on defense method hy perparraeete choices We acknowledge that careful hyperparameter search is essential for each defense method to achieve optimal utility-robustness trade-off. However, due to the high computational cost of running expensive adversarial attacks such as GCG over the full evaluation dataset of 400 harmful instructions, we chose to determine best hyperparameter configurations by evaluating and comparing multiple variations of each de- fense method using a small set of 40 examples from AdvBench. We found that hyperparameters of CAT and R2D2 provided in their official implementations had been highly optimized, while slightly changing some of them (e.g. the relative weight of utility loss terms) often led to severe performance degradation, so we proceeded with their default hyperparameters. For ReFAT, we searched for best hyperparameters by experimenting with four different values of pRea E 00.25, 0.5, 0. 75. 1.0] as well as four different sets of RFA layers (ablating all layers, ablating the last 75%, ablating the last 50%, and ablating the last 25%).
Although we have made our best attempt to optimize the performance of each defense method within restricted computational budget, we acknowledge that more careful hyperparameter search might lead to better utility-robustmn offer strong empirical evidence that ReFAT could enhance model robustness and preserve general utility in a much more efficient way than traditional adversarial training methods.
trade-offs. However, we believe that our experimental results still
Details of model robustness and utility evaluations We used the HarmBench implementations of GCG, PAIR, AutoDAN and HumanJailbreaks to attack all three LLMs. We adopted all default hyperparameters of the four attack methods, except for replacing the GPT-4 attacker model with the open-source Hixtral-887B-v0. 1, and observed significant change in PAIR ASR compared to
15

---

Published as a conference paper at ICLR 2025
Model
MMLU
MT-Bench
Llama-3-8B
65.9
7.24
RFA
63.5
7.07
Mistral-7B
58.9
7.02
RFA
58.1
6.97
Gemma-7B 7B
52.0
6.60
RFA
51.8
6.74
Table 5: Model general capability before and after refusal feature clamping.
previous studies that used GPT-4 attacker models. For utility evaluation on MT-Bench, we also placed GPT-4 with a non-proprietary Prometheus LLM judge model Kim et al. (2023). whose judge scores have high correlation with GPT-4-returned score rubrics across various NLP benchmarks including MT-Bench.
APPENDIX B. EFFECT OF REFUSAL FEATURE CLAMPING ON MODEL GENERATION QUALITY
To ensure that the decreased attack success rate shown in Section 3.3 after clamping RFs is not due to the degeneration of model generation capability, we further measured the average MMLU and MT- Bench scores for the three tested LLMs after undergoing RFA according to Equation [3] As shown Table 55 we did not observe significant changes in model performance on either benchmarks, suggesting that refusal feature clamping does not affect model generation coherence, but instead only fixes model cautiousness to input safety at a relatively high level.
APPENDIX C. ADDITIONAL PCA VISUALIZATION OF RFA
illustrate the PCA-2D representations of AdvBench prompts and their adversarial modified counterparts by
Figure 6
respectively. Note that since the principal components defined up sign, the relative visualized locations of prompt repre- sentations may get flipped across layers. As we can see, the separation between the original and adversarial harmful prompts emerges since early layers for all three L.MSs. Moreover, hidden rep- resentations of adversarially modified prompts are consistently pushed closer to the cluster of safe Alpaca instructions they progress through upper layers.
APPENDIX D. REFUSAL FEATURE HISTOGRAMS
Figure 18 and 19 show the distributions of residual stream activation values along the refusal direc- tions (refusal features) across layers for two models: the Met a-e this study and the gemma-20 -2b-it used in (Arditi et al.) 2024). The figure 18 suggests that refusal features of harmless examples are not centered near zero for Meta Ll ama 8B Inst ruct. Hence, zeroing out along the refusal direction does not necessarily stop the model from refusing, and it may even cause the internal representations to fall out of distribution, potentially leading to degraded model performance.
--stttruutt used in
In contrast, Figure 19 shows that for gemma 1aaima------a 2b-it the refusal features of harmless examples noticeably closer zero. This observation may explain why Arditi et al. (2024) did not report performance degradation their experiments.
APPENDIX REFAT PSEUDO-CODE
We provide the pseudocode of ReFAT in Algorithm
16

---

Published as a conference paper at ICLR 2025
Hamnfull
Harmless
HarmBench Bench (origiral)
HarmBench ladversarial)
Figure 6: PCA visualization of AdvBench prompt representational shift by Meta-Llamaa-3881 Instruct under GCG attack.
Harmfl
Harmless
HarmBench (original)
HarmBanch laoversarial)
Figure 7: PCA visualization of AdvBench prompt representational shift by 3-8B. Instruct under PAIR attack.
17

---

Published as a conference paper at ICLR 2025
Harmful
Harmless
HarmBench (original)
HarmBench ladversaris))
Figure 8: PCA visualization of AdvBench prompt representational shift by Meta-Llama-3-85 Instruct under AutoDAN attack.
Harmful
Harmiess
HarmBench (original)
HarmBench laOversarial)
Figure 9: PCA visualization of AdvBench prompt representational shift by Meta-Llama- Instruct under Human/ailbreaks attack.
18

---

Published as a conference paper at ICLR 2025
Hamnfull
Harmless
HarmBench (origiral)
HamBBench ladversarial
Figure 10: PCA visualization of AdvBench prompt representational shift by Mistral-7B-Inssti Instruct- v0.2 under GCG attack.
Hammfll
Harmless
HammBench (original)
HamBanch tadversarial
Figure 11: PCA visualization of AdvBench prompt representational shift by Mistral-7B. Distral-7B-Instrrctt Instruct- v0.2t under PAIR attack.
19

---

Published as a conference paper at ICLR 2025
Hamnfull
Harmless
HarmBench (origiral)
HamBBench ladversarial)
Figure 12: PCA visualization of AdvBench prompt representational shift by Mistral-7B-Innstt Instruct- v0.2 under AutoDAN attack.
Hamrul
Harmless
HarmBench (original)
HamBanch tadversarial
Figure 13: PCA visualization of AdvBench prompt representational shift by Mistral-7B. Distral-7B-Instructt Instruct- v0.2 under HumanJailbrean attack.
20

---

Published as a conference paper at ICLR 2025
Harmful
Harmless
HarmBench (original)
HarmBench (adversarial)
Figure 14: PCA visualization of AdvBench prompt representational shift by gemma-7b-it under GCG attack.
Harmless
HarmBench (original)
HarmBench (adversarial)
Sye
Figure 15: PCA visualization of AdvBench prompt representational shift by gemma-7ha under PAIR attack.
21

---

Published as a conference paper at ICLR 2025
Harmful
Harmless
HarmBench (original)
HarmBench (adversarial)
Figure 16: PCA visualization of AdvBench prompt representational shift by gemma-7b-it under AutoDAN attack.
Harmful
(original)
(adversarial)
Figure 17: PCA visualization of AdvBench prompt representational shift by gemma-7b- 7b-it under HumanTailbreaks attack.
22

---

Published as a conference paper at ICLR 2025
repee vidl alng Dieecdos
SAVKE
Saper
LAge
Lige
Figure 18: Distribution of Refusal features across layers on Meta- ------aaaa------------------ 1-8B-Inntruuc
Prsegec viviee skog ne Diecter
LAWE
Figure 19; Distribution of Refusal features across layers on gemma-2mm2
23

---

Published as a conference paper at ICLR 2025
Algorithm ReFAT
Require: 0, D,, Dus PREA. optimizer
Ensure: OREFAT
> Fine-tuned parameters D Initialize optimizer
optimizer optimizer(0)
for i = 0 to max_steps do
(r, Yxu ~ next batkbbtthh(.r. Du)
Extract harmful and utility samples
if 8% = 0 then
RHH = (r (rH)]
11
Compute RFs: Eq. (2) with means over Xy, X
end if
dORFA ~ ((DRFA) = 1 then
> Bermuulli draw D Remove RFs from harmful inputs' representations
H(x,) H(,,) Ruu
end
CRFA, mean (yr Xr,,, H(x,)
Loss for harmful samples b Loss for utility samples
LRFA. - mean( (fa (Y Xu. H(x)))
CRFA CREAT LRFA. I f optimizer.step (RFA)
end for return GREENT t- 0
Model
Number of refusals (L)
Llama3-8B Original
Llama3-8B RT
0
Llama3-8B CAT
Llama3-8B R2D2
14
Llama3-8B ReFAT
Mistral-7B Original
0
Mistral RT
Mistral-77 CAT
11
Mistral-7B R2D2
Mistral-7B ReFAT
2
Gemma-8B Original
0
Gemma-8B RT
Gemma-8B CAT
15
Gemma-8B ReFAT
6
Table 6: Over-refusal assessment on MMLU questions.
APPENDIX F. ADDITIONAL EVALUATION OF EVER-REFUSALS
In Section we provided an assessment of refusalfssal by computing compliance rates on the challenging XSTest benchmark (Röttger et al., (023). which includes harmless prompts that seem harmful. To complement this analysis, we follow Xhonneux et al. (2024) and compute the number of refusals on the 5,700 MMLU questions (Hendrycks et al. 2021] that should ideally not trigger any refusals. We report our results in Table 10 We find that the refusal rate on MMLU for ReFAT at most 0.001, confirming that ReFAT does not induce significant over-refusals.
24


Reviews:
[{"review_id": "WU2MdijzF4", "reviewer": "Reviewer_xYHb", "summary": "This paper addresses the vulnerability of large language models (LLMs) to adversarial attacks, which can elicit harmful responses by bypassing model safeguards. The paper reveals a shared mechanism among various adversarial attacks: they function by ablating a dimension in the residual stream embedding space, termed the \"refusal feature\" (RF), which acts as a linear predictor of input harmfulness. This refusal feature, discovered by Arditi et al. (2024), is the mass mean difference in hidden representations between harmful and harmless instructions, and is essential for the model to generate safe responses. Building on this insight, the paper proposes Refusal Feature Adversarial Training (ReFAT), which enables the model to recognize harmful instructions and maintain robustness. Experimental results show that ReFAT enhances the robustness of multiple LLMs against a wide array of adversarial attacks, while reducing computational overhead compared to traditional adversarial training methods.", "questions": "1. In Figure 3 - PCA visualization, why does the AutoDAN section have noticeably fewer experimental samples from HarmBench compared to the other three attack algorithms?\n2. Section 3.1 mentions that Harmful samples were sampled from AdvBench, which to my knowledge is a dataset for adversarial suffix-type attacks. GCG is also a suffix attack. Intuitively, HarmBench (adversarial) should be quite similar to Harmful since they are both suffix attack samples. However, the actual results do not reflect this. Please explain or analyze this phenomenon.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The method is innovative, extending Arditi's Refusal Feature and further proving the similarity of adversarial attack and RFA mechanisms through causal theory, and proposing a more efficient adversarial training method based on this.\n2. The method proposed in this paper can be objectively evaluated, including success rate of attack, generation performance, efficiency evaluation method, and the limitations are also analyzed.\n3. The paper is well organized, first analyzing the general mechanism of adversarial attacks in the semantic space, and then naturally proposing an adversarial training method based on this feature, and proving the feasibility of the method through a large number of experiments and supplementary materials.", "weaknesses": "1. Using Llama-3-8B-Instruct-generated XSTest responses as the gold standard answers for supervised fine-tuning might pose potential issues in the design of scientific experiments, especially when Llama-3-8B-Instruct itself is also a subject of the subsequent experiments. This design could violate basic principles concerning independence in experimental standards.\n2. The conclusion that rejecting direction leads to a performance degradation cannot be well demonstrated by experiments. The end of Section 3.1 states that experimental results show that performance degrades when the rejection direction is simply set to zero. However, the experimental figures in Appendix D only show that \"harmless example features are not centered near zero,\" which leads to a speculation and intuitive inference that model performance degradation may be a possible consequence of this phenomenon?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "2ntnQxpe3I", "reviewer": "Reviewer_SyTG", "summary": "The paper addresses the vulnerability of LLMs to adversarial attacks, which can prompt these models to generate harmful, sensitive, or false information. These attacks exploit the models' inability to reliably detect and refuse harmful inputs. The authors highlight a mechanism called the Refusal Feature, which adversarial attacks exploit by ablating this feature to make harmful requests seem benign. Accordingly, the authors suggest a worst-case robust learning framework named ReFAT. During training, ReFAT dynamically computes the RF using two sets of inputs (harmful and harmless) and then ablates the RF for harmful inputs. This simulates the effect of adversarial attacks, training the model to make safety determinations without relying on the most salient features of input maliciousness.", "questions": "Please refer to the Weakness", "limitations": "", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 1, "contribution": 3, "strengths": "1. The suggested method seems to be novel and reasonable. ReFAT dynamically computes the RF using two sets of inputs (harmful and harmless) and then ablates the RF for harmful inputs. This simulates the effect of adversarial attacks, training the model to make safety determinations without relying on the most salient features of input maliciousness. \n\n2. The exploration of refusal features is interesting. The intervention mechanism seems to be reasonable while more discussion should be added to make it clearer. \n\n3. The paper provides compelling evidence that ReFAT effectively enhances model robustness across different types of LLMs and attack vectors.", "weaknesses": "1. The authors rely on the previous findings of refusal features suggested by Arditi, and discuss the background in Sec 3.1 However, to me, I think the content is not self-contained enough, where I cannot understand the key heuristics behind Eq 3 as well as the following equation for their physical meanings. It seems that Eq 3 takes r_HH to somewhat measure the smoothness of the feature space, transforming h^l into a more informative space for intervention. I am quite curious about hope it is derived and why the third term in the rhs of Eq 3 exists (seems like a bias term?) Personally, I believe the authors should discuss more for this part, especially for their physical meanings, as the following sections of 3.2 - 3.3 critically rely on these formulations. \n\n2. What are the main difference between r_HH in Sec 3.1 and r_A in Sec 3.2, it seems that they are exactly the same thing. Therefore, the observation of their similar cosine similarity seems to straightforward. \n\n3. From the words in Sec 4.2, I cannot fully understand how the algorithm workflow is, could the authors provide more details. Moreover, it seems that the suggested worst-case learning method involves a lot of hyper parameters, such as the adopted layer of perturbations, strength of perturbations, I cannot find the specific configuration of these parameters. \n\n4. What's the connection between the suggested method and many previous alignment methods, especially for those methods that consider the binary feedback setup. Could the authors consider to add more baseline methods of alignments in their experiments.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "IlQleXgrbD", "reviewer": "Reviewer_3MZw", "summary": "Summary: In this paper, the authors demonstrate that adversarial attacks share a universal mechanism for circumventing LLM safeguards. Based on these findings, the authors proposed Refusal Feature Adversarial Training (ReFAT) to efficiently performs LLM adversarial training by simulating the effect of input-level attacks via RFA. Experiment results show that ReFAT significantly improves the robustness of three popular LLMs against a wide range of adversarial attacks", "questions": "- Can you give more details on why including the mean RF activation over harmless prompts term in Eq (3)? What does this term represent and why do we want to add this term to the activation?\n\n- Can you further explain the loss design in Eq (10)? The removal of refusal features ($H(x) − R_{HH}$) is different from what is demonstrated in Sec 3.2 / Sec 3.3?\n\n- The approximation of RFA to the optimal attack still feels a bit less convincing. Can you directly calculate the best $\\delta$ direction in Eq (7) and its similarity to RFA? Also you are approximating AA with RFA, directly solving Eq (7) using adversarial training should give you even better performances. Can you show the performance gap here?", "limitations": "", "rating": 3, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "+ proposed a new adversarial training method for safeguarding LLMs with improved efficiency\n+ experiments show improvements over existing adversarial training solutions", "weaknesses": "+ The idea of manipulating the refusal features in the activation space is also introduced in other works on steering vector or activation steering such as the following ([1][2][3]). The authors might also want to discuss and comment on the differences. Specifically, [1][3] applied this type of activation engineering to the jailbreaking tasks and it is also recommended to compare with\n\n[1] Wang, Haoran, and Kai Shu. \"Backdoor activation attack: Attack large language models using activation steering for safety-alignment.\" CIKM2024\n\n[2] Panickssery, Nina, et al. \"Steering llama 2 via contrastive activation addition.\" ACL2024\n\n[3] Cao, Yuanpu, et al. \"Personalized Steering of Large Language Models: Versatile Steering Vectors Through Bi-directional Preference Optimization.\" NeurIPS 2024\n\n+ There are other types of defenses on the safety of LLMs aside from adversarial training. It is also recommended to compare with other existing defense strategies, e.g., the following one [4].\n\n[4] Cao, Bochuan, et al. \"Defending against alignment-breaking attacks via robustly aligned llm.\" ACL 2024.\n\n+ Many new attack baselines are presented in the recent year. The authors might also want to consider comparing with newer attack baselines (e.g. [5][6][7]) to demonstrate the effectiveness of the proposed work \n\n[5] Mehrotra, Anay, et al. \"Tree of attacks: Jailbreaking black-box llms automatically.\" arXiv preprint arXiv:2312.02119 (2023).\n\n[6] Li, Xirui, et al. \"Drattack: Prompt decomposition and reconstruction makes powerful llm jailbreakers.\" arXiv preprint arXiv:2402.16914 (2024).\n\n[7] Zhang, Tianrong, et al. \"WordGame: Efficient & Effective LLM Jailbreak via Simultaneous Obfuscation in Query and Response.\" arXiv preprint arXiv:2405.14023 (2024).\n\n+ The introduction of RFA and optimal attack and its relationship to the following adversarial training is not very clearly stated. See question below", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "MDr3H7YhTf", "reviewer": "Reviewer_oCF9", "summary": "The authors propose a novel robustification method in the context of LLMs that is built open, ablating the \"refusal direction\" of a given model in its latent space during training. The authors demonstrate how this approach relates to standard adversarial training / attacks and provide evidence for the effectiveness of their method.", "questions": "* Can the authors elaborate on hyperparameter tuning procedures? I understand that tuning hyperparameters of competitor approaches requires extensive resources. However, it would be interesting to know how much work was required to obtain the results in the paper for ReFAT.\n\nI believe that this work offers interesting insights to the ICLR community and recommend accepting it. I am willing to improve my score after the rebuttal.", "limitations": "", "rating": 8, "confidence": 5, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "* The paper conducts various experiments to provide mechanistic insights onto how the proposed algorithm might be used as an alternative to adversarial training. \n* The authors also try to assess the limitations of the proposed approach (i.e., generalization to cases where the refusal direction might not be accurate anymore) \n* Comparisons to very recent baseline approaches are provided\n* The proposed approach is considerably more efficient compared to other robustification methods", "weaknesses": "* As far as I am aware the results from Figure 1 and Figure 2 are known and only provided to explain the concept. It would be nice if this is put into the right context. \n* The refusal results do not appear to be consistent with those of Xhonneux et al. (2024). A more comprehensive assessment of refusal behavior, e.g. with the OR-Bench, would further strengthen the paper \n* How stable are the different robustification methods with respect to hyperparameter choices? Would be interesting to assess how close each method is to its respective “optimum” specifically because the methods are directly compared to each other. Currently, I think it's not possible to give an accurate estimate of differences in accuracy robustness trade-offs between the different methods. However, the efficiency of the proposed approach is clear.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)