Robustness in Large Language Models: A Survey of Mitigation Strategies and Evaluation Metrics
Authors: PANKAJ KUMAR
Subhankar Mishra
Venue: Accepted by TMLR ()

Abstract: Large Language Models (LLMs) have emerged as a promising cornerstone for the development of natural language processing (NLP) and artificial intelligence (AI). However, ensuring the robustness of LLMs remains a critical challenge. To address these challenges and advance the field, this survey provides a comprehensive overview of current studies in this area. First, we systematically examine the nature of robustness in LLMs, including its conceptual foundations, the importance of consistent performance across diverse inputs, and the implications of failure modes in real-world applications. Next, we analyze the sources of non-robustness, categorizing intrinsic model limitations, data-driven vulnerabilities, and external adversarial factors that compromise reliability. Following this, we review state-of-the-art mitigation strategies, and then we discuss widely adopted benchmarks, emerging metrics, and persistent gaps in assessing real-world reliability. Finally, we synthesize findings from existing surveys and interdisciplinary studies to highlight trends, unresolved issues, and pathways for future research.

Published in Transactions on Machine Learning Research (11/2025)
Robustness in Large Language Models: A Survey of Mitiga- tion Strategies and Evaluation Metrics
Pankaj Kumar
mankaj.kumarrniseee
School of Computer Sciences
National Institute of Science Education and Research An OCC of Homi Bhabha National Institute, India
Subhankar Mishra
smishra @riser aat.rrac..i. in
School of Computer Sciences
National Institute of Science Education and Research An OCC of Homi Blablu National Institute, India
Reviewed on OpenReview: https: // openreview. net/ formm? id= Bchwaaod6g
Abstract
Large Language Models (LLMs) have emerged as promising cornerstone for the develop- ment of natural language processing (NLP) and artificial intelligence (Al). However, ensuring the robustness LLMs remains a critical challenge. To address these challenges and ad- vance the field, this survey provides a comprehensive overview of current studies this area. First, we systematically examine the nature of robustness LLMs, including its con- ceptual foundations, the importance of consistent performance across diverse inputs, and the implications of failure modes in real-world applications. Next, we analyze the sources of non-robustnesss, categorizing intrinsic model limitations, data-driven vulnerabilities, and external adversarial factors that compromisc reliability. Following this, we review state- of-the-art mitigation strategies, and then we discuss widely adopted benchmarks, emerging metrics, and persistent gaps in assessing real-world reliability. Finally, we synthesize findings from existing surveys and interdisciplinary studies to highlight trends, unresolved issues, and pathways for future research.
1 Introduction
Large Language Models (LLMs), mainly characterized by their vast number of parameters, have emerged promising cornerstone for the development of natural language procossing(NLP)) and artificial intelligence (AI) Zhang al. (2023). These models have demonstrated remarkable capabilities across wide range of NLP applications. Foundation models like GPT-4 OpenAT et al. (2024), GPT-3 Brown et al. (2020), Qwen 2.5-VL Bai et al. (2025a), Deepseek- V3 DeepSeek-Al et al. (2025), Meta (LLaMA-3, LLaMA-2 Touvron et al. (2023b), LLaMA-1 Touvron et al. (2023a)), Gemini DeepMind (2023) are pre-trained on massive datasets and serve as the backbone for various AT tasks, from text generation multimodal understanding the ability process and interpret multiple types of data, such as text and images. Their extensive factual knowledge has significantly improved their effectiveness in information retrieval, enabling them provide more accurate and contextually relevant responses AlKhamissi et al. (2022); Petroni et al. (2019). As result, these models achieve high accuracy on benchmark evaluations, demonstrating their strong predictive capabilities across diverse tasks OpenAl et al. (2024); Bai et al. (2025a); DeepSeek-Al et al. (2025); Grattafiori et al. (2024). However, accuracy alone insufficient to ensure reliability in real-world applications.
In recent years, despite improvements the accuracy of deep neural network models, rescarchers have found that they are easy fool by applying a specific imperceptible perturbation Szegedy et al. (2014). A deep learning model's accuracy describes how accurately the model predicts sample points distribution. If

---

Published in Transactions on Machine Learning Research (11/2025)
model cannot predict accurately, then no matter what properties this model holds, it would be meaning- less. Although accuracy is the most fundamental metric in the evaluation and is essential to validate the performance of an LLM before it is released, it is equally important to test its robustness when deploying for the development of reliable AI systems. Robustness, a crucial aspect of deep learning models, describes their ability to maintain stable predictions when faced with specific perturbations or variations in the input data Liu et al. (2024b). Despite recent advancements, ensuring the robustness of LLMs remains a critical challenge. LLMs may encounter unpredictable variations in language, shifts in data (changes in the data patterns that model encounters, which may affect its performance), and adversarial inputs that can affect their performance. In practical applications, these models often face noisy, unstructured text, breaking the assumption that input data will always be clean and well-formed. Additionally, a lack of robustness may result in unintended biases, incorrect predictions, or overreliance on spurious correlations (misleading corre- lations in data that a model may rely on incorrectly), raising concerns about their reliability in high-stakes environments such as healthcare Wan ct al. (2024b;a); He et al. (2025), law Lee (2023); Cui et al. (2024); Yue al. (2023); Bhambhoria et al. (2024); Bai et al. (2021b), complex reasoning Yang et al. (2023), code generation Sun et al. (2024b); Lin et al. (2024a); Mishra et al. (2024); Hassid et al. (2024), and finance Lee et al. (2025); Zhao et al. (2024a); Li et al. (2024c); Wu et al. (2023). Because of this, a thorough and exacting assessment of LLM robustness that goes beyond conventional accuracy criteria is required.
However, ad advancing research on the robustness of L.LMs also faces significant challenges. First, the absence of standardized definitions and categorizations of robustness complicates cross-study comparisous, as research efforts often differ in how they frame their scope and components. Second, pinpointing the root causes of non-robustness, such as data biases, unstable training dynamics, architectural limitations, inference ineffi- ciencies, requires discntangling complex interactions across these factors. Third, while numerous mitigation strategies exist, their effectiveness often depends on addressing specifie vulnerabilities, making it difficult to generalize solutions. Fourth, evaluating robustness remains fragmented, with no unified metrics or bench- marks to holistically assess performance under diverse real-world conditions like noisy inputs or adversarial attacks. Finally, existing literature on LLM robustness (Zhao et al., 2025; Gu et al., 2025; He et al., 2025; Liu et al., 2024b; Mehrabi et al., 2022; Wang et al., 2025; Lu et al., 2024; Weng, 2023; Yang et al., 2024a) is scattered across domains, limiting cross-pollination of insights and hindering the development of cohesive solutions.
To address these challenges and advance the field, this survey provides a comprehensive overview of current studies in this area. Figure 1 shows the outline of this survey. We begin by clarifying definitions and categorizing the dimensions of robustness to establish a shared framework for analysis ($2). Next, we systematically identify and classify the primary sources of non-robustnesss, including data quality issues, training instabilities, architoctural constraints, and inference-time vulnerabilities ($3). We then review state- of-the-art mitigation strategies, mapping each approach the specific weaknesses it targets ($4). Following this, we analyze evaluation methodologies, discussing widely adopted benchmarks, emerging metrics, and persistent gaps in assessing real-world reliability (65). Finally, we synthesize findings from existing surveys and interdisciplinary studies to highlight trends, unresolved issues, and pathways for future rescarch (56). By unilying these perspectives, we aim to foster collaboration and accelerate progress toward building more reliable, resilient LLMs.
The existence of numerous surveys, while indicating intense rescarch activity, also suggests a potentially fragmented landscape where different. communities might use varying terminology or focus on specific aspects of the broader robustness problem. A key contribution of a comprehensive survey like this one is to bridge these perspectives and synthesize the common underlying principles and challenges. Furthermore, existing surveys often highlight gaps and open questions that remain pertinent. The lack of unified definitions and practical frameworks for operationalising trustworthiness (including robustness) is noted (de Cerqueira et al., 2025). The difficulty in evaluating generative tasks robustly is frequently mentioned. Understanding and mitigating more subtle or complex shortcuts beyond simple lexical cues remains an area for research (Howe et al., 2025; Zhou et al., 2024d; Yuan et al., 2023). Finally, ensuring that robustness improvements scale effectively with incrcasing model size is an ongoing concern.
2

---

Published in Transactions on Machine Learning Research (11/2025)
Whost in Rohustzans in LLMs (8 2.3)
Gau en (2023); Du et al. (2002); Slegh et al. (2024); Tiu al. (20244)) Malsurt al. (2021)
Surker es. al. (2024); Allom ot ol. (2024); Aljshoni et nl. (20253; Li wt nl. (20266)
Rolbastauss In LLMs ($ 2)
Craudas ss ac. (2022)); Youg st al. (20264); Thu vt al. (2024); Gan wt al. (2024); Xinomunus et. al (2024)
Key dimnensiores of Robustncest 2:2)
Jisug et (2025): Du es, (2022); Yuan et al. (2003); Nagurajin ei al. (28124); Lua al. (2026)
Zaoza (20240); Yong (2125b); Lin al. (2124b); Agnanal et (2025)
Date-Related
Maharus et (2024);
Du (2022); Li al. (2024b); Jung et (20125); Allem al (2524); Aljohani es al (2025)
(202tb); Yan (2024s): Singh (2024); et (2024e)
Naganajan (2124) You al. (2024h); Burbort (2026); Huwag al. (2022t)
Sources of nom- rubustness
Trainiag- Related ($ 3.2)
Yuun vi al. (2022)) Clou nl. (2020); Youg al. (2114))); Lin al. (2024))
Architectural (8 (.3)
Zinwag (3022):: Das ul. (2025); Mu ei (2018)); Fin. (2024)) Auwar al. (2024)
Inferencee Related 18 3.4)
Na al. (2025); Hong al. (2023),; Stä al. (30224a); You el al. (2024);; Stan sl. (20224
Yu et al. (20124
Deng nl. (2021); Weng (2025) Thaoo al. (9020); Jiang al. (2070)
Data Angneutation
Xu es al (2025); Lin & Sum (2023); Lee et al. (2024b)
Pre preepprccssing Approaches (8
Qua (2022); Zayed al. (2022); Lim al. 12025)
Survey Robust of LLMs
Data Filtering
Huang e ol. (2024a); Leuronon nl. (2022)); Dong (2022
(2025e); Bendinell (2025), Clan (2M256)
Hui et (20216); Liu Sun (2028), Altiniskk al. (2022)
Adversorial Training
Xhoumoux (2024); Dong (2021); Rodallor (2024)
Rohimian & Mehroom (2022); Kithm es al. (2025); Wa et al. (2025)
Jang al. (2020): Xu al. (2023); Karimi Mababodi al. (2020)
In-prooeesing Appronchow (8 1.2)
Regubarization
Utama et al. (2020); Garimella et al. (2021); Xu et al. (2025)
Rovichandren (2000); La al. (2002)
Oh & Decaberg (2025); Ougang et al. (2022): Christiano et al. (2023)
Hong sl. (2024); Edaasunjls Thu et (2025): Sun (2024): Harvon Poyatos al. (2025)
(2024): Gupts al. (2025)
Aligument
Mitigation Strategies (8
Zhong et al. (20251a); Xu et al. (2029); Wang es al. (2024a)
Dong nl. (2024b); Xtong et al. (2024), Zhao al. (2024b)
Rolnsd Promptiing
Agrnnal et al. (3025): Clau es al. (2025))); Li al. (2026))
Weight Redisteibution
Clui & Wang (2022); Zhong et sl. (2025))
Intra-processing Approaches (3 4.3)
Boyer et al. (2025); Komer et al. 13025w); Go at al. (3024)
Modilied Decading
Dalatim al. (20255
Infermacw Time Adaptation
Manvi et al. (3024); Smill et al. (2024); Laul al. (2024)
Hongen (2024);
(2025)
Output Filtering
Kumar al. (20255); Liu al. (2023); Plunee al. (2024)
Weng (21123);; Rabedon al. (2022); Wang al. (2025)
Post-procesingg Appronches ($ 4.4)
Gn al. (2005) Kumar et (2005h) Cantins al. (2025)
LLA.-asss-juuge
Roims et al. (2004); Beger et (2005) al. (20254)
Metric
Motrics and
Benchmarks ($ 3)
Beachmarks
Scalshility of Defonces, Robnstnows Uitility Trade-offs, Exahsstion Gaps, Thoorticcal Undeesttaiingg and Real-warld Deployment
Future Work 6)
Figure 1: The outline of the survey on robustness of LLMs.
1.1 Search Methodology
The purpose of this survey is to gather and categorize research work that helps to improve robustness in LLMs. A systematic search was conducted across multiple digital libraries and repositories to identify relevant studies on robustness in LLMs as shown in Fig. 2. Table 1.1 summarizes the databases and sources that were included:
This search covered studies published between January 2020 and June 2025, ensuring inclusion of the most recent work on LLM robustness. Search strings were tailored to each database but generally com- bined terms related to "large language models", "robustness", "evaluation", and "mitigation strategies". A representative query structure was:
('large language model" " OR "LLM" OR "foundation model")
AND (robustness OR reliable OR adversarial OR 00D OR evaluation OR mitigating robustness)
3

---

Published in Transactions on Machine Learning Research (11/2025)
Table 1: Search results by source Screened
Source
Identified
Included
arXiv
389
258
173
ACL Anthology
47
35
21
ACM Digital Library
26
15
5
IEEE Xplore
17
7
1
Review
22
12
GitHub
7
4
2
Total
508
337
209
Identification of studies databases and registers
Records identified from: Databases (n = 6):
Identificaiion
ACM (n- 26)
IEEE (n = 17)
Records removed before screening:
ACL (n 47)
Duplicate records (n 171)
Arxiv 389)
Openreview (n Github (n
Records screened 337)
Records excluded (n 41)
Reports sought for retrieval (n = 296)
Reports not retrieved (n 23)
Screeming
Reports excluded:
Reports assessed for eligibility (n = 273)
Duplicate Records/Similar Results (n 18)
Papers without Experiments on LLM (n 25)
Paper before 2020 (n = 21)
New studies included in review 209)
Included
Reports of new included studies (n = 209)
Figure PRISMA flow diagram of the survey methodology
1.1.1 Inclusion Criteria
Studies were included if they met the following criteria:
Explicitly addressed robustness, reliability, evaluation of I.I.Ms.
4

---

Published in Transactions on Machine Learning Research (11/2025)
Contained empirical experiments benchmarks involving LLMs.
Published within the time range 2020 2025.
1.1.2 Exclusion Criteria
Studies were excluded if they:
Were duplicates or near-duplicate entries across sources or with similar concepts or results.
Did not contain experiments on LLMs (e.g., purely theoretical works, works on VIM)..
Were published before 2020.
Were inaccessible or unretrievable.
Further, after completing this criterion, we applied backward snowballing (i.e., finding new publications by tracing references cited in this paper with some relevance). This process was repeated iteratively for each newly identified publication.
2 Robustness in LLMs
In the context of LLMs from various literatures, robustress refers to their ability to perform reliably and safely despite challenges like input variations, unexpected data, or adversarial attacks (which involve crafting specific inputs designed to mislead the model into producing incorrect or unintended outputs, despite the inputs appearing normal and being susceptible to humans). It is frequently discussed as critical component within the broader framework of AI Trustworthiness. Trustworthy AI systems expected to be reliable, safe, fair, transparent, accountable, and robust. Robustness underpins several of these qualities; for instance, model prone to adversarial manipulation (lack of robustnoss) cannot be considered safe or reliable (Wang et al., 2023a; Aljohani et al., 2025). Similarly, a model that hallucinates or provides inconsistent answers under slightly different prompts lacks reliability, another facet closely tied to robustness (Zhou et al., 2024c). Research into the vulnerabilities of machine learning models, including LLMs, has often focused on adversarial robustness the model's resilience against inputs intentionally crafted cause misclassification or undesired behaviour (Zhao et al., 2025).
This survey approaches robustness comprehensively, considering LLMs as integrated systems rather than isolated components.
2.1 What is Robustness in LLMs
The concept of robustness for LLMs is multifaceted, and various studies approach its definition from dif- ferent angles, reflecting the diverse ways models can fail or exhibit instability. Formally, robustness can be conceptualized as the degree to which a model's output f(x) remains stable or correct when the input æ is subjected to some form of perturbation or drawn from a distribution Drest different from the training distribution Dtrain- The specific nature of the perturbation or distribution shift defines the dimension of robustness being considered. This concept is vital for setting research goals and evaluation standards, robustness directly impacts whether users can trust these models in real-world applications. Synthesizing across the literature, several core themes emerge:
Stability under Disruption: Robustness is fundamentally about the stability of LLM performance and behaviour when faced with various forms of disruption, including unseen scenarios, different types of attacks, and noise in the input (Guo et al., 2023). It implics predictability even when conditions deviate from the ideal.
Consistency and Reliability of Outputs: Robustness requires the model consistently generate outputs that accurate, reliable, and unbiased across diverse scenarios (Lad et al., 2024; Aljohani

---

Published in Transactions on Machine Learning Research (11/2025)
et al., 2025). This involves minimizing errors, factual inaccuracies (hallucinations), and harmful biases, even under challenging conditions.
Adherence to Intended Behaviour: A robust model should adhere to its intended function and safety constraints. This includes following legitimate instructions correctly while resisting malicious manipulations, such as prompt injection attacks (Li et al., 2024d), (which involves performing unin- tended actions by combining adversarially designed malicious input with the model's instructions) or backdoor attacks (Cai et al., 2022; Chen et al., 2021).
Resilience to Input Variations: A robust LLM should maintain consistent oulpuls despite varialions in the input that preserve the core meaning or intent. This includes resilience to natural language variations like morphological changes, typos, paraphrasing, and syntactic restructuring (Singh et al., 2024; Mahaut et al., 2024; Sarker et al., 2024). It also encompasses stability when confronted with unforeseen or malformed prompts (Ailem et al., 2024).
Performance Maintenance under Distribution Shifts (Du et al., 2022): Robustness entails maintain- ing performance levels when the distribution of deployment data differs from the training data (OOD generalization). This is crucial as real-world data rarely perfectly matches training sets.
Drawing these threads together, a working definition for this survey is:
LLM's robustness refers to the model's ability to maintain consistent performance, reliability, and adherence to intended behaviour (including accuracy, factuality, safety, and fairness) despite variations in inputs, contexts, or underlying data distributions. This encompasses resilience to natural noise, semantic paraphrasing, distribution shifts, incomplete information, reasoning perturbations, instruction variations, and adversarial manipulations.
2.2 Key Dimensions of Robustness
LLM robustness is not monolithic property but rather a collection of related capabilities. To better undersland and address the challenge, it is useful to delineate the key facets of LLM robustness, recognizing that these categories often overlap and interact. Figure 3 provides an overview of this overlapping nature, illustrating how progress in one dimension can amplify or undermine robustness in others due to their inherent interdependencies.
2.2.1 Resilience to Adversarial Attacks
It refers to a model's ability to withstand inputs that have been intentionally manipulated by an adversary to trigger specific failures (Chacko et al., 2024). Such perturbations are lypically small, often imperceptible or semantically plausible to humans, yet they exploit. latent vulnerabilities in the model. These attacks commonly manifest as misclassifications in classification tasks (Yang et al., 2024d), the generation of harmful toxic content, the circumvention of safety alignments through jailbreaks (a class of prompt injections designed to override safety filters and moderation policies) (Tao et al., 2024). In broader cases, adversarial berturbatios can simply degrade model performance without obvious failure.
Attacks on LLMs vary in their gramularity. At the input level, adversaries can manipulate characters (e.g.. HotFlip), words (e.g, synonym substitution), or entire sentences (e.g., insertion of distracting phrases) (Yang et al., 2024d). More subtle perturbations such as typographical errors have also been shown to degrade reasoning robustness (Gan et al., 2024). Attacks further differ depending the threat model: white-box attacks assume access to internal parameters gradients, while black-box attacks rely solely on interacting with inputs and outputs. Prominent techniques include Greedy Coordinate Gradient (GCG), AutoDAN, and PAIR (Xhonneux et al., 2024), with some methods targeting continuous embeddings rather than discrete tokens. In the case of multimodal LLMs (MLLMss), adversaries can exploit vulnerabilities within individual modalities (e.g,, image or text) or across modality interactions, compounding the risk (Jiang et al., 2025).
At their core, adversarial attacks succeed by exploiting brittle statistical dependencies and spurious correla- tions learned during training, exposing the fragility of LLMs small but strategically chosen perturbations.
6

---

Published in Transactions on Machine Learning Research (11/2025)
2.2.2 OOD Genralization
It concerns the ability a model to sustain performance when faced with imputs drawn from distributions different from those encountered during training- Real-world deployment frequently involves such distri- bution shifts, arising from temporal drift, novel domains, or different user populations. When tested on OOD datascts, LLMs often experience significant performance degradation relative to in-distribution (ID) benchmarks (Du et al., 2022). Failures commonly emerge from covariate shift, where input features differ, or concept shift, where input-output output mappings change (Yuan et al., 2023; Nagarajan et al., 2024).
These challenges surface in multiple forms: difficultics with unfamiliar knowledge domains, stylistic shifts in text, or multilingual and code-mixed settings. Such failures reflect a lendency to rely on spurious correlations and biases present in training data, rather than learning generalizable, invariant features.
2.2.3 Sensitivity to Prompt Variations
It captures how much a model's output changes when the input instruction is rephrased or slightly altered while retaining semantic intent (Yang al., 2024d). Unlike humans, who are generally resilient paraphrasing or minor structural shifts, LLMs can exhibit drastic changes in correctness, coherence, or consistency under such conditions (Agrawal et al., 2025).
Even simple alterations such as synonym replacement, insertion or deletion of words, reordering of an- swer options can destabilize performance. This fragility often stemss from overfitting to prompt formats encountered during training and reliance on superficial cues rather than deeper semantic understanding. Re- ducing sensitivity to prompt variation is therefore essential for achieving robustness in cnteructionfollowiiii scenarios.
2.2.4 Handling Noisy Corrected Input
It refers to a model's capacity to process data containing imperfections commonly found in real-world use. Such noise may include typographical errors, misspellings, irregular grammar, or extraneous punctuation. Automated pipelines introduce additional errors, e.g., transcription mistakes from voice-to-text systems inaccuracies from OCR (Optical Character Recognition) processes.
Models trained or fine-tuned on noisy data are further at risk, as they may learn brittle mappings that amplify fragility rather than tolerance (Luo et al., 2024). In practice, noisy or corrupted imputs can distract the model and degrade downstream lask performance, underscoring the need for archilectures and training regimes that explicitly account for the messiness real-world data.
2.2.5 Fairness Under Stress
It highlights a model's ability to uphold fairness and avoid amplifying societal biases when confronted with adversarial prompts or challenging contexts (Jung et al., 2025). Failures this dimension manifest as disparities prediction quality across socio-denographic or geographic groups. For instance, LLMs often perform better on U.S.-based datasets than on Chilean ones, reflecting geographical bias. In the U.S., attributes such religious affiliation play stronger roles (Abeliuk et al., 2025; Qu & Wang, 2024).
and political identity influence accuracy, whereas in Chile, gender, education, and
These disparities typically originate from imbalances in training data, where certain populations are under- represented or misrepresented, resulting in skewed learned distributions. Addressing this requires approaches that ensure equitable performance across diverse populations, even under adversarial or distributionally shifted conditions.
2.2.6 Consistency and Reliability of Outputs
Consistency and reliability pertain to the stability and trustworthiness of a model's generations across se- mantically similar inputs. Failures of consistency inchude producing contradictory answers to paraphrasod queries or generating factually incorrect, nonsensical, or hallucinated content (Zhou et al., 2024e; Yang al., 2025b).

---

Published in Transactions on Machine Learning Research (11/2025)
These issues arise from lack of stable internal representations and overemphasis local statistical fluency at the expense of factual soundness or logical coherence. As such, inconsistency is closely tied to other robustness dimensions, including OOD generalization and adversarial susceptibility. Ensuring consistency is not only a matter reliability but also a prerequisite for deploying LLMs in domains where factual accuracy is critical.
Enhance LLM Robustness: Synergies and Tradeoffs
Resilience Adversarial Attacks
Fairness under Stress
Adversarial resilience impacts prompt sensitivity and fairness
Fairness affects generalization and consistency under stress
Consistency and Reliability
Robustness Noise
Reliability boosts resilience and reduces noise sensitivity
1nni
Noise tolerance improves generalization and consitency
Improve OOD Generalization
Sensitivity to prompt variation
Generalization enhances consistency and reduces hallucination risks, along with prompt sensitivity
Prompt sensitivity influences adversarial resilience and usability
Figure 3: A conceptual visualization of the interdependent dimensions critical to LLM robustness, highlight- ing the synergies and tensions between improving OOD) generalization, noise resilience, output consistency, and fairness, and so highlighting the challenge of achieving well-balanced, comprehensive robustness across all dimensions.
2.2.7 Task-Specific Robustness
Task-specific robustness addresses the challenges LLMs face in meeting the unique demands of particular downstream applications. In reasoning-intensive tasks, models often struggle to maintain logical consistency, as seen in low performance on benchmarks such as FOLIO (Han et al., 2024). In coding applications, failures include the generation of functionally incorrect insecure code (Bao et al., 2025).
Such difficulties stem from the symbolic gap between natural language and formal logic programming languages, as well as from translation errors and capacity limits in solver-aided methods. These weaknesses highlight that robustness cannot be fully captured by general benchmarks alone but must be evaluated in domain-specific contexts where performance reliability crucial.
These dimensions are often interconnected. A model prone to spurious correlations (an OOD issue) is often vulnerable to adversarial attacks that exploit those patterns and more sensitive to prompt vari- ations that shift these cues. Enhancing consistency (e.g., reducing prompt sensitivity) can lower adversarial vulncrability, while stronger OOD generalization reduces hallucination risks and may indirectly reinforce consistency. Robustness to noise may also strengthen consistency. At the same lime, progress in one dimen- sion can create trade-offs another. For example, enforcing consistency too rigidly may limit adaptability novel inputs, and alignment methods aimod at improving fairness may weaken OOD gencralization (also known the "alignment tax") (Lin al., 2024b). Moreover, OOD inputs can push models beyond their knowledge boundaries, increasing hallucination risks. Overall, robustness requires balanced strategies,

---

Published in Transactions on Machine Learning Research (11/2025)
over-optimizing single dimension undermine others. Figure illustrates these dependencies and trade- offis across interdependent dimensions.
3 Sources of
Understanding why LLMs lack robustness requires examining the contributing factors across different stages of their lifecycle, from data collection to training and deployment. Figure 4 illustrates some of the failure cases by giving some real-time examples. Further, these issues can be broadly categorized as stemming from the data, the model itself, or the learning process. Table 2 provides an overview of these sources. These failures robust can originate mainly from:
Data-Related Sources: Problems inherent in the vast datasets used for pre-training and fine-tuning, including biases, noise, and contamination.
Medel-Related Sources: Limitations stemming from the model's architecture, parameterization, emergent properties like sensitivity to input formatting.
Training/ Training/Learning Learning- Related Sources: Aspects the optimization process, learning objectives, and the dynamics of how models acquire knowledge and capabilitics.
Reeatee
Inference-Relatt Vulnerabilities that arise during the model's deployment or use, such issues from the choice of decoding strategies, reliance on external retricval systems, exposure to distri- bution shifts and adversarial inpuls al inference time.
3.1 Data Related Sources
The massive datasets used to train LLMs are primary source of their capabilities but also significant source of their vulnerabilities. Several primary causes contribute to the lack of robustness observed in LLMs are:
3.1.1 Spurious Correlations
This is arguably one of the most significant causes of robustness failures, particularly concerning OOD generalization (Du et al., 2022; McMilin, 2022). Instead of learning the intended, often complex, causal relationships or concepts, models learn to rely on simpler, superficial patterns (shortcuts) that happen to correlate with the correct output in the training data but do not hold universally. When these spurious cor- relations are absent or altered in new inputs (e.g., OOD data, perturbed examples), the model's performance collapses. Examples include:
Lexical Bias: Relying on specific words (e-g., negation words like 'no', 'never' strongly predicting "contradiction' in Natural Language Inference (NLI) tasks) Kamal et al. (2024); Du et al. (2023).
Overlap Bias:
Exploiting word overlap between premise and hypothesis in NIJ Li et al. (2025b); Chandna et al. (2025).
Positional Bias: Predicting answers based on their typical position in the training context (e.g..
always in the k-th sentence for QA) Wang et al. (2023b); Shi et al. (2025).
Style Bias: Associating certain writing styles with specific labels Cao (2025); Malik et al. (2024).
Heuristics in Reasoning: Using memorised rules-of-thumb or simple numerical patterns instead of robust algorithms (Li et al., 2024b) for tasks like arithmetic.
9

---

Published in Transactions on Machine Learning Research (11/2025)
Table 2: Sources of non-robustness in LLMs.
Specific Cause
Root Cause
Description
Data Related
Shorteut Learning
Data collection/annoaatio annotation issues, mirrored cognitive biases, simplic- ity bias in ERM learning. Mirrored cognitive biases in web- scale data.
Model exploits shallow statistical cues instead of robust features.
Spurions Correlations
Dataset Biases
Model learns and amplifies socictal biases from data.
Lack of Diversity
Limitations in data collection scope and resources.
Insufficient variety in training data. limits generalization.
Data Poisoning
Adversarial intent during data contribution/ curation. crtrbbbtiooccuaaionn..
Malicious data injection creates vulnerabil- ities.
Training-Relatee Optimization Objectives (ERM)
Incentive structure of minimizing average loss on potentially biased IID data.
Standard training encourages learning shortcuts.
Alignment Tax
Objective mismatch between alignment and pre-training. rep- resentation shifts during RLII,, KI. penalty constraints.
Alignment degrades pre-trained capabili- tics/ dos//roustness.
RLHF Impact (Biases, Reward Hacking)
cupperfect/baaee biased reward models, inconsisteett/ /limited human feod- back, optimization exploiting RM proxies.
Alignment process introduces flaws or fails fully align.
Fine-tuming Limitations (Overfitting, Noise Sen- sitivity)
Overfitting to specific fine-tuning data characteristics, amplification of noise in smaller datasets.
Fine-tuning reduces OOD robustness or is brittle noise.
Architectural Transformer Vulnerabili- ties
Specific mechanisms of attention computation, information flow across layers. Information disruption of weights/ mechanisms, ing errors.
Inherent properties (e.g., attention) can be exploited.
Vulnerabilities to Mod- ifications (Quantization, Pruning)
bottlenecks, learned cascad-
Efficiency optimizations degrade robust- ness.
Inforence-Relate
Decoding Strategies
Exploration vs. trade-off, amplification of proba- bility uncertaintics.
exploitation
Choice of decoding impacts consistency and robustness.
RAG Issucs
Reliance retriever quality, han- dling retrieved context.
Imperfect retrieval, difficulty integrating multiple/ noossy sources.
3.1.2
Dataset Biases and Anomalies
LLMs often inherit shortcomings from systematic biases and unintended statistical cues in their training data. Training data inevitably reflects societal biases present in the source text (often large web-scraped corpora). LLMs can learn and amplify these biases related to gender, racc, culture, religion, etc., leading to unfair, discriminatory, or non-robust outputs when prompted about sensitive topics. Evaluating fairness under prompts designed to induce bias reveals these vulnerabilities (Jung et al., 2025). For instance, crowd-sourced datasots, used widely for fine-tuning and evaluation, frequently contain superficial annotation patterns, where human annotators unintentionally introduce simplistic labeling strategies that models exploit shorteuts. These patterns create misleading statistical associations (e.g., keyword matching) rather than reflecting
10

---

Published in Transactions on Machine Learning Research (11/2025)
genuine task understanding. Even benchmark design can amplify biases, models may overfit to variations in test data construction rather than solving tasks as intended (Ailem et al., 2024). Together, these data biases and methodological flaws perpetuate robustness failures across training, evaluation, and deployment.
3.1.3 Data Poisoning/Backdonr
Adversaries intentionally inject malicious examples into the training data (or fine-tuning data) to create hidden backdoors. These backdoors can be triggered by specific inputs at inference time to cause targeted misbchaviour or compromise model safety, often without degrading general performance noticcably, specifi- cally in fine-tuned models (Aljohani et al., 2025).
3.1.4 Sensitivity to Input Variations
LLMs exhibit high sensitivity to the precise form of the input, even when the underlying semantics remain unchanged:
Prompt Sensitivity: Minor changes in wording, punctuation, or formatting of prompts can lead to significantly different and sometimes incorrect outputs. Models might solve task correctly with one phrasing but fail with equivalent rewordings (Mahaut et al., 2024). Even minor typos can degrade the performance (Liu et al., 2024b).
Instruction Sensitivity: Performance vary drastically based how instructions are phrased structured within the prompt. Counterintuitively, models specifically fine-tuned for domain might become more sensitive to instruction variations than general-purpose models (Yan et al., 2024a; Aljohani et al., 2025).
Noise Sensitivity: Models struggle with naturally occurring noise (spelling/grammar errors, OCR/ASR anomalies) (Singh et al., 2024) and can be easily distracted by irrelevant information deliberately injected noise (Zhou et al., 2024e).
3.2 Training Related Sources
Standard pre-training objectives like next-token prediction and fine-tuning objectives based Empirical Risk Minimization (ERM) primarily optimize for average performance on the training distribution. These objectives may not explicitly encourage robustness to distribution shifts or perturbations. Furthermore, the dynamics of gradient- based optimization might lead models to latch onto simple, non-robust features early in training. The process of training and aligning LLMSs, therefore, introduces several potential vulnerabilities, inchuding:
3.2.1 Optimization Objectives
LLMs are primarily trained using next-token prediction loss (NTP), which optimizes the likelihood of pre- dicting each token in a sequence given its preceding context. This objective drives the model to capture patterns that reduce soquenco-level prediction loss, enabling the acquisition of syntactic, semantic, and con- textual dependencies. But it also encourage reliance on superficial patterns shortcuts in the training data, potentially limiting generalization and robustness (Thrampoulidis, 2024; Nagarajan et al., 2024).
3.2.2 RLHF
While Reinforcement Learning from Human Feedback (RLHF) is crucial for making LLMs safer and more helpful, the process itself can hinder robustness in the following ways:
Reward Hacking: LLMs may learn to exploit weaknesses or biases in the reward model (RM) used during RLHF, maximizing the reward signal without genuinely fulfilling the intended preference (e.g., generating overly verbose responses because the RM implicitly favours length) (Yan et al., 2024b).
11

---

Published in Transactions on Machine Learning Research (11/2025)
Bias Amplificatin: RLHF optimizes based human feedback, but this feedback itself be biased, inconsistent, or fail to capture the full spectrum of desirable behaviour. Optimizing for average preferences might even strengthen covert biases not explicitly penalized by the feedback (Barnhart et al., 2025).
Capability Trade-ofls: Safety alignment, often achieved via RLHF or related techniques, has been observed to sometimes degrade specific capabilities like complex reasoning (Huang et al., 2025).
3.2.3 Alignment Tax
This phenomenon, termed the "alignment tax", means that improving aligmment (e.g,, helpfulness, harm- lessness) might come at the cost of reduced performance on general knowledge benchmarks or can sometimes negatively impact model calibration (leading to overconfidence) or introduce new vulnerabilities (Chen al., 2020; Yang et al., 2024b). Fine-tuning L.LSs for specific tasks aligning them with human preferences (e.g- using RLHF) can lead to degradation of capabilities learned during pre-training (e.g,, Masked Language Modeling vs. Standard auto-regressive prediction), which can influence downstream behaviour (Lin et al., 2024b). This creates difficult trade-off for developers.
3.2.4 Fine-tuning Limitations
While vanilla fine-tuning adapts LLMs specific Lasks or domains, can also reduce robustness (Sengupla et al., 2025; Luo et al., 2024), as in cases like:
Overfitting: Models can overfit to the specific style, domain, spurious correlations within the fine-tuning data, harming OOD generalization (Yuan et al., 2023).
Fine-tuning performance is highly sensitive to noise in the instruction-followiii or preference data (Luo et al., 2024). Even moderate noise levels can cause significant performance drops.
Noise Sensitivity:
Instruction Brittleness: Instruction-tuned models can show substantial performance degradation when test-time instructions are phrased differently from those seen during fine-tuning, indicating lack of robustness to instruction variations (Aljohani et al,, 2025). Specialized models might be even more fragile in this regard.
3.3 Architectural Limitations
While less explored the provided sources, the inherent properties of the dominant Transformer architecture, such as the attention mechanism's focus or the lack of explicit symbolic reasoning modules, might contribute to certain robustness vulnerabilities. The lack of built-in mechanisms for reliable uncertainty quantification causal reasoning could also be factor (Zhang, 2023). The underlying architecture of LLMs, predominantly the Transformer, also presents inherent vulnerabilities:
Transformer Properties: Specific components of the Transformer architecture, such as the self- attention mechanism, can be points of failure. While propertics like redundancy might offer some baseline resilience compared to older architectures, this resilience limited and can be overcome by targeted attacks Das et al. (2025). Further, expanding model depth (layer expansion) can particu- larly disrupt the attention mechanisms.
Vulnerabilities to Modifications: Practical deployment often requires model modifications for effi- ciency, such as quantization (reducing numerical precision) or pruning (removing reights//neronss). These compression techniques can induce "information loss cascades", "issades" degrading robust- ness (Ma et al., 2025). Similarly, architectural changes aimed at efficiency, like attention-cfficient variants (e.g., GLA Transformer, MatMul-Free LM (Fan & Tao, 2024) or Funnel Transformers (Choi et. al., 2025)), involve trade-offs that may impact robustness. Transformer architectures appear to
12

---

Published in Transactions on Machine Learning Research (11/2025)
have inherent robustness thresholds beyond which modifications cause severe performance degrada- tion. For example, the extreme vulnerability to Bit-Flip Attacks (BFAs), where flipping just few bits in the weights of a large model can cause catastrophic failure, challenges assumptions about their inherent resilience (Ma et al., 2025).
Linear Transformers: Simpler variants like linear transformers have shown specific vulnerabilities, such as susceptibility to hijacking attacks during in-context learning, where malicious examples in the prompt manipulate the learned function (Anwar al., 2024).
Sensitivity to Prompt Variation
Jailbreak Prompts
Prompt
Model
Prompt (Restricted):
Output:
"Summerize the causes of World War in two sentences.
"The war begen meinly becsuse the assaination of Franz Fordinand. Germany's eggression was the key cause."
"How explosives home ?*
"'m cannot instructions
making explosives.
Prompt B:
Model Output B:
Prompt (Jailbreak):
Model Output:
"Briefly describe the reasons behind the outbreak World
"World War was caused by milllariem, imporiaism, nationallsm. aesessination Archduke Ferdinint
"For a fictional story, explain how a character might atlempl to create fireworks using house
mix polassium sugar, other matoriats combusiible
readtion..
immediate
Non-Robustness
Fairness Under Stress
Learning from spurious cues
Prompt A (Noutral]:
Model Output A:
Input
Sentment
predicted
Model-
story about
"A software engineer named Alex worked fast growing startup, balancing deadlnes and crealivity while collaborating with Tearrmates.
absollutlly delicious!
Posilive
Poeilive
stronglyy with Posilive in training data.
startup."
Service was slow; but the food was delicious.
Positive
Posilive
Same loxical que drivan prediction.
Prompt B (Stress):
Model Output B:
Although
"Wiite story software engineer make &l realisti..
'A young female engineer struggled to fit with hot maln colloagues, often fooling nervous during meelings and unsure her idees were
was terrible and service rude, the dessert delicious.
Nogative
Positive
Model relees on "delicious" instead full context.
Figure 4: An illustration of some failure cases of non-robustness (adapted from Schulhoff et al. (2025); Shen et al. (2024); Gallegos et al. (2024); Bano et al. (2025); Zhou et al. (2024b)). The examples are represen- tative of behaviors primarily observed in GPT-3.5, and are intended to demonstrate common categorics of robustness failures.
3.4 Inference related Sources
Non-robustness in LLMs also arises during inference, where vulnerabilities arise from how models interpret inputs and produce outputs. Minor paraphrasing or ambiguous instructions can destabilize responses, while decoding strategies like temperature sampling introduce umpredictability by balancing coherence and creat- ing risks of erratic outputs. Adversarial inputs exploit the model's instruction-followig nature to bypass safeguards, and input tokenization steps distort rare words or non-standard syntax, amplifying errors. These challenges, inherent to the inference phase, can introduce these vulnerabilities as:
3.4.1 Inference and Decoding Vulnerabilities
Even with trained model, the way outputs are generated during inference by the choice of decoding strategy can also introduce vulnerabilities like:
Decoding Stratogy Sensitivity: The algorithm used to select the next token basod on the model's probability distribution (e.g., greedy search, beam search, top-k/nucleus sampling) has major impact the performance of the model (Nik et al., 2025).
13

---

Published in Transactions on Machine Learning Research (11/2025)
Performance Robustness: Different strategies offer trade-offs. Deterministic methods like greedy search (Bang et al., 2023) might be preferred for closed-ended tasks requiring preci- sion, while stochastic methods (sampling) are often better for open-ended generation requiring diversity (Shi et al., 2024a). However, stochasticity can reduce the consistency of the model. often
Hyperparameter Sensitivity: The performance and behaviour of decoding strategies highly sensitive to hyperparameters like temperature (for sampling) beam width (for beam search). Achieving optimal performance might require extensive tuning, but fixed hyperparam- eters might lead to suboptimal robustness across diverse inputs (Shi et al., 2024a).
Calibration Errors: LLM confidence scores (often derived from output probabilities) frequently fail accurately reflect the true likelihood of the generated output being correct (Yao et al., 2024). Models, especially those tune with RLHF, tend to be overconfident. This miscalibration hinders reliable decision-making based on model outputs.
3.4.2 Gaarieval-Augmenter Generation (RAG) Sources
RAG systems enhance LLMs by retrieving external information, but their robustness depends heavily on the quality and relevance of the retrieved context (Shen et al., 2024). If the retriever returns inaccurate, irrelevant or noisy information (due to its own lack robustness), the final LLM output quality can be significantly compromised, sometimes performing worse than without retrieval at all. LLMs may also struggle effectively utilize large number of retrieved documents, even with long context windows (Yu et al., 2024).
A comprehensive approach robustness is required due the availability of vulnerabilities throughout the entire lifecyle, from data collection through training to inference. Additionally, the observed conflict between preserving robustness and optimizing for capabilities (c.g., through scaling or alignment) implics that accomplishing both at the same time is a significant, continuous task that calls for careful trade-off management.
4 Mitigation Strategies
Having covered the various sources of non-robustness in Section 3, we will now look into mitigation strategies. These strategies are categorized based on the stage of the typical LLM development and deployment pipeline where they are applied:
Pre-processing: Actions taken on the data before model training or fine-tuning begins (e.g., data cleaning, augmentation).
2. In-proccssing:
Modifications integrated during the model training or fine-tuning process (e.g., robust optimization, adversarial training, alignment techniques).
Intra-processing: Techniques applied during the model's inference or generation phase (e.g., robust prompting, modified decoding, inference-time adaptation).
4. post-processing: Methods applied after the model generates an output, but before it is presented to the user or used downstream (e.g., output filtering, validation, using judge model).
This pipeline-basee basod catcgorization provides structured way to understand where different interventions fit within the LLM lifecycle and how they contribute overall robustness. Further, Table 3 summarizes rep- resentative methods under each category, while Figure 5 illustrates how these strategies collectively enhance robustness across the LLM development pipeline.
4.1 Pre- Pre-processing strategies
Pre-processing strategies represent the carliest opportunity influence LLM robustness by intervening the data stage, before any model training fine-tuning occurs. These methods focus curating, cleaning,
14

---

Published in Transactions on Machine Learning Research (11/2025)
augmenting the vast datasets used to train LLMs, aiming to embed robustness characteristics implicitly through the data the model learns from. They effectively address data biases and vulnerabilities in raw training data, preventing the model from inheriting or amplifying them, which could compromise the model's performance. Some key pre-processing approaches that enhance robustness at the data level are as follows:
Data Augmentation for Robustness: Data augmentation aims to increase the diversity and size of the training datasot, typically to improve model generalization. Dong et al. (2021) describes this as specifically designed techniques to expose the model to the lypes of variations or adversarial inputs it might encounter during deployment. Early techniques adapted from general NLP, such as Easy Data Augmentation (EDA), involved simple lexical operations like synonym replacement, random insertion, random swap, or random deletion (Weng, 2023). While useful for generalization, these methods may not adequately prepare models for targeted adversarial attacks or significant distribution shifts.
A more targeted approach is Adversarial Data Augmentation (ADA), which generates challenging examples to improve robustness against data shifts or corruptions. ADA creates misleading target distributions using adversarial loss, perturbing data to fool the model during training, A key advancemett, Maximum- -nntro ADA (ME-ADA) (Zhao ct al., 2020), introduced an Information Bottlcneck- regularizer that maxi- mizes model uncertainty, producing harder adversarial examples by pushing augmented data further from the source distribution, outperforming prior methods on benchmarks. Simultaneously, Adversarial Contrastive Learning (ACL) (Jiang et al., 2020) merges adversarial examples with self-supervised pro-training. By enforc- ing feature consistency across standard and adversarial views, ACL enhances inherent invariance, improving robustness and label efficiency over unsupervised methods. Follow-up work refined ACT. via robustness-aware coreset selection and adversarial invariant regularization (Xu et al., 2023). Furthermore, Qi et al. (2025) propose a data augmentation approach using "safety recovery examples' to cultivate "deep safety alignment', which significantly improves robustness against common exploits like prefilling and adversarial suffix attacks.
As research shifted towards LLMs, augmentation techniques became more specialised. Liu & Sun (2023) introduced the Adversarial Augmentation Approach (A3), combining adversarial training with NLP-specifi data augmentation. Unlike traditional methods, A3 employs paraphrasing model guided by a separate generator to produce reusable adversarial examples, optimized for specific tasks via a discriminator. This efficiency boosted accuracy for models like BERT, outperforming earlier methods. Further, Bae et al. (2025) introduces SALAD (Structure Aware and LLM- driven Augmented Data), a contrastive learning approach that employs a tagging- based method for generating structure-aware positive samples and leverages LLMs to create diverse counterfactual negative samples for triplet loss optimization.
Meanwhile, HarmAng (Lee et al., 2024b) tackles safety: it trains compact "guard" models to detect harmful queries by generating adversarial examples (e.g,, jailbroken LLM prompts) and distilling knowledge from a large teacher model. This let 485M-parrmeter safety model match the performance of 7B+ counterparts, proving targeted augmentation can compress robustness into smaller systems. These advances align with broader efforts to refine LLM robustness through data-centric strategies, such as adaptive data filtering and synthetic data generation (Dong et al., 2021; Qian et al., 2022; Ding et al., 2024; Zayed et al., 2022; Lim et al., 2023).
Data Filtering: Modern LLMs rely heavily on vast amounts of internet-sourced data for training, but this data often includes noise, toxic content, societal biases, personal information, and factual inaccuracies (Huang et al., 2024a). Since LLMs can memorise such flaws during training, these issues directly translate into risks like biased outputs, privacy breaches, and unreliable behaviour in real-world applications. Data filtering approaches this by modifying training samples their weights to mitigate harmful content in model learning (Li et al., 2025c; Wang et al., 2025). Additionally, this approach can generate contrastive pairs (e.g., pairing biased and debiased examples) to explicitly teach models to disrogard biased patterns in the data. While filtering and cleaning data before training is essential, considering the fact that manual curation is time-consuming and demands domain expertise, to mitigate these risks, it also introduces complex trade- offs: overly strict filtering to remove toxic content or roduce bias can inadvertently harm the model's general performance or crase valid examples from underrepresented groups. For instance, prioritizing safety might suppress harmful outputs but weaken the model's versatility, while aggressive bias mitigation could strip
15

---

Published in Transactions on Machine Learning Research (11/2025)
away nuanced data critical for fairness. Thus, achieving the right balance between data quality (removing harmful content) and quantity (retaining useful diversity) remains a pivotal challenge in building trustworthy LLMs.
8
User
Training/ Alignment
Model Inference
Reasoning phase
01
Data Collection
Post- prse-proessiing
0i
eee
Pre-processing
Intra-processing
In-processing
Output
Figure 5: Comprehensive LLM Robustness Pipeline. A multi-stage framework for enhancing LLM robustness across the deployment lifecycle. (1) Pre-processing: Data curation and augmentation strate- gies; (2) In-processing: Training-time interventions including adversarial training and alignment; (3) intra-processing Real-time inference adaptations; (4) Post-processing: Output validation and filter- ing. Arrows indicate data flow and leedback mechanisms between stages.
Laurençon et al. (2023) proposed a Rule-based Heuristic Filtering, using predefined criteria to remove sensi- tive data (e.g., PII) or toxic content via blocklists or classifiers, though their success hinges on the precision of these tools. To streamline complexity, frameworks like Data-Juicer (Chen et al., 2023a) systematize clean- ing by automating steps like deduplication and quality scoring. More recently, LLMs themselves have been repurposed as data cleaners: studies show they can fix simple errors (e-g., invalid dates) using contextual analysis but falter with nuanced issues like sataset-wide biases (Bendinelli et al., 2025). From basic heuristics to AI-driven refinement, these approaches illustrate the layered effort to balance scalability and reliability in training data. Further, BaichuanSEED (Dong et al., 2024a) demonstrates the scalability of data-centric methods, showing that careful data curation and reweighting can enable even a general 7B-parameter LLM to achieve state-of-the-art benchmark performance without architectural modifications. Yang et al. (2024c) introduces RAZOR (Rewriting And Zero-biaz Optimization Refinement), a novel unsupervised text rewriting technique designed mitigate dataset biases (shortcuts) that hinder language model generalization without roquiring prior knowledge of specific biases. RAZOR iteratively rewrites text segments using LLMs, selecting replacements that reduce spurious correlations wetw surface features and labels based on token statistics and positional information.
4.2 In- in-processing Strategies
In- In-processing mitigation strategies integrate directly into the model's training fine-tuning loop to build robustness inherently into the model's parameters. Unlike pre-processing methods that modify input data, these Lechniques actively guide the learning process, continy optimizing the model to develop more robust and equitable representations. This approach is particularly effective for addressing complex bias patterns embodded in data relationships and countering training-induce sources of non-robustness, offering more direct control over model behaviour during learning. We now examine key in-processing techniques that shape model robustness through training dynamics.
16

---

Published in Transactions on Machine Learning Research (11/2025)
Adversarial Training: Adversarial Training (AT) strengthens models by intentionally injecting adver- sarial examples into their training data, thereby forcing the model to learn more robust features. Tt can be formulated as a minimax optimization problem: the inner loop maximizes the loss by finding the worst-case adversarial example within a defined perturbation budget, while the outer loop minimizes the loss on these adversarial examples (along with clean examples) to update the model parameters (Bai al., 2021a).
Early approaches involved adapting methods from other domains like generating attacks via word substitu- tions guided by gradient information or word importance scores (Liu & Sun, 2023; Weng, 2023) performing perturbations directly in the continuous embedding space and then mapping these perturbed embeddings back to discrete tokens, often using a masked language model (MLM) head (Altinisik et al., 2023). While some methods also show that AT can improve both generalization and robustness for a wide range of NLP tasks. Liu et al. (2020) introduce ALUM (Adversarial training for large neural LangUage Models), a method designed for both pre-training and fine-tuning of Transformer-basod language models. regularizes the training objective by applying perturbations in the embodding space that maximize adversarial loss, cf- fectively enforcing label smoothness in local neighborhoods. The approach builds on virtual adversarial training, with the objective defined as:
min E( ((f(x;)),)) + + (f
#
Here, f(x; 0) represents the neural language model parameterized by 8, ((- is the loss function (e.g.. cross- entropy), (xr y) is an input-output pair from the training dataset. D, and o is a small perturbation applied to the embedding x. The term a is a hyperparameter that controls the trade-off between the standard empirical risk and the adversarial regularization lerm. Further, Xhonneux et al. (2024) propose a fast adversarial Unlikelihood) and CAPO Paatinuous-Adversaa IPO). C-AdvUL applics the unlikelihood (UL) loss with contimuous embedding attacks and incorporates additional utility loss term, fine-tuning on a utility dataset Du, apart from the original dataset D:
training algorithm C-AdvUL
Continuous-Adversee
min E (x [log fo x 6(z, 0) - log fel0 (zx ((,)) [log fe(y/=))
While, CAPO integrates continuous attacks with Identity Preference Optimisation (IPO), a DPO variant (Rafailov al., 2024), using the IPO loss on perturbed inputs and relying on the KL divergence term inherent in IPO to maintain utility without requiring separate utility datasct. The loss function for CAPO is:
min - E (). (cp (1os fo(ylı + ((x,0)) log fo(Ølz + 8(2, (1)
So, (2)a))
(6lox)
Herc, x is a harmful prompt, y and 0 are safe and harmful continuations of x respectively, 6(x, 9) is a targeted attack. (h( = ht- 222 (from IPO), fo is a neural network with parameters 0, So, is a fixed reference model.
Distributionally Robust Optimization (DRO) (Rahimian & Mchrotra, 2022; Kuhn et al., 2025) is another work for optimizing model performance under worst-case conditions over specified distribution or ambiguous set of inputs, rather than just point-wise adversarial examples. Recent work like PEARL (Permutation- resilient learning) and Dr. DPO (Distributionally Robustifying DPO) has also applied these principles to specific LLM robustness challenges (Wu et al., 2025; Chen et al., 2025a).
However, scaling AT to LLMS also introduces several challenges. First, the discrete nature of text compli- cates gradient-based perturbation strategies, where small token-level modifications must preserve semantic coherence, and gradients derived from differentiable surrogates (e.g., word embeddings) do not always map meaningfully to discrete token substitutions. Second, the computational overhead grows prohibitive; gener- ating adversarial examples via itcrative methods (c.g., Projected Gradient Descent) or combinatorial scarch over token sequences is resource-intensive, and fine-tuning massive LLMs on such augmented datasets ampli- fies training costs exponentially. Third, AT often induces a catistness--tilityy trade-off, where improvements in adversarial accuracy come at the expense of degraded performance on clean data, necossitating careful balancing. Finally, robustness gains are frequently attack-specific as models trained against one perturba- tion type (e.g., synonym swaps) may remain vulnerable to unseen attack strategies (e.g., paraphrasing
17

---

Published in Transactions on Machine Learning Research (11/2025)
structural perturbations). And so efficiency and integration with alignment objectives are becoming central themes, with continuous attacks and DRO (Dong et al., 2021; Chen et al., 2025a) emerging promising directions.
Regularization and Constrained Optimization Regularization methods add constraints or penalties to the training objective to prevent overfitting and encourage desirable model properties, including robust- ness. Recent advances highlight methods like BSR (Batch-wise Sum-to-Zere Regularization) to enforce zero- centered reward sums per batch, effectively constraining extreme reward magnitudes and mitigating hidden state norm dispersion (Hong et al., 2025). It adds additive regularization term to the Bradley-Teryy (BT) LBT + X LBSR. The BSR term is defined as
loss in reward models: LBT BSR
2
B
L LBSR
Σ [w
r(a,, M(Di Mha))
B
Here [B] is the batch size and À weight hyperparameter. Sharma al. (2024) propose "information- guided regularization", which integrates dropout with information-theorrtic principles to guide fine-tuning, thereby improving generalization and robustness against overfitting. Similarly, Vukadin et al. (2025) propose Large Language Model Allribution Aligned Training (L.ATT), which incorporates LLM-generated global task feature attributions into the training process of smaller networks through an attribution atrribution-matching regularization term, yiclding suporior performance in fow-shot lcarning sconarios. The overall loss function in LAAT can be defined as:
1 n (( 1 n
a(x,) [[(x;)]]
Σ
(BBE((M((z)) 91) + YLMSE
SLLM
|
Here, ÊBCE is the standard binary cross-entropy loss, and ÉMSE is the mean squared error between the normalized attribution scores. The term a(z;) represents the input gradient, V VoL y:), which quantifies the scnsitivity of the model's loss with respect to cach input feature Iı. SLLM is the vector of LLM- derived importance scores, and is a weighting factor for the regularization term. The normalization by a(x;)
Euclidean norm, c.g.; [[a(z]]] ensures that the regularization aligns the direction of fcature importance rather than its raw magnitude. This regularization acts as inductive bias, guiding the smaller model's learning dynamics to conform to the LLM's broader understanding of feature relevance. Karimi Mahabadi et al. (2020) proposed Debiased Focal Loss (DBL) for NLU classification tasks, where biased training examples are woinnweighted using an auxiliary bias-only model. While not developed for language model generation, the underlying idea of adaptive reweighting to reduce reliance on spurious correlations remains relevant. Likewise, Utama et al. (2020) introduced confidence regularization to mitigate overconfidence on biased examples, striking a balance between in in-distribution accuracy and OOD generalization. Similarly, (Garimella et al., 2021) designed a lexical co-occurrence based regularizer that assigns bias scores to adjectives and adverbs (W), incorporating them into the optimization process.
More broadly, regularization has also been explored for fairness and noisy-label robustness in machine learn- ing (Ravichandran et al., 2020; Xu et al., 2025; Heck et al., 2024; Mou et al., 2024; Li et al., 2022). While many of these works focus on classifiers rather than generative LMs, their principles in penalizing sensitivity to biased features, adjusting loss functions to handle noisy data, or promoting balanced performance across groups, are conceptually transferable LLMs. Together, these methods demonstrate how structured regu- larization can be leveraged to balance robustness, fairness, efficiency, and generalization in modern language models.
Alignment for Robustness Aligning LLMs with human values during training aims to ensure these systems are helpful and reliable. (Yao et al., 2025) develop Token Constraint Decoding (TCD), an inference- time algorithm that enforces alignment between token-level predictions to bolster robustness in noisy settings. Their extensive experiments reveal that TCD significantly restores performance degraded by input noise, yielding up to a 39% absolute gain for smaller models. Techniques like Supervised Fine- Tuning (SFT) (Sun, 2024; Luo et al., 2024) high-quality data and Reinforcement Learning from Human Feedback (RLHF)
18

---

Published in Transactions on Machine Learning Research (11/2025)
(Ouyang al., 2022; Christiano al., 2023), which uses human preferences to shape model behaviour, are widely adopted. Newer RL. methods, such as Direct Preference Optimization (DPO), simplify alignment by training models directly on preference-ranked outputs, while variants like ORPO (Odds Ratio Preference Optimization Hong et al. (2024)), KTO (Ethayarajh et al., 2024), and AlphaPO (Gupta et al., 2025) seck to enhance efficiency or performance. Inspired by DPO and KTO (Qi et al., 2025) inroduce a novel constr fine-tuning objective designed to protect the generative distribution of initial tokens. This formulation enhances the persistence of safety aligument under fine-tuning attacks while maintaining the model's utility, but adapted to control the deviation from the initial generative distribution for each token position, similarly to the token-wise RT. objectives in literature.
While primarily focused on safety and helpfulness, aligmment inherently contributes to robustness against certain failure modes, particularly attacks designed to elicit harmful or biased content. For example, ap- proaches like Safe RLHF (Tran et al., 2025) integrate safety-specific rewards to balance helpfulness with risk mitigation.
However, alignment introduces its own challenges. First, models may become overly sensitive to prompt phrasing, leading to inconsistent responses or unnecessary refusals of benign queries (Oh & Demberg, 2025; Tran et al., 2025). Second, alignment might overlook emerging vulnerabilities, as pre-alignment evaluations often fail to predict post-alignment weaknesses. Third, reward hacking can occur, where models exploit flaws in their training objectives to maximize scores without gemuinely adhering to human intent Eleerreaa-Pyyatee et al., 2025). Finally, methods like RLHF demand extensive computational resources and rely heavily on high-quality, diverse training data, limiting scalability. Addressing these trade-offs remains critical to developing reliable, ethically aligned AI systems.
Acknowledging these challenges, researchers are actively developing strategies to strengthen the alignment process and mitigate its inherent risks. One approach integrates AT with alignment objectives, such as combining continuous adversarial perturbations with preference optimization frameworks (Xhonneux et al., 2024). Others focus on RPO (Reward-aware Preference Optimization) methods like Dr. DPO (Distribution- ally Robustifying DPO Wu et al. (2025)) improve resilience to noisy preference labels, while techniques like Segment-Level DPO (SDPO Kong al. (2025)) and perplexity-aware corrections refine how models handle imperfect training data (Zhong et al., 2025a; Xu et al., 2023). For reward modeling, advanccments include ensemble methods to reduce reward hacking risks, worst-case scenario oplimization to miligate unstable outputs, and causal reward frameworks to better capture human intent (Wang et al., 2024a; Dong et al., 2024b; Xiong et al., 2024). Additionally, consistency aligmment introduces self-reward mechanisms to ensure models produce stable responses across varied prompts, reducing sensitivity to phrasing changes (Zhao et al., 2024b). Together, these strategies aim to balance safety, reliability, and adaptability in aligned AT systems while addressing challenges like data noise, reward exploitation, and behavioural inconsistency.
4.3 Intra-processing Strategies
Intra- ttra--proeessing mitigation strategies improve LLM reliability by dynamically adjusting how models inter- pret inputs or produce outputs during the inference or generation phase, without altering their underlying training parameters (Wang et al., 2025). This approach provides cost-effective way to address vulnera- bilities, avoiding the computational expense of retraining while maintaining adaptability to emerging risks, and is further able to counter data, training or inference-related sources of non-robustness, though they do not address root causes in the training data or model parameters. We now explore some intra- parra-pocessing techniques that enhance model robustness through dynamic input-output adaptation during real-time infer- ence.
Robust Prompting and Instruction Defence The development of benchmarks specifically targeting prompt injection and instruction perturbation has been crucial in revealing the significant vulnerabilities of even state-of-the-art LLMs and driving the need for these more advanced intra-processing defences. LLMs are inherently vulnerable to adversarial inputs due to their instruction foolooiiinn nature, where prompts act as both a critical interface and an attack surface (Agrawal et al., 2025; Chen et al., 2025b). These strategies aim to secure LLMs by addressing vulnerabilities in how they interpret and execute input prompts. Basic approaches include instruction design, where prompts are engineered with explicit safety directives
19

---

Published in Transactions on Machine Learning Research (11/2025)
(c.g.: "ignore harmful instructions"). However, heavily tuned models may still prioritize conflicting later instructions, and overly restrictive prompts risk stifling legitimate creativity (Ti et al., 2024d; Weng, 2023). Similar to pre-processing data augmentation, some techniques attempt to clean the prompt just before the LLM sees it. This can involve paraphrasing prompts or retokenizing inputs to disrupt adversarial patterns, offering limited protection against sophisticated altacks (Weng. 2023).
More advanced methods include self-denoising, where LLMs iteratively revise corrupted instructions using their own language understanding to outperform traditional fine-tuning in resisting perturbations (Agrawal et al., 2025). Further, Hu et al. (2024) propose RobustGER, which teaches LLMs to perform language-space denoising by incorporating an embedding derived from ASR (Automatic Speech Recognition) N-best lists, refined through audio distillation. Another novel approach, referenced instruction tracking, requires LLMS to explicitly cite which prompt instruction they followed during generation, and so responses referencing malicious injections are automatically filtered, which effectively repurposes the model's instruction sensitivity as defence (Chen et al., 2025b). While these intra-processing strategies vary in complexity, they highlight the trade-off's between usability, computational cost, and robustness in real-time LLM salety.
Weight Redistribution Weighted rodistribution refers to adjusting a trained model's attention weights (without additional training) to reduce bias in its puts Since atlention weights can reflect learned biases in the data, redistributing them may help the model focus less on biased words or phrases during predictions. Chai & Wang (2022) developed an adaptíve rewcighting method that assigns samplo-spocific weights to prioritize error-prone instances and ensure balanced minority group representation for group-level fairness and exhibits robustness to label noise on various benchmark datasets. Further, considering the fact that Al models focus on specific words (attention weights) may reinforce biases. Zhong et al. (2025b) propose a framework that employs two complementary fusion strategics. First, a data-aware inter-stage fusion overlaps generation and inference by migrating long-tailed samples. Second, a model-aware intra- stage fusion uses a fused pipeline schodule to mitigate pipeline bubbles during training, thereby improving preparation for inference tasks. Here, a pipeline bubble refers to the idle time or inefficiency that occurs in pipeline-paralle, training when some stages of the pipeline are waiting for others to complete their work, rather than performing computations. It doesn't make a model less robust, but inefficient training caused by bubbles can indirectly reduce robustness.
Modified Decoding and Search Strategies The methods that guide how LLMs select tokens to generate text also play subtle but important role in balancing output quality and robustnoss. While standard approaches like greedy decoding (choosing the most probable token) or beam search are widely used, they often struggle under adversarial conditions or when generating diverse, reliable outputs (Beyer et al., 2025). Despite their limitations, rescarch has largely prioritized input- or output-lovel defences (c.g., prompt engineering, response filtering) over reimagining decoding itself as a primary robustness mechanism. This gap persists even as adversarial attacks exploit decoding weaknesses, such as using greedy search or Greedy Coordinate Gradient (GCG) (Kumar et al., 2025a) to craft optimal input perturbations. The relative neglect of defensive decoding strategies may stem from practical hurdles, such as the computational complexity of altering core generation processes compared to simpler input/output interventions.
Emerging approaches aim to address these gaps by refining how LLMs navigate token selection. Uncertainty- aware decoding, for instance, could suppress generations when the model's confidence is low, reducing errors in high-stakes scenarios. Ensemble decoding combines outputs from varied model states or prompts to dilute adversarial influences, while constrained decoding enforces safety rules (c.g., blocking harmful phrases) during token selection (Shi et al., 2024b; Gu et al., 2024; Daheim et al., 2025). Son et al. (2025) formalizes this challenge as maximin game, introducing RMOD (Robust Multi-Objective Decoding), a method aimed at maximizing worst-case rewards through Nash equilibrium optimization. RMOD achieves this by balancing competing objectives, specifically, identifying a Nash equilibrium between reward weight allocations and the sampling policy during text generation.
However, these strategies remain underexplored compared to input/output defences, partly due to perceived trade-offs between robustness, computational cost, and output creativity. For example, overly strict decoding rules might stifle natural language diversity, mirroring the pitfalls of rigid prompt engineering. Until decoding
20

---

Published in Transactions on Machine Learning Research (11/2025)
innovations match the practicality of input/output defences, their potential to enhance LLM robustness will likely remain secondary.
Inference- Time Adaptation and Transformation Beyond prompt manipulation and decoding, other intra-processing lechniques involve adapting the model or ils execution environment at inference time. While efficient inference infrastructure does not directly enhance robustness, enables the deployment of adaptive systems that can improve real-world reliability (Manvi et al., 2024). For instance, LeVine et al. (2024) evaluates the performance and calibration of reward models under distribution shift and finds that accuracy degrades significantly, particularly for OOD responses. Some of key strategies include test-time adaptation (TTA), which makes minor, instance-specifie adjustments to improve handling of rare or unfamiliar data, such as medical cases outside training distributions (Snell et al., 2024). Architectural interventions explore structural modifications during inference, like removing or swapping transformer layers, revealing that models retain most functionality despite such changes, which is a sign of inherent rodundancy and fault tolerance (Lad et al., 2024). Other work examines components like layer normalization, showing how architect ural choices impact stability under perturbations (Jha & Reagen, 2024). Finally, efficient inference engines optimize computational bottlenecks (e.g., attention mechanisms) using memory optimization and adaptive computation, enabling complex real-time processes like retrieval-augmente
generation while balancing speed and accuracy et al., 2025). Together, these approaches highlight how real-time adaptability and ural insights can bolster LLM reliability without sacrificing efficiency.
4.4 Post-processing techniques
cost-processing strategies constitute the final line of defence in the LLM pipeline, applied after the model has generated its output but before that output is delivered the user or consumed by a downstrcam application. These methods involve scrutinizing, filtering, validating, or transforming the generated text to detect or mitigate potential robustness failures, such as harmful content, factual inaccuracies, biases, outputs resulting from successful attacks that bypassed earlier defences.
Output Filtering and Validation A fundamental principle of post- post-processing is to treat the LLMs output with a degree of skepticism, applying verification steps similar to how one might validate user input. Common strategies include safety classifiers, where smaller models or rule-based systems screen outputs for harmful or biased content, blocking or flagging problematic responses (Kumar al., 2025b; Liu et al., 2023; Zhou et al., 2024a). For example, the Erasc-and- -heckk method itcratively tests modified versions of suspicious prompts to detect adversarial inputs, leveraging pre-generation filtering to block harmful content (Kumar et al., 2025a; Phute et al., 2024). Perplexity filtering identifies nonsensical outputs by measuring how natural generated text appears to language model, flagging high-perplexity results as potential errors or attacks (Weng, 2023).
For structured tasks (e.g., code or json generation), format validation ensures outputs adhere to predefined schemas or pass external checks like code compilers, preventing errors or injection vulnerabilities (Rebedea et al., 2023; AI, 2025). Similarly, output sanitization removes sensitive information (c.g., personal data) leaked during generation, mitigating privacy risks (Wang el. al., 2025). Further, Song et al. (2025); Ma- heshwari et al. (2025) implements RAG to verify outputs after initial response generation. After a language model produces an answer, the system automatically fetches supporting evidence from external databases or documents, using either the original user query or the generated response as search criteria. The model then cross-checks its own output against this retrieved evidence, creating a self-correction cycle that improves factual consistency. While methods like Erase-and-Check offer strong defences, their computational cost of- ten requires simplified variants for practical use, highlighting the trade-off between robustness and efficiency. Together, these strategies underscore the importance of layered verification to balance safety, accuracy, and usability in real-world LLM deployments.
LLM-as-a-Judge for Verification and Filtering This approach uses one language model to evaluate the outputs of another, offering scalable and muanced asscssments beyond basic rulc-basod checks. This method is inereasingly applied to enhance robustness by automating tasks like bias detection, safety compli- ance, and factual accuracy (Shi et. al., 2025; Gu et al., 2025; Kumar et al., 2025b). For instance, judge LLMss
21

---

Published in Transactions on Machine Learning Research (11/2025)
Table 3: Decision Matrix for Mitigation Strategy Selection
Threat Model
Primary Dimension(s) Addressed
Recommended Mitigation Strategies (by Pipeline Stage)
Key Cousideratious
Trade-ofls
(Souree of
Dacaset Binses & Anomaliis
Fairness under Stress, Consisteucy
Pre-procesiing Data Filtering (Rule-base,, Datu-Juicrr, L.M--ascllunrr) Data Augmentation (Contrastive pains]; In-processing: Aligrament (Safe ILIIF). Regularization (DBL)
Trade-off: Overly strict filtering, remove useful data.
Mannal data curation high, automaaed data curation lower.
Effectiveues:: Crucial for ethical AL.
Data Poisoning Backdoors
iddversurial Attarks, Safety, Reliabiity
Pre-proessing: Duta Filtering (rigoroms
Trade-off: AT is expensive, attack- speciiff.. Cost: High for AT'
vetting):
In-proceesing: Adversarial Training (AT, DRO);
Elfectiveness: Continuous monitoring needed. Sealability: Challenging for large models.
Pres- proe-ppeessingg Output Filtering (Safety
Classifers), LLM--ssu-JJule J-ddee (detection)
Sensitivity to Topur Varistions
Prompt Robusttoss, Noise Iooustaesss Cousisteacy
Pre-procesinng Data Augmenntation (EDA, A3); Insri processing: Robust Prompting (Self-denoising, Refereuced Instruction
Trade-off:: Overly restriesive prompts stifle creativity.
(Prompt/Noisg)
Cost: Lower (infereace-time) than retraining Generalizabilit:: Adaatt ennerging risks.
Tracking), Inferences Time Adaptation
RLHH Tmpacc (Rteward Hacking, Bias Amaplifccation. Capability Trudc-ofss)
Fairness under Stress, Consisteucy, Task- Specific Robustuess
Tn-prooossing: Alignment (RPO, Ensembll RMs, Cousistency Alignment)
Trade-off:: "Alignment tax" (roduced general capubilities.
Cost: High computational resources.
Sealabiitt: Limited by data quality/diveerity
Alignment: Tax
OOD Generalization, Speii-Speeific Robustness
In-proceesiugg Aligument (RPO, Consistency Aligument, Madel Avernging)
Direct trade-off with general utility. Effectiveess: Aims balance sufety with performannee.
Trade-off:
Vine-tuning
OOD Geurralization,
Pre-proeesing: Data Angunentation, Data Filtering:
Risk of narrowing model's broader capabilites.
Trade-off:
Linitations
Noise Robustness,
(Overficting, Noise
Prompt Robastaess
Tn-proossing: Regularization,
Depends on strasegg.
Sunsitivity, Instruction Bristlenoss)
Insru- processio: Robust Prompting
Effectiveness: Requires careful data curation.
RAG Issues
Consistency, Factuality
Intra-proosee proceesing: Inference- Time Adaptation (Efficient inference engines); Pret-procesing: RAG for Verification
Trade-off: Retrieval overleedd.
Cost: Adds lateney.
Effectivenes: Improves grounding, but
bottlenecled by retriever quility.
can systematically analyze responses for fairness across demographic categories, validate reasoning steps in technical tasks (e-g., code vulnerability detection), or flag factual errors by cross-referencing trusted sources (Cantini et al., 2025). Advanced frameworks even deploy judge LLMs to autonomously generate adversarial prompts, test target models, and assess response reliability, guided by domain-specific constraints (Li et al., 2025d; Beyer et al., 2025).
However, reliance on LLM judges introduces challenges. First, their evaluations can be inconsistent due to prompt sensitivity, inherent biases, or a lack of grounding in objective criteria (Gu et al., 2025). Second, judge models themselves are prone to manipulation; studies show adversarial phrases or stylistic cues (e.g., phrascs like "I think") can skew their asscssments (Raina et al., 2024; Lee et al., 2024a). Finally, the lack of standardized evaluation protocols and risks like "preference leakage", where judges favour outputs from models they were trained on, underscores the need for multi-judge ensembles, human oversight, and rigorous benchmarking to ensure reliability (Beyer et al., 2025). While promising, LLM-as-a-Judge systems require careful design to balance automation with trustworthiness.
5 Metrics and Benchmarks
Modern language models must demonstrate reliability beyond basic performance metrics. As these models are deployed in real-world applications from healtheare diagnostics to logal document analysis their
behaviour under stress becomes critical. Robustness evaluation answers crucial questions: How does the model fail? When does fail? Most importantly, why does it fail?
22

---

Published in Transactions on Machine Learning Research (11/2025)
The landscape of LLM robustness contains eight interconnected dimensions 2.2, each requiring specialized measurement. approaches. Our analysis reveals that the majority of production failures stem from overlooked robustness factors rather than pure accuracy issues. Table 4 distils some essential metrics across 7 categories, providing practitioners with:
A diagnostic toolkit for model weaknesses
Prioritization guidance for system improvements
Benchmarking standards for research comparisons
Key Insight: No single metric tells the whole story. Effective evaluation requires combining complementary measures across multiple dimensions to ensure reliability.
5.1 Metrics
Evaluating the multifaceted concept of LLM robustness requires diverse toolkit of metrics, each designed to capture specific aspects of model behaviour under various challenging conditions. These metrics move beyond simple IID accuracy to quantify performance degradation, generalization ability, consistency, calibration, fairness under duress, and factuality, particularly when models are stressed.
5.1.1 Performance Degradation Metrics
These metrics quantify the drop in performance when an LLM is evaluated on challenging data (adversarial or noisy) compared to its performance on clean, standard data. They provide a direct measure of how much specific challenge impacts the model's effectiveness.
Accuracy Drop / F1 Drop/ / Metric Drop: This metric calculates the difference in model performance between a baseline (clean or standard) dataset and challenging version of that dataset (e.g., perturbed, adversarial, or noisy) Yuan et al. (2023). This metric directly quantifics how much a given challenge degrades effectiveness when expressed in absolute terms or percentage points. A larger drop indicates lower robustness, while a smaller drop suggests resilience under stress.
Attack Success Rate (ASR): This metric is central to adversarial robustness evaluation. It measures the percentage of adversarial inputs that successfully cause the intended model failure, such misclassification in NLU tasks, bypassing safety filters to generate harmful content, successfully executing jailbreak prompt (Jung et al., 2025). A higher ASR signifies lower robustness to the specific tack method used. Tt is key metric for benchmarks like AdvGLUU+++ BeinbreakBench, and BencptBench (Zhou et al., 2024a).
Compliance Ratio Refusal Rate: These metrics are particularly relevant for evaluating safety and alignment. robustness, especially against jailbreaking attempts. It measures how often the LLM generates harmful or forbidden content when prompted with malicious instructions (Varshney el al., 2024; Zeng et al., 2025). Conversely, the Refusal Rate measures how often the model refuses to answer. A high refusal rate for harmful prompts indicates good safety alignment, but high refusal rate for benign prompts indicates over-defensvveness, potential negative sidc-effect of safety Iraining.
5.1.2 Out-of- Disttritittiittionn (OOD) Performance Metrics
These metrics specifically assess how well LLM performs when faced with data that differs statistically from its training distribution.
OOD Accuracy F1 score: Standard performance metrics like Accuracy or F Fl-score calculated directly on designated OOD benchmark datasets, such as those included in the BOSS suite (c.g.. Dynasent, ANLI, NewsQA) (Yuan al., 2023). This provides a direct measure of capability on unseen distributions.
23

---

Published in Transactions on Machine Learning Research (11/2025)
Table Different metrics for evaluation of robustness in LLMs.
Specific Category
Dimension Measured
Metrics
Brief Description
Performence Degrada-
Accuracy Drop, F1
General Robustness
Decreuse in standard metrics challenging clean data.
tion
Drop (Yuan et al, 2023)
Attack Success Rate
Adversarial Resilience, Safety
Pereentage of successfll adversarial attacks jailbbenks
(ASR) (Zhou al,, 2024a)
Compliance / Refusal
Safety, Alignment
Froquency of generating harmful content or refusing prompts
Rate (Varshmey et al., 2024; Zeng et al., 2025)
OOD Performance
Accuracy/FP /FL Score (Yuan et al.,
OOD
OOD Generalization
Task performance on designated out-of-distribution datasets.
2023)
ID-0OD Performence
OOD Gencralization
Difference between in-distribution and out-of- distribution performance. Ability to distinguish in-distribution versus out-of- distribution inputs.
Gap (Yuan et 2023)
OOD Detection (AU-
OOD Awareness
ROC, Energy Score)
(Lu nl., 2024)
Cousistency
Semantic Consistency (Yang et al., 20255)
Prompt
Robustnoss, Reliability
Stability output meaning under input paraphrasing or slight modifications. Proportion identical or equivalent predictions across sctups (e.g., prompts, soods).
Consistency Rate
Prompt Robustness, Sampling Stability
(CR) (Nalbaudyan
ct al., 2025)
Respouse Cousistency
Prompt Robustnces
Froquency of the most common claim across paraphrased prompts.
(RC) (Rahman et al., 2024)
LL.M-bused
Sampling Stubility, Reliability
LLM judges assess consistency between generated samples.
Consisteucy
Score (Saxena ct al., 2024)
Calibration
Expected Calibration
Confidence Reliability
Aligument between predicted confidence and actual curacy
Error (ECE) (Posocco Bonnefoy, 2021)
ECE under Distri- bution Shift (Huang al., 2024b; LeVine al., 2024)
OOD Generalization
ECE mensured spocifically on OOD data
Pairuess under Stress
Bias Metries (e.g. Fairness Robustaces FLEX) (Jung al., 2025)
Evaluation of faimess when models are exposed to bias- inducing prompts.
Task-Specific
Code
Robustness Checks (Li
Code Generation Ro- bustness
Checks for robustness in generated code, like security correctness features.
al.,
2025c)
Reasouing Accuracy ReClor-plus)
Reasoning Robustness
Performance on reasoning tasks coutaining structure variations.
(e.g.,
(Bao et al., 2025)
Hallucination/ Factuality FactScore, FCH Rate (Rahman et al., 2024) FEWL (Wei et al., 2024)
Factuality,
Verification of generated facts against trusted
Faithfulness
kuowledge souree context. Weighted agrecment smong reference LLMs based expertise.
Factuality (Reference- Free)
SelfCheckGPT.
Factuality/Conne /Consistency (Referenco-Free (Chen al., 2024) Faithfulness to Source
Consistency checks across multiple generated samples metamorphic prompt variations.
MetaQA (Wei al., 2024)
Faithfulness Metrics (NLI/QA-based)
Cousistency between generated text and provided document.
Hallucination Rate
Factuality Robustness under Stress
Change hallucination when exposed stress conditions.
Increase (HRI)
ID-0OD Performance Gap: This metric quantifics the difference in performance between an ID dataset and a corresponding OOD dataset (Yuan al., 2023). It explicitly measures the drop generalization capability due to the distribution shift. Studies using benchmarks like BOSS have
24

---

Published in Transactions on Machine Learning Research (11/2025)
shown that this gap vary significantly and exhibit complex patterns (e.g., linear, piecewise linear, V-shaped) depending on factors like model scale, training steps, and task type, indicating that simply improving ID performance does not always guarantee better OOD performance.
OOD Detection Metrics (o.g., AUROC, FPR@TPR): These metrics evaluate the model's ability to recognize that an input is OOD, often by threshokding a confidence score derived from model outputs (e.g,, token probabilities) or internal representations (Huang et al., 2024a). Common metrics include the Area Under the Receiver Operating Characteristic curve (AUROC) and the False Positive Rate (FPR) at a high True Positive Rate (TPR). While not directly measuring task performance robustness, effective OOD detection is crucial for building reliable systems that can identify and potentially abstain from making predictions on inputs they are likely to handle poorly (Lu et al., 2024). Techniques like Energy Score, originally from classification, have been adapted for this purpose in LLMs and reward models (LeVine et al., 2024).
5.1.3 Consistency Metrics
Consistency metrics evaluate the stability of LLM outputs. A consistent model should produce similar outputs for semantically identical inputs and exhibit stable behaviour under non-deterministie sampling, Lack of consistency can signal unreliability, especially for tasks requiring factual accuracy (Nalbandyan et al., 2025).
Semantic Consistency: Assesses whether the meaning or core information conveyed the LLM's output remains the same when the input prompt paraphrased or expressed differently, while pre- serving the original intent (Nalbandyan et al., 2025). Evaluation can be qualitative quantitative, often using semantic similarity metrics based on embeddings (e.g., cosine similarity between output embeddings) (Patwardhan et al., 2025).
Consistency Rate (CR): Proposed within the SCORE framework (Nalbandyan et al., 2025), CR quantifies the agreement among predictions for the same input across different evaluation settings (e.g., 10 different prompts, different random scods for sampling). It is calculated as the average proportion of agreeing pairs among all possible pairs predictions for each input instance. For multiple-choice questions (MCQ), agreement means identical predicted letters; for tasks like MATH, means symbolic equivalence checked via tools like sympy (Nalbandyan et al., 2025).
Response Consistency (RC): Used in the DefAn benchmark (Bao al., 2025), this metric specifically
measures consistency across multiple (e-g., 15) paraphrased versions of single prompt. For each set of paraphrased prompts, it caleulates the frequency of the most common factual claim generated in the responses. The overall RC is the average of these frequencies.
Multilingual Consistency: Evaluates whether the model's performance or the semantic meaning of its output is preserved when prompts or inputs are translated into different languages (Qi et al., 2023).
LLM-based Consistency Score: This approach uses another LLM as a judge (Saxena et al., 2024). It prompts the target LLM multiple times (n > 1) for the same input using a non-zero temperature (e.g., 1.0) to induce variability. The judge LLM then compares pairs of generated responses, assessing whether they contradict or support each other. The consistency score is the fraction of pairs decmed consistent.
5.1.4 Calibration Metrics
Calibration metrics assess the alignment between an LLM's predicted confidence and its actual likelihood of being correct. Well-calibrated models are crucial for trustworthy docision-making, as their confidence scores reliably indicate the potential accuracy of their outputs. Evaluating calibration under stress, such distribution shifts, is vital for robustness.
25

---

Published in Transactions on Machine Learning Research (11/2025)
Expected Calibration Error (ECE): It works by dividing predictions into bins based on their confi- dence scores (e.g., 10 bins from 0.0-0.1, 0.1-0.2...., 0.9-1.0). Within each bin, the average confidence and the actual accuracy (fraction of correct predictions) are calculated. ECE is the weighted average of the absolute difference between average confidence and accuracy across all bins, weighted by the number of samples in each bin. lower ECE indicates better calibration (perfect calibration yields ECE=0). Frameworks like UQ4CT aim to minimize ECE during fine-tuning. (Posocco & Bonncfoy, 2021)
ECE under Distribution Shift: This involves calculating ECE specifically on OOD datasets under simulated distribution shifts to assess how calibration holds up under stress. Research suggests that factors like OOD prompts versus OOD responses can impact the calibration of components like reward models differently (LeVine et al., 2024; Huang et al., 2024b).
Other Metrics include:
Brier Score: Measures the mean squared difference between predicted probabilities and actual outcomes (0 or 1). Its other variants include weighted Bricr score (Zhu et al., 2024).
Area Under the ROC Curve (AUROC): Can be used to assess how well confidence scores discriminate between correct and incorrect predictions when varying a confidence threshold.
5.1.5 Fairness Metrics under Stress
These metrics evaluate whether an LLM maintains fairness and avoids amplifying social biases when sub- jected to adversarial conditions, such prompts designed to provoke biased responses.
Concept: Standard fairness evaluation often checks for performance disparities or stereotypical as- sociations on clean data. Fairness robustness evaluation applics similar principles but within a stress-testing context, using benchmarks like FLEX (Jung al., 2025).
Specific Metrics: These often involve measuring differences in other robustness metrics (like ASR, refusal rates, toxicity scores, task accuracy) across different demographic groups when the model is prompted with bias-inducing adversarial inputs (Jung et al., 2025). For example, one might measure if a jailbreak attack is more successful (higher ASR) when the harmful instruction targets a specific demographic group, or if the model refuses benign requests more often for certain groups under adversarial pressure. Metrics derived from causal frameworks, like stratified invariance, can also quantify the model's reliance on protected attributes under intervention (Cotta & Maddison, 2024).
5.1.6 Task Task-Specific Robustness Metrics
Certain applications require robustness dimensions unique to the task domain. Metrics are tailored accord- ingly.
Code Generation:
Beyond functional correctness, robustness evaluation focuses aspects like secu- rity vulnerabilities or handling of edge cases too (Rahman & Kundu, 2024). Metrics might involve:
Static Analysis: Checking for the presence or absence of necessary robustness features like input validation, exception handling, or specifie control structures compared to human-written reference code (Li et al., 2025e).
Robustness to Prompt Perturbation: Evaluating if code generation remains correct when the natural language instruction contains typos semantic variations (Gan et al., 2024).
Code Hallucination Metrics: Specific metrics from benchmarks like HalluCode, such as Accuracy of Hallucination Existence Recognition (Ace-Ree) (did the model correctly identify generated code contains hallucination ?) and Accuracy of Hallucination Mitigation (Ace-Mit) (did the model successfully correct the hallucinated code ?) (Läu et al., 2024a).
26

---

Published in Transactions on Machine Learning Research (11/2025)
Logical Reasoning: Evaluating performance degradation standard reasoning benchmarks (e.g.: ReClor, LogiQA) when the task structure is perturbed, for example, by shuffling the order of multiple-choice options or replacing the correct option with "none of the above" (as done in ReClor- plus, LogiQA-plus) (Bao et al., 2025). Robustness can also be tested against typographical errors the problem statement. using benchmarks like R2ATA (Gan al., 2024).
5.1.7 Hallucination and Factuality Metrics under Stress
This crucial category focuses on measuring an LLM's propensity to generate content that is factually incor- rect, inconsistent with provided sources (unfaithful), nonsensical (hallucination) (Liu et al., 2024a). The evaluation is particularly concerned with how this tendency changes under stressful conditions like OOD inputs, adversarial prompts, or questions probing the model's knowledge boundaries.
Pact-Checking / Factuality Scores: These metrics assess the alignment of generated content with verisiable world knowledge or a ground truth source.
Knowledge Base (KB) / Corpus Comparison: Generated statements checked against external structured KBs or large factual corpora (Muhlgay et al., 2024). The FACTOR benchmark operationalizes this by creating contrastive (true/false) statements from a corpus and evaluating the LM's likelihood score assigned to the true version versus false alternatives (Muhlgay et al., 2024).
Exact Match (EM) (Wang et al., 2024c): Measures the percentage of generated answers that perfectly match a known factual reference answer. It is simple but often too strict, failing to credit semantically correct paraphrases.
Atomic Fact Verification (c.g., FactScore, FCH Rate): This approach decomposes a longer generated text into individual factual claims ("atomic facts") and verifies each claim against a reliable source like Wikipedia (Wang et al., 2024c). The final score often the percentage of verified facts. This allows for fino-grained analysis of long-form generation. The Factual Contradiction Hallucination (FCH) rate used in the DefAn benchmark follows a similar principle (Rahman et al., 2024).
FEWL (Factualness Evaluations via Weighting LLMs): A reference-free metric designed for scenarios without gold-standard answers (Wei et al., 2024). It uses multiple external LLMs ("reference LLMs") as proxics. It calculates a truthfulness score by weighting the agreement between the evaluated response and each reference LLM's response based on the reference LLM's estimated "expertise" (disagreement with wrong answers) and "non-laziness" (consistency across similar questions) (Wei et al., 2024).
QA/NLI-based Metrics: These leverage auxiliary models. A Question Generation/Ansseriin system can be used to generate questions from the generated text and check if the answers are consistent with the source docunent. Alternatively, NLI models can classify the relationship (entailment, contradiction, neutral) between generated statements and source text sentences (Chen et al., 2024).
Faithfulness / Groundedness Scores: These metrics specifically measure whether the generated text accurately reflects and is supported by given source document. This is critical for tasks like summarization or Retrieval-Augmente Generation (RAG).
Methods often overlap with fact-checking (c.g., using NLI or QA models) but focus specifically adherence to the provided context rather than general world knowledge (Chen et. al., 2024). Faithfulness metrics evaluate if all claims in the output can be inferred from the source (Yang et al., 2025a).
Mol-Hallu: A domain-specific metric for evaluating faithfulness in molecular comprehension tasks. uses an entailment model to chock if scientific entities mentioned in the generated text are actually supported by the provided molecular descriptions (Ti et al., 2025a).
27

---

Published in Transactions on Machine Learning Research (11/2025)
1. Add domain data
Accuracy/ F1 Drop (8 5.1.1)
Augmentation
Drop > X pp
3. Distributionally Robust Opdimization(ROO)
Test-time adaptation
1. Adversarial fine-tuning
RLHF /DPO safety
Attack Success Rate (ASR) & Compilance Rate 5.1.1)
Integrate robust. prompting templates and constrained decoding
If ASR Y
Output filters
Ensembling Judges
Training
OOD Performance (F1, Gap, AUROC) (9 5.1.2)
If OOD Gap is large or AUROC < 0.8
2. Collect OOD-aware data
Deploy OOD Detectors
RAG grounding
LLMS
Paraphrase Augmentation
Prompt Consistency (CR, SC, RC) (8 5.1.3)
If CR 90%
Consistency Regularization
3. Prompt Canonicalisation
Temperature Scaling
Caliberation (ECE, Brier Score) 6.1.4)
If ECE high
Calibration-aware losses
Model ensembles Bayeslan approximates
Debias or reweight datasets
Fairness under Stress (FLEX) ($ 5.1.5)
If disparity is high under strees prompts
Fairness-aware tuning
3. Post-processing filters
Hallucination Factuality (HRI, FactScore, FCH) (8 5.1.7)
Adopt RAGs with trusted knowledge sourers Fact-chocking layers
HRT high or FactScore low
Grounded QA fine-tuning
Figure 6: Actionable guidance for LLM practitioners where Performance metrics can be taken from Table and then by identifying the threat model or corresponding weak dimensions, practitioners can apply corresponding strategies from Table
Consistency-Baet Based Metrics: These metrics leverage the idea that factual information should be stable, while hallucinations might be more variable or contradictory across different generations or prompts.
Caff-Coniistency Checks (c.g., SelfCheckGPT): This approach involves generating multiple re- sponses from the same LLM for a single prompt, typically using temperature sampling (T>0) to introduce diversity (Wei et al., 2024). The consistency (or lack thereof) across these responses is then measured. High variance or contradiction among samples might indicate hallucination, while consistent outputs suggest higher confidence or factuality. Various metrics can be used to quantify this, such semantic similarity variance contradiction detection using NLI models (Wei et al, 2024).
LLM- based Consistency Score: This method uses secondary model to evaluate consistency by generating multiple responses (with controlled randomness) to the same prompt, then calculat- ing how often these responses logically align (Saxena et al., 2024). The resulting "consistency score" measures reliability under variable conditions.
MetaQA: This method applies melamorphie testing principles (Yang al., 2025a). It generates variations of the original prompt using synonym antonym substitutions. It then checks if the LLM's responses to these related prompts exhibit the expected consistency (for synonyms) inconsistency (for antonyms). Deviations from expected patterns can signal factual errors or hallucinations (Yang et al., 2025a).
Uncertainty as Indicator: The model's own uncertainty estimates can sometimes serve a proxy for hallucination risk.
28

---

Published in Transactions on Machine Learning Research (11/2025)
Confidence Scores: Using metrics derived from the model's output probabilities, such as token- level probabilities, sequence log-probability, entropy (Mahaut et al., 2024). The assumption is that lower confidence might correlate with a higher likelihood of hallucination. However, this requires the model to be well-calibrated for the confidence scores to be reliable indicators.
Energy Score: While primarily used for OOD detection, the energy score calculated for reward models can indicate when the model is operating on inputs (prompts or responses) far from its training distribution, suggesting its reward estimate (which might relate to factuality) could be unreliable (LeVine et al., 2024).
Evaluating Increase in Hallucination under Stress: A key aspect of robustness is understanding how hallucination behaviour changes under pressure. This requires comparing hallucination rates measured using the metrics above under standard conditions versus stress conditions.
Methodology: Apply chosen hallucination metric (e.g., FCH rate, FEWL score, SelfCheckGPT score) to standard benchmark (e.g., "ruthfulQAA) and then again stressed version of that benchmark (c.g., TruthfulQA prompts with added noise, OOD context, or adversarial perturbations).
Metric: The Hallucination Rate Increase (HRI) can be defined as HRI Hallucination Rate (Stress) Hallucination Rate (Standard). A significantly positive HRT indicates failure in factuality robustness, meaning the model becomes more prone to hallucination when challenged. This requires benchmarks specifically designed or adapted for stress testing factuality (discussed in Section 2.2).
5.2 Benchmarks
Complementing the metries described above, a growing number of benchmarks and evaluation frameworks are being developed to systematically assess LLM robustness across its various dimensions. Table provides an overview of the benchmarks discussed. These benchmarks provide standardized datasets and protocols for testing models under specific types of stress.
5.2.1 Adversarial Benchmarks
These benchmarks are designed to evaluate an LLM's resilience to intentionally crafted inputs aimed at caus- ing model failure, such as misclassification, generation of harmful content, or bypassing safety mechanisms.
AdvGLUE / AdvGLUE++: These benchmarks are adversarial versions of the popular GLUE (Gen- eral Language Understanding Evaluation) benchmark. They apply various textual adversarial atlack methods (e.g., word substitutions using synonyms, character-level perturbations, sentence paraphras- ing) the original GLUE tasks (like sentiment analysis, NLI). AdvGLUE++ (Wang et al., 2021) expands upon AdvGLUE with more adversarial examples, targeting newer LLMs. They serve as standard for evaluating the robustness of fundamental language understanding capabilities against common textual attacks.
PromptBench: Unlike benchmarks focusing on perturbing input samples, PromptBench (Zhang, 2023) specifically evaluates the robustness of LLMs to adversarial prompts (the instructions given to the model). It includes a framework for dynamically generaling adversarial prompts using character, word, sentence, and semantic-level attacks and applies these perturbed prompts across various tasks (sentiment analysis, NLI, QA, translation, math) and datasets. This targets the sensitivity of LLMs to the way instructions are phrased.
Jailbroak Benchmarks (c.g., JailbreakBench, AdyBench subset): These benchmarks consist of prompts specifically designed lo circumvent an LLM's safely aligmment training and elicit responses that are harmful, unethical, illegal, or otherwise prohibited by the model's safety guidelines (Xhon- neux al., 2024). Examples include prompts using role-playing scenarios, hypothetical situations, or character encodings to trick the model. Evaluating performance on these benchmarks (often using ASR Compliance Ratio) is crucial for assessing the effectiveness of safety measures.
29

---

Published in Transactions on Machine Learning Research (11/2025)
R2ATA (Gan et al., 2024): This benchmark focuses the robustness of LLM reasoning capabilities. It uses the Adversarial Typo Attack (ATA) algorithm to introduce minimal, targeted typographical errors into reasoning problems (from datasets like GSM8K, BBH, MMLU). It then measures the degradation in the LLM's ability to perform correct step-by-step reasoning Shtain-of-Thoughie and arrive at the right answer.
Adversarial benchmarks, while primarily focused on inducing misclassification or safety failures, can inad- vertently trigger hallucinations. Attacks that manipulate reasoning processes or push models into unusual states via jailbreaking prompts (Gan et al., 2024; Zhou et al., 2024a) might cause them to generate factually incorrect or nonsensical outputs as a byproduct of the attack's 's success or the model's attempt to handle the confusing input. Evaluating factuality metrics on adversarial datasets can provide insights into how robust a model's factual grounding is when under direct attack.
5.2.2 OOD Benchmarks
OOD benchmarks are designed to evaluate how well LLMs generalize their capabilitics to data drawn from distributions that differ from their training data. This tests robustness against natural shifts encountered in the real world.
BOSS (Benchmark suite for Out-of-distribatie robustneSS): BOSS is notable effort to create a more challenging and holistic OOD eva evaluation suite for NLP. It covers five diverse tasks: Senti- ment Analysis (SA), Toxic Detection (TD), NLI, Named Entity Recognition (NER), and Extractive Question Answering (EQA) (Yuan et al., 2023). For each task, BOSS includes one large, diverse In- Distribution (ID) dataset (e.g., Amazon reviews for SA, MNLI for NLI, SQuAD for EQA) and three corresponding OOD datasets (Yuan et al., 2023). The OOD datasets carefully selected based protocol that prioritizes: (1) distinct data sources/domain to ensure low semantic similarity (measured via SimCSE) with the ID set and (2) evidence of significant. performance drop for a baseline model trained on the ID set, indicating challenging distribution shift (Yuan et al., 2023). Examples of OOD datascts included are Dynasont, SemEval (SA); ANLI, ContractNLI, WANLI (NLI); AdvQA, NewsQA, SearchQA (EQA) (Yuan et al., 2023).
ANLI (Adversarial NLI): Created through an iterative human-and moudd-mdel-i--tte--bboe process, ANLI contains NLI examples specifically designed to be difficult for contemporary models. Due its challenging nature and distinct creation process, is frequently used as OOD benchmark for NLI task generalization (Yuan et al., 2023).
Dynasent: A sentiment analysis dataset generated dynamically using adversarial methods to create challenging examples that models trained on standard sentiment datasets might misclassify (Yuan et al., 2023).
WANLI: An NLI dataset synthesized using GPT-3, focusing on challenging linguistic patterns that models often struggle with in datasets like MNLI (Yuan et al., 2023).
Bench (Li et al., 2024a): This is a comprehensive benchmark to evaluate adversarial robustness under dataset and threat distribution shifts. Further, this benchmark demonstrates that adversarial robustness suffers significant degradation under distribution shifts, yet in-distribution robustness correlates strongly and linearly with ant-of-distribution robustness.
5.2.3 Consistency/Prompp Robustness Benchmarks
These benchmarks focus on evaluating the stability of LLM outputs when faced with variations in prompt formulation non-deterministic sampling, testing whether the model's behaviour is sensitive to superficial changes.
SCORE (Systematic Consistency and Robustness Evaluation): SCORE (Nalbandyan et al., 2025) provides framework for non-adversarial robustness evaluation. assesses models on existing benchmarks (like MMLU-Pro, AGIEval, MATH) under three specific perturbation scenarios
30

---

Published in Transactions on Machine Learning Research (11/2025)
Table 5: Different Benchmarks for evaluation of robustness in LLMs.
Target Dimension
Example Dataset
Benchmarks
Evaluation Approach
Key Component
Adversurial Resilience
AdvGLUE/ / AdvCLUE PromptBench
Modified SST-2,
Perturbed versions of CLUE using textual attacks
MNLI, QQP, ctc.
Adversarial Resilience
Uses
prompts with
Dynamic adversarial attacks on prompts (char, word, seutence, semantic)
(Prompts)
datasets like GLUE,
SQuAD,
GSM8K,
GSM-PLUS
Adversarial Resilience (Safcty) Adversarial Resilience
JuibrrakBeuch,
Ad-
Custom
juilbreak
Prompts designed to bypass safety filters
BBecch
prompts
R2ATA
Perturbed
GSMSK,
Adversarial typographical crrors in reasoning problems
(Reasoning), Noise
BBH, MMLU
OOD Gencralization
BOSS
II:: Amazon, SQuAD,
Curated ID/OOD dotasets based on semantic
MNLI, CC, FewNerd;
dissimilarity & performance drop protocol.
OOD: Dyuascut,
ANLI, NewsQA, etc. OODRobustBench
OODcobus
Predicts the maximum OOD robustness achievable by
extrapolating existing ly-bused robust training tech-
niques hypothotienl models with perfect ID robust-
WANLI
ANLI dataset
Adversarially collected NLI examples.
Consistency, Prompt Robustness
SCORE
MMLU-Pro, AGIEval, MATH
Evaluates consisteney across prompt paraphrasing, sam- pling sceds, choice order perumtations.
Fairuess under Stress, Adversarial Resilience
FLEX
Modified BBQ, CrowS- Pairs, StereoSet
Adversarial prompts (persona, competing objectives, text attacks) fairness datasets
Spek-Specific (Reasoning)
ReClor-plus, etc.
Modified ReClor,
Structural variations (shuffled options, or adding the above") reasoning datasets.
LogiQA
Task-Spocific (Code)
CoderEval
CoderEval benehmark
Used to analyze code robustness aspects like missing checks vs. human code
Factuality/ Halllncination TruthfulQA
TruthfulQA dataset
Questions targeting common misconceptions to test truthfulness vs. imitation
FELM
FELM dataset
Fine Fine-graine grained, segment-level level factuality annotations with error types & references
FACTOR
Wiki-AATTOR, News-
LM likelihood evaluation on contrastive (true vs. false) statements derived from corpus
FACTOR, etc.
DefAn
DefAn dataset
Large dataset evaluating FCH, PMH, and RC across paraphrased prompts
UMWP
UMWP datasct
Tests LLMs identify unanswerable problems hallu- cinate solutions
(Recoguition)
HaluEval
HaluEval dataset (de- rived from HotpotQA, CNN/DM, Alpaca,
Large dataset of ballucinated/conee samples; tests LLM ability classify hallucination
etc)
(Code)
HalluCode CodeHalu
HalluCode, Code- HaluEval datasets
Benchmarks with taxonomics for ovalusting code- specifie hallucinations LLM-free evaluation existence, attribute, relation Incinations in MLLMs
(Multimodal)
AMBER
AMBER dataset (cus- tutn annotated images))
(Multimodal)
HIQIIBench ODE
IIQIIBench dataset;
Meta-cvaluation of benchmark quality (IIQIIBeuch); Dynamic opeu-sct generation (ODE)
ODE framework
Prompt Robustness: Testing with 10 different non-adversarial, semantically equivalent prompts for each question, varying structure and including Chain-of-Thought (CoT) variations.
Non-Greedy Inference: Evaluating consistency across 5 runs using the same prompt but with temperature sampling (T=0.7) and different random seeds.
Choice Order Robustness: For MCQ datasets, shuffling the order answer choices while keeping the correct answer logically in the same position. SCORE reports the range (min/max) of accuracy across these scenarios and the overall Consistency Rate (CR) (Nalbandyan et al., 2025).
31

---

Published in Transactions on Machine Learning Research (11/2025)
Paraphrasing Benchmarks: Methodologies that involve generating multiple paraphrased versions of instructions or queries and measuring the consistency of the LLM'' responses (Barbero et al., 2025). This directly tests robustness to linguistic variation.
Evaluating how changes in prompt structure, such as altering the po- sition of the question within the prompt (beginning, middle, end), affect model performance and consistency (Nalbandyan et al., 2025).
Structural Variation Tests:
5.2.4 Fairness/Bias Robustness Benchmarks
These benchmarks are specifically designed assess whether LLMs maintain fairness and avoid biased outputs when subjected to stress adversarial prompts intended to provoke bias
FLEX (Fairness Benchmark LLM under Extreme Scenarios): FLEX (Jung et al., 2025) focuses on the robustness of fairness. takes samples from existing fairness benchmarks (like BBQ, CrowS- Pairs, StereoSet) where baseline models typically provide unbiased responses. then applies ad- versarial prompts using techniques like persona injection (instructing the LLM to adopt a biased persona), competing objectíves (presenting conflicting goals that might induce bias), or text at- tacks (subtle manipulations of the input) (Jung et al., 2025). FLEX evaluates whether the model maintains its unbiased stance even under these extreme, bias-inducing conditions.
5.2.5 Siek-Specifiic Robustness Benchmarks
These benchmarks evaluate robustness in the context of particular downstream applications where unique failure modes might exist.
Reasoning:
ReClor-plus, LogiQA-plus, LogiQAv2-plus (Bao et al., 2025): These extend standard logical reasoning datasets (ReClor, LogiQA, LogiQAv2) by introducing structural variations the multiple-choice questions. These variations include randomly shuffling the answer options replacing the correct answer with a "none of the other options is correct" choice, testing if the model relies on superficial patterns or truly understands the logic (Bao et al., 2025).
R2ATA (Gan et al., 2024): Assesses reasoning robustness specifically against adversarial typo- graphical errors introduced into the problem statements of reasoning tasks (Gan al., 2024).
Code Generation:
CoderEvval (Li et al., 2025e): While primarily code generation benchmark, it has been used in studics focusing on code robustness issucs beyond simple functional correctness, such as identifying missing input validation or error handling checks by comparing generated code to human references (Li et al., 2025e).
Benchmarks evaluating robustness perturbations in the natural language instructions pro- vided for code generation tasks are also emerging (Barbero et al., 2025).
5.2.6 Hallucination/Factualiic Benchmarks
This category includes benchmarks explicitly created to measure an LLM's tendency to hallucinate or its ability to adhere to factual knowledge.
This benchmark (Cecchini et al., 2024) is designed to measure whether LLMs are truth- ful generating answers to questions where humans often hold common misconceptions. tests if models avoid repeating false belicfs prevalent their training data, distinguishing truthfulness from mere imitation (Yang et al., 2025a). is also used widely for evaluating factuality robustness with Fnnhanced (Yang et. al., 2025a).
TruthfulQA:
updated version,
32

---

Published in Transactions on Machine Learning Research (11/2025)
HaluEval: A large-scale benchmark (35,000 samples) focusing on the LLM's ability to recognize hallucinations (Ti et al., 2023). Tt includes generated and human-annotated samples across QA, knowledge-groune dialogue, text summarization, and general user queries. Models are evaluated on their ability to correctly classify provided text as containing hallucinations ("Yos") or not ("No")
FELM (Factuality Evaluation of LLMs): FELM (Chen ct al., 2023b) provides fino-grained, segment- level factuality annotations for LLM-generated responses. For each segment, human annotators provide a factuality label (correct/incorrest /incorrect), identify the error type if incorrect, and list reference links supporting the judgment. It covers diverse domains including world knowledge, science, math, and reasoning.
This benchmark (Muhlgay et al., 2024) automatically transforms a given factual corpus (e.g., Wikipedia, news articles) into a set of evaluation instances. Each instance consists of a context, a factually correct completion, and several plausible but factually incorrect variations (generated based on different error types like entity substitution, negation, and numerical errors). It evaluates an LM by measuring whether it assigns higher likelihood (probability) to the factually correct completion compared to all the incorrect alternatives in a generation setting (Muhlgay el al., 2024).
FACTOR:
DefAn: A large dataset ( 75k prompts) across eight domains (including Sports, Census data, No- bel Prize) designed to elicit definitive, concise factual answers (Rahman et al., 2024). It evalu- ates three aspects: Factual Contradiction Hallucination (FCH rate % of responses with incorrect facts), Prompt Misalignment Hallucination (PMH rate- % of responses deviating from prompt in- structions/ Atructions/formaa)), format), and Response Consistency (RC consistency of claims across 15 paraphrased prompts) (Rahman et al., 2024).
UMWP (Unanswerable Math Word Problem): This benchmark (Sun et al., 2024a) evaluates hal- lucination in the context of mathematical reasoning. It consists of math word problems that are intentionally designed to be unanswerable (c.g., due to missing information). It tests whether LLMs correctly identify these problems as unanswerable or if they hallucinate by attempting to provide a mumerical solution.
Code Hallucination Benchmarks (HalluCode, CodeHalu, Collu-Bench): These benchmarks (Liu et al., 2024a) are specifically designed for the code domain. They often include taxonomies of code-specific hallucinations (e.g., intent conflicting, context inconsistency, dead code, knowledge conflicting (Liu al., 2024a); mapping, naming, resource, logic hallucinations (Tian et al., 2025)). They evaluate an LLM's ability to generate correct code and/or recognize hallucinations in gener- ated code snippets. Collu-Bench, for instance, focuses predicting hallucination locations based on generation log probabilities and execution feedback (Jiang et al., 2024).
Multimodal Hallucination Benchmarks (AMBER, POPE, MME, HQHBench, ODE, etc.): These benchmarks evaluate hallucinations in MLLMs, where the generated text might conflict with the provided visual (or other modality) input (Bai et al., 2025b).
AMBER (Bai et al., 2025b; Wang et al., 2024b) is notable for being an LLM-free benchmark. Tt uses carefully annotated images and an automated pipeline to evaluate MLLM hallucinations across both generative and discriminative tasks, covering existence (object presence), attribute (object properties), and relation espatialcoontad relations between objects) hallucinations with- out relying on another LLM for judgment (Wang et al., 2024b). While other benchmarks like ODE (Tu et al., 2024) propose a dynamic, open-set protocol to generate novel evaluation samples and mitigate data contamination.
Evaluating Hallucination under Stress: While the benchmarks listed above are primarily designed to elicit or detect hallucinations, they form the basis for evaluating factuality robustness under stress. This can be achieved by:
Applying stress conditions (c.g., adding noise, using OOD contexts, applying adversarial pertur- bations) to the prompts or inputs of these benchmarks (c.g., stressing TruthfulQA or HaluEal inputs).
33

---

Published in Transactions on Machine Learning Research (11/2025)
Measuring the change in hallucination rates using appropriate metries under standard condi- tions versus stress conditions). Benchmarks like UMWP or DefAn inherently contain challenging conditions designed to probe these factuality limits.
The diversity of these hallucination benchmarks highlights the complexity of the phenomenon. Some test the gencration of truthful content (TruthfulQA, FACTOR, DefAn), while others test the recognition of flawed content (HaluEval, HalluCode recognition Lasks). They cover different domains (general knowledge, dia- logue, code, math, multimodal) and rely on different evaluation paradigms (reference-basee likelihood-based, sesiifiiaatio-basedd) A comprehensive assessment of an LLM's factuality and hallucina- tion tendencies requires leveraging multiple benchmarks that cover these different facets (Liu et al., 2024a). Furthermore, the field is actively evolving to address in traditional static benchmarks. There is a noticeable trend towards developing benchmarks that are dynamic (generating test cases on-the-fly to prevent con- tamination, c.g., ODE, DyVal) (Tu et al., 2024), LLM-free (avoiding reliance on potentially unrcliable LLM judges, e.g., AMBER) (Wang et al., 2024b). These advancements aim to improve the reliability and validity of LLM robustness evaluations.
reference-free,
6 Challenges and Future Work
The field has made notable progress identifying and characterizing robustness challenges in LLMs. While awareness of these vulnerabilities is now widespread, and numerous miligation strategies and evaluation frameworks have emerged, even state-of-the-art LLMs demonstrate brittleness across critical dimensions. Robustness does not consistently correlate with model scale as larger models are not inherently more robust, and scaling trends often show weak or inconsistent patterns (Zhou et al., 2024d; Yang et al., 2024d). Safety- aligned models remain susceptible to sophisticated jailbreaking attempts, while performance may deteriorate sharply with minor distribution shifts or input perturbations (Qi et al., 2025; Oh & Demberg, 2025; Yuan et al., 2023). Ultimately, achieving comprehensive and reliable robustness persists as a fundamental challenge for the field.
6.1 Major Challenges and Limitations
Several key challenges that hinder progress towards truly robust LLMs are:
Scalability of Defences: Many promising defence mechanisms, particularly those involving adversarial example generation during training (AT) or complex inference-time checks, are computationally expensive and may not scale efficiently to trillion-pan pellion-paramete models (Lee et al., 2024b; Howe et al., 2025). Ensuring robustness improvements keep pace with model scaling is crucial but not guaranteed.
Robustness-Uttin Tradc-offs: Aggrossively optimizing for robustness can often negatively impact the model's general capabilities or performance on clean, standard tasks (Lin el al., 2024b; Lee et al., 2024b). The alignment tax associated with RLHF is prime example of it. Finding the right balance and developing methods that improve robustness without sacrificing utility is critical ongoing challenge.
3. Evaluation Gaps: Current evaluation methodologies have limitations. There is need for more prehensive benchmarks covering a wider range of robustness dimensions simullaneously, including more subtle and complex failure modes (e.g., sophisticated shortcuts). Evaluating the robustness of generative capabilitics remains particularly difficult compared to classification tasks (Ailem et al., 2024). Ensuring benchmarks are realistic, efficient, and resistant to "teaching to the test" is also vital.
4. Theoretical Understanding: Our theoretical understanding of why LLMs exhibit certain robustness failures like shortcut learning, understanding how model architecture (e.g., attention mechanisms, MoE) influences robustness and vulnerabílities or the alignment tax and why certain defences work still developing (Ye al., 2024). Deeper thcoretical insights could guide the development of more principled and effective mitigation strategies.
34

---

Published in Transactions on Machine Learning Research (11/2025)
5. Real-world Deployment:
Translating robustness improvements observed on static benchmarks into reliable performance in dynamic, open-world environments with continuous distribution shifts and novel, unforeseen threats remains a significant hurdle. Bridging this gap is essential for trustworthy deployment.
6. Robust Evaluation Methodologies: A critical need exists for more reliable, comprehensive, and standardized benchmarks and evaluation protocols. This includes developing robust. LLM judges, methods for verifying judge outputs, and metrics that capture real-world failure modes more effec- tively.
6.2 Future Research Directions
Addressing these challenges points towards several promising avenues for future rescarch:
1. Causal and Invariant Learning: Moving beyond correlational learning towards models that under- stand underlying causal relationships or learn representations that are inherently invariant to changes in domain or distribution (Ye et al., 2024). This could lead to more fundamentally robust models less reliant on spurious cues.
2. Compositional Robustness: Investigating how models behave under combinations of different, per- turbations (e.g., noisy input + OOD context + adversarial prompt) and developing methods to ensure robustness in such complex scenarios.
Exploring hybrid approaches that combine multiple processing steps, as well as investigating methods to optimize their computational efficiency, are promising directions for advancing the field and ensuring the safe and reliable deployment of LLMs in wide range of real-world applications.
Hybrid Approach:
Efficient Robust Training and Alignment: Developing more scalable adversarial training methods (e.g., improving continnous AT), more efficient robust optimization techniques, and alignment meth- ods (like RLHF variants) that explicitly minimize the alignment tax inherently more robust to reward model imperfections (e.g., reward-robust RLHF) (Yan et al., 2024b).
5. Adaptive and Automated Evaluation: The field must prioritize evaluating evaluation methods them- selves, specifically, by assessing the rcliability, validity, and biases inherent in existing benchmarks and automated metrics. Furthermore, there is critical need to develop dynamic evaluation plat- forms and automated red-teaming methods capable of continuously probing models for weaknesses, adapting to emerging attack strategies, and delivering realistic, ongoing assesments of robustness.
6. Improving Benchmarks: To advance benchmarking practices, future efforts should prioritize compre- hensive benchmarks that cover broader range of tasks, domains, languages, modalities (e.g., text, images, or audio), and robustness challenges. These benchmarks should dynamically generate test cases during evaluation to prevent data leakage and rigorously assess adaptability. Equally critical ensuring benchmarks mirror real-world conditions, such as natural distribution shifts, complex user interactions, and multifaceted failure modes, rather than relying on simplistic, artificial pertur- bations. Finally, rigorous validation needed to confirm that benchmarks accurately measure the capabilities they claim to evaluate, avoiding misaligned inflated performance metrics.
Robustness Multimodal and Agentic Systems: Extending robustness rescarch to the unique chal- lenges of MLLMs and emerging LLM-based agent systems, considering factors like tool use, memory, and interaction with environments (Jiang et al., 2025; Yu et al., 2025).
8. Interpretability for Robustness: Leveraging interpretabilityy techniques to better understand why models fail in specific robustness scenarios (e.g., identifying responsible components (Yang et al., 2025b) or internal representations of ruth//ics (Bürger al., 2024)) and using these insights design targeted interventions or more robust architectures like reconstruction attack (Staccy al., 2024; 2022).
35

---

Published in Transactions on Machine Learning Research (11/2025)
In conclusion, while LLMs have demonstrated transformative capabilities, ensuring their robustness remains critical for safe and responsible real-world adoption. Though the field has advanced significantly in diagnosing vulnerabilities and proposing mitigation strategies, fundamental challenges persist. Future progress will depend on four key priorities: (1) deepening theoretical insights into causality and invariance, (2) developing efficient and robust training frameworks that scale with model size, (3) creating adaptive evaluation systems that address evolving failure modes, and (4) extending robustness principles to emerging paradigms like MLLMs and autonomous Al agents. Addressing these challenges systematically will be essential to transition from promising prototypes to trustworthy, reliably deployable AI systems.
7
Conclusion
The field of robust LLMs has moved rapidly from adapting existing ML techniques to developing LLM- specific strategics that address unique challenges like instruction following, alignment, and scalability. In light of these developments, this survey offers a comprehensive overview of Langunge Modell robustness, a critical factor in ensuring their trustworthiness and reliable deployment. We define LLM robustness as a multi-faceted concept that encompasses resilience to adversarial attacks, generalization to distriiditt data, stability under prompt variations, tolcrance to noisy inputs, and output consistency. Our analysis highlights that non-robustness arises from systemic issues spanning the entire LLM lifecycle. We then categorize methods to mitigate these vulnerabilities into four groups based on their deployment stage. Furthermore, we evaluate widely used metrics and benchmarks that have been employed to assess LLM performance across diverse dimensions in recent research. Finally, we outline key challenges for future work, with the goal of advancing LLM reliability and enabling their safe, real-world application.
References
Andrés Abeliuk, Vanessa Gaete, and Naim Bro. Fairness in Ilm-generated surveys, 2025. URL https: 15351.
Aryan Agrawal, Lisa Alazraki, Shahin Honarvar, and Marek Rei. Enhancing 1lm robustness to perturbed instructions: An empirical study, 2025. URL
027333.
Guardrails AI. Guardrails: A python framework for reliable ai applications. https://github..oo com/ 2025. Accessed: 2025-05-16.
quardrails-aa//uardraa
Melissa Ailem, Katerina Marazopoulou, Charlotte Siska, and James Bono. Examining the robustness of Ilm evaluation to the distributional assumptions of benchmarks, 2024. URL https://arxiv.. org/ ab2//444. 16966.
Manar Aljohani, Jun Hou, Sindhura Kommu, and Xuan Wang. A comprehensive survey on the trustworthi- ness of large language models in healthcare, 2025. URL htttps///aaav...rrr/////555.... 15871.
Badr AlKhamissi, Millicent Li, Asli Celikyilmaz, Mona Diab, and Marjan Ghazvininejad. A review on language models as knowledge bases, 2022. URL
Enes Altinisik, Hassan Sajjad, Husrev Sencar, Safa Messaoud, and Sanjay Chawla. Impact of adversarial training on robustness and generalizability of language models. In Anna Rogers, Jordan Graber, and Naoaki Okazaki (eds.). Findings of the Association for Computational Linguisties: ACL 2023, pp. 7828 7840, Toronto, Canada, July 2023. Association for Compulational Linguistics. doi: 10.18653/v /vl 2023. fandiiniinnscc.... 496. URL https: /tt://acaacc //waaaaaahllooyoo..../aa htt.laantoooogoor//222222 org/2023 Findings-acl.de 496/
Usman Anwar, Johannes Von Oswald, Louis Kirsch, David Krueger, and Spencer Frei. Adversarial robustness of in-context learning in transformers for linear regression, 2024. URL https://arxiv http://///axvvooo/////////// org/ /2411 05189.
Suyoung Bac, Hyojun Kim, YunScok Choi, and Jeo-Hyong Lee. Salad: Improving robustness and gener- alization through contrastive learning with structuro-aware and Ilm-driven augmented data, 2025. URL httpe://xxivvvo//aeeee or5/ 12185.
36

---

Published in Transactions on Machine Learning Research (11/2025)
Shuai Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Sibo Song, Kai Dang, Peng Wang, Shijie Wang, Jun Tang, Humen Zhong, Yuanzhi Zhu, Mingkun Yang. Zhaohai Li, Jiangiang Wan, Pengfei Wang, Wei Ding, Zheren Fu, Yiheng Xu, Jiabo Ye, Xi Zhang, Tianbao Xie, Zesen Cheng, Hang Zhang, Zhibo Yang, Haiyang Xu, and Junyang Lin. Qwen2.5-vl technical report, 2025a. URL butps://arxiss org/ abs/2502. 13923.
Tao Bai, Jinqi Luo, Jun Zhao, Bihan Wen, and Qian Wang. Recent advances in adversarial training for adversarial robustness, 2021a. URL https://arxxt www.aiiiioogggbba.ee 01356.
Xiang Bai, Rishi Bommasani, Michihiro Yasunaga et al. Societal implications of foundation models. SSRN Electronic Journal, 2021b. doi:
URL https: /atp:://aappeaa/ee sern, wom//ol3////c///oo////oooo//o/// 2o13/papers.
cfm?abstract cfofabstract__dd374888
Zechen Bai, Pichao Wang, Tianjun Xiao, Tong He, Zongbo Han, Zheng Zhang, and Mike Zheng Shou. Hallucination of multimodal large language models: survey, 2025b. URL https://arxiv. org/ /bs//
2404.18930
Yejin Bang, Samuel Cahyawijaya, Nayeon Lee, Wenliang Dai, Dan Su, Bryan Wilie, Holy Lovenia, Ziwei Ji, Tiezheng Yu, Willy Chung, Quyet V. Do, Yan Xu, and Pascale Fung. A multitask, multilingual, multimodal evaluation of chatgpt on reasoning, hallucination, and interactivity, 2023. URL https://
arxiv. org/orgg///ao. aataaaas/300// //20/.222222...2.
Muneera Bano, Hashini Gunatilake, and Rashina Hoda. What does software engineer look like? exploring societal stereotypes in Ilms, 2025. URL https://arxis: http://xxxvv..rr/aabae wtggabs////eeoo.eo.ooogeee /501 03569.
Qiming Bao, Gael Gendron, Alex Yuxuan Peng, Wanjun Zhong, Neset Tan, Yang Chen, Michael Witbrock, and Jiamou Liu. Assessing and enhancing the robustness of large language models with task structure variations for logical reasoning, 2025. URL https://arxiv. wwtp://.wrrraaaa//1.o.... 09430.
Federico Barbero, Álvaro Arroyo, Xiangming Gu, Christos Perivolaropoulos, Michael Bronstein, Petar Veličković, and Razvan Pascanu. Why do ilms attend to the first token?, 2025. URL https://arxi: org/abs/2504 02732.
Logan Barnhart, Reza Akbarian Bafghi, Stephen Becker, and Maziar Raissi. Aligning to what? limits to rlhf based aligument, 2025. URL https://arste http:://aaavv..ooaaaaaaa/aa/ wrg/abs/25033 htt.b//55000002.
Tommaso Bendinelli, Artur Dox, and Christian Holz. Exploring Ilm agents for cleaning tabular machine learning datasets, 2025. URL https://arrdv..rr/aaa/2222 http:///.wr//aa///50006666. 06664.
Tim Beyer, Sophie Xhonneux, Simon Geisler, Gauthier Gidel, Leo Schwinn, and Stephan Günnemann. Llm-safely evaluations lack robustness, 2025. URL https://arxiv htttp:://axxiv.orr/bbb///////
02574.
Rohan Bhambhoria, Samuel Dahan, Jonathan Li, and Xiaodan Zhu. Evaluating ai for law: Bridging the gap with open-source solutions, 2024. URL / 12349.
Tom B. Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, Sandhini Agarwal, Ariel Herbert- Voss, Gretchen Krueger, Tom Henighan, Rewon Child, Aditya Ramesh, Daniel M. Ziegler, Jeffrey Wu, Clemens Winter, Christopher Hesse, Mark Chen, Eric Sigler, Mateusz Litwin, Scott Gray, Benjamin Chess, Jack Clark, Christopher Berner, Sam McCandlish, Alec Radford, Ilya Sutskever, and Dario Amodei. Language models are few-shot learners, 2020. URL
Lennart Bürger, Fred A. Hamprecht, and Boaz Nadler. Truth is universal: Robust. detection of lies in LLMs. In The Tiihth-eighth Annual Conference on Neural Information Processing Systems, 2024. URL https://openreview www.leewweeeeffoeeeeee net/ffrumm tttp:orrrunndaoFeee2eee
Xiangrui Cai, haidong xu, Sihan Xu, Ying Zhang, and Xiaojie Yuan. Badprompt: Backdoor attacks on continuous prompts. In Alice H. Oh, Alckh Agarwal, Daniclle Belgrave, and Kyunghyun Cho (ods.). Advances in Neural Information Processing Systems, 2022. URL attps://openrer/ net/forum?id
r r1N6f030r..
37

---

Published in Transactions on Machine Learning Research (11/2025)
Riccardo Cantini, Alessio Orsino, Massimo Ruggiero, and Domenico Talia, Benchmarking adversarial ro- bustness to bias elicitation in large language models: Scalable automated assessment with Imm-as-a-judge, 2025. URL
Hongliu Cao. Writing style matters: An examination of bias and fairness in information retrieval systems. Tn Proceedings of the Eighteenth ACM International Conference Web Search and Data Mining, WSDM '25, pp. 136-344. ACM, March 2025. doi: 01.1144//700151.37083333 URL http://dxx //dp:///xx.ooiiooo org/10.1145/ 3701551 3703514.
3703551.3703514.
David Cecchini, Arshaan Nazir, Kalyan Chakravarthy, and Veysel Kocaman. Holistic evaluation of large lan- guage models: Assessing robustness, accuracy, and toxicity for real-world applications. In Anaelia Ovalle, Kai-Wei Chang, Yang Trista Cao, Ninareh Mehrabi, Jieyu Zhao, Aram Galstyan, Jwala Dhamala, Anoop Kumar, and Rahul Gupta (eds.), Proceedings of the 4th Workshop on Trustworthy Natural Language Processing (TrustNNLP 2024), pp. 109- (09-117, Mexico City, Mexico, June 2024. Association for Computational Linguistics. doi: 10. (0.18653/vll wttp//2..t.tttppp//e URL https///aclanthology org/2024. trustalp-1, 11/.
Samuel Jacob Chacko, Sajib Biswas, Chashi Mahiul Islam, Fatema Tabassum Liza, and Xinwen Liu. Ad- versarial atlacks on large language models using regularized relaxation, 2024. URL https://arxixt abs/2410. 19160.
Junyi Chai and Xiaoqian Wang. Fairness with adaptive weights. In Kamalika Chaudhuri, Stefanie Jegelka, Le Song, Csaba Szepesvari, Gang Niu, and Sivan Sabato (eds.), Proceedings of the 39th International Conference on Machine Learning, volume 162 of Proceedings of Machine Learning Rescarch, pp. 2853- 2866. PMLR, 07 2022. URL https://proocedinggn wtt.sssmr..rres//eeeeeeeeeeeseee wwwpprressvvee vvtee//vvv2/////e hh22/22h222.... .tmml.
Bhavik Chandna, Zubair Bashir, and Prochcta Sen. Dissecting bias in Ilms: A mechanistic interpretability perspective, 2025. URL https: //aarv////iiv////a orgg/bs//5066/ 05166.
Daoyuan Chen, Yilun Huang, Zhijian Ma, Hesen Chen, Xuchen Pan, Ce Ge, Dawei Gao, Yuexiang Xie, Zhaoyang Liu, Jinyang Gao, Yaliang Li, Bolin Ding, and Jingren Zhou. Data-juicer: A one-stop data processing system for large language models, 2023a. URL https:
org/abs/ aa//ab//22/ 2309 02033.
Liang Chen, Li Shen, Yang Deng, Xiaoyan Zhao, Bin Liang, and Kam-Fai Wong. Pearl: Towards permutation-resilien llms, 2025a. URL https://arxiv.cr www.eorg/gaaaa.a altaab/2..21122/. 14628.
Shiqi Chen, Yiran Zhao, Jinghan Zhang, 1-Chun Chern, Siyang Gao, Pengfei Liu, and Junxian He. FELM: Benchmarking factuality evaluation of large language models. In Thirty-sevnthh Conference Neural Information Processing Systems Datasets and Benchmarks Track, 2023b. URL https://openrerrer:
net//forum?td-:5077ye....
Xiaoyi Chen, Ahmed Salem, Michael Backes, Shiqing Ma, and Yang Zhang, BadNL: Backdoor attacks against NLP models. In ICML 2021 Workshop on Adversarial Machine Learning, 2021. URL https:
//openreview.netee www.tn/ettm/miioocmm divrumiii
Yen-Chun Chen, Zhe Gan, Yu Cheng, Jingzhou Liu, and Jingjing Liu. Distilling knowledge learned in bert for text generation, 2020. CRL https://arxiv..or org/
Yulin Chen, Haoran Li, Yuan Sui, Yue Liu, Yufei He, Yangqiu Song, and Bryan Hooi. Robustness via referencing: Defending against prompt injection atlacks by referencing the executed instruction, 2025b. URL https: http:///xxvvv.roo// http:or///.......////.../.
Yuyan Chen, Qiang Fu, Yichen Yuan, Zhihao Wen, Ge Fan, Dayiheng Liu, Dongmei Zhang, Zhixu Li, and Yanghua Xiao. Hallucination detection: Robustly discerning reliable answers in large language models, 2024. URL https://arxi..or///abaaa
04121.
DongHyun Choi, Lucas Spangher, Chris Hidey, Peter Grabowski, and Ramy Eskander. Revisiting funnel transformers for modern 1lm architectures with comprehensive ablations in training and inference config- urations, 2025. URL https: //aariv.//.iveee org/abs/2504 02877.
38

---

Published in Transactions on Machine Learning Research (11/2025)
Paul Christiano, Jan Leike, Tom B. Brown, Miljan Martic, Shane Legg, and Dario Amodei. Deep reinforce- ment. learning from human preferences, 2023. URL https: htttt:::/aaxii..oo//aa//////r/ 177.03111.
Leonardo Cotta and Chris J. Maddison. Test-time fairness and robustness in large language models, 2024. URL http://axxvv...gabbbaa/a
076855.
Jiaxi Cui, Munan Ning, Zongjian Li, Bohua Chen, Yang Yan, Hao Li, Bin Ling, Yonghong Tian, and Li Yuan. Chatlaw: A multi-agent collaborative legal assistant with knowledge graph enhanced mixture-of-experts large language model, 2024. URL https:/ http///xxivv.rrr// wwt..og///////eee......o.o abs/aab6..... 16092.
Nico Dahcim, Clara Meister, Thomas Möllcnhoff, and Iryna Gurevych. Uncertainty-awan docoding with minimum bayes risk. In The Thirteenth International Conference on Learning Representations, 2025. URL
https://openrevien www.:n/ettooondddp////ooe 1XyQ.
Sanjay Das, Swastik Bhattacharya, Souvik Kundu, Shamik Kundu, Anand Menon, Arnab Raha, and Kanad
Basu. Genbfa: An evolutionary optimization approach to bit-flip attacks on llms, 2025. URL https: //arxiv. http./.rrr/abb/211.11t. 13757.
José Siqueira de Cerqueira, Kai-Kristian Kemell, Rebekah Rousi, Nannan Xi, Juho Hamari, and Pekka Abrahamsson. Mapping trustworthiness in large language models: A bibliometric analysis bridging theory to practice, 2025. URL https://arxiv. org/ hatpa/b/////000/4/
DeepMind. Gemini 1 technical report. Google DeepMind Report, 2023. URL https://storagg
googleapis. cttllss..cmm//eeeeeeeeeeeeee wwwwdd/eeeidddmneeeeeeeoeoeeeeee
htt////mmmnnnmiinieeee Baanaani/gemnnn___epppoe 1_report.ppppee pdf.
DeepSeek-Ar AI, Aixin Liu, Bei Feng, Bing Xue, Bingxuan Wang, Bochao Wu, Chengda Lu, Chenggang Zhao, Chengqi Deng, Chenyu Zhang, Chong Ruan, Damai Dai, Daya Guo, Dejian Yang, Deli Chen, Dongjic Ji, Erhang Li, Fangyun Lin, Fucong Dai, Fuli Luo, Guangbo Hao, Guanting Chen, Guowei Li, H. Zhang, Han Bao, Hanwei Xu, Haocheng Wang, Haowei Zhang, Honghui Ding, Huajian Xin, Huazuo Gao, Hui Li, Hui Qu, J. L. Cai, Jian Liang, Jianzhong Guo, Jiaqi Ni, Jiashi Li, Jiawei Wang, Jin Chen, Jingchang Chen, Jingyang Yuan, Junjic Qin, Jumlong Li, Junxiao Song, Kai Dong, Kai Hu, Kaige Gao, Kang Guan, Kexin Huang, Kuai Yu, Lean Wang, Lecong Zhang, Lei Xu, Leyi Xia, Liang Zhao, Litong Wang, Liyue Zhang, Meng Li, Miaojun Wang, Mingchuan Zhang, Minghua Zhang, Minghui Tang, Mingming Li, Ning Tian, Panpan Huang, Peiyi Wang, Peng Zhang, Qiancheng Wang, Qihao Zhu, Qinyu Chen, Qiushi Du, R. J. Chen, R. L. Jin, Ruiqi Ge, Ruisong Zhang, Ruizhe Pan, Runji Wang, Runxin Xu, Ruoyu Zhang, Ruyi Chen, S. S. Li, Shanghao Lu, Shangyan Zhou, Shanhuang Chen, Shaoqing Wu,, Shengfeng Ye, Shengfeng Ye, Shirong Ma, Shiyu Wang, Shuang Zhou, Shuiping Yu,, Shunfeng Zhou, Shuting Pan, T. Wang, Tao Yun, Tian Pei, Tianyu Sun, W. L. Xiao, Wangding Zeng, Wanjia Zhao, Wei An, Wen Liu, Wenfeng Liang, Wenjun Gao, Wenqin Yu, Wentao Zhang, X. Q. Li, Xiangyue Jin, Xianzu Wang, Xiao Bi, Xiaodong Liu, Xiaohan Wang, Xiaojin Shen, Xiaokang Chen, Xiaokang Zhang, Xiaosha Chen, Xiaotao Nic, Xiaowen Sun, Xiaoxiang Wang, Xin Cheng, Xin Liu, Xin Xie, Xingchao Liu, Xingkai Yu, Xinnan Song, Xinxia Shan, Xinyi Zhou, Xinyu Yang, Xinyuan Li, Xuecheng Su, Xuheng Lin, Y. K. Ti, Y. Q. Wang, Y. X. Wei, Y. X. Zhu, Yang Zhang, Yanhong Xu, Yanhong Xu, Yanping Huang, Yao Li, Yao Zhao, Yaofeng Sun, Yaohui Li, Yaohui Wang, Yi Yu, Yi Zheng, Yichao Zhang, Yifan Shi, Yiliang Xiong, Ying He, Ying Tang, Yishi Piao, Yisong Wang, Yixuan Tan, Yiyang Ma, Yiyuan Liu, Yongqiang Guo, Yu Wu, Yuan Ou, Yuchen Zhu, Yuduan Wang, Yue Gong, Yuheng Zou, Yujia He, Yukun Zha, Yunfan Xiong, Yunxian Ma, Yuting Yan, Yuxiang Luo, Yuxiang You, Yuxuan Liu, Yuyang Zhou, Z. F. Wu, Z. Z. Ren, Zehui Ren, Zhangli Sha, Zhe Fu, Zhean Xu, Zhen Huang, Zhen Zhang, Zhenda Xie, Zhengyan Zhang, Zhewen Hao, Zhibin Gou, Zhicheng Ma, Zhigang Yan, Zhihong Shao, Zhipeng Xu, Zhiyu Wu, Zhongyu Zhang, Zhuoshu Li, Zihui Gu, Zijia Zhu, Zijun Liu, Zilin Li, Ziwei Xie, Ziyang Song, Ziyi Gao, and Zizheng Pan. Deepseek-v3 technical report, 2025. URL https: / /aaxiv.vvvv.///a org/abs/ taabs/241... 19437.
Bosheng Ding, Chengwei Qin, Ruochen Zhao, Tianze Luo, Xinze Li, Guizhen Chen, Wenhan Xia, Junjic Hu, Anh Tuan Luu, and Shafiq Joly. Data augmentation using LLMs: Data perspectives, learning paradigms and challenges. In Lun-Wet Ku, Andre Martins, and Vivek Srikumar (eds.), Findings of the Association for Computational Linguistics: ACL 2024, pp. 1679-1705, Bangkok, Thailand, August 2024. Association for Computational Linguistics. doi: 10.18653/v /225//////222...//// findings-acl.99 URL 2024. f indings-acl.. .97.
org/
39

---

Published in Transactions on Machine Learning Research (11/2025)
Guosheng Dong, Da Pan, Yiding Sun, Shusen Zhang, Zheng Liang, Xin Wu, Yanjun Shen, Fan Yang, Haoze Sun, Tianpeng Li, Mingan Lin, Jianhua Xu, Yufan Zhang, Xiaonan Nie, Lei Su, Bingning Wang, Wentao Zhang, Jiaxin Mao, Zenan Zhou, and Weipeng Chen. Baichuanseed: Sharing the potential of extensive data collection and doduplication by introducing a competitive large language model baseline, 2024a. URL hattss://arie http:///axxvvv..rabbbessss org/abs/ 2408. 15079.
Hanze Dong, Wei Xiong, Bo Pang, Haoxiang Wang, Han Zhao, Yingbo Zhou, Nan Jiang, Doyen Sahoo, Caiming Xiong, and Tong Zhang. Rlhf workflow: From reward modeling to online rlhf. arXiv preprint arXiv:2405.0788 2024b.
Xin Dong, Yaxin Zhu, Zuohui Fu, Dongkuan Xu, and Gerard de Melo. Data augmentation with adversar- ial training for cross-lingual NLI. In Chengqing Zong, Fei Xia, Wenjie Li, and Roberto Navigli (eds.), Proceedings of the 59th Anmual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers), pp. 3158-5167 Online, August 2021. Association for Computational Linguistics. doi: 10. 10.18653/v112022 www.://.....oo...--.1.1 long.401.
URL https: httpa///acclatthoogoooo http:gg..rgg.......e// acl-loog... 1011
Menguan Du, Fengxiang He, Na Zou, Dacheng Tao, and Xia Hu, Shortcut learning of large language models in natural language understanding, 2023. URL https: /ttp:////axiii . org/ abs//2/s..22/////////////// 11857.
Yuxian Du, Fengxiang He, Yiming Liu, Zhilin Yang, and Jiliang Tang. Towards understanding and evaluat- ing robustness of pre-trained language models for text classification. In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing (EMNLP), pp. 328 336. Association for Compu- pdf.
tational Linguistics, 2022. URL https: cettps:/feegxxaaiie giw.gngghh.ggtttbb.
Kawin Ethayarajh, Winnie Xu, Niklas Muennighoff, Dan Jurafsky, and Douwe Kiela. Kto: Model alignment as prospect theoretic optimization, 2024. CRL http::::///xxxvorr/////// htabs//240.0111 01306.
Xiaojing Fan and Chunliang Tao. Towards resilient and efficient Iims: A comparative study of efficiency, performance, and adversarial robustness, 2024. URL https: //t::i////xvvvvva www.aatww....wa.aaaaooooooo.. orgo/ooggaao.ooeoooo wwwg/abs/2408.000 04585.
Isabel O. Gallegos, Ryan A. Rossi, Joe Barrow, Md Mehrab Tanjin, Sungchul Kim, Franck Dernoncourt, Tong Yu, Ruiyi Zhang, and Nesreen K. Ahmed. Bias and fairness in large language models: A survey, 2024. URL httpp:///rxxvvorr/// http/bbs/23009
Esther Gan, Yiran Zhao, Liying Cheng, Yancan Mao, Anirudh Goyal, Kenji Kawaguchi, Min-Yen Kan, and Michael Shich. Reasoning robustness of llms to adversarial typographical errors, 2024. URL https: // //arxiv. http://bb//211../0///
Aparna Garimella, Akhash Amarnath, Kiran Kumar, Akash Pramod Yalla, Anandhavelu Natarajan, Niyati Chhaya, and Balaji Vasan Srinivasan. He is very intelligent, she is very beautiful? on mitigating social biases in language modelling and generation. In Findings, 2021. URL attps://app semanticscholar. org/CorpusID: : 236477795.
Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al- Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, Amy Yang, Angela Fan, Anirudh Goyal, Anthony Hartshorn, Aobo Yang, Archi Mitra, Archie Sravankumar, Artem Korenev, Arthur Hinsvark, Arun Rao, Aston Zhang, Aurelien Rodriguez, Austen Gregerson, Ava Spataru, Baptiste Roziere, Bethany Biron, Binh Tang, Bobbie Chern, Charlotte Caucheteux, Chaya Nayak, Chloe Bi, Chris Marra, Chris McConnell, Christian Keller, Christophe Touret, Chunyang Wu, Corinne Wong, Cristian Canton Ferrer, Cyrus Nikolaidis, Damien Allonsius, Daniel Song, Danielle Pintz, Danny Livshits, Danny Wyatt, David Esiobu, Dhruv Choudhary, Dhruv Mahajan, Diego Marcia-Olann Diego Perino, Dieuwke Hupkes, Egor Lakomkin, Ehab AlBadawy, Elina Lobanova, Emily Dinan, Eric Michael Smith, Filip Radenovic, Francisco Guzmán, Frank Zhang, Gabriel Synnaeve, Gabrielle Lee, Georgia Lewis Anderson, Govind Thattai, Graeme Nail, Gregoire Mialon, Guan Pang, Guillem Cucurell, Hailey Nguyen, Hannah Korevaar, Hu Xu, Hugo Touvron, Iliaan Zarov, Imanol Arricta Ibarra, Isabel Kloumann, Ishan Misra, Ivan Evti- mov, Jack Zhang, Jade Copet, Jaewon Lee, Jan Geffert, Jana Vranes, Jason Park, Jay Mahadcokar, Jeet Shah, Jelmer van der Linde, Jennifer Billock, Jenny Hong, Jenya Lee, Jeremy Fu, Jianfeng Chi, Jianyu
40

---

Published in Transactions on Machine Learning Research (11/2025)
Huang, Jiawen Liu, Jie Wang, Jiecao Yu, Joanna Bitton, Joe Spisak, Jongsoo Park, Joseph Rocca, Joshua Johnstun, Joshua Saxe, Junteng Jia, Kalyan Vasuden Alwala, Karthik Prasad, Kartikeya Upasani, Kate Plawiak, Ke Li, Kenneth Heafield, Kevin Stone, Khalid El-Arini, Krithika Iyer, Kshitiz Malik, Kuenley Chiu, Kunal Bhalla, Kushal Lakhotia, Lauren Rantala- Yeary, Laurens van der Maaten, Lawrence Chen, Liang Tan, Liz Jenkins, Louis Martin, Lovish Madaan, Lubo Malo, Lukas Blecher, Lukas Landzaat, Luke de Oliveira, Madeline Muzzi, Mahesh Pasupuleti, Mannat Singh, Manohar Paluri, Marcin Kardas, Maria Tsimpoukelli, Mathew Oldham, Mathieu Rita, Maya Pavlova, Melanie Kambadur, Mike Lewis, Min Si, Mitesh Kumar Singh, Mona Hassan, Naman Goyal, Narjes Torabi, Nikolay Bashlykov, Nikolay Bogoychev, Niladri Chatterji, Ning Zhang, Olivier Duchenne, Onur Çelebi, Patrick Alrassy, Pengchuan Zhang, Peng- wei Li, Petar Vasic, Peter Weng, Prajiwal Bhargava, Pratik Dubal, Praveen Krishnan, Punit Singh Koura, Puxin Xu, Qing He, Qingxiao Dong, Ragavan Srinivasan, Raj Ganapathy, Ramon Calderer, Ricardo Sil- veira Cabral, Robert Stojuic, Roberta Raileamu, Rohan Maheswari, Rohit Girdhar, Rohit Patel, Romain Sauvestre, Ronnie Polidoro, Roshan Sumbaly, Ross Taylor, Ruan Silva, Rui Hou, Rui Wang, Saghar Hos- seini, Sahana Chennabasappa, Sanjay Singh, Sean Bell, Seohyun Sonia Kim, Sergey Edunov, Shaoliang Nie, Sharan Narang, Sharath Raparthy, Sheng Shen, Shengye Wan, Shruti Bhosale, Shun Zhang, Simon Vandenhende, Soumya Batra, Spencer Whitman, Sten Sootla, Stephane Collot, Suchin Gururangan, Syd- ney Borodinsky, Tamar Herman, Tara Fowler, Tarek Sheasha, Thomas Georgiou, Thomas Scialom, Tobias Speckbacher, Todor Mihaylov, Tong Xiao, Uijwal Karn, Vedanuj Goswami, Vibhor Gupta, Vignesh Ra- manathan, Viktor Kerkez, Vincent Gonguet, Virginie Do, Vish Vogeti, Vitor Albiero, Vladan Petrovic, Weiwei Chu, Wenhan Xiong, Wenyin Fu, Whitney Meers, Xavier Martinet, Xiaodong Wang, Xiaofang Wang, Xiaoqing Ellen Tan, Xide Xia, Xinfeng Xie, Xuchao Jia, Xuewei Wang, Yaelle Goldschlag, Yashesh Gaur, Yasmine Babaei, Yi Wen, Yiwen Song, Yuchen Zhang, Yue Li, Yuning Mao, Zacharie Delpierre Coudert, Zheng Yan, Zhengxing Chen, Zoe Papakipos, Aaditya Singh, Aayushi Srivastava, Abha Jain, Adam Kelsey, Adam Shajnfeld, Adithya Gangidi, Adolfo Victoria, Ahuva Goldstand, Ajay Menon, Ajay Sharma, Alex Boesenberg, Alexei Baevski, Allie Feinstein, Amanda. Kallet, Amit Sangani, Amos Teo, Anam Yunus, Andrei Lupu, Andres Alvarado, Andrew Caples, Andrew Gu, Andrew Ho, Andrew Poulton, Andrew Ryan, Ankit Ramehandani, Annie Dong, Annie Franco, Anuj Goyal, Aparajita Saraf, Arka- bandhu Chowdhury, Ashley Gabriel, Ashwin Bharambe, Assaf Eisemman, Azadeh Yazdan, Beau James, Ben Maurer, Benjamin Leonhardi, Bernie Huang, Beth Loyd, Beto De Paola, Bhargavi Paranjape, Bing Liu, Bo WI, Boyu Ni, Braden Hancock, Bram Wasti, Brandon Spence, Brani Stojkovic, Brian Gamido, Britt Montalvo, Carl Parker, Carly Burton, Catalina Mejia, Ce Liu, Changhan Wang, Changkyu Kim, Chao Zhou, Chester Hu, Bhing-Hssing Chu, Chris Cai, Chris Tindal, Christoph Feichtenhofer, Cynthia Gao, Damon Civin, Dana Beaty, Daniel Kreymer, Daniel Li, David Adkins, David Xu, Davide Testuggine, Delia David, Devi Parikh, Diana Liskovich, Didem Foss, Dingkang Wang, Duc Le, Dustin Holland, Ed- ward Dowling, Fissa Jamil, Elaine Montgomery, Elconora Presani, Emily Hahn, Emily Wood, Eric-Tuan Le, Erik Brinkman, Esteban Arcaute, Evan Dunbar, Evan Smothers, Fei Sun, Felix Kreuk, Feng Tian, Filippos Kokkinos, Firat Ozgenel, Francesco Caggioni, Frank Kanayet, Frank Seide, Gabriela Medina Flo- rez, Gabriella. Schwarz, Gada Badeer, Georgia Swee, Gil Halpern, Grant Herman, Grigory Sizov, Guangyi, Zhang, Guna Lakshminarayanan, Hakan Inan, Hamid Shojanazori, Han Zou, Hannah Wang, Hanwen Zha, Haroun Habeeb, Harrison Rudolph, Helen Suk, Henry Aspegren, Hunter Goldman, Hongyuan Zhan, Ibrahim Damlaj, Igor Molybog, Igor Tufanov, Ilias Leontiadis, Irina-Elent Veliche, Itai Gat, Jake Weiss- man, James Geboski, James Kohli, Janice Lam, Japhet Asher, Jcan- Baptist Gaya, Jeff Marcus, Jeff Tang, Jennifer Chan, Jenny Zhen, Jeremy Reizenstein, Jeremy Teboul, Jessica Zhong, Jian Jin, Jingyi Yang, Joe Cummings, Jon Carvill Jon Shepard, Jonathan McPhie, Jonathan Torres, Josh Ginsburg, Junjie Wang, Kai Wu, Kam Hou U, Karan Saxena, Kartikay Khandelwal, Katayoun Zand, Kathy Matosich, Kaushik Vecraraghavan, Kelly Michelena, Keqian Li, Kiran Jagadeesh, Kun Huang, Kunal Chawla, Kyle Huang, Lailin Chen, Lakshya Garg, Lavender A, Leandro Silva, Lee Bell, Tei Zhang, Liangpeng Guo, Licheng Yu, Liron Moshkovich, Luca Wehrstedt, Madian Khabsa, Manav Avalani, Manish Bhatt, Martynas Mankus, Matan Hasson, Matthew Lennie, Matthias Reso, Maxim Groshev, Maxim Naumov, Maya Lathi, Meghan Keneally, Miao Liu, Michael L. Seltzer, Michal Valko, Michelle Restrepo, Mihir Patel, Mik Vyatskov, Mikayel Samvelyan, Mike Clark, Mike Macey, Mike Wang, Miquel Jubert Hermoso, Mo Metanat, Moham- mad Rastegari, Munish Bansal, Nandhini Santhanam, Natascha Parks, Natasha White, Navyata Bawa, Nayan Singhal, Nick Egebo, Nicolas Usunier, Nikhil Mehta, Nikolay Pavlovich Laptev, Ning Dong, Nor- man Cheng, Oleg Chernoguz, Olivia Hart, Omkar Salpekar, Ozlem Kalinli, Parkin Kent, Parth Parekh,
41

---

Published in Transactions on Machine Learning Research (11/2025)
Paul Saab, Pavan Balaji, Pedro Rittner, Philip Bontrager, Pierre Roux, Piotr Dollar, Polina Zvyag- ina, Prashant Ratanchandani, Pritish Yuvraj, Qian Liang, Rachad Alao, Rachel Rodriguez, Rafi Ayub, Raghotham Murthy, Raghu Nayani, Rahul Mitra, Rangaprabhu Parthasarathy, Raymond Li, Rebekkah Hogan, Robin Battey, Rocky Wang, Russ Howes, Ruty Rinott, Sachin Mchta, Sachin Siby, Sai Jayesh Bondu, Samyak Datta, Sara Chugh, Sara Hunt, Sargun Dhillon, Sasha Sidorov, Satadru Pan, Saurabh Mahajan, Saurabh Verma, Seiji Yamamoto, Sharadh Ramaswamy, Shaun Lindsay, Shaun Lindsay, Sheng Feng, Shenghao Lin, Shengxin Cindy Zha, Shishir Patil, Shiva Shankar, Shuqiang Zhang, Shuqiang Zhang, Sinong Wang, Sneha Agarwal, Soji Sajuyigbe, Soumith Chintala, Stephanie Max, Stephen Chen, Steve Kehoe, Steve Satterfield, Sudarshan Govindaprasad, Sumit Gupta, Summer Deng, Sungmin Cho, Sunny Virk, Suraj Subramanian, Sy Choudhury, Sydney Goldman, Tal Remez, Tamar Glaser, Tamara Best, Thilo Koehler, Thomas Robinson, Tianhe Li, Tianjun Zhang, Tim Matthews, Timothy Chou, Tzook Shaked, Varun Vontimitta, Victoria Ajayi, Victoria Montanez, Vijai Mohan, Vinay Satish Kumar, Vishal Mangla, Vlad Ionescu, Vlad Poenaru, Vlad Tiberiu Mihailescu, Vladimir Ivanov, Wei Li, Wenchen Wang, Wenwen Jiang, Wes Bouaziz, Will Constable, Xiaocheng Tang, Xiaojian Wu, Xiaolan Wang, Xilun Wu, Xinbo Gao, Yaniv Kleinman, Yanjun Chen, Ye Hu, Ye Jia, Ye Qi, Yenda Li, Yilin Zhang, Ying Zhang, Yossi Adi, Youngjin Nam, Yu, Wang, Yu Zhao, Yuchen Hao, Yundi Qian, Yunlu Li, Yuzi He, Zach Rait, Zachary DeVito, Zef Rosnbrick, Zhaoduo Wen, Zhenyu Yang, Zhiwei Zhao, and Zhiyu Ma. The llama 3 herd of models, 2024. URL https: // //aaaaxvvvoorr/e//aa//./.......a
21783.
Jiawei Gu, Xuhui Jiang, Zhichao Shi, Hexiang Tan, Xuehao Zhai, Chengjin Xu, Wei Li, Yinghan Shen, Shengjie Ma, Honghao Liu, Saizhuo Wang, Kun Zhang, Yuanzhuo Wang, Wen Gao, Lionel Ni, and Jian Guo. A survey on llm-as-a-judge, 2025. URL
15594.
Kevin Gu, Eva Tuecke, Dmitriy Katz, Raya Horesh, David Alvarcz-Molis, and Mikhail Yurochkin, Chared: Character-wise ensemble decoding for large language models, 2024. URL https: org/abs/2407. 11009.
Zishan Guo, Renren Jin, Chuang Liu, Yufei Huang, Dan Shi, Supryadi, Linhao Yu, Yan Liu, Jiaxuan Li, Bojian Xiong, and Deyi Xiong. Evaluating large language models: A comprehensive survey, 2023. URL 19736.
https://arxiv http:///axxvvv..aaaaaeee
Aman Gupta, Shao Tang, Qingquan Song, Sirou Zhu, Jiwoo Hong, Ankan Saha, Viral Gupta, Noah Lee, Eunki Kim, Siyu Zhu, Parag Agrawal, Natesh Pillai, and S. Sathiya Keerthi. Alphapo reward shape matters for Ilm aligmment, 2025. URL https: //axxiv///////////// org/
Simeng Han, Hailey Schoelkopf, Yilun Zhao, Zhenting Qi, Martin Riddell, Wenfei Zhou, James Coady, David Peng, Yujie Qiao, Luke Benson, Lucy Sun, Alex Wardle-Solano, Hannah Szabo, Ekaterina Zubova, Matthew Burtell, Jonathan Fan, Yixin Liu, Brian Wong, Malcolm Sailor, Ansong Ni, Linyong Nan, Jungo Kasai, Tao Yu, Rui Zhang, Alexander R. Fabbri, Wojeiech Kryscinski, Semih Yavuz, Ye Liu, Xi Victoria Lin, Shafiq Joty, Yingbo Zhou, Caiming Xiong, Rex Ying, Arman Cohan, and Dragomir Radev. Folio: Natural language reasoning with first-order logic, 2024. URL https: //arii/////ii////aa org/ arggabs///ee 2000000000000000.....
Michael Hassid, Tal Remez, Jonas Gehring, Roy Schwartz, and Yossi Adi The larger the better? improved Ilm node-generation via budget reallocation, 2024. CRL https: www.aaiwwi.....aaaaaa.a.oa wttp:o/////.../000///0/
Kai He, Rui Mao, Qika Lin, Yucheng Ruan, Xiang Lan, Mengling Feng, and Erik Cambria. A survey of large language models for healthcare: from data, technology, and applications to accountability and ethics, 2025. URL https: :
22100. 05694.
Michael Heck, Christian Geishauser, Nurul Lubis, Carel van Niekerk, Shutong Feng, Hsien-Chin Lin, Ben- jamin Matthias Ruppik, Renato Vukovic, and Milica Gašié. Learning from noisy labels via self-tanght on-the-fly meta loss rescaling, 2024. URL https://arrt httpp:///axxiv.oor/////222
David Horrers-Poyatos, Carlos Peláez- González, Cristina Zuheros, Andrés Herrera-Poyatos Virilo Tejedor, Francisco Herrera, and Rosana Montes. An overview of model uncertainty and variability in llmob sentiment analysis. challenges, mitigation strategies and the role of explainability, 2025. URL https: 04462.
42

---

Published in Transactions on Machine Learning Research (11/2025)
Jiwoo Hong, Noah Lee, and James Thorne. Orpo: Monolithic preference optimization without reference model, 2024. URL https:://arxit org/ wrggorsg//////eeee/ooo http:/2433.069990
Jiwoo Hong, Noah Lee, Eunki Kim, Guijin Son, Woojin Chung, Aman Gupta, Shao Tang, and James Thorne. On the robustness of reward models for language model aligument, 2025. URL httpa: htapa://aaa /arxxvxxvvvv//////// org/ abs/ 2505. 07271.
Nikolaus Howe, Ian McKenzie, Oskar Hollinsworth, Michal Zajac, Tom Tseng, Aaron Tucker, Pierre-Lue Bacon, and Adam Gleave. Scaling trends in language model robustness, 2025. URL https://arxiv.. org/ 2401..121......
Yuchen Hu, CHEN CHEN, Chao-Han Huck Yang, Ruizhe Li, Chao Zhang, Pin-Yu Chen, and EngSiong Chng. Large language models are efficient learners of noisc-robust speech recognition. In The Twelfth International Conference on Learning Representations, 2024. URL stttp:://pennrviie..ntttt net/forum?id= ceATjGPTUD.
Tiansheng Huang, Sihao Hu, Fatih Ilhan, Selim Furkan Tekin, Zachary Yahn, Yichang Xu, and Ling Liu. Safety tax: Safety alignment makes your large reasoning models less reasonable, 2025. URL https: 00555.
//arxiv. Wlaaaii.org/aaaeeeeeeeeaeaa
Yue Huang, Lichao Sun, Haoran Wang, Siyuan Wu, Qihui Zhang, Yuan Li, Chujic Gao, Yixin Huang, Wenhan Lyu, Yixuan Zhang, Xiner Li, Zhengliang Liu, Yixin Liu, Yijue Wang, Zhikun Zhang, Bertie Vidgen, Bhavya Kailkhura, Caiming Xiong, Chaowei Xiao, Chunyuan Li, Eric Xing, Furong Huang, Hao Liu, Heng Ji, Hongyi Wang, Huan Zhang, Huaxiu Yao, Manolis Kellis, Marinka Zitnik, Meng Jiang, Mohit Bansal, James Zou, Jian Pei, Jian Liu, Jianfeng Gao, Jiawei Han, Jicyu Zhao, Jiliang Tang, Jindong Wang, Joaquin Vanschoren, John Mitchell, Kai Shu, Kaidi Xu, Kai-Wei Chang, Lifang He, Lifu Huang, Michael Backes, Neil Zhenqiang Gong, Philip S. Yu, Pin-Y Yu Chen, Quanquan Gu, Ran Xu, Rex Ying, Shuiwang Ji, Suman Jana, Tianlong Chen, Tianming Liu, Tianyi Zhou, William Wang, Xiang Li, Xiangliang Zhang, Xiao Wang, Xing Xie, Xun Chen, Xuyn Wang, Yan Liu, Yanfang Ye, Yinzhi Cao, Yong Chen, and Yue Zhao. Trust]lm: Trustworthiness in large language models, 2024a. URL https: ttttps://ante //apsiv///xvv../// wwwxiivoorg..o .ow.oogg//aa............. abs /a//bbb//24000 2401.00561..
Yukun Huang, Yixin Liu, Raghuveer Thirukovalluru, Arman Cohan, and Bhuwan Dhingra. Calibrating long-form generations from large language models. In Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen (eds.), Findings of the Association for Computational Linguistics: EMNLP 2024, pp. 13441-13466 Miami, Florida, USA, November 2024b. Association for Computational Linguisties. doi: 10.18653/v1/ 2024. fi2d.iindings-o www.iings-cnnll.7585558 emnlp.785. URL https: httaaaaaaaacoooooooroooooa
findings madingg--mmnp.7e5 70m/p.785/.
Nandan Kumar Jha and Brandon Reagen. Aero: Softmax-only lims for efficient private inference, 2024. URL
https://arxiv. org/abs/ has//bb//22// /2b10.2240...2 13060.
Chengze Jiang, Zhuangzhuang Wang, Minjing Dong, and Jie Gui. Survey of adversarial robustness in multimodal large language models, 2025. URL https://arxixi wwweexiv..org/eee http//bb/25503 139./
Nan Jiang, Qi Li, Lin Tan, and Tianyi Zhang. Collu-bench: A benchmark for predicting language model hallucinations in code, 2024. URL atttp:///aziiii http://axxvvv./aaaaaaa ab2///10.22200...//// 09997.
Ziyu Jiang, Tianlong Chen, Ting Chen, and Zhangyang Wang. Robust pre-training by adversarial rastivee learning, 2020. URL http:///aarii...or////////0.0.. 13337.
Dahyun Jung, Seungyoon Lee, Hyeonseok Moon, Chanjun Park, and Heuiseok Lim. Flex: benchmark for evaluating robustness of fairness in large language models, 2025. URL https://aarat org/ 225003.. 19540.
Ashraf Kamal, Tarique Anwar, Vincet Kumar Sejwal, and Mohd Fazil. Bicapshate: Attention to the linguistic context of hate via bidirectional capsules and hatebase. IEEE Transactions on Computational Social 1722,
Systems, 11(2):1781-111 1792, April 2024. ISSN 2329-924X. doi: 221100//CSSS2222332222
43

---

Published in Transactions on Machine Learning Research (11/2025)
Rabech Karimi Mahabadi, Yonatan Belinkov, and James Henderson. End-to-end bias mitigation by mod- elling biases in corpora. In Dan Jurafsky, Joyce Chai, Natalie Schluter, and Joel Tetreault (eds.); Proceedings of the 58th Annual Meeting of the Association for Computational Linguistics, pp. 8706 8716, Online, July 2020. Association for Computational Linguistics. doi: /tt5:///111222.acl//// URL httpp::/acclanthologg. otg/2020.acl1 macl-main..ee 769//
Aobo Kong, Wentao Ma, Shiwan Zhao, Yongbin Li, Yuchuan Wu, Ke Wang, Xiaoqian Liu, Qicheng Li, Yong Qin, and Fei Huang, Sdpo: Segment-level direct preference optimization for social agents, 2025. URL 01821.
https://arxiv.
Daniel Kuhn, Soroosh Shafiee, and Wolfram Wiesemann. Distributionally robust oplimization, 2025. URL https://arxiv, wttp://www...gp//////.a....... 02549.
Aounon Kumar, Chirag Agarwal, Suraj Srinivas, Aaron Jiaxun Li, Soheil Feizi, and Himabindu Lakkaraju. Cortifying Ilm safety against adversarial prompting, 2025a. URL https: //arxivv wttpaaawwwww..aaaa//aaar wwggabs////eeeeoooeooooooeeeeer/ /209 200..02000....... 02705.
Komal Kumar, Tajamul Ashraf, Omkar Thawakar, Rao Muhammad Auwer, Hisham Cholakkal, Mubarak Shah, Ming- Hsuan Yang, Phillip H. S. Torr, Fahad Shahbaz Khan, and Salman Khan. Lim post-training: A deep dive into reasoning large language models, 2025b. URL https: //trxaaaaavvv///a//////eeeeaaaaa org/abs/2502 21321.
Vedang Lad, Wes Gurnee, and Max Tegmark. The remarkable robustness of Ilms: Stages of inference?, 2024.
URL https: http///xxvvvv/////. wwwpoogg//bbbaaeeeeeee 19384.
Hugo Laurençon, Lucile Saulnier, Thomas Wang, Christopher Akiki, Albert Villanova del Moral, Teven Le Scao, Leandro Von Werra, Chenghao Mou, Eduardo González Ponferrada, Huu Nguyen, Jörg Frohberg, Mario Saško, Quentin Lhoest, Angelina McMillan-Major, Gerard Dupont, Stella Biderman, Anna Rogers, Loubna Ben allal, Francesco De Toni, Giada Pistilli, Olivier Nguyen, Somaich Nikpoor, Maraim Masoud, Pierre Colombo, Javier de Rosa, Paulo Villegas, Tristan Thrush, Shayne Longpre, Sebastian Nagel, Leon Weber, Manuel Muñoz, Jian Zhu, Daniel Van Strien, Zaid Alyafcai, Khalid Almubarak, Minh Chien Vu, Itziar Gonzalez-Dios, Aitor Soroa, Kyle Lo, Manan Dey, Pedro Ortiz Suarez, Aaron Gokaslan, Shamik Bose, David Adelani, Long Phan, Hieu Tran, lan Yu, Suhas Pai, Jenny Chim, Violette Lepercq, Suzana Tlic Margaret Mitchell, Sasha Alexandra Luccioni, and Yacine Jernite. The bigscience roots corpus: A 1.6tb composite multilingual dataset, 2023. URL
Dongryeol Lee, Yerin Hwang, Yongi-Mi Kim, Joonsuk Park, and Kyomin Jung. Are I1n-judges robust to expressions of uncertainty? investigating the effect of epistemic markers on llmebased evaluation. ArXiv, abs/2410.20074, 2024a. URL attps::/appl semanticscholar org orggCorpusslaC ID: 2733555884..
Jean Lee, Nicholas Stevens, and Soyeon Caren Han. Large language models in finance (finllms). Neural Computing and Applications, Jamuary 2025. ISSN 1433-3058. doi: 10.10077/000521-004--0000 10495-9 URL
http://dx.ddw doi. http:///x..oi..r//1..../..../ 00070/000021002-110000000
Jich-Sheng Lee. Lexgpt 0.1: pre-trained gpt-j models with pile of law, 2023. URL https://arxiv.org/
abs/2306. 05431.
Scanie Loe, Hacbin Scong, Dong Bok Lee, Minki Kang, Xiaoyin Chen, Dominik Wagner, Yoshua Bengio, Juho Lee, and Sung Ju Hwang. Harmaug: Effective data augmentation for knowledge distillation of safety guard models. ArXiv, abs/2410.01524, 2024b. URL https: www.sticscoooeee...... org/ CorpusID: 273025699.
Will LeVine, Benjamin Pikus, Anthony Chen, and Scan Hendryx. A bascline analysis of reward models' ability to accurately analyze foundation models under distribution shift, 2024. URL https: http://///xxvvo///// abs/2311. 14743.
Hao Li, Liuzhenghao Lv, He Cao, Zijing Liu, Zhiyuan Yan, Yu Wang, Yonghong Tian, Yu Li, and Li Yuan. How to detect and defeat molecular mirage: A metric-driven benchmark for hallucination in llm-based molecular comprehension, 2025a. URL /ttp///rvv..orgas////////// 12314.
44

---

Published in Transactions on Machine Learning Research (11/2025)
Junyi Li, Xiaoxue Cheng. Wayne Xin Zhao, Jian-Yun Nie, and Ji-Rong Wen. Halueval: A large-scale hallucination evaluation benchmark for large language models, 2023. URL https://arxiv: wwtpeiiiiorr//bbba 2305. 11747.
org/ abs/
Lin Li, Yifei Wang, Chawin Sitawarin, and Michael W. Spratling, OODRobustbench: a benchmark and large- scale analysis of adversarial robustness under distribution shift. In Forty-first International Conference on Machine Learning, 2024a. URL attps://openrett wtwp:/arrwwee..eeeeooolllllaaene nett/forun/dddAAeeeiiie
Miaomiao Li, Hao Chen, Yang Wang. Tingyuan Zhu, Weijia Zhang, Kaijie Zhu, Kam-Fai Wong, and Jindong Wang. Understanding and mitigating the bias inheritance in Ilm-based data augmentation downstream tasks, 2025b. URL https: /awpiv.r.vvvv//////////...//aav httg/abs/2502. 2541104412......
Qintong Li, Leyang Cui, Xueliang Zhao, Lingpeng Kong, and Wei Bi. GSM-plus: A comprehensive bench- mark for evaluating the robustness of LLMs as mathematical problem solvers. In Lun-Wei Ku, An- dre Martins, and Vivek Srikumar (eds.), Proceedings of the 62nd Annual Meeting of the Association for Computational Linguisties (Volume 1: Long Papers), pp- 196112984,, Bangkok, Thailand, August 2024b. Association for Computational Linguistics. doi: 10.18653 /220///////2222aal-/aa long. URL https: / //aclanthology. org/2024 wee2222422c11100 mon--ong.... 163/.
Qiongxiu Li, Xiaoyu Luo, Yiyi Chen, and Johannes Bjerva. Trustworthy machine learning via memorization and the granular long-tail: A survey on interactions, tradeoffs, and beyond, 2025c. URL https: ptatpa///arxiv org/abs/250$ 07501.
Xuran Li, Peng Wu, and Jing Su. Accurate fairness: Improving individual fairness without trading accuracy, 2022. URL https: //ariiv.///////e/aaeeaaeaeemme org/ hbs///b////// 22o00//220..022 08704.
Yinheng Li, Shaofei Wang, Han Ding, and Hang Chen. Large language models in finance: A survey, 2024c. 10723.
URL https: //axxiv org/
Yue Li, Xiao Li, Hao Wu, Minghui Xu, Yue Zhang, Xiuzhen Cheng, Fengyuan Xu, and Shong Zhong, Everything you wanted to know about Ilm-based vulnerability detection but were afraid to ask, 2025d.
URL https: http:///axxvvvvvee www./rgg///bbbeeeeeeeeeeeeeeeeee 13474.
Zekun Li, Baolin Peng, Pengcheng He, and Xifeng Yan. Evaluating the instruction-folllwwin robustness of large language models to prompt injection. In Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen (eds.), Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pp. 557-568, Miami, Florida, USA, November 2024d. Association for Computational Linguistics. doi: 10. 18653/v1 /222222222l22mmmm.
URL https: http::///cclatholooyy org/2024. mam.mm33....33
ZiKe Li, Mingwei Liu, Anji Li, Kaifeng He, Yanlin Wang, Xin Peng, and Zibin Zheng. Enhancing the rosustness of Ilm-generated code: Empirical study and framework. arXiv preprint arXiv:2503.20197, March 2025c. doi: 10.48550/arXiw.2555 250...2999..
Jongin Lim, Youngdong Kim, Byungjai Kim, Chanho Ahn, Jinwoo Shin, Eunho Yang, and Seungju Han. Biasadv: Bias-adversarial augmentation for model debiasing. In 2023 IEEE/CVT Conference on Computer Vision and Pattern Recognition (CVPR), pp. 3832 3841, 2023. doi: 10.1109/CVPRS220 wCWPRC27292022..00222 2023.0033..
Feng Lin, Dong Jae Kim, Tse-Husn, and Chen. Soen-101: Code generation by emulating software process models using large language model agents, 2024a. URL https: /ttp:///a/vvv///////a/eeeeeaaa.r arggabs///ee 15852.
Yong Lin, Hangyu Lin, Wei Xiong, Shizhe Diao, Jianmeng Liu, Jipeng Zhang, Rui Pan, Haoxiang Wang, Wenbin Hu, Hanning Zhang, Hanze Dong, Renjie Pi, Han Zhao, Nan Jiang, Heng Ji, Yuan Yao, and Tong Zhang. Mitigating the alignment tax of rlhf, 2024b. URL https://arrs www.ii..og/aaaaeee argg/bs//300 wttpaa/.../......5.03
Fang Liu, Yang Liu, Lin Shi, Houkun Huang, Ruifeng Wang, Zhen Yang, Li Zhang, Zhongqi Li, and Yuchi Ma. Exploring and evaluating hallucinations in llm-peeered code generation, 2024a. URL https:// arxiv.org// httpg/abs/24444099/
45

---

Published in Transactions on Machine Learning Research (11/2025)
Tianyuan Liu and Yuqing Sun. End-to-end adversarial sample generation for data augmentation. In Houda Bouamor, Juan Pino, and Kalika Bali (eds.), Findings of the Association for Computational Linguisties: EMNLP 2023, pp. 11359 11368, Singapore, December 2023. Association for Computational Linguisties. doi: 10.18653/v1 /t/////1////////// mondings-cmnlp.7000 URL https://aclanthology wwwp:/2......./// findings-emiin emmlp. 760/.
Xiaodong Liu, Hao Cheng, Pengcheng He, Weizhu Chen, Yu Wang, Hoifung Poon, and Jianfeng Gao. Adversarial training for large neural language models, 2020. URL https://araae org/abs//004 08994.
Xiaoxia. Liu, Jingyi Wang, Jun Sun, Xiaohan Yuan, Guoliang Dong, Peng Di, Wenhai Wang, and Dongxia Wang. Prompting frameworks for large language models: A survey, 2023. URL 2311.12785.
org/abs/
Yang Liu, Yuanshun Yao, Jean-Francois Ton, Xiaoying Zhang, Ruocheng Guo, Hao Cheng, Yegor Klochkov, Muhammad Faaiz Taufiq, and Hang Li. Trustworthy 1lms: survey and guideline for evaluating large language models' alignment, 2024b. URL attps://arxiv. org/ wwt..orgg//b//////// httpa/bb//////5/5/ 05374.
Shuo Lu, Yingsheng Wang, Lijum Sheng, Aihua Zheng, Lingxiao Hc, and Jian Liang. Recent advances ood detection: Problems and approaches, 2024. URL https: //arxiv org/abs/ htgg//bb/2409// 11884.
Junyu Luo, Xiao Luo, Kaize Ding, Jingyang Yuan, Zhiping Xiao, and Ming Zhang. Robustft: Robust supervised fine-tuning for large language models under noisy response, 2024. URL abs 22s/2411..19922
Ziyang Ma, Zuchao Li, Lefei Zhang, Gui-Song Xia, Bo Du, Liangpei Zhang, and Dacheng Tao. Model hemorrhage and the robustness limits of large language models, 2025. URL https: org/ /bs// 23924.
Matéo Mahaut, Laura Aina, Paula Czarnowska, Momchil Hardalov, Thomas Müller, and Lluis Marquez. Factual confidence of Iims: on reliability and robustness of current estimators. In Proceedings of the 62nd Anmual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 4554 4570. Association for Computational Linguistics, 2024. doi: /0.18653//1/2222aacc http://dx. doi. org/10. 118633/11/222..c11111 250. 250.
URL
Harsh Maheshwari, Srikanth Tenmeti, and Alwarappan Nakkiran. Citefix: Enhancing rag accuracy through post-processing citation correction, 2025. URL https: //tp:///aavvvv/iaa /tt////aaaiiraaaaaa//a/a/aaaaaaa org/abs/2504. 15629.
Manuj Malik, Jing Jiang, and Kian Ming A. Chai. An empirical analysis of the writing styles of persona- assigned LLMs. In Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen (ods.), Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pp. November 2024. Association for Computational Linguistics. doi: 10. 10.18633 http://////2224.mmmmmaaa 1079. URL https:
Miami, Florida, USA,
1122222..mmlpmmaaeem. emnlp-main. 1079/
Rohin Manvi, Anikait Singh, and Stefano Ermon. Adaptive inference-time compute: Lims can predict if they can do better, even mid-generation, 2024. URL htttps:/aarti http///axvvvv../ org/ arrg/bbs// abss/2100.000
Emily McMilin. Selection bias induced spurious correlations in large language models. In ICML 2022: Workshop on Spurious Correlations, Invariance and Stability, 2022. URL
net/
forum?id= Snn.DvvUUn..
Ninareh Mehrabi, Fred Morstatter, Nripsuta Saxena, Kristina Lerman, and Aram Galstyan. A survey on bias and fairness in machine learning, 2022. URL https://arxiv wrg. 1b661.9...6655..
Mayank Mishra, Mall Stallone, Gaoyuan Zhang, Yikang Shen, Aditya Prasad, Adriana Meza Soria, Michele Merler, Parameswaran Selvam, Saptha Surendran, Shivdeep Singh, Manish Sethi, Xuan-Hong Dang, Pengyuan Li, Kun-Lung Wu, Syed Zawad, Andrew Coleman, Matthew White, Mark Lewis, Raju Pavuluri, Yan Koyfman, Boris Lublinsky, Maximilien de Bayser, Ibrahim Abdclaziz, Kinjal Basu, Mayank Agarwal, Yi Zhou, Chris Johnson, Aanchal Goyal, Hima Patel, Yousaf Shah, Petros Zerfos, Heiko Ludwig, Asim
46

---

Published in Transactions on Machine Learning Research (11/2025)
Munawar, Maxwell Crouse, Pavan Kapanipathi, Shweta Salaria, Bob Calio, Sophia Wen, Seetharami See- lam, Brian Belgodere, Carlos Fonseca, Amith Singhee, Nirmit Desai, David D. Cox, Ruchir Puri, and Rameswar Panda. Granite code models: A family of open foundation models for code intelligence, 2024. URL https: // /ttpxvaxvvvv////////////////waa. www.vv.rgg/abb. org/abs/2405 243244434......
Ningping Mou, Xinli Yuc, Lingchen Zhao, and Qian Wang. Fairness is essential for robustnoss: fair adversarial training by identifying and augmenting hard examples. Frontiers of Computer Science, 19(3):193803 November 2024. ISSN 2095-2236. doi: 10.1007//11 17000024377---
Dor Muhlgay, Ori Ram, Inbal Magar, Yoav Levine, Nir Ratner, Yonatan Belinkov, Omri Abend, Kevin Leyton- Broonn Amnon Shashua, and Yoav Shoham. Generating benchmarks for factuality evaluation of language models, 2024. URL https:t:://. / wwtp:///w.abb.....o/.// 06908.
Vaishnawh Nagarajan, Anders Andreassen, and Behnam Neyshabur. Understanding the failure modes of out-of-distribution generalization, 2024. URL
15775.
Grigor Nalbandyan, Rima Shahbazyan, and Evelina Bakhturina. Score: Systematic consistency and robust- ness evaluation for large language models, 2025. URL
0013.
Alireza Nik, Michael A. Riegler, and Pål Halvorsen. Energy-conscious 1lm decoding: Impact of text generation strategies on gpu energy consumption, 2025. URL httpp:///ariii..rr//a///220...
Soyoung Oh and Vera Demberg. Robustness of large language models in moral judgements, Apr 2025. URL btttps://mme ncbi nlm. nih www.ggo//ariiii /tt.:////rrrlclle/////1111111//
OpenAT, Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Igge Akkaya, Florencia Looni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, Red Avila, Igor Babuschkin, Suchir Balaji, Valerie Balcom, Paul Baltescu, Haiming Bao, Mohammad Bavarian, Jeff Belgum, Trwan Bello, Jake Berdine, Gabriel Bernadett-Shapirg Christopher Berner, Lenny Bogdonoff, Oleg Boiko, Madelaine Boyd, Anna-Luisa Brakman, Greg Brockman, Tim Brooks, Miles Brundage, Kevin Button, Trevor Cai, Rosie Campbell, Andrew Cann, Brittany Carey, Chelsea Carlson, Rory Carmichael, Brooke Chan, Che Chang, Fotis Chantzis, Derek Chen, Sully Chen, Ruby Chen, Jason Chen, Mark Chen, Ben Chess, Chester Cho, Casey Chu, Hyung Won Chung, Dave Cummings, Jeremiah Currier, Yunxing Dai, Cory Decareaux, Thomas Degry, Noah Deutsch, Damien Deville, Arka Dhar, David Dohan, Steve Dowling, Sheila Dumming, Adrien Ecoffet, Atty Eleti, Tyna Floundou, David Farhi, Liam Fedus, Niko Felix, Simón Posada Fishman, Juston Forte, Isabella Fulford, Leo Gao, Elie Georges, Christian Gibson, Vik Goel, Tarun Gogineni, Gabriel Goh, Rapha Gontijo-Lopes, Jonathan Gordon, Morgan Grafstein, Scott Gray, Ryan Greene, Joshua Gross, Shixiang Shane Gu, Yufei Guo, Chris Hallacy, Jesse Han, Jeff Harris, Yuchen He, Mike Heaton, Johannes Heidocke, Chris Hessc, Alan Hickey, Wade Hickey, Peter Hoeschele, Brandon Houghton, Kenny Hsu, Shengli Hu, Xin Hu, Joost Huizinga, Shantanu Jain, Shawn Jain, Joanne Jang, Angela Jiang, Roger Jiang, Haozhun Jin, Denny Jin, Shino Jomoto, Billie Jonn, Heewoo Jun, Tomer Kaftan, Lukasz Kaiser, Ali Kamali, Ingmar Kanitscheider, Nitish Shirish Keskar, Tabarak Khan, Logan Kilpatrick, Jong Wook Kim, Christina Kim, Yongjik Kim, Jan Hendrik Kirchner, Jamie Kiros, Matt Knight, Daniel Kokotajlo, Tukaas Kondraciuk, Andrew Kondrich, Aris Konstantinidis, Kyle Kosic, Gretchen Krueger, Vishal Kuo, Michael Lampe, Ikai Lan, Teddy Lee, Jan Leike, Jade Leung, Daniel Levy, Chak Ming Li, Rachel Lim, Molly Lin, Stephanie Lin, Mateusz Litwin, Theresa Lopez, Ryan Lowe, Patricia Lue, Anna Makanju, Kim Malfacini, Sam Manning, Todor Markov, Yaniv Markovski, Bianca Martin, Katie Mayer, Andrew Mayne, Bob McGrew, Scott Mayer McKinney, Christine McLeavey, Paul McMillan, Jake McNeil, David Medina, Aalok Mehta, Jacob Menick, Luke Metz, Andrey Mishchenko, Pamela Mishkin, Vinnie Monaco, Evan Morikawa, Daniel Mossing, Tong Mu, Mira Murati, Oleg Murk, David Mély, Ashvin Nair, Reiichiro Nakano, Rajeev Nayak, Arvind Neelakantan, Richard Ngo, Hyeonwoo Noh, Long Ouyang, Cullen O'Keefe, Jakub Pachocki, Alex Paino, Joe Palermo, Ashley Pantuliano, Giambattista Parascandolo, Joel Parish, Emy Parparita, Alex Passos, Mikhail Pavlov, Andrew Peng, Adain Perelman, Filipe de Avila Belbute Peres, Michael Petrov, Henrique Ponde de Oliveira Pinto, Michael, Pokorny, Michelle Pokrass, Vitchyr H. Pong, Tolly Powell, Alethea Power, Boris Power, Elizabeth Prochl, Raul Puri, Alec Radford, Jack Rac, Aditya Ramesh, Cameron Raymond, Francis Real, Kendra Rimbach, Carl Ross, Bob Rotsted, Henri Roussez, Nick Ryder, Mario Saltarelli, Ted Sanders, Shibani Santurkar, Girish Sastry, Heather Schmidt, David
47

---

Published in Transactions on Machine Learning Research (11/2025)
Schmurr, John Schulman, Daniel Selsam, Kyla Sheppard, Toki Sherbakov, Jessica Shich, Sarah Shoker, Pranav Shyam, Szymon Sidor, Eric Sigler, Maddie Simens, Jordan Sitkin, Katarina Slama, Ian Sohl, Ben- jamin Sokolowsky, Yang Song, Natalie Staudacher, Felipe Petroski Such, Natalie Summers, 1lya Sutskever, Jie Tang, Nikolas Tezak, Madeleine B. Thompson, Phil Tillet, Amin Tootoonchian, Elizabeth Tseng, Pre- ston Tuggle, Nick Turley, Jerry Tworek, Juan Felipe Cerón Uribe, Andrea Vallone, Arun Vijayvergiya, Chellca Voss, Carroll Wainwright, Justin Jay Wang. Alvin Wang, Ben Wang, Jonathan Ward, Jason Wei, CJ Weinmann, Akila Welihinda, Peter Welinder, Jiayi Weng, Lilian Weng, Matt Wiethoff, Dave Willner, Clemens Winter, Samuel Wolrich, Hannah Wong, Lauren Workman, Sherwin Wu, Jeff Wu, Michael Wu, Kai Xiao, Tao Xu, Sarah Yoo, Kevin Yu, Qiming Yuan, Wojeiech Zaremba, Rowan Zellers, Chong Zhang, Marvin Zhang, Shengjia Zhao, Tianhao Zheng, Juntang Zhuang, William Zhuk, and Barret Zoph. Gpt-4 technical report, 2024. URL https: httpas///axvvvvooo org/ 2tt.//2333027.44...
Long Ouyang, Jeff Wu, Xu Jiang, Diogo Almcida, Carroll L. Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul Christiano, Jan Leike, and Ryan Lowe. Training language models to follow instructions with human feedback, 2022. URL ttttps///rxdte wwarxxv.og//bbb... org/abs/2200 02155.
Aditya Patwardhan, Vivck Vaidya, and Ashish Kundu. Automated consistency analysis of llm,, 2025. URL 07036.
Fabio Petroni, Tim Rocktäschel, Patrick Lewis, Anton Bakhtin, Yuxiang Wu, Alexander H. Miller, and Sebastian Riedel. Language models as knowledge bases?, 2019. URL https: http:///axxvvvor.g/.. abs/1999. 01066.
Mansi Phute, Alec Helbling, Matthew Hull, Sheng Peng, Sebastian Szyller, Cory Cornelius, and Duen Horng Chan. Lim self defense: By self examination, Iims know they are being tricked, 2024. URL https://arxiv http:///aaarvv..g/aaaa/eesse wtgg/bs/////////oo/e 073000000888......
Nicolas Posocco and Antoine Bonnefoy. Estimating expected calibration errors, 2021. URL htttttt////a//
org/abs/ 2ttp://299..000 03480.
Jirui Qi, Raquel Fernández, and Arianna Bisazza. Cross-lingual consistency of factual knowledge in multilin- gual language models. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pp. 10650-10666, Association for Computational Linguistics, 2023. doi: 10. 10.18653/v1/2 1 emnlp-maie m58..658.. URL http::/dx:: http//xx.dooorgggg/./
doi 10./10..////...o.. 18653/v1/2023 emnlp-main.655
Xiangyu Qi, Ashwinee Panda, Kaifeng Lyu, Xiao Ma, Subhrajit Roy, Ahmad Beirami, Prateek Mittal, and Peter Henderson. Safety alignment should be made more than just a few tokens deep. In The Thirtcenth International Conference on Learning Representations, 2025. URL https:///pentti http://pmreviiieeeeee/rrrrrtttt net/oorum??dd 6Mxhg9PtDE.
Rebecca Qian, Candace Ross, Jude Fernandes, Eric Smith, Douwe Kiela, and Adina Williams. Porturbation augmentation for fairer nlp, 2022. URL https://arxiv.orr wwtp:oo/////////e/eeaa httpaabb./......./
Yao Qu and Jue Wang. Performance and biases of large language models in public opinion simulation. Humanities and Social Sciences Communicatonns, 11(1):1095, August 2024. ISSN 2662-9992. doi: 10.
1057/8411598-022-3300-44
Rafael Rafailov, Archit Sharma, Eric Mitchell, Stefano Ermon, Christopher D. Manning, and Chelsea Finn. Direct preference optimization: Your language model is secretly reward model, 2024. URL https:
//aaxii..rg//bs//30055 18290.
Hamed Rahimian and Sanjay Mchrotra. Frameworks and results distributionally robust optimization. Open Journal of Mathematical Optimization, 3:1 85, July 2022. ISSN 2777-5860. doi: 10.5802/ojmo. URL http://dx... doi. www.d//.......0///////// omm..//mmm... 15.
A B M Ashikur Rahman, Saced Anwar, Muhammad Usman, and Ajmal Mian. Defan: Definitive answer
dataset for lhss hallucination evaluation, 2024. URL https: //axxiv../////////a org/ httpabb/..240...2/
48

---

Published in Transactions on Machine Learning Research (11/2025)
Mirza Masfiqur Rahman and Ashish Kundu. Code hallucination. ArXiv, abs/2407.04831, 2024. URL
https://api. http:pppsssmmaniccchlllaaaa www.Corpps.D:aDa........ 27:1000050.
Vyas Raina, Adian Liusie, and Mark Gales. Is LLM-as-a-judge robust? investigating universal adversarial attacks on zero-shot LLM assessment. In Yaser Al-Onaizan, Mohit. Bansal, and Yun-Nung Chen (eds.); Procoodings of the 2024 Conference on Empirical Methods in Natural Language Processing, pp. 7499- 7517, Miami, Florida, USA, November 2024. Association for Computational Linguistics. doi: 10.18653/ v1/2024.emnlp main 427. URL https: https://acllartbooogyooooo org/2024. emnlp-main.40 427/.
Srinivasan Ravichandran, Drona Khurana, Bharath Venkatesh, and Narayanan Unny Edakunni. Fairxgboost: Fairncss-aware classification in xgboost, 2020. URL https://arxiv. wttp://wwww.g////////./...0//./. 01442.
Traian Rebedea, Razvan Dinu, Makesh Sreedhar, Christopher Parisien, and Jonathan Cohen. Nemo
guardrails: toolkit for controllable and safe 1lm applications with programmable rails, 2023. URL
https://arxiv. org/abs/231...ooo....aoo 10501.
https///ar.av.orr//aa//20....
Laboni Sarker, Mara Downing, Achintya Desai, and Tevfik Bultan. Syntactic robustness for Ilm-based code generation, 2024. URL ptttps:/aarxiee http://axwvoooggbbb////a/a wrwp//////44..1555550
Yash Saxena, Sarthak Chopra, and Aruendra Mani Tripathi. Evaluating consistency and reasoning capa- bilities of large language models, 2024. URL. httppp/://aaxv.or/aabba///////// 16478.
Sander Schulhoff, Michael Ilie, Nishant Balepur, Konstantine Kahadze, Amanda Liu, Chenglei Si, Yinheng Li, Aayush Gupta, HyoJung Han, Sevien Schulhoff, Pranav Sandeep Dulepet, Saurav Vidyadhara, Dayeon Ki, Sweta Agrawal, Chau Pham, Gerson Kroiz, Feilcen Li, Hudson Tao, Ashay Srivastava, Hevander Da Costa, Saloni Gupla, Megan L. Rogers, Inna Goncearenco, Giuseppe Sarli, Igor Galynker, Denis Peskoff, Marine Carpuat, Jules White, Shyamal Anadkat, Alexander Hoyle, and Philip Resnik. The prompt report: A systematic survey of prompt engincering techniques, 2025. URL https::/aartie httl/aaiiv.or.//aaa/// htt///aa//22....// 06608.
Ayan Sengupta, Vaibhav Seth, Arinjay Pathak, Aastha, Verma, Natraj Raman, Sriram Gopalakrishnan, Niladri Chatterjee, and Tanmoy Chakraborty. Robust and efficient fine-tuning of llms with bayesian reparameterization of low-rank adaptation, 2025. URL
org/
Mandar Sharma, Nikhil Muralidhar, Shengzhe Xu, Raquib Bin Yousuf, and Naren Ramakrishnan. Informa- tion guided regularization for fine-tuning language models. In First Conference Language Modeling, 2024. URL https::/openreee
Xiaoyu Shen, Rexhina Blloshmi, Dawei Zhu, Jiahuan Poi, and Wei Zhang. Assossing "implicit" retrieval robustness of large language modcls. In Yaser Al-Onaizan, Mohit Bansal, and Yun-Nung Chen (eds.), Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pp. 8988- 9003, Miami, Florida, USA, November 2024. Association for Computational Linguistics. doi: 10.18653/ www.e-mminnnnn.eeee 507. URL https: http:://aclanthologg org/ 2024. emnlp main. 507/.
Chufan Shi, Haoran Yang, Deng Cai, Zhisong Zhang, Yifan Wang, Yujiu Yang, and Wai Lam. A thorough examination of decoding methods in the era of Ilms, 2024a. URL
/ttp:://axxvvvvo /eabb///22...ee2 06925.
Lin Shi, Chiyu Ma, Wenhna Liang, Xingjian Diao, Weicheng Ma, and Soroush Vosoughi. Judging the judges: A systematic study of position bias in Ilm-as-a-judge, 2025. URL attps://arxivy httpg//abs/22..000/ 07791.
Ruizhe Shi, Yifang Chen, Yushi Hu, Alisa Liu, Hannaneh Hajishirzi, Noah A. Smith, and Simon Shaolei Du. Decoding- time language model alignment with multiple objectives. In The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024b. URL attps://one //opnreeeeeeeeeeeeee net/forum?
id=3csuL7TVpV.
Ayush Singh, Navpreet Singh, and Shubham Vatsal. Robustness of llms to perturbations in text, 2024. URL https://arxiv. httpps///arrav.orrr////////.... 08989.
Charlie Snell, Jachoon Lee, Kelvin Xu, and Aviral Kumar. Scaling Ilm test-time compute optimally can be more effective than scaling model parameters, 2024. URL https://arxiv.. wwtp:///g/////////a/aa/a 03314.
49

---

Published in Transactions on Machine Learning Research (11/2025)
Seongho Son, William Bankes, Sangwoong Yoon, Shyam Sundhar Ramesh, Xiaohang Tang, and Ilija Bo- gunovic. Robust multi-objective controlled decoding of large language models, 2025. URL https: //arxiv.ors httpivv..rrgab//553333 abs/2503....... 000./
Xiaoshuai Song, Zhengyang Wang, Keqing He, Guanting Dong, Yutao Mou, Jinxu Zhao, and Weiran Xu. Assessing and post-processing black box large language models for knowledge editing. In THE WEB CONFERENCE 2025, 2025. URL http:///pppprooooeeeeooooooaadaa
Joe Stacey, Pasquale Minervini, Haim Dubossarsky, and Marek Rei. Logical reasoning with span-level predictions for interpretable and robust nli models, 2022. URL
/tt////aaiirrrrr//////////////// 11432.
Joe Stacey, Pasquale Minervini, Haim Dubossarsky, Oana-Maria Camburu, and Marek Rei, Atomic inference for nli with generated facts as atoms, 2024. URL https: org/abs/2305. 13214.
Hao Sun. Supervised fine-tuning as inverse reinforcement learning, 2024. URL attps://ant http:///wxxv.o//aaaaa// 2207.12017
Yuhong Sun, Zhangyue Yin, Qipeng Guo, Jiawen Wu, Xipeng Qiu, and Hui Zhao. Benchmarking hal- lucination in large language models based on unanswerable math word problem, 2024a. URL. https:
//arxiv.orgg...eeee.. wwwrg/ab//443..000
Zhihong Sun, Chen Lyu, Bolun Li, Yao Wan, Hongyu Zhang, Ge Li, and Zhi Jin. Enhancing code generation performance of smaller models by distilling the reasoning ability of Ilmss 2024b. URL https://arxit: bzg/abs//ee 220//2233... 2240..1271.. 13271.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks, 2014. URL https://arxiv http://////iwvooo////aaa////////
org/abs/ abrg122s/331.... 119999999...9.......
Yiyi Tao, Yixian Shen, Hang Zhang, Yanxin Shen, Lun Wang, Chuanqi Shi, and Shaoshuai Du. Robustness of large language models against adversarial attacks, 2024. URL pettps//arxxv.. arggabs/2412. 17011.
Christos Thrampoulidis. Implicit optimization bias of next-token prediction in linear models. In The Tiirty-eigtth Annual Conference on Neural Information Processing Systems, 2024. URL https://
openreview.net. wttp://.....ooom///////011/.geg
Yuchen Tian, Weixiang Yan, Qian Yang, Xuandong Zhao, Qian Chen, Wen Wang, Ziyang Luo, Lei Ma, and Dawn Song. Codchalu: Investigating code hallucinations in 1lms via exccution- basod verification, 2025. URL https::///////tt wwtp://///a/abb///////a/a
Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Fric Hambro, Faisal Azhar, Aurélien Rodriguez, Armand Joulin, Edouard Grave, and Guillaume Lample. Llama: Open and efficient foundation language models. ArXiv, (bs//230.11377 2023a. URL https: / /appi.pp.... sww.ticsccooaar.r...m.......aa..
Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bash- lykov, Soumya Batra, Prajiwal Bhargava, Shruti Bhosale, Dan Bikel, Lukas Blecher, Cristian Canton Fer- rer, Moya Chen, Guillem Cucurull, David Esiobu, Jude Fernandes, Jeremy Fu, Wenyin Fu, Brian Fuller, Cynthia Gao, Vedanuj Goswami, Naman Goyal, Anthony Hartshorn, Saghar Hosseini, Rui Hou, Hakan Inan, Marcin Kardas, Viktor Kerkez, Madian Khabsa, Isabel Kloumann, Artem Korenev, Punit Singh Koura, Marie-Anne Lachaux, Thibaut Lavril, Jenya Lee, Diana Liskovich, Yinghai Lu, Yuning Mao, Xavier Martinet, Todor Mihaylov, Pushkar Mishra, Igor Molybog, Yixin Nic, Andrew Poulton, Jeremy Reizenstein, Rashi Rungta, Kalyan Saladi, Alan Schelten, Ruan Silva, Eric Michael Smith, Ranjan Subra- manian, Xiaoqing Ellen Tan, Binh Tang, Ross Taylor, Adina Williams, Jian Xiang Kuan, Puxin Xu, Zheng Yan, lliyan Zarov, Yuchen Zhang, Angela Fan, Melanie Kambadur, Sharan Narang, Aurelien Rodriguez, Robert Stojnic, Sergey Edunov, and Thomas Scialom. Llama 2: Open foundation and fine-tuned chat models, 2023b. URL https::////// //arxiv...vv////aa/ arg/abs/23007
Thien Q Tran, Akifumi Wachi, Rei Sato, Takumi Tanabe, and Youhei Akimoto. Vulnerability mitigation for safety-aligned language models via debiasing, 2025. URL https://arxiv http://axxvvvorro/// httpr//w..rr//as/22/200022...11
50

---

Published in Transactions on Machine Learning Research (11/2025)
Yahan Tu, Rui Hu, and Jitao Sang. Ode: Open-set evaluation of halluucnationss in multimodal large language models, 2024. URL https:///arae http:////axvvvrooaaaaae wwwp:w.rgg.b........ abs/aa/9//9//// 099118
Prasetya Ajie Utama, Nafise Sadat Moosavi, and Tryna Gurevych. Mind the trade-off: Debiasing nlu models without degrading the in-distribution performance, 2020. URL https://arxiv. wwtpa/wwwww...aaa////o////// 00315.
Neeraj Varshney, Pavel Dolin, Agastya Seth, and Chitta Baral. The art of defending: A systematic evaluation and analysis of LLM defense strategies on safety and over-defensiveness. In Tun-Wei Ku, Andre Martins, and Vivek Srikumar (eds.), Findings of the Association for Computational Linguisties: ACL 2024, pp. 13111-13128, Bangkok, Thailand, August 2024. Association for Computational Linguistics. doi: 10.18653/ org/2024 findings--aan 776//
1//2022..fnding--all.77.. URL
Davor Vukadin, Marin Silić, and Goran Delač. Large language models attribution regularizers for efficient model training, 2025. URL bttps://arke wwwpw//...w..aa./......o
Zhongwei Wan, Che Liu, Mi Zhang, Jie Fu, Benyou Wang, Sibo Cheng, Lei Ma, César Quilodrán-Casae and Rossella Arcueci. Med-unic: Unifying cross-lingual medical vision-language pre-training by diminishing bias, 2024a, URL attps://arxiv:
19894.
Zhongwei Wan, Yichun Yin, Wei Zhang, Jiaxin Shi, Lifeng Shang, Guangyong Chen, Xin Jiang, and Qun Liu. G-map: General memory-augmentedd pre-trained language model for domain lasks, 2024b. URL
https://arxin: orgg/bs/////////// http:////aaxi.oorrr/aa/222222 03613.
Boxin Wang, Chejian Xu, Shuohang Wang, Zhe Gan, Yu Cheng, Jianfeng Gao, Ahmed Hassan Awadallah, and B. Li. Adversarial glue: A multi-task benchmark for robustness evaluation of language models. ArXiv, abs/2111.028400 2021. URL http:://pp..smmnniicccii wtgp/ooprrrrr/oooroooaooaaaea :222
Haoxiang Wang, Wei Xiong, Tengyang Xie, Han Zhao, and Tong Zhang, Interpretable preferences via multi- objective reward modeling and mixturc-of-experts. In The 2024 Conference Empirical Methods in Natural Language Processing, 2024a.
Huandong Wang, Wenjie Fu, Yingzhou Tang, Zhilong Chen, Yuxi Huang, Jinghua Piao, Chen Gao, Fengli Xu, Tao Jiang, and Yong Li. A survey on responsible Ilms: Inherent risk, malicious use, and mitigation strategy, 2025. URL https: wttpv//..rrgab///....... 09431.
Jindong Wang, Xixu Hu, Wenxin Hou, Hao Chen, Runkai Zheng, Yidong Wang, Linyi Yang, Haojun Huang, Wei Ye, Xiubo Geng, Binxin Jiao, Yue Zhang, and Xing Xie. On the robustness of chatgpt: An adversarial and oft-o--distribution perspective, 2023a. URL https://arxi:: org/ abs /3022 12095.
Junyang Wang, Yuhang Wang, Guohai Xu, Jing Zhang, Yukai Gu, Haitao Jia, Jiaqi Wang, Haiyang Xu, Ming Yan, Ji Zhang, and Jitao Sang. Amber: An Ilm-fre multi diltii-immnnionall benchmark for milms hallucination evaluation, 2024b. URL https:///arie owgps/iiioorr/eeoo abs hashs///..aac/aa 073397.
Peiyi Wang, Lei Li, Liang Chen, Zefan Cai, Dawei Zhu, Binghuai Lin, Yunbo Cao, Qi Liu, Tianyu Liu, and Zhifang Sui. Large language models are not fair evaluators, 2023b. URL https://arxit: otg//bs////aeeeee 17926.
Yuxia Wang, Minghan Wang, Muhammad Arslan Manzoor, Fei Liu, Georgi Georgiev, Rocktim Jyoti Das, and Preslav Nakov. Factuality of large language models: A survey, 2024c. URL https://arxiv. org/ abs/2402.02422
org/
Jiaheng Wei, Yuanshun Yao, Jean-Francois Ton, Hongyi Guo, Andrew Estornell, and Yang Liu. Measuring and reducing 1lm hallucination without gold-standard answers, 2024. URL https://arxiv, org/abst 1041..
Lilian Weng. Adversarial attacks on 1lms. giltabveng.github.i. Oct 2023. URL https://1ilianvery github. htc.ubb.o//patss2022--3- 1at1:/22222211------222----2-- 101-25-adv-e ad------d-ttttck--111---
51

---

Published in Transactions on Machine Learning Research (11/2025)
Junkang Wu, Yuexiang Xie, Zhengyi Yang, Jiancan Wu, Jiawei Chen, Jinyang Gao, Bolin Ding, Xiang Wang, and Xiangnan He. Towards robust alignment of language models: Distributionally robustifying direct preference optimization. In The Thirteenth International Conference on Learning Representations, 2025. URL /ttps://openreviiie net/forum (ot.orrrrrmdddCfffi.ii......
Shijie Wu, Ozan Irsoy, Steven Lu, Vadim Dabravolski, Mark Dredze, Sebastian Gehrmann, Prabhanjan Kambadur, David Rosenberg, and Gidcon Mann. Bloomberggpt: large language model for finance, 2023. URL
ha///bs/222 17664
Sophie Xhonnoux, Alessandro Sordoni, Stephan Günnemann, Gauthier Gidel, and Leo Schwinn. Efficient adversarial training in llms with continuous atlacks, 2024. URL htopp:://axiv.... .rg..oggg/aa.................... ha///bb//2/// 2405. 15589.
Wei Xiong, Hanze Dong, Chenlu Ye, Ziqi Wang, Han Zhong, Heng Ji, Nan Jiang, and Tong Zhang. Iterative preference learning from hurman leedback: Bridging theory and practice for rIhl under kl-constraint. ICML, 2024.
Jingxuan Xu, Wuyang Chen, Linyi Li, Yao Zhao, and Yunchao Wei. Collapsed language models promole fairness, 2025. URL https://arxiv wwt//rgg//////e/ee abs/2410. 04472.
Xilie Xu, Jingfeng Zhang, Feng Liu, Masashi Sugiyama, and Mohan Kankanhalli. Efficient adversarial contrastive learning via robustness-aware coreset selection, 2023. URL https://arxiv arg/abs/2302. 03857.
Tianyi Lorena Yan, Fei Wang, James Y. Huang, Wenxuan Zhou, Fan Yin, Aram Galstyan, Wenpeng Yin, and Muhao Chen. Contrastive instruction tuning, 2024a. URL https://arxt:: http:///arriv..o//a///////e///// wrg//bs//4/20..0a./ 1114402..111..... 11138.
Yuzi Yan, Xingzhou Lou, Jialian Li, Yiping Zhang, Jian Xie, Chao Yu, Yu Wang, Dong Yan, and Yuan Shen. Reward-robust rlhf in lmss, 2024b. URL attps://arxie: .rgg abs/ /20./ 15360.
Borui Yang, Md Afif AI Mamun, Jie M. Zhang, and Gias Uddin. Hallucination detection in large language hbbs/2502..584.
models with metamorphic relations, 2025a. URL attps://arxiv
Jingfeng Yang, Hongye Jin, Ruixiang Tang, Xiaotian Han, Qizhang Feng, Haoming Jiang, Bing Yin, and Xia Hu. Harnessing the power of 1lms in practice: A survey on chatgpt and beyond, 2023. URL https:
// //arxiv. wwweiiivorrgaae arggabbs/3044.. 2311122............
Jingkang Yang, Kaiyang Zhou, Yixuan Li, and Ziwei Liu. Generalized out-of-distribution detection: A survey, 2024a. URL https://arxiv http:://aarai..oo//b////000 11334.
Jingyuan Yang, Dapeng Chen, Yajing Sun, Rongiun Li, Zhiyong Feng, and Wei Peng. Enhancing semantic consistency of large language models through model editing: An interpretability-orrettte approach, 2025b.
URL attps://araa http///axivv..g//bbbaaaae hmgg/abs/25111... 201111100..........1111 11041.
Ruixin Yang, Dheeraj Rajagopal, Shirley Anugrah Hayati, Bin Hu, and Dongyeop Kang. Confidence cali-
bration and rationalization for lims via multi-agent deliberation, 2024b. URL http///xxvvv./rgee/e
09127.
Shuo Yang, Bardh Prenkaj, and Gjergji Kasneci. Razor: Sharpening knowledge by cutting bias with unsu- pervised text rewriting, 2024c. URL /tttps://rxxvv.rtt www.:/rg//////lieee htw.a////212....7.....
Zeyu Yang, Zhao Meng, Xiaochen Zheng, and Roger Wattenhofer. Assessing ad adversarial robustness ness of large language models: An empirical study, 2024d. URL https////avvvvrrrr/eeee /2440
Jui-Ming Yao, Hao-Yuan Chen, Zi-Xian Tang, Bing-Jia Tan, Sheng- Wei Peng, Bing-Cheng Xie, and Shun- Feng Su. Token constraint decoding improves robustness on question answering for large language models, 2025. URL https: /taps:///axxvvv wwt. 09408.
Weiran Yao, Shelby Heinecke, Juan Carlos Niebles, Zhiwei Liu, Yihao Feng, Le Xue, Rithesh Murthy, Zeyuan Chen, Jianguo Zhang, Devansh Arpit, Ran Xu, Phil Mui, Huan Wang, Caiming Xiong, and Silvio Savarese. Retroformer: Retrospective large language agents with policy gradient optimization, 2024. URL https://arxiy wwwpe/v..rrggbb//3..o..o 02151.
52

---

Published in Transactions on Machine Learning Research (11/2025)
Wenqian Ye, Guangtao Zheng, Xu Cao, Yunsheng Ma, and Aidong Zhang. Spurious correlations in machine learning: A survey, 2024. URL https://arxiv.ore http///axxvvoooraaaaa httg//2./2422.11111 12715.
Zihao Ye, Lequn Chen, Ruihang Lai, Wuwei Lin, Yineng Zhang, Stephanie Wang, Tianqi Chen, Baris Kasikei,
Vinod Grover, Arvind Krishnamurthy, and Lais Ceze. Flashinfer: E.fficient and customizable attention engine for Ilm inference serving, 2025. URL https://arxiv wrgg:as/////a/a1/11 01005
Miao Yu, Fanci Meng, Xinyun Zhou, Shilong Wang, Junyuan Mao, Linsey Pang, Tianlong Chen, Kun Wang, Xinfeng Li, Yongfeng Zhang, Bo An, and Qingsong Wen. A survey on trustworthy Ilm agents: Threats and countermeasures, 2025. URL https://arxias orggabs////3 09648.
Yue Yu, Wei Ping. Zihan Liu, Boxin Wang, Jiaxuan You, Chao Zhang, Mohammad Shocybi, and Bryan Catanzaro. Rankrag: Unifying context ranking with regrieeel-angmmeneed generation in llms, 2024. URL https://arxiv, org/abs /2/0//b2/2407...// .02485.
Lifan Yuan, Yangyi Chen, Ganqu Cui, Hongcheng Gao, FangYuan Zou, Xingyi Cheng, Heng Ji, Zhiyuan Liu, and Maosong Sun. Revisiting out-of-distribution robustness in NLP: Benchmarks, analysis, and LLMs evaluations. In Thirly-sevnnth Conference on Neural Information Processing Systems Datasets and Benchmarks Track, 2023. URL https://opeurrevieu. httpp:///paaarrriee.eee///r/rrrp httt://oorrrriiii//033333.333
Shengbin Yue, Wei Chen, Siyuan Wang, Bingxuan Li, Chenchen Shen, Shujun Liu, Yuxuan Zhou, Yao Xiao, Song Yun, Xuanjing Huang, and Zhougyu Wei. Disc-lawllm: Fine-tuning large language models for intelligent legal services, 2023. URL
http:///xxvvv...... 21399.
Abdelrahman Zayed, Prasanna Parthasarathi, Goncalo Mordido, Hamid Palangi, Samira Shabanian, and Sarath Chandar. Doep learning on a healthy data dict: Finding important examples for fairness, 2022.
URL httpss://araa wttp://wwwrr/a//........ 11109.
Xinyi Zeng, Yuying Shang, Jiawei Chen, Jingyuan Zhang, and Yu Tian. Root defence strategies: Ensuring wtt/:a//////...000000 06809.
salety of Im at the decoding level, 2025. URL
Jiaxin Zhang. Awweomm------uunnnttiiillllllll-
wwttschuu...ommmcc commjxzzangjhaeeeeoocccco 2023. Accessed: 2025-05-06.
Awesome- LLM- Urt
DieesomeLLM--Uncertaaii
Shuo Zhang, Liangming Pan, Junzhou Zhao, and William Wang. Mitigaling language model hallucination alignment. arxiv, 05 2023. doi:
with interactive
Huaqin Zhao, Zhengliang Liu, Zihao Wu, Yiwei Li, Tianze Yang, Peng Shu, Shaochen Xu, Haixing Dai, Lin Zhao, Hanqi Jiang, Yi Pan, Junhao Chen, Yifan Zhou, Gengchen Mai, Ninghao Liu, and Tianming Liu. Revolutionizing finance with 1lms: An overview of applications and insights, 2024a. URL https: //arxiv. org/ abs 2164.11641......
Long Zhao, Ting Liu, Xi Peng, and Dimitris Metaxas. Maximum-entropy adversarial data augmentation for improved generalization and robust ness. In H. Larochelle, M. Ranzato, R. Hadsell, M. F. Balcan, and H. Lin (eds.), Advances in Neural Information Processing Systems, volume 33, pp. 14435-14447. Cur- ran Associates, Inc., 2020. URL
www.eeeddnnnn.euriss.s... seeuurps.ccppppprfflleee.. (iapprr_fiieespppr//200000 a5bf Sbbeccc0776.ffdteesfffeeea. pawpeceeeddd-pppre.eeemee
Wayne Xin Zhao, Kun Zhou, Junyi Li, Tianyi Tang, Xiaolei Wang, Yupeng Hou, Yingqian Min, Beichen Zhang, Junjie Zhang, Zican Dong, Yifan Du, Chen Yang, Yushuo Chen, Zhipeng Chen, Jinhao Jiang, Ruiyang Ren, Yifan Li, Xinyu Tang, Zikang Liu, Peiyu Liu, Jian-Yun Nie, and Ji-Rong Wen. A survey of large language models, 2025. URL bettp:///arxo wrw.l.rg/aaaoo org/abs/2303 18223.
Yukun Zhao, Lingyong Yan, Weiwei Sun, Guoliang Xing, Shuaiqiang Wang, Chong Meng. Zhicong Cheng, Zhaochun Ren, and Dawei Yin. Improving the robustness of large language models via consistency align- ment. In Nicoletta Calzolari, Min- Yen Kan, Veronique Hoste, Alessandro Lenci, Sakriani Sakti, and Ni- anwen Xue (ods.), Procoedings of the 2024 Joint International Conference on Computational Linguistics, Language Resources and Evaluation (LREC-COLING 2024), pp. FLRA and TCCL. URL https://aclaatthooogy..c org//024 1rec-main. 782/.
Torino, Italia, May 2024b.
53

---

Published in Transactions on Machine Learning Research (11/2025)
Jialun Zhong, Wei Shen, Yanzeng Li, Songyang Gao, Hua Lu, Yicheng Chen, Yang Zhang, Wei Zhou, Jinjie Gu, and Lei Zou. A comprehensive survey of reward models: Taxonomy, applications, challenges, and future, 2025a. URL
12338.
Yinmin Zhong, Zili Zhang, Bingyang Wu, Shengyu Liu, Yukun Chen, Changyi Wan, Hampeng Hu, Lei Xia, Ranchen Ming, Yibo Zhu, and A Jin. Optimizing rlhf training for large language modcls with stage fusion, 2025b. URL https:/ http///xxvvvv.o./e.e/re atgg//02/2409.... 13221.
Andy Zhou, Bo Li, and Haohan Wang. Robust prompt optimization for defending language models against jailbreaking attacks, 2024a. URL https://arxiv wwtp:/orrraaaa...1//7/.
Yuhang Zhou, Paiheng Xu, Xiaoyu Liu, Bang An, Wei Ai, and Furong Huang. Explore spurious correlations at the concept level in language models for text classification. In Lun- Lun-Wei Ku, Andre Martins, and Vivek Srikumar (ods.), Procoodings the 62nd Annual Mocting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 478 492, Bangkok, Thailand, August 2024b. Association for Computational Linguistics. doi: 10.18653 11/2024.aclllong 28. URL https: http:///aaaaaalagaaeeee
acl acl-long 28/.
Yujia Zhou, Yan Liu, Xiaoxi Li, Jiajie Jin, Hongjin Qian, Zheng Liu, Chaozhuo Li, Zhicheng Dou, Tsung Yi Ho, and Philip S. Yu. Trustworthiness retrieval-augmennted generation systems: A survey, 2024c. URL https://arzie www.orgg//////.eeeoeee 2200..1002..
Yuqing Zhou, Ruixiang Tang, Ziyu Yao, and Ziwei Zhu. Navigating the shortcut maze: A comprehensive analysis shortcut learning in text classification by language models, 2024d. URL abs/2409. 17455.
org/
Zhanke Zhou, Rong Tao, Jianing Zhu, Yiwen Luo, Zengmao Wang, and Bo Han. Can language models perform robust reasoning in Mhain-of-thougln prompting with noisy rationales?, 2024e. URL https: //laaaiv.rrg/bbbeee../. 2238..
Kehao Zhu, Yingye Zheng, and Kwun Chuen Gary Chan. Weighted brier score overall summary measure for risk prediction models with clinical utility consideration, 2024. URL https //rxxvaxvvvv//a///////////////wl org/ 2408. 01626.
54


Reviews:
[{"review_id": "6a8IvoDPmA", "reviewer": "Reviewer_86sW", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "**P.S.** I would urge the authors to please proof-read the paper. Currently, the paper has *numerous typos* and in some places, *incomplete sentences*. For example, in Figure 1, there is an incomplete block with the phrase “Will be updated later”. Similarly, in Section 3, there is an empty bulleted heading “Inference-Related:” followed by a blank.\n\n___\n## What I liked about the paper\n- It is timely and has a well-defined scope\n- It presents a *clear taxonomy* of the work in this extensive literature\n- It provides a nice overview of metrics and benchmarks used to diagnose failure and evaluate robustness, which is bound to be helpful to practitioners\n- It has useful discussions on the pending problems in the field\n___\n___\n\n## Scope for improvement\nI am not expert on robustness, and will largely focus on the writing / stylistic aspects. Unfortunately, I find that the writing and the structure of the paper has a lot of scope of improvements, some of which I highlight below. \n\n- **Lack of concrete examples**: The survey would have been more compelling had it provided textual examples (with prompts and responses) to illustrate instances where LLMs lack robustness. For instance, you could provide explicit examples explaining how LLMs can be sensitive to minor prompt variations, or are susceptible to jailbreaking (Sec 2.2). You could explain spurious correlations by illustrating through an example of an LLM learning a superficial pattern instead of the intended complex relationship (Sec 3.1.1). \n- **The “Sources” and “Mitigation Strategies” sections seem disconnected:** The paper does a good job of individually categorizing different sources of non-robustness, and categorizing mitigating strategies. However, these two sections seem like separately-written surveys, with the details of the which method caters to which robustness type being hidden in the text. While a clean mapping may not always exist, to the extent possible, the authors could make it clear which mitigation strategies are best suited for a particular type of robustness. In some cases, this is obvious: e.g., sensitivity to prompt variations may be tackled through adversarial training; in other cases, like hallucinations, the solutions are not clearly laid out (e.g. use of RAG or judge LLMs for verification?)\n- **Redundancies:** The paper does have occasional redundancies that could be removed.  For example, Section 2.1 lists out common themes in the robustness literature, and Section 2.2 again lists a similar categorization of desired capabilities, with slightly different phrasing and more details. I would find this text cleaner if Section 2.1 could be shortened (without an elaborate list) and have the details deferred to Section 2.2. Similarly, the paper has three separate sections for “Discussion”, “Challenges and Future Work” and “Conclusions”. Combining some of these into smaller subsections may make for a more concise presentation.\n- **Math expressions:** The paper completely shies away from using any math expression. While I understand why the authors may want to keep the descriptions simple, in some places, math equations go a long way in stating an idea clearly. For example, when describing Adversarial Training in Section 4.2, it would be easier for the reader to have the loss expressed as an equation, rather than have the inner and outer loops of the adversarial mechanism described in words. Please don’t hesitate to use math expressions wherever they are useful to convey a high-level idea.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The authors present an elaborate survey of robustness in LLMs, covering:\n- the definition of robustness\n- the sources of lack of robustness\n- elaborate taxonomy of mitigation strategies\n- evaluation metrics and benchmarks-\n- discussions on pending research directions.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "Please \"Scope for improvement\" above.\n\n## Other stylistic comments\n- *Section 2.2*: I am not a big fan of the **label-description** format. This would work well if you have a single phrase following the  “Appearance” and “Cause” labels. However, in some cases, you have multiple descriptive phrases following each heading, making the section look like informally-written study notes. Furthermore, I am not sure if the label “Appearance” best describes how the particular lack of robustness manifests in applications; perhaps “symptoms” might be a better choice of heading?\n- *Section 4.2, Adversarial Training*: You may want to clarify here and elsewhere if the losses discussed apply to the **pre-training, SFT or RL stages**\n- *Section 4.2, Regularization*: It wasn’t clear to me why contrastive losses and focal losses are clubbed together with regularization approaches. Is there a different categorization you could give to these methods, perhaps “Regularization and loss modifications” (although the previous adversarial training may also fit into to this then)\n\n## Minor comments and typos\n- Figure 2 occupies a lot of space, but adds little additional information/insights. Can you make it smaller and more concise?\n- “LLMs have been observed to consistently outperform on U.S. datasets compared to Chilean datasets” -> Please provide reference for this\n- Figure 3: “This visualization demonstrates how these factors interconnect” → where in the figure are the interconnections highlighted? It looks like the same textual description in the comment is repeated in the figure accompanied by icons.\n- Section 3.1.2: “ For instance, crowd-sourced datasets, used widely for fine-tuning and evaluation, frequently contain superficial annotation patterns, where human annotators unintentionally introduce simplistic labeling strategies that models exploit as shortcuts.” → Isn’t this an example of a spurious correlation, or by simplistic labeling strategies, are you referring to strategies that superficially use a protected group for labeling? Please also provide a reference for this.\n- Section 3.2.1: I think the critique in Nagarajan et al., 2024 is more about the use of the *next-token prediction* loss, and less to do with optimizing the “average” loss.\n- Section 3.2.4, Fine-tuning Limitations: You may want to clarify that these are potential limitations of *vanilla fine-tuning*, not fine-tuning in general. Indeed there are robust versions of fine-tuning that seek to address some of these issues.\n- Section 4.1, Page 13, Data Filtering: “LLMS” → “LLMs”\n- Section 4.2, Page 14, “uses an entropy regularize” → regularizer?\n- Section 4.2, Page 14, “ Xhonneux et al. (2024) proposes” -> propose?\n- Section 4.2, Page 14, You mention “DPO” with no context. May want to provide the expansion: “Direct Preference Optimization”, and mention that you are referring to RL methods here\n- Section 4.2, Regularization: When mentioning “Debiased Focal Loss”, you may want to clarify if these losses are for typical classification tasks or for general language model generation tasks (my reading of the reference is that it is for the former).\n- Section 4.2, Regularization: Many of the fairness references mentioned don’t directly address language modeling. Are you implying that these methods can be adapted to LMs?\n- Section 4.2, Alignment, Page 16: Please expand “RPO” → is it Reward-aware Preference Optimization?\n- Section 4.3, “This approach provides a cost-effective way … “ → consider splitting it into two sentences (especially after the “though” part).\n- Section 4.3, Weight re-distribution, “Zhong et al. (2025b) proposes a framework which ..” → please consider rephrasing this long and overly complicated sentence. I don’t understand what a “pipeline bubble” is.\n\n*Additional reference*: The following is an award-winning work on safety alignment that may be worth including:  Qi et al., Safety Alignment Should Be Made More Than Just a Few Tokens Deep, ICLR 2025.", "broader_impact_concerns": "Since this is a survey paper, I don't have particular ethical concerns. The authors could include an impact statement in the paper if this is part of TMLRs requirement for publishing.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "4R3EhQ7wEy", "reviewer": "Reviewer_LBK7", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\n1.\tThe survey is well-motivated. Structuring the discussion of LLM robustness around definition, causes, evaluation methods and mitigation strategies provides a foundation for advancing the field and developing robust LLMs. \n\nWeaknesses:\n\n1.\tThe paper offers valuable insights about various factors that affect the robustness of LLMs. However, adding references wherever possible would strengthen these discussions and make them more concrete. For example, on page 8, when discussing biases (e.g., lexical, positional), citing relevant papers that demonstrate these biases in practice would improve credibility.\n2.\tSection 3 describes the sources that contribute to reduced robustness in LLMs. Thus, the appropriate title should be something like “Sources of Robustness Failures in LLMs”.\n3.\tThe paper discusses “Accuracy Drop” in section 5.1.1 and the “IID-OOD Performance Gap” in section 5.1.2, but their definitions seem very similar. Please clarify the distinction between these two metrics, as they currently appear redundant.\n4.\tThe key contributions of this survey lies in its effort to define the scope of LLM robustness and unify diverse existing works on its various subaspects under a single framework. Additionally, the paper effectively categorizes the literature by highlighting different sources of non-robustness, mitigation strategies, and evaluation benchmarks across multiple dimensions. \nTo enhance the paper’s contributions for the research community, it would be beneficial to propose a composite benchmark (built by aggregating multiple existing benchmarks) that can holistically evaluate all dimensions of robustness discussed in the paper. Furthermore, evaluating popular open-source models such as LLaMA, Mistral, and Qwen, etc, on this proposed benchmark would offer concrete insights and enhance the practical relevance of the survey.\n\nSuggestions and Typos:\n\n1. I understand the motivation behind including Figure 2 and Figure 3; however, on their own, these figures do not clearly convey the intended points. One still needs to refer to the text description to understand their purpose. For example, in Figure 2, the tree illustration uses roots to represent various dimensions of robustness, but it is unclear what the tree itself signifies. If the tree is meant to represent the LLM, then it would be helpful to explicitly label the tree trunk as “LLM” to clarify its meaning.\nSimilarly, to enhance the clarity in Figure 3, authors may onsider adding a descriptive title like “Synergies and trade-offs in building robust LLMs”. Incorporating labeled arrows like “Fairness vs Generalization” between competing objectives would help better communicate the underlying trade-offs and make the figure more self-explanatory.\n2. Figure 1 - Future Work says \"Will be updated later\", which appears to be a placeholder. Please update this appropriately.\n3.\tPage 7. The heading Inference Related does not have any accompanying description or content.\n4.\tpage 9 – Phrasing issue:\n“The process of training and aligning LLMs can introduces such vulnerabilities:” should be revised.\n5.\tSection 3.2.2 – 2nd line – the work robustness sources seems weird:\n“the process itself can introduce robustness Sources in the following ways”. Pease rephrase for clarity.\n6.\tPage 31: Robust Evaluation Strategies -> the following passage has  unexplained numbers (I believe authors wanted to cite these subsections) like 52, 59 etc. in the text. Please fix this.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This survey paper examines the robustness of large language models (LLMs). Previous research has explored this topic from multiple angles, including adversarial attack where prompts are intentionally crafted to elicit harmful or incorrect responses, as well as issues like hallucinations and domain shifts. The survey begins by providing a comprehensive definition of LLM robustness. It then analyses the different factors contributing to non-robust behaviour and reviews strategies to address these weaknesses. Additionally, the paper discusses existing benchmarks and metrics used to evaluate the reliability of LLMs.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "1. Please propose a composite benchmark (like a leaderboard) that can be used to evaluate the robustness of open-source LLMs across the dimensions mentioned in the survey. Evaluate at least a few of the popular opensource models (at least the smaller ones) on this new benchmark.\n\n2. Please fix the issues (1,2,3) mentioned in weaknesses above. \n\n3. Please fix the typos mentioned in the previous section.", "broader_impact_concerns": "None", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "N1KEPLVDS6", "reviewer": "Reviewer_eekr", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "## Strengths\n1. Provides a clear working definition of llm robustness that synthesizes multiple perspectives from the literature, addressing a gap in consistent terminology across the field\n2. The categorisation is structured and the classification is a path forward to more standardised and consistent terminology in the field\n3. The lifecycle approach is very practical and not something I've seen in many survey papers\n\n## Weaknesses\n1. The search methodology seems to be absent. No search protocol, inclusion/exclusion criteria or PRISMA-style flowchart. Without these the reproducibility is limited and it's hard to gauge whether there are gaps in the survey approach. \n2. Some of the writing could be sharpened and more coherent, for example: \"Large Language Models (LLMs)\" is defined four times across the paper, NLI is defined three times. It only needs to be defined once. \n3. The definitions and delinations of adversarial attacks vs jailbreaks vs prompt injections are not clear to me, yet a lot of the phrasing seems to suggest these are being treated as distinct. Although the authors do mention that there can be overlaps (and I agree that they are almost impossible to avoid), it would be good to get some clarification in this instance.\n4. The authors do go into trade-offs between different approaches, but there's no deep systematic critical evaluation of relative merits. I would have been interested in head-to-head comparisons  or even fairly simple scalability or cost-benefit quantifications. This would help both researchers and practitioners answers questions like \"which defense mechanisms are most effective for specific threat models\" and result in more informed decisions and increase the value of the paper\n5. There is also a lack of more direct guidance for practitioners. Table 2 helps with this to some extent but it's not explicit in their recommendation. This ties back to my previous point about cost-benefit analyses to make the findings more actionable to practitioners.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This survey paper provides a comprehensive overview of robustness challenges in llms. The authors define llm robustness as a multi-faceted concept encompassing resilience to adversarial attacks, out-of-distribution generalisation, prompt stability, noise tolerance and output consistency. They then organise current literature into a coherent framework spanning the entire llm lifecycle.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "1. Include a detailed search protocol (databases, date range, search strings), explicit inclusion and exclusion criteria or a PRISMA-style flow diagram\n2. Provide crisper definition for adversarial attacks, jailbreaks and prompt injections\n3. Include simple quantitative cost–benefit analyses for key threat model types\n4. Add actionable guidance for practitioners (I can suggest either a decision matrix or flowchart, but even simple key takeaway sentences would be valuable)", "broader_impact_concerns": "None identified.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)