Elamur Research⌕
☰
home / papers / 2026 / HiddenGuard: Fine-Grained Safe Generation with Specialized Representation Router

HiddenGuard: Fine-Grained Safe Generation with Specialized Representation Router

Paper · 2026 · Lingrui Mei, Shenghua Liu, Yiwei Wang et al.

Summary

Safety alignment in LLMs usually works as a yes/no gate: a prompt is either answered or refused. This tends to block harmless requests, such as a "killer slideshow," and to miss subtle or context-dependent harm. The authors propose HiddenGuard, which moderates output token by token instead of refusing whole answers.

Its core component, PRISM, runs in parallel with a frozen base model and reads its intermediate hidden states. Several low-rank "activators" detect that a harmful context is present. A separate router network then decides, for each generated token, whether to keep it or replace it with [REDACTED]. As a result, warnings and general context survive while specific dangerous instructions are masked.

The authors also release a dataset with token-level annotations of harmful spans. They report over 90% F1 for detecting and redacting harmful content and attack success rates below 7%. General capability (MMLU-Pro) and false refusal rates stay unchanged.

The work matters because it offers a middle path between unhelpful refusals and successful jailbreaks.

Key points

  • Architecture: PRISM (Representation Router for In-Stream Moderation) has two parts.
    • Activators are LoRA-style low-rank signal heads trained with an adversarial regularization loss and a retention loss, following circuit breakers (Zou et al., 2024).
    • A router makes the per-token redaction decision. Base weights are not modified.
  • Attack success rate (ASR): On LLaMA3.1-8B, ASR fell from 19.8 to 1.2, and on LLaMA3.1-70B from 37.9 to 1.1. MMLU-Pro stayed at about 48.3 and 55.0. By contrast, the Eraser baseline dropped MMLU-Pro to roughly 21 and 18.
  • False refusals: On the benchmark of An et al. (2024), FRR was identical to the base models (0.86, 0.72 and 0.92 for LLaMA3-8B, LLaMA3.1-8B and LLaMA3.1-70B).
  • Ablation: The full system scored precision 0.85, recall 0.87 and F1 0.86, and replacing either component with a simple MLP lowered F1 to between 0.65 and 0.83. Note that this F1 sits below the headline "over 90%," so the two figures likely come from different evaluation setups.
  • Limitations noted by the authors:
    • Sycophantic content can remain in the parts of a response that are not redacted.
    • Evaluation covers a narrow set of benchmarks (no WildGuardTest or Aegis).
    • The activator and router add a small compute cost.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓Hong Kong University of Science and TechnologyHong Kong · China142 works · 25,136 citations🏛️Chinese Academy of SciencesBeijing · China194 works · 23,906 citations🔬Institute of Computing TechnologyBeijing · China51 works · 3,411 citations🎓University of California, MercedMerced · United States11 works · 425 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksArts and Humanities · 16,039 worksLanguage and Linguistics · 15,891 works

🧭 Topics 1Research subjects and languages the work is about.Bias, fairness & safety · 517 works

Cite

Cite as Lingrui Mei, Shenghua Liu, Yiwei Wang, Baolong Bi, Ruibin Yuan and Xueqi Cheng. 2026. HiddenGuard: Fine-Grained Safe Generation with Specialized Representation Router. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.acl-long.1482

@inproceedings{mei2026hiddenguard,
  title = {{HiddenGuard: Fine-Grained Safe Generation with Specialized Representation Router}},
  author = {Lingrui Mei, Shenghua Liu, Yiwei Wang, Baolong Bi, Ruibin Yuan and Xueqi Cheng},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.1482},
  url = {https://doi.org/10.18653/v1/2026.acl-long.1482}
}

References

143 references, 39 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Gilad Alon and Michael Kamfonas. 2023. Detecting language model attacks with perplexity. arXiv preprint arXiv:2308.14132.
  2. Bang An, Sicheng Zhu, Ruiyi Zhang, Michael-Andrei Panaitescu-Liess, Yuancheng Xu, and Furong Huang. 2024. Automatic pseudo-harmful prompt generation for evaluating false refusals in large language models. Preprint, arXiv:2409.00598. — [arXiv:2409.00598](https://arxiv.org/abs/2409.00598) find
  3. Markus Anderljung and Alexis Carlier. 2021. Some AI Governance Research Ideas. https://docs.google.com/document/d/ 13LJhP3ksrcEBKxYFG5GkJaC2UoxHKUYAHCRdRlpePEc/ edit. Accessed on: January 30, 2024. ↗
  4. Anthropic. 2024. The claude 3 model family: Opus, sonnet, haiku. find
  5. Usman Anwar, Abulhair Saparov, Javier Rando, Daniel Paleka, Miles Turpin, Peter Hase, Ekdeep Singh Lubana, Erik Jenner, Stephen Casper, Oliver Sourbut, and 1 others. 2024. Foundational challenges in assuring alignment and safety of large language models. arXiv preprint arXiv:2404.09932. find
  6. Anish Athalye, Nicholas Carlini, and David Wagner. 2018. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International conference on machine learning, pages 274–283. PMLR. find
  7. Adam Au. 2023. China vs. US Approaches to AI Governance. The Diplomat. https://thediplomat.com/2023/10/ china-vs-us-approaches-to-ai-governance/. Accessed on: 1 February, 2024. ↗
  8. Baolong Bi, Shenghua Liu, Yiwei Wang, Lingrui Mei, Hongcheng Gao, Yilong Xu, and Xueqi Cheng. 2024e. Adaptive token biaser: Knowledge editing via biasing key entities. arXiv preprint arXiv:2406.12468. find
  9. Lewis Bailey, Eugene Ong, Stuart Russell, and Scott Emmons. 2023. Image hijacks: Adversarial images can control generative models at runtime. arXiv preprint arXiv:2309.00236. — [arXiv:2309.00236](https://arxiv.org/abs/2309.00236) find
  10. Baolong Bi, Shenghua Liu, Yiwei Wang, Siqian Tong, Lingrui Mei, Yuyao Ge, Yilong Xu, Jiafeng Guo, and Xueqi Cheng. 2025c. Reward and guidance through rubrics: Promoting exploration to improve multi-domain reasoning. arXiv preprint arXiv:2511.12344. — [arXiv:2511.12344](https://arxiv.org/abs/2511.12344) find
  11. Nathan Barnard and Erin Robertson. 2024. AI Governance and Strategy: A List of Research Agendas and Work That Could Be Done. Less Wrong. https://www.lesswrong.com/posts/ Zn73PkYWGKYjLiBAf/. ↗
  12. Justin B. Bullock, Yu-Che Chen, Johannes Himmelreich, Valerie M. Hudson, Anton Korinek, Matthew M. Young, and Baobao Zhang. 2022. The Oxford Handbook of AI Governance. Oxford University Press. find
  13. David Bau, Hendrik Strobelt, William Peebles, Jonas Wulff, Bolei Zhou, Jun-Yan Zhu, and Antonio Torralba. 2020. Semantic photo manipulation with a generative image prior. arXiv preprint arXiv:2005.07727. — [arXiv:2005.07727](https://arxiv.org/abs/2005.07727) find
  14. Nicholas Carlini, Milad Nasr, Christopher A Choquette-Choo, Matthew Jagielski, Irena Gao, Pang Wei Koh, Daphne Ippolito, Florian Tramer, and Ludwig Schmidt. 2023. Are aligned neural networks adversarially aligned? Advances in Neural Information Processing Systems, 36. find
  15. Baolong Bi, Yuyao Ge, Shenghua Liu, Yuchen He, Siqian Tong, Lizhe Chen, Lingrui Mei, Zehao Li, Yiwei Wang, Yujun Cai, and 1 others. 2026. Promptcd: Test-time behavior enhancement via polarity-prompt contrastive decoding. arXiv preprint arXiv:2602.20696. — [arXiv:2602.20696](https://arxiv.org/abs/2602.20696) find
  16. Mathilde Caron, Hugo Touvron, Ishan Misra, Hervé Jégou, Julien Mairal, Piotr Bojanowski, and Armand Joulin. 2021. Emerging properties in self-supervised vision transformers. In Proceedings of the IEEE/CVF international conference on computer vision, pages 9650–9660.
  17. Baolong Bi, Shenghua Liu, Lingrui Mei, Yiwei Wang, Junfeng Fang, Pengliang Ji, and Xueqi Cheng. 2025a. Decoding by contrasting knowledge: Enhancing large language model confidence on edited facts. In ACL 2025, pages 17198–17208. find
  18. Center for AI Safety, Aidan O’Gara, Corin Katzke, and Dan Hendrycks. 2024. AI Safety Newsletter \#32: Measuring and Reducing Hazardous Knowledge in LLMs. AI Safety Newsletter. https://newsletter.safe.ai/p/ ai-safety-newsletter-32-measuring. ↗
  19. Baolong Bi, Shenghua Liu, Lingrui Mei, Yiwei Wang, Pengliang Ji, and Xueqi Cheng. 2024a. Decoding by contrasting knowledge: Enhancing llms’ confidence on edited facts. arXiv preprint arXiv:2405.11613. — [arXiv:2405.11613](https://arxiv.org/abs/2405.11613) find
  20. Baolong Bi, Shenghua Liu, Xingzhang Ren, Dayiheng Liu, Junyang Lin, Yiwei Wang, Lingrui Mei, Junfeng Fang, Jiafeng Guo, and Xueqi Cheng. 2025b. Refinex: Learning to refine pre-training data at scale from expert-guided programs. arXiv preprint arXiv:2507.03253. — [arXiv:2507.03253](https://arxiv.org/abs/2507.03253) find
  21. Baolong Bi, Shenghua Liu, Yiwei Wang, Lingrui Mei, and Xueqi Cheng. 2024b. Is factuality decoding a free lunch for llms? evaluation on knowledge editing benchmark. Preprint, arXiv:2404.00216. — [arXiv:2404.00216](https://arxiv.org/abs/2404.00216) find
  22. Baolong Bi, Shenghua Liu, Yiwei Wang, Lingrui Mei, and Xueqi Cheng. 2024c. Lpnl: Scalable link prediction with large language models. In Findings of the Association for Computational Linguistics ACL 2024, pages 3615–3625. find
  23. Baolong Bi, Shenghua Liu, Yiwei Wang, Lingrui Mei, Hongcheng Gao, Junfeng Fang, and Xueqi Cheng. 2024d. Struedit: Structured outputs enable the fast and accurate knowledge editing for large language models. arXiv preprint arXiv:2409.10132. — [arXiv:2409.10132](https://arxiv.org/abs/2409.10132) find
  24. Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. 2023. Jailbreaking black box large language models in twenty queries. Preprint, arXiv:2310.08419.
  25. Fei-Long Chen, Du-Zhen Zhang, Ming-Lun Han, Xiu-Yi Chen, Jing Shi, Shuang Xu, and Bo Xu. 2023. Vlp: A survey on vision-language pre-training. Machine Intelligence Research, 20(1):38–56. find
  26. Jianing Chen, Zehao Li, Yujun Cai, Hao Jiang, Shuqin Gao, Honglong Zhao, Tianlu Mao, and Yucheng Zhang. 2025a. From tokens to nodes: Semantic-guided motion control for dynamic 3d gaussian splatting. Preprint, arXiv:2510.02732. — [arXiv:2510.02732](https://arxiv.org/abs/2510.02732) find
  27. Jianing Chen, Zehao Li, Yujun Cai, Hao Jiang, Chengxuan Qian, Juyuan Kang, Shuqin Gao, Honglong Zhao, Tianlu Mao, and Yucheng Zhang. 2025b. Haif-gs: Hierarchical and induced flow-guided gaussian splatting for dynamic scene. In NeurIPS 2025. find
  28. Juan Chen, Baolong Bi, Wei Zhang, Jingyan Sui, Xiaofei Zhu, Yuanzhuo Wang, Lingrui Mei, and Shenghua Liu. 2025c. Rethinking all evidence: Enhancing trustworthy retrieval-augmented generation via conflict-driven summarization. arXiv preprint arXiv:2507.01281. — [arXiv:2507.01281](https://arxiv.org/abs/2507.01281) find
  29. Arijit Ghosh Chowdhury, Md Mofijul Islam, Vaibhav Kumar, Faysal Hossain Shezan, Vaibhav Kumar, Vinija Jain, and Aman Chadha. 2024. Breaking down the defenses: A comparative survey of attacks on large language models. Preprint, arXiv:2403.04786. — [arXiv:2403.04786](https://arxiv.org/abs/2403.04786) find
  30. Paul F Christiano, Jan Leike, Tom Brown, Miljan Martic, Shane Legg, and Dario Amodei. 2017. Deep reinforcement learning from human preferences. Advances in neural information processing systems, 30. find
  31. Sasha Costanza-Chock, Inioluwa Deborah Raji, and Joy Buolamwini. 2022. Who Audits the Auditors? Recommendations from a field scan of the algorithmic auditing ecosystem. In Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency, pages 1571–1583. find
  32. Council of the European Union. 2024. Proposal for a Regulation of the European Parliament and of the Council on Artificial Intelligence (Artificial Intelligence Act). https://data.consilium.europa.eu/doc/document/ST-5662-2024-INIT/en/pdf. ↗
  33. Allan Dafoe. 2018. AI governance: a research agenda. Governance of AI Program, Future of Humanity Institute, University of Oxford: Oxford, UK, 1442:1443. find
  34. Badhan Chandra Das, M Hadi Amini, and Yanzhao Wu. 2024. Security and privacy challenges of large language models: A survey. arXiv preprint arXiv:2402.00888.
  35. Ning Ding, Yulin Chen, Bokai Xu, Yujia Qin, Zhi Zheng, Shengding Hu, Zhiyuan Liu, Maosong Sun, and Bowen Zhou. 2023. Enhancing chat language models by scaling high-quality instructional conversations. arXiv preprint arXiv:2305.14233.
  36. Alex Engler. 2023. A comprehensive and distributed approach to AI regulation. Brookings. find
  37. Michael Feffer, Aman Sinha, Zachary C Lipton, and Hoda Heidari. 2024. Red-teaming for generative ai: Silver bullet or security theater? arXiv preprint arXiv:2401.15897. — [arXiv:2401.15897](https://arxiv.org/abs/2401.15897) find
  38. Honghao Fu, Yongli Gu, Yidong Yan, Yilang Shen, Yiwen Wu, and Libo Sun. 2025a. Sdr-gain: A high real-time occluded pedestrian pose completion method for autonomous driving. IEEE Transactions on Intelligent Transportation Systems, 27(1):972–982. find
  39. Honghao Fu, Yuan Ouyang, Kai-Wei Chang, Yiwei Wang, and Yujun Cai. 2025b. Contextnav: Towards agentic multimodal in-context learning. arXiv preprint arXiv:2510.04560. — [arXiv:2510.04560](https://arxiv.org/abs/2510.04560) find
  40. Honghao Fu, Junlong Ren, Qi Chai, Deheng Ye, Yujun Cai, and Hao Wang. 2025c. Vistawise: Building cost-effective agent with cross-modal knowledge graph for minecraft. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 21895–21909. find
  41. Honghao Fu, Yilang Shen, Yuxuan Liu, Jingzhong Li, and Xiang Zhang. 2023. Sgcn: a multi-order neighborhood feature fusion landform classification method based on superpixel and graph convolutional network. International Journal of Applied Earth Observation and Geoinformation, 122:103441. find
  42. Honghao Fu, Hao Wang, Jing Jih Chin, and Zhiqi Shen. 2025d. Brainvis: Exploring the bridge between brain and visual signals via image reconstruction. In ICASSP 2025-2025 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pages 1–5. IEEE. find
  43. Honghao Fu, Yufei Wang, Wenhan Yang, Alex C Kot, and Bihan Wen. 2024. Dp-iqa: Utilizing diffusion prior for blind image quality assessment in the wild. arXiv preprint arXiv:2405.19996. — [arXiv:2405.19996](https://arxiv.org/abs/2405.19996) find
  44. Honghao Fu, Miao Xu, Yiwei Wang, Dailing Zhang, Liu Jun, and Yujun Cai. 2026. Videostir: Understanding long videos via spatio-temporally structured and intent-aware rag. arXiv preprint arXiv:2604.05418. find
  45. Haonan Ge, Yiwei Wang, Kai-Wei Chang, Hang Wu, and Yujun Cai. 2025a. Framemind: Frame-interleaved video reasoning via reinforcement learning. arXiv preprint arXiv:2509.24008. — [arXiv:2509.24008](https://arxiv.org/abs/2509.24008) find
  46. Yuyao Ge, Shenghua Liu, Baolong Bi, Yiwei Wang, Lingrui Mei, Wenjie Feng, Lizhe Chen, and Xueqi Cheng. 2024. Can graph descriptive order affect solving graph problems with llms? ACL 2025.
  47. Yuyao Ge, Shenghua Liu, Yiwei Wang, Tianyu Liu, Baolong Bi, Lingrui Mei, Jiayu Yao, Jiafeng Guo, and Xueqi Cheng. 2026. Prism-δ: Differential subspace steering for prompt highlighting in large language models. arXiv preprint arXiv:2603.10705. — [arXiv:2603.10705](https://arxiv.org/abs/2603.10705) find
  48. Yuyao Ge, Shenghua Liu, Yiwei Wang, Lingrui Mei, Baolong Bi, Xuanshan Zhou, Jiayu Yao, Jiafeng Guo, and Xueqi Cheng. 2025b. Focusing by contrastive attention: Enhancing vlms’ visual reasoning. arXiv preprint arXiv:2509.06461. — [arXiv:2509.06461](https://arxiv.org/abs/2509.06461) find
  49. Yuyao Ge, Lingrui Mei, Zenghao Duan, Tianhao Li, Yujia Zheng, Yiwei Wang, Lexin Wang, Jiayu Yao, Tianyu Liu, Yujun Cai, and 1 others. 2025c. A survey of vibe coding with large language models. arXiv preprint arXiv:2510.12399. — [arXiv:2510.12399](https://arxiv.org/abs/2510.12399) find
  50. Neel Guha, Christie Lawrence, Lindsey A Gailmard, Kit Rodolfa, Faiz Surani, Rishi Bommasani, Inioluwa Raji, Mariano-Florentino Cuéllar, Colleen Honigsberg, Percy Liang, and 1 others. 2023. Ai regulation has its own alignment problem: The technical and institutional feasibility of disclosure, registr… find
  51. Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q. Weinberger. 2017. On calibration of modern neural networks. Preprint, arXiv:1706.04599. find
  52. Gillian K Hadfield and Jack Clark. 2023. Regulatory Markets: The Future of AI Governance. arXiv preprint arXiv:2304.04914. — [arXiv:2304.04914](https://arxiv.org/abs/2304.04914) find
  53. Seungju Han, Kavel Rao, Allyson Ettinger, Liwei Jiang, Bill Yuchen Lin, Nathan Lambert, Yejin Choi, and Nouha Dziri. 2024. Wildguard: Open one-stop moderation tools for safety risks, jailbreaks, and refusals of llms. Advances in Neural Information Processing Systems, 37:8093–8131.
  54. Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. 2021. Lora: Low-rank adaptation of large language models. arXiv preprint arXiv:2106.09685.
  55. Gabriel Ilharco, Marco Tulio Ribeiro, Mitchell Wortsman, Suchin Gururangan, Ludwig Schmidt, Hannaneh Hajishirzi, and Ali Farhadi. 2022. Editing models with task arithmetic. arXiv preprint arXiv:2212.04089.
  56. Jiaming Ji, Boyuan Chen, Hantao Lou, Donghai Hong, Borong Zhang, Xuehai Pan, Juntao Dai, and Yaodong Yang. 2024. Aligner: Achieving efficient alignment through weak-to-strong correction. arXiv preprint arXiv:2402.02416. find
  57. Yifan Jiang, Kriti Aggarwal, Tanmay Laud, Kashif Munir, Jay Pujara, and Subhabrata Mukherjee. 2024. Red queen: Safeguarding large language models against concealed multi-turn jailbreaking. Preprint, arXiv:2409.17458. — [arXiv:2409.17458](https://arxiv.org/abs/2409.17458) find
  58. Sayash Kapoor, Rishi Bommasani, Kevin Klyman, Shayne Longpre, Ashwin Ramaswami, Peter Cihon, Aspen Hopkins, Kevin Bankston, Stella Biderman, Miranda Bogen, and 1 others. 2024. On the Societal Impact of Open Foundation Models. arXiv. find
  59. Kai Konen, Sophie Jentzsch, Diaoulé Diallo, Peer Schütt, Oliver Bensch, Roxanne El Baff, Dominik Opitz, and Tobias Hecking. 2024. Style vectors for steering generative large language model. arXiv preprint arXiv:2402.01618. — [arXiv:2402.01618](https://arxiv.org/abs/2402.01618) find
  60. Neel Nanda Li, Maximilian, and Xander Davies. 2023. Circuit breaking: Removing model behaviors with targeted ablation. arXiv preprint arXiv:2309.05973. — [arXiv:2309.05973](https://arxiv.org/abs/2309.05973) find
  61. Nelson Li, Alexander Pan, Anjali Gopal, Stephen Yue, Daniel Berrios, Andrei Gatti, Jeffrey D Li, Anne-Kathrin Dombrowski, Shrey Goel, Long Phan, and 1 others. 2024a. The wmdp benchmark: Measuring and reducing malicious use with unlearning. arXiv preprint arXiv:2402.05070.
  62. Zhecheng Li, Yiwei Wang, Bryan Hooi, Yujun Cai, Naifan Cheung, Nanyun Peng, and Kai-Wei Chang. 2024b. Think carefully and check again! meta-generation unlocking llms for low-resource cross-lingual summarization. arXiv preprint arXiv:2410.20021. — [arXiv:2410.20021](https://arxiv.org/abs/2410.20021) find
  63. Zhecheng Li, Yiwei Wang, Bryan Hooi, Yujun Cai, Nanyun Peng, and Kai-Wei Chang. 2024c. Drs: Deep question reformulation with structured output. In Association for Computational Linguistics ACL, 2025. find
  64. Zhecheng Li, Yiwei Wang, Bryan Hooi, Yujun Cai, Zhen Xiong, Nanyun Peng, and Kai-Wei Chang. 2024d. Vulnerability of llms to vertically aligned text manipulations. In Association for Computational Linguistics ACL, 2025.
  65. Zhong-Zhi Li, Ming-Liang Zhang, Fei Yin, Zhi-Long Ji, Jin-Feng Bai, Zhen-Ru Pan, Fan-Hu Zeng, Jian Xu, Jia-Xin Zhang, and Cheng-Lin Liu. 2024e. Cmmath: A chinese multi-modal math skill evaluation benchmark for foundation models. arXiv preprint arXiv:2407.12023. find
  66. T Lin. 2017. Focal loss for dense object detection. arXiv preprint arXiv:1708.02002.
  67. Huan Ling, Karsten Kreis, Daiqing Li, Seung Wook Kim, Antonio Torralba, and Sanja Fidler. 2021. Ed-itgan: High-precision semantic image editing. Advances in Neural Information Processing Systems, 34:16331–16345. find
  68. Chang Liu, Hongkai Chen, Yujun Cai, Hang Wu, Qingwen Ye, Ming-Hsuan Yang, and Yiwei Wang. 2025. Structured attention matters to multimodal llms in document understanding. arXiv preprint arXiv:2506.21600. — [arXiv:2506.21600](https://arxiv.org/abs/2506.21600) find
  69. Xiao Liu, Hao Yu, Hanchen Zhang, Yanzhe Xu, Xinmei Lei, Huolin Lai, Yida Gu, Haohan Ding, Kai Men, Kai Yang, and 1 others. 2023. Agentbench: Evaluating llms as agents. arXiv preprint arXiv:2308.03688.
  70. Xiang Long, Li Du, Yilong Xu, Fangcheng Liu, Haoqing Wang, Ning Ding, Ziheng Li, Jianyuan Guo, and Yehui Tang. Liveclawbench: Benchmarking llm agents on complex, real-world assistant tasks. find
  71. Weikai Lu, Ziqian Zeng, Jianwei Wang, Zhengdong Lu, Zelin Chen, Huiping Zhuang, and Cen Chen. 2024. Eraser: Jailbreaking defense in large language models via unlearning harmful knowledge. Preprint, arXiv:2404.05880. — [arXiv:2404.05880](https://arxiv.org/abs/2404.05880) find
  72. Ximing Lu, Faeze Brahman, Peter West, Jaehun Jang, Khyathi Chandu, Abhilasha Ravichander, Lianhui Qin, Prithviraj Ammanabrolu, Liwei Jiang, Sahana Ramnath, and 1 others. 2023. Inference-time policy adapters (ipa): Tailoring extreme-scale lms without fine-tuning. arXiv preprint arXiv:2305.15065. find
  73. Linyue Ma, Yilong Xu, Xiang Long, and Zhi Zheng. 2025. An efficient rubric-based generative verifier for search-augmented llms. arXiv preprint arXiv:2510.14660. — [arXiv:2510.14660](https://arxiv.org/abs/2510.14660) find
  74. Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083.
  75. Neil Mangaokar, Avijit Hooda, Jiahao Choi, Sidharth Chandrashekaran, Kassem Fawaz, Somesh Jha, and Atul Prakash. 2024. Prp: Propagating universal perturbations to attack large language model guard-rails. arXiv preprint arXiv:2402.15911. find
  76. Jiayi Mao, Hanle Zheng, Huifeng Yin, Hanxiao Fan, Lingrui Mei, Hao Guo, Yao Li, Jibin Wu, Jing Pei, and Lei Deng. 2025. Adaptive dendritic plasticity in brain-inspired dynamic neural networks for enhanced multi-timescale feature extraction. Neural Networks, page 108191. find
  77. Gary E Marchant. 2011. The growing gap between emerging technologies and the law. Springer. find
  78. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, and 1 others. 2024. Harmbench: A standardized evaluation framework for automated red teaming and robust refusal. arXiv preprint arXiv:2402.04249.
  79. Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi. 2023. Tree of attacks: Jailbreaking black-box llms automatically.
  80. Lingrui Mei, Shenghua Liu, Yiwei Wang, Baolong Bi, and Xueqi Chen. 2024a. Slang: New concept comprehension of large language models. arXiv preprint arXiv:2401.12585. find
  81. Lingrui Mei, Shenghua Liu, Yiwei Wang, Baolong Bi, Jiayi Mao, and Xueqi Cheng. 2024b. " not aligned" is not" malicious": Being careful about hallucinations of large language models’ jailbreak. arXiv preprint arXiv:2406.11668. find
  82. Lingrui Mei, Shenghua Liu, Yiwei Wang, Yuyao Ge, Baolong Bi, Jiayu Yao, Jun Wan, Ziling Yin, Jiafeng Guo, and Xueqi Cheng. 2026. Gated differentiable working memory for long-context language modeling.
  83. Lingrui Mei, Jiayu Yao, Yuyao Ge, Yiwei Wang, Baolong Bi, Yujun Cai, Jiazhi Liu, Mingyu Li, Zhong-Zhi Li, Duzhen Zhang, and 1 others. 2025. A survey of context engineering for large language models. arXiv preprint arXiv:2507.13334. — [arXiv:2507.13334](https://arxiv.org/abs/2507.13334) find
  84. Kevin Meng, David Bau, Alex Andonian, and Yonatan Belinkov. 2022a. Locating and editing factual associations in GPT. Advances in Neural Information Processing Systems, 35. find
  85. Kevin Meng, Arnav S Sharma, Alex Andonian, Yonatan Belinkov, and David Bau. 2022b. Mass-editing memory in a transformer. arXiv preprint arXiv:2210.07229. find
  86. Tomas Mikolov, Kai Chen, Greg Corrado, and Jeffrey Dean. 2013. Efficient estimation of word representations in vector space. arXiv preprint arXiv:1301.3781.
  87. Eric Mitchell, Charles Lin, Antoine Bosselut, Chelsea Finn, and Christopher D Manning. 2021. Fast model editing at scale. arXiv preprint arXiv:2110.11309. find
  88. Eric Mitchell, Charles Lin, Antoine Bosselut, Christopher D Manning, and Chelsea Finn. 2022. Memory-based model editing at scale. In International Conference on Machine Learning, pages 15817–15831. PMLR. find
  89. Zachary Mowshowitz. 2022. Jailbreaking chatgpt on release day. https://www.lesswrong.com/posts/RYcoJdvmoBbi5Nax7/ jailbreaking-chatgpt-on-release-day. Accessed: 2024-05-19. ↗
  90. OpenAI. 2022. large-scale generative pre-training model for conversation. OpenAI blog. find
  91. OpenAI. 2023. Gpt-4 technical report. arXiv:2303.08774.
  92. Preprint, Long Ouyang, Jeff Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, and 1 others. 2022. Training language models to follow instructions with human feedback. Advances in Neural Information Processing Systems, 35:27730–2…
  93. Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving. 2022. Red teaming language models with language models. arXiv preprint arXiv:2202.03286.
  94. Rafael Rafailov, Archit Sharma, Eric Mitchell, Stefano Ermon, Christopher D Manning, and Chelsea Finn. 2023. Direct preference optimization: Your language model is secretly a reward model. arXiv preprint arXiv:2305.18290.
  95. Inioluwa Deborah Raji. 2021. The Anatomy of AI Audits: Form, Process, and Consequences. The Oxford Handbook of AI Governance. find
  96. Xuming Ran, Mingkun Xu, Lingrui Mei, Qi Xu, and Quanying Liu. 2022. Detecting out-of-distribution samples via variational auto-encoder with reliable uncertainty estimation. Neural Networks, 145:199– 208. find
  97. Alexander Robey, Eric Wong, Hamed Hassani, and George J Pappas. 2023. Smoothllm: Defending large language models against jailbreaking attacks. arXiv preprint arXiv:2310.03684.
  98. Paul Röttger, Hannah Rose Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. 2023. Xstest: A test suite for identifying exaggerated safety behaviours in large language models. arXiv preprint arXiv:2308.01263.
  99. Christian Schlarmann and Matthias Hein. 2023. On the adversarial robustness of multi-modal foundation models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 3677– 3685. find
  100. Yonadav Shavit, Sandhini Agarwal, Miles Brundage, Steven Adler, Cullen O’Keefe, Rosie Campbell, Teddy Lee, Pamela Mishkin, Tyna Eloundou, Alan Hickey, and 1 others. 2023. Practices for Governing Agentic AI Systems. find
  101. Erfan Shayegani, Md Abdullah Al Mamun, Yu Fu, Pedram Zaree, Yue Dong, and Nael Abu-Ghazaleh. 2023. Survey of vulnerabilities in large language models revealed by adversarial attacks. arXiv preprint arXiv:2310.10844.
  102. Zezheng Song, Jiaxin Yuan, and Haizhao Yang. 2024. Fmint: Bridging human designed and data pretrained models for differential equation foundation model. arXiv preprint arXiv:2404.14688. — [arXiv:2404.14688](https://arxiv.org/abs/2404.14688) find
  103. Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, Aurélien Rodriguez, Armand Joulin, Edouard Grave, and Guillaume Lample. 2023a. Llama: Open and efficient foundation language models. CoRR, a…
  104. Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, Dan Bikel, Lukas Blecher, Cristian Canton Ferrer, Moya Chen, Guillem Cucurull, David Esiobu, Jude Fernandes, Jeremy Fu, Wenyin Fu, and 49 others… — Llama 2: Open Foundation and Fine-Tuned Chat Models
  105. Alexander Matt Turner, Lisa Thiergart, Gavin Garimella, and David Udell. 2023. Activation addition: Steering language models without optimization. arXiv preprint arXiv:2308.10248.
  106. Andrew Tutt. 2017. An FDA for algorithms. Admin. L. Rev., 69:83. find
  107. Paul Upchurch, Jacob Gardner, Geoff Pleiss, Robert Pless, Noah Snavely, Kavita Bala, and Kilian Weinberger. 2017. Deep feature interpolation for image content changes. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR). find
  108. A Vaswani. 2017. Attention is all you need. Advances in Neural Information Processing Systems.
  109. Michael Veale, Kira Matus, and Robert Gorwa. 2023. AI and Global Governance: Modalities, Rationales, Tensions. Annual Review of Law and Social Science, 19. find
  110. Juan Vega, Irshad Chaudhary, Cuiying Xu, and Gagandeep Singh. 2023. Bypassing the safety training of open-source llms with priming attacks. arXiv preprint arXiv:2312.12321. — [arXiv:2312.12321](https://arxiv.org/abs/2312.12321) find
  111. Jun Wan and Lingrui Mei. 2025. Large language models as computable approximations to solomonoff induction. arXiv preprint arXiv:2505.15784. — [arXiv:2505.15784](https://arxiv.org/abs/2505.15784) find
  112. Yiwei Wang, Muhao Chen, Nanyun Peng, and Kai-Wei Chang. 2024a. Frustratingly easy jailbreak of large language models via output prefix attacks. find
  113. Yubo Wang, Xueguang Ma, Ge Zhang, Yuansheng Ni, Abhranil Chandra, Shiguang Guo, Weiming Ren, Aaran Arulraj, Xuan He, Ziyan Jiang, and 1 others. 2024b. Mmlu-pro: A more robust and challenging multi-task language understanding benchmark. arXiv preprint arXiv:2406.01574.
  114. Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2024. Jailbroken: How does llm safety training fail? Advances in Neural Information Processing Systems, 36.
  115. Jason Wei, Nika Haghtalab, and Jacob Steinhardt. 2023. Jailbroken: How does llm safety training fail? arXiv preprint arXiv:2307.02483.
  116. Yuxin Wen, Neel Jain, John Kirchenbauer, Micah Goldblum, Jonas Geiping, and Tom Goldstein. 2024. Hard prompts made easy: Gradient-based discrete optimization for prompt tuning and discovery. Advances in Neural Information Processing Systems, 36. find
  117. Hang Wu, Yujun Cai, Haonan Ge, Hongkai Chen, Ming-Hsuan Yang, and Yiwei Wang. 2025a. Re-fineshot: Rethinking cinematography understanding with foundational skill evaluation. arXiv preprint arXiv:2510.02423. — [arXiv:2510.02423](https://arxiv.org/abs/2510.02423) find
  118. Hang Wu, Hongkai Chen, Yujun Cai, Chang Liu, Qingwen Ye, Ming-Hsuan Yang, and Yiwei Wang. 2025b. Dimo-gui: Advancing test-time scaling in gui grounding via modality-aware visual reasoning. In EMNLP 2025.
  119. Tianyu Wu, Lingrui Mei, Ruibin Yuan, Lujun Li, Wei Xue, and Yike Guo. 2024. You know what i’m saying: Jailbreak attack via implicit reference. arXiv preprint arXiv:2410.03857. — [arXiv:2410.03857](https://arxiv.org/abs/2410.03857) find
  120. Zhen Xiong, Yujun Cai, Bryan Hooi, Nanyun Peng, Zhecheng Li, and Yiwei Wang. 2025a. Enhancing llm character-level manipulation via divide and conquer. arXiv preprint arXiv:2502.08180. — [arXiv:2502.08180](https://arxiv.org/abs/2502.08180) find
  121. Zhen Xiong, Yujun Cai, Zhecheng Li, and Yiwei Wang. 2025b. Mapping the minds of llms: A graph-based analysis of reasoning llm. arXiv preprint arXiv:2505.13890. — [arXiv:2505.13890](https://arxiv.org/abs/2505.13890) find
  122. Zhen Xiong, Yujun Cai, Zhecheng Li, and Yiwei Wang. 2025c. Unveiling the potential of diffusion large language model in controllable generation. arXiv preprint arXiv:2507.04504. — [arXiv:2507.04504](https://arxiv.org/abs/2507.04504) find
  123. Zhen Xiong, Yujun Cai, Zhecheng Li, Junsong Yuan, and Yiwei Wang. 2025d. Thinking with sound: Audio chain-of-thought enables multimodal reasoning in large audio-language models. arXiv preprint arXiv:2509.21749.
  124. Yilong Xu, Jinhua Gao, Xiaoming Yu, Baolong Bi, Huawei Shen, and Xueqi Cheng. 2024. Aliice: Evaluating positional fine-grained citation generation. In NAACL 2025 Main Conference. find
  125. Ming-Liang Zhang, Zhong-Zhi Li, Fei Yin, Liang Lin, and Cheng-Lin Liu. 2024c. Fuse, reason and verify: Geometry problem solving with parsed clauses from diagram. arXiv preprint arXiv:2407.07327. — [arXiv:2407.07327](https://arxiv.org/abs/2407.07327) find
  126. Yilong Xu, Jinhua Gao, Xiaoming Yu, Yuanhai Xue, Baolong Bi, Huawei Shen, and Xueqi Cheng. 2025a. Training a utility-based retriever through shared context attribution for retrieval-augmented language models. arXiv preprint arXiv:2504.00573. find
  127. Ming-Liang Zhang, Zhong-Zhi Li, Fei Yin, and Cheng-Lin Liu. 2023. Lans: A layout-aware neural solver for plane geometry problem. arXiv preprint arXiv:2311.16476. find
  128. Yilong Xu, Xiang Long, Zhi Zheng, and Jinhua Gao. 2025b. Ravine: Reality-aligned evaluation for agentic search. arXiv preprint arXiv:2507.16725. — [arXiv:2507.16725](https://arxiv.org/abs/2507.16725) find
  129. Yilong Xu, Zhi Zheng, Xiang Long, Yujun Cai, and Yiwei Wang. 2026. Self-manager: Parallel agent loop for long-form deep research. arXiv preprint arXiv:2601.17879. — [arXiv:2601.17879](https://arxiv.org/abs/2601.17879) find
  130. Jiayu Yao, Shenghua Liu, Yiwei Wang, Rundong Cheng, Lingrui Mei, Baolong Bi, Zhen Xiong, and Xueqi Cheng. Lost in time: Systematic temporal bias in large audio language models. find
  131. Jiayu Yao, Shenghua Liu, Yiwei Wang, Rundong Cheng, Lingrui Mei, Baolong Bi, Zhen Xiong, and Xueqi Cheng. 2025a. Not in sync: Unveiling temporal bias in audio chat models. arXiv preprint arXiv:2510.12185. — [arXiv:2510.12185](https://arxiv.org/abs/2510.12185) find
  132. Jiayu Yao, Shenghua Liu, Yiwei Wang, Lingrui Mei, Baolong Bi, Yuyao Ge, Zhecheng Li, and Xueqi Cheng. 2025b. Who is in the spotlight: The hidden bias undermining multimodal retrieval-augmented generation. find
  133. Yunzhi Yao, Peng Wang, Bozhong Tian, Siyuan Cheng, Zhoubo Li, Shumin Deng, Huajun Chen, and Ningyu Zhang. 2023. Editing large language models: Problems, methods, and opportunities. arXiv preprint arXiv:2305.13172. find
  134. Ruibin Yuan, Hanfeng Lin, Shuyue Guo, Ge Zhang, Jiahao Pan, Yongyi Zang, Haohe Liu, Yiming Liang, Wenye Ma, Xingjian Du, and 1 others. 2025. Yue: Scaling open foundation models for long-form music generation. find
  135. Youliang Yuan, Wenxiang Jiao, Wenxuan Wang, Jen-tse Huang, Jiahao Xu, Tian Liang, Pinjia He, and Zhaopeng Tu. 2024. Refuse whenever you feel unsafe: Improving safety in llms via decoupled refusal training. arXiv preprint arXiv:2407.09121.
  136. Duzhen Zhang, Yahan Yu, Chenxing Li, Jiahua Dong, Dan Su, Chenhui Chu, and Dong Yu. 2024a. Mm-llms: Recent advances in multimodal large language models. arXiv preprint arXiv:2401.13601.
  137. Jiaxin Zhang, Zhongzhi Li, Mingliang Zhang, Fei Yin, Chenglin Liu, and Yashar Moshfeghi. 2024b. Geoeval: benchmark for evaluating llms and multi-modal models on geometry problem-solving. arXiv preprint arXiv:2402.10104. find
  138. Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric Xing, and 1 others. 2023. Judging llm-as-a-judge with mt-bench and chatbot arena. arXiv preprint arXiv:2306.05685.
  139. Andy Zhou, Boyi Li, and Haizhong Wang. 2024. Robust prompt optimization for defending language models against jailbreaking attacks. arXiv preprint arXiv:2401.17263. — [arXiv:2401.17263](https://arxiv.org/abs/2401.17263) find
  140. Runchuan Zhu, Bowen Jiang, Lingrui Mei, Fangkai Yang, Lu Wang, Haoxiang Gao, Fengshuo Bai, Pu Zhao, Qingwei Lin, Saravan Rajmohan, and 1 others. 2025. Adaptflow: Adaptive workflow optimization via meta-learning. find
  141. Andy Zou, Long Phan, Sarah Chen, Jesse Campbell, Phillip Guo, Rishi Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Anne-Kathrin Dombrowski, and 1 others. 2023a. Representation engineering: A top-down approach to ai transparency. arXiv preprint arXiv:2310.01405.
  142. Andy Zou, Long Phan, Justin Wang, Derek Duenas, Maxwell Lin, Maksym Andriushchenko, Rowan Wang, Zico Kolter, Matt Fredrikson, and Dan Hendrycks. 2024. Improving alignment and robustness with circuit breakers. arXiv preprint arXiv, 2406. find
  143. Andy Zou, Zifan Wang, J. Zico Kolter, and Matt Fredrikson. 2023b. Universal and transferable adversarial attacks on aligned language models. Preprint, arXiv:2307.15043.

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/mei-2026-hiddenguard-fine-grained-safe-generation/