Research / Topics
Fairness, privacy, hallucination, calibration and general robustness.
Proposes TLRS-DPO, a token-level risk-scoring extension of DPO that penalizes only high-risk tokens in rejected responses, reporting better safety behaviour with minimal helpfulness loss.
Uses signal detection theory on HarmBench, XSTest and IHEval across 13 models to show system prompts mainly shift refusal willingness rather than safe/unsafe discrimination.
Evaluates three open-weight LLMs on pro-anorexia community questions, finding unsafe responses about twice as common without user context and disparities by race, gender and BMI.
Proposes SPECTRA, a training-free weight-level low-rank update that transfers the base model's refusal direction into fine-tuned LLMs, restoring safety without retraining or safety data.
Tests GPT-4o configurations classifying UK PMQs, finding accuracy hides label instability, and analyses UK/EU policy documents to argue public bodies need checks beyond aggregate accuracy.
Adds auditability as a fourth axis for LLM unlearning, proposing GapWiden and GapVeil to make deletion verifiable; it finds no existing method meets all four axes.
Vision paper arguing federated and decentralized learning should be the default for LLM preference-based alignment (RLHF/DPO), citing privacy, pluralism, and robustness, with technical challenges and a research agenda.
Dr. No steers sparse autoencoder features at inference to make vision-language and language models abstain when evidence is insufficient, beating post-hoc rejection on several abstention benchmarks, with gains source-dependent.
Tests whether low model confidence can flag prompt-injection hijacks of LLM classifiers; it ranks well but misses most hijacks at a 5% alarm rate, and misses nearly all when the injection claims certainty.
Pre-registered study finding post-trained LLMs fabricate citations far more when asked for sources, a prompt-driven effect, though causal reward-hacking is not proven.
Probes, an SAE and optimized directions in small LMs' hidden states predict refusal versus confabulation; pushing along them flips most confabulations into refusal openings.
Introduces a privacy benchmark and a defense that plans and risk-assesses data flows in LLM agents, reducing privacy violations in multi-step tasks while showing a privacy-utility-autonomy tradeoff.
Introduces HEARSAYBENCH, 400 human-verified cases on users whose rights are constrained by war or displacement. Across 14 models, advice is worse than situational inference and often unsafe to follow.
A controlled 14B study finds SFT+GRPO reward training makes models reliably refuse unsupported causal claims without false refusals, with a placebo control and mainly model-based ratings.
Proposes claim-based streaming decoding with backtracking guardrails and conformal risk certification to bound the safety risk of LLM generations under jailbreaks.
Compares LoRA and full fine-tuning for prompt-safety classifiers, finding in-domain accuracy misleads, as trained models trail a prompted 8B on jailbreaks and over-flag benign but harmful-looking prompts.
Shows that approximate unlearning in LLMs leaves recoverable traces in pre- and post-unlearning snapshots, and proposes TRACE, which reconstructs unlearned training text without prior data knowledge.
Presents VERA, an open-source dashboard that scores LLMs against measurable EU AI Act technical requirements via COMPL-AI benchmarks, and finds it cut assessment time versus raw benchmark files.
In a within-subjects study, users learned science from LLM assistants with planted falsehoods and absorbed about two-thirds of stated falsehoods with high confidence, so trust calibration collapsed.
Proposes that users' emotional-avoidance relief drives them to rate disempowering LLM interactions positively, explaining Anthropic's findings, and suggests design changes that preserve user agency.
Audits 18 reward models against human ratings and finds their scores cluster by prompt far more than human ratings do, with mixed usefulness for response selection.
Self-rewarded RL for moral argumentation makes LLMs more decisive and order-invariant, but sycophancy persists, showing consistency gains do not imply valid moral judgment.
Surveys 118 RAG defense papers by measured endpoint, finds mismatched evaluations, and shows a verbatim-copy guard still lets adaptive queries recover 48.3% of hidden facts.
Shows that human raters and text-to-image preference models favour attractive faces regardless of quality, distorting leaderboards and overriding user prompts, and tests mitigations for this reward-model bias.
Proposes graduated disclosure, where an LLM's response detail is calibrated to user authorisation, trained with a reward that penalises unauthorised leakage. It reports reduced leakage on enterprise and clinical benchmarks while keeping utility.
The paper shows that a VLM's appropriate location-disclosure granularity can be read from hidden states, and proposes an inference-time router and steering method that improves privacy-aligned disclosure while keeping general capabilities largely intact.
Proposes Symbolic Preference Labeling, which records derivations for safety preference labels so they can be recomputed and audited, then trains a DPO policy and measures refusal rates on benign and toxic prompts.
Introduces AfriGuard, a multilingual dataset for harmful-intent detection and refusal across 10 African languages, showing guardrail and LLM safety weaknesses and improving them via fine-tuning.
Shows that authority-style user prefixes make small open-weight LLMs refuse benign legal requests 2-20x more often, revealing instability in refusal behaviour under contextual framing.
Proposes SPLASH, a black-box method that contrasts security and style review log-probabilities to pick secure LLM-generated code and localize vulnerable statements, outperforming a frontier LLM judge.
Probes and steers 25 open-weight LLMs scoring essays, finding rubric directions share a dominant lever, so scores aren't independently controllable by rubric despite human agreement.
Studies how LLM agents change answers during multi-agent debate, finding that stronger consensus can coexist with more shared unanimous errors, and motivates evaluating dependence alongside accuracy.
Adds a symmetry-based Gini regularizer to sparse autoencoder training to reduce representation blind spots in safety-critical text, improving weak-tail perturbation responses across GPT-2, Gemma 2 and Qwen 2.5.
Proposes a risk-sensitive, LLM-judge rubric for patient-facing medical QA and finds that risk language is independent of factual hallucination, while medical fine-tuning reshapes rather than reduces risk.
Shows that recursively self-distilling a safe LLM on its own benign-cued outputs progressively erodes safety, causing misalignment on harmful queries even without harmful training prompts.
Uses mechanistic interpretability to locate an attention head in medical chest X-ray ViTs that attends to annotation text, a spurious shortcut that output-level evaluation fails to detect.
Proposes Update-Matched Unlearning, which uses a relearning-matched reference so LLM unlearning resists harmful relearning while preserving the ability to learn new tasks.
Evaluates prompt-injection detectors on calibration, discrimination and allow-block-defer policies, finding that calibrated probabilities alone do not yield reliable security decisions under distribution shift.
Introduces DecisionRobust, a benchmark testing text and vision decision models against adversarial perturbations and prompt injection, finding weak transfer and that input robustness does not imply injection robustness.
Independently reproduces five factuality alignment methods (PPO, GRPO, Dr. GRPO, DPO, KTO) and finds none significantly beat the base model, as rewards optimise format and length rather than factuality.