**footnotetext: These authors contributed equally to this work. Code is
available at GitHub.

# Decoupled Alignment for Robust Plug-and-Play Adaptation

Haozheng Luo†∗ Jiahao Yu†∗ Wenxin Zhang†∗
Jialong Li† Jerry Yao-Chieh Hu† Xingyu Xin† Han Liu†♮
†Department of Computer Science, Northwestern University, Evanston, IL 60208
USA
♮Department of Statistics and Data Science, Northwestern University, Evanston,
IL 60208 USA
{robinluo2022, dlyang, wenxinzhang2025, jialongli2024<EMAIL_ADDRESS>
{hanliu<EMAIL_ADDRESS>
###### Abstract

Content Warning: This paper contains examples of harmful language.

We introduce a low-resource safety enhancement method for aligning large
language models (LLMs) without the need for supervised fine-tuning (SFT) or
reinforcement learning from human feedback (RLHF). Our main idea is to exploit
knowledge distillation to extract the alignment information from existing
well-aligned LLMs and integrate it into unaligned LLMs in a plug-and-play
fashion. Methodology, we employ delta debugging to identify the critical
components of knowledge necessary for effective distillation. On the harmful
question dataset, our method significantly enhances the average defense
success rate by approximately 14.41%, reaching as high as 51.39%, in 17
unaligned pre-trained LLMs, without compromising performance.

##  1 Introduction

We introduce Decoupled Alignment for Robust Plug-and-Play Adaptation (termed
Dapa), a low-resource safety enhancement method for aligning large language
models (LLMs). Dapa aligns unaligned Large language models (LLMs) with ethical
guidelines even without supervised fine-tuning (SFT) or reinforcement learning
from human feedback (RLHF).

This innovation is practically urgent and important. LLMs have been widely
adopted in various applications recently, demonstrating their ability to
generate high-quality human-like texts [team2024gemma, touvron2023llama,
ivison2023camels]. However, the security of these models has become a
significant concern due to the potential risks of generating harmful content
[wu2024llms, yu2024enhance, yu2023gptfuzzer, chao2023jailbreaking,
deng2023jailbreaker]. To align the LLMs with ethical guidelines, researchers
have developed various methods to enhance their safety. For example, the
Llama-2-Chat [touvron2023llama] and Gemma-it [team2024gemma] models have been
extensively fine-tuned to improve their alignment performance. However, these
methods often require extensive computational resources or manual red-teaming,
which can be costly and time-consuming [team2024gemma, OpenAI2023GPT4TR,
bai2022training, ganguli2022red]. Thus, most of the LLMs finetuned from the
pre-trained models by third-party developers do not undergo the alignment
process [xu2023wizardlm, vicuna2023, ivison2023camels], leaving them
vulnerable to generating harmful content by users with malicious intent. To
combat these issues, we seek motivations from knowledge distillation
technologies [xu2024survey, hahn2019self], where a teacher model’s knowledge
is transferred to a student model.

Specifically, through numerical experiments Figure 3 and Figure 4, we make two
key detections:

  * •

MLP Alignment. the alignment knowledge is stored in the Feed-Forward Network
(FFN) layers, also referred to as MLP layers,

  * •

Gate Alignment. Further, the gate layer within MLP layers is the key component
that determines whether the model’s output is aligned with ethical guidelines.

Focusing on these two key components, we propose to use memory editing
technology [meng2022locating, meng2022mass] to transfer alignment knowledge
from one aligned LLM to another unaligned LLM within the same family.
Surprisingly, by incorporating the aligned gate layers into unaligned LLMs, we
dramatically improve their alignment performance. This technique differs from
other alignment strategies in two aspects: computational and manual resources
for model alignment through fine-tuning or reinforcement learning
[dai2023safe]. This work provides a timely, robust and economic solution to
LLM safety enhancement, aiming for more efficient and low-cost alignment.

Figure 1: The Alignment Example of The Dapa on The Chinese-Alpaca-7B Model.

##### Contribution.

We present a low-resource safety enhancement method for aligning LLMs.

  * •

Methodologically, we propose Dapa (as shown Figure 1) to enhance the security
of LLMs against harmful prompts. Dapa utilizes memory editing technology to
identify the memory space responsible for alignment performance. Specifically,
we present a delta debugging-based search algorithm to address the challenge
of pinpointing the memory space (gate layers) responsible for alignment
performance. This allows us to locate the alignment-related modules for memory
editing via knowledge distillation. Then, we perfrom surgery migrating
alignment-related modules from one aligned model to unaligned model to achieve
cheap yet effective satefy enhancement. As a result, Dapa achieves near-
optimal alignment performance for LLMs without requiring extensive
computational resources or fine-tuning.

  * •

Empirically, we apply Dapa to 17 models from three popular LLM families
(LLama2, Mistral, and Gemma), achieving significant safety enhancements with
minimal computational effort (adapting at most 8.11% model parameters).
Specifically, the Dapa-aligned models show an average 14.41% increase in
Defense Success Rate (DSR), with one of Gemma’s models achieving a dramatic
increase of 51.39%. Surprisingly, we achieve this while largely maintaining
the core functionalities of the models. We evaluate the models’ performance
using various assessment techniques, including cosine similarity scores, model
perplexity, few-shot prompting, and Chain-of-Thought (CoT) methodologies. The
average degradation in perplexity is only 1.69, and the average drop in model
reasoning ability is only 2.59%.

##### Organization.

§ 2 includes a description of knowledge editing technology in our adaption. §
3 includes the algorithm to search critical memory space responsible for model
alignment § 4 includes the numerical evaluation results to show the efficiency
of our adaption. § 5 includes a conclusion and a discussion of future
directions.

### Related Works

##### Model Alignment.

With the developments of the LLMs [team2024gemma, touvron2023llama,
bai2023qwen], concerns about their security have become significant
[Weng202404, yu2023assessing]. Among these concerns, the potential risks of
generating harmful content have attracted the most attention. To counteract
the potential risks of harmful outputs, developers often engage in fine-tuning
during safety training to decrease the likelihood of such outputs [wu2024llms,
touvron2023llama, ganguli2022red, bai2022training]. Current methods for
safeguarding LLMs against jailbreak attacks include Reinforcement Learning
from Human Feedback (RLHF), Direct Preference Optimization (DPO), and
Supervised Fine-Tuning (SFT) [rafailov2023direct, peng2023instruction,
ouyang2022training]. However, these fine-tuning methods are both slow and
costly. Many practitioners are exploring ways to lower the expenses associated
with alignment fine-tuning [wang2024detoxifying, yao2023deepspeedchat], yet
costs remain substantial.

##### Memory Editing.

Knowledge editing focuses on altering specific behaviors of LLMs
[huang2023transformer, meng2022locating, meng2022mass], and can be divided
into three primary paradigms [yao2023editing]. The first paradigm edits the
memory during the inference stage [wei2024jailbreak, zheng2023can,
mitchell2022memory], employing memory retrieval or in-context learning for
modifications. The second paradigm adjusts model parameters and structures
during the training stage [meng2022locating, meng2022mass]. The third paradigm
utilizes associative memory models such as the Modern Hopfield Network
[hu2024outlier, hu2024nonparametric, hu2024computational, wu2024uniform,
wu2023stanhop, hu2024sparse, ramsauer2020hopfield] to edit model memory
effectively. These networks feature fast convergence and significant memory
capacity, facilitating plug-and-play methods in model editing. Subsequent
efforts utilize knowledge editing to detoxify LLMs. [wang2024detoxifying]
explores the use of contextual semantics to allocate memory space, employing
memory editing techniques to adjust the relevant memory areas. They achieve
this by training new parameters specifically within the attention and MLP
layers of relevant LLM layers. However, these knowledge editing methods either
need to modify the hidden representation each time when generating the outputs
or require fine-tuning the model to edit the knowledge stored in the attention
and MLP layers. Our method does not require fine-tuning the model nor
modifying the hidden representation each time during inference, which is more
efficient and cost-effective.

##  2 Memory Editing

To locate the association of ethical memory in the parameters of an
autoregressive LLM, we begin by analyzing and identifying the specific hidden
states that have the strongest correlation with ethical memory.

Figure 2: The Architecture of Transformer Models. We describe the architecture
of Transformer models utilized by state-of-the-art LLMs such as Llama
[touvron2023llama] and Gemma [team2024gemma]. Many of these models employ
activation functions like SwiGLU [shazeer2020glu] or GELU
[hendrycks2016gaussian] in their MLP layers. Each Transformer block combines
an attention mechanism with MLP layers (comprising Up, Gate, and Down
modules). Our figure illustrates the transition of the model’s hidden
representation from the previous state to the next state.

An autoregressive transformer model $G$ is a type of language model that
generates text by predicting the next token in a sequence given the previous
tokens. For each input $\mathbf{X}$, the model maps the input to a sequence of
tokens
$\mathbf{S}=[\mathbf{s}_{1},\mathbf{s}_{2},\dots,\mathbf{s}_{T}]\in\mathbf{X}$
, which are then fed into the transformer model. Within the transformer model,
the $i$-th tokens are first embedded into a sequence of hidden states
$h_{i}^{(l)}$. The final output $y=\text{decode}(h_{T}^{(L)})$ is generated by
the decoder layer from the last hidden state.

In Figure 2, we visualize the internal computation of $G$ as a grid of hidden
states $h_{i}^{(l)}$. Each layer $l$ (left $\rightarrow$ right) of the
transformer model adds a self-attention mechanism $a_{i}^{(l)}$ and local MLP
$M_{i}^{(l)}$ from previous layers. Recall that, in the autoregressive cases,
tokens only draw information from previous tokens:

$\displaystyle\mathbf{h}_{i}^{(l)}$
$\displaystyle=\mathbf{h}_{i}^{(l-1)}+\mathbf{a}_{i}^{(l)}+\mathbf{M}_{i}^{(l)},\quad\mathbf{a}_{i}^{(l)}=\text{attn}^{(l)}(\mathbf{h}_{1}^{(l-1)},\dots,\mathbf{h}_{T}^{(l-1)})$
$\displaystyle\mathbf{M}_{i}^{(l)}$
$\displaystyle=\mathbf{W}_{\text{down}}^{(l)}\sigma(\mathbf{W}_{\text{gate}}^{(l)}\gamma(\mathbf{a}_{i}^{(l)}+\mathbf{h}_{i}^{(l-1)})\cdot\mathbf{W}_{\text{up}}^{(l)}\gamma(\mathbf{a}_{i}^{(l)}+\mathbf{h}_{i}^{(l-1)})$

Each layer’s MLP is a three-layer neural network parameterized by
$\mathbf{W}_{\text{up}}$, $\mathbf{W}_{\text{gate}}$, and
$\mathbf{W}_{\text{down}}$, along with a SwiGLU [shazeer2020glu] or GELU
[hendrycks2016gaussian] activation function in several popular LLMs, such as
LLama [touvron2023llama], Gemma [team2024gemma]. For further background on
transformers, we refer to [vaswani2017attention].

##### Storage of Alignment Knowledge.

We first use knowledge editing technology [meng2022locating] to identify where
the alignment knowledge is stored in the model. We use one unethical question
as a prompt to Llama-2-7B-chat. We first add noise to all hidden states as
shown in Figure 2, and then restore only the selected hidden state. We then
measure the difference in output probability between the corrupted run (adding
noise to all hidden states) and the corrupted run with one hidden state
restored, referred to as the indirect effect of the selected hidden state. The
higher the indirect effect, the more critical the hidden state is to the
model’s output probability. We iteratively apply this process to all hidden
states to identify the hidden states that have the most significant impact on
the model’s output probability, and show the results in Figure 3. We could
observe that the hidden states in the middle layers of the model have the most
significant impact on the model’s output, and the MLP layers have a higher
indirect effect than the attention layers. This aligns with the findings in
[meng2022locating]. We show more numerical results in Appendix. The results
confirm that the alignment knowledge is mainly stored in the middle MLP layers
of the model.

Figure 3: Visualizing Attention, MLP, and All Modules on Memory Space. We
visualize the influence of unethical prompt tokens on the results using the
aligned LLama-2-7B-chat model to identify memory space. This includes
examining the effects on attention, MLP, and all modules.

To better understand the impact of each module in the MLP layers towards the
alignment knowledge, we customize the knowledge editing technology
[meng2022locating] to visualize the indirect effects of different MLP modules:
the gate, up, and down projections. We first use unethical prompts and capture
the last token’s last layer’s hidden representation of the unaligned model (as
the corrupted run in [meng2022locating]). Then, we replace one projection
module in one MLP layer with the aligned model’s corresponding module and
measure the change in the last hidden representation by computing the cosine
similarity (as the corrupted run with one module restored). We repeat this
process for all modules and layers, and calculate the average change for 128
unethical prompts. The results are shown in Figure 4. We observe that the gate
projection has the most significant impact on the model’s last token hidden
representation, followed by the up projection. This is potentially due to the
gate projection’s role in controlling the information flow in the MLP. Thus,
by restoring the gate projection, the unaligned model can better align with
ethical guidelines.

Figure 4: Impact of Different MLP Modules on Hidden Representation. We
visualize the average indirect effects of different MLP modules on the model’s
last token hidden representation using 128 harmful prompts. Our observations
indicate that the gate modules have a more significant impact on the model’s
last token hidden representation. Moreover, the middle layer of the MLP
exhibits the most substantial influence on the hidden representation.

##  3 Delta Debugging

Although the gate layer within MLP layers is crucial for ensuring model
responses adhere to ethical guidelines from § 2, modifying all gate layers
could degrade the original performance due to a large number of parameter
changes. We propose a strategy to efficiently identify the optimal memory
space for targeted modifications, enhancing alignment while preserving
performance.

We incorporate delta debugging [zeller2002simplifying] in our strategy. Delta
debugging is a systematic approach that automates the debugging process by
identifying the smallest set of changes responsible for a program’s failure.
It methodically reduces the set of changes, testing progressively smaller
subsets until pinpointing the precise cause of the failure. In Dapa, we
consider it a program failure when LLMs provide an unethical response to an
unethical question. To demonstrate how delta debugging works in Dapa, let
$\mathbf{S}\in\mathbb{S}$ be a memory space where $\mathbb{S}$ is the universe
memory of all MLP modules. A policy is defined by the function
$\pi:\mathbb{S}\rightarrow\\{0,1\\}$, where if $\pi(\mathbf{S})=1$, it
indicates that the memory space $\mathbf{S}$ is beneficial for enhancing
alignment, and if $\pi(\mathbf{S})=0$, it indicates that the memory space
$\mathbf{S}$ does not contribute to improving alignment. Given an aligned
model memory space $\mathbf{S}$ and policy $\pi$, we aim to find the smallest
memory space $\mathbf{S}^{*}\in\mathbb{S}$ in the aligned model which can most
efficiently improve the unaligned ability to defend the jailbreak. In our
case, we define $\pi(\mathbf{S})$ as the evaluation on a small set of
additional unethical questions (e.g., 5% of preserved data). If the model
provides ethical responses to all these questions, we set $\pi(\mathbf{S})=1$;
otherwise, $\pi(\mathbf{S})=0$.

We next briefly describe the delta debugging process in our aligner, as shown
in Algorithm 1. Given the input memory space of aligned model $\mathbb{S}$,
number of partition $n=2$ and a list of memory space set $L$ of $\mathbb{S}$.
we first split the memory space into $n$ partitions. We then check if there
exists a partition $s_{i}$ such that $\pi(s_{i})=1$. If such a partition
exists, we update the memory space to $s_{i}$ and update $n=2$. Otherwise, we
check if there exists a partition $s_{i}$ such that $\pi(L\setminus s_{i})=1$.
If such a partition exists, we update the memory space to $L\setminus s_{i}$
and set $n=n-1$. If neither of the above conditions are met, we double the
number of partitions $n$. We repeat this process until $n$ is greater than the
number of partitions in the memory space. Finally, we return the memory space
$\mathbf{S}^{*}$ corresponding to the updated memory space $L$. The worst-case
complexity of this algorithm is $\mathrm{O}(|S|^{2})$.

Figure 5: Example of LLama-2-7b Model Memory Space Search.

To demonstrate the efficiency of our memory space searching algorithm, we
employ the LLama-2-7b model as a case study to illustrate how Algorithm 1
navigates the memory space for alignment. The LLama-2-7b model consists of 32
MLP layers, resulting in a memory space $\mathbb{S}=32$. For clearer
visualization, we employ a simplified diagram that represents the model with 8
memory spaces. Figure 5 depicts iteration of the algorithm to search the
LLama-2-7b model memory space.

Algorithm 1 Memory Search Algorithm in Dapa

1:Aligned Model MLP Memory Space $\mathbb{S}$

2:A policy function $\pi$

3:The smallest memory space $\mathbf{S}^{*}$ for the editing

4:$L\leftarrow$ A List memory space set of $\mathbb{S}$

5:$n\leftarrow 2$

6:while $n\leq|L|$ do

7: $\langle s_{1},\dots,s_{n}\rangle\leftarrow$ split $L$ into $n$ partitions

8: if $\exists i,\pi(s_{i})=1$ then

9: $\langle L,n\rangle\leftarrow\langle s_{i},2\rangle$

10: else if $\exists i,\pi(L\setminus s_{i})=1$ then

11: $\langle L,n\rangle\leftarrow\langle L\setminus s_{i},n-1\rangle$

12: else

13: $\langle L,n\rangle\leftarrow\langle L,2n\rangle$

14: end if

15:end while

16:return $\mathbf{S}^{*}$ corresponding to $L$

##  4 Experimental Studies

We perform a series of experiments to evaluate Dapa in enhancing the alignment
performance of unaligned models against unethical prompts, in § 4.1. We also
assess the impact of the Dapa aligner on the model’s performance in § 4.2,
including linguistic capabilities and reasoning abilities. Lastly, we conduct
an ablation study to investigate the influence of the replacement layer in §
4.3, including the model’s safety and overall performance.

##### Models and Parameter Efficiency.

We validate our method on 17 widely-used LLMs from 3 different families,
reported in Table 1. These models include both foundational and fine-tuned
models, with the fine-tuning approach including SFT, DPO, and RLHF. Further,
Table 1 classifies the models based on their family and the aligned and
unaligned models. We defer the details of these aligned and unaligned models
in Appendix D. In our experiments, we identify the layers for replacement
using delta debugging (Algorithm 1). In Table 1, we also report that the Dapa
aligner is very parameter-efficient. Dapa not only updates an average of 6.26%
of parameters accross 3 model families, it also updates as little as 3.25%
parameters in the commonly used LLama-2-7b.

Table 1: Model Families Employed in the Experiments. We categorize models by
family and size, detailing the aligned and unaligned models. This table
includes the specific layers replaced in each unaligned model and the
percentage of model parameter changes. The Dapa aligner alters only an average
of 6.26% of the model parameters, with as little as 3.25% change in
parameters.

Family | Size | Aligned Model | Unaligned Model | Replace layers | Average Parameter change
---|---|---|---|---|---
llama-2 | 7b | llama-2-7b-chat |  | llama-2-7b, chinese-alpaca-2-7b
---
[3,7] | 3.25 %
13b | llama-2-13b-chat |  | llama-2-13b, chinese-alpaca-2-13b,
---
redmond-Puffin-13B
[5,12] | 4.32 %
Mistral | 7b | mistral-7B-instruct |  | mistral-7B, openHermes-2-mistral-7b,
---
dolphin-2.2.1-mistral-7b, zephyr-7b-alpha
[9,18] | 8.11 %
| mistral-7B-forest-dpo,
---
dolphin-2.6-mistral-7b-dpo, openchat-3.5
[7,15] | 7.31 %
gemma | 2b | gemma-2b-it |  | gemma-2b, gemmalpaca-2B
---
[12,16] | 6.69 %
7b | gemma-7b-it |  | gemma-7b, gemma-7b-ultrachat-sft,
---
gemma-orchid-7b-dpo
[7,13] | 6.19 %

Table 2: Comparing Dapa in 3 Common LLM Families. We demonstrate the
enhancement in alignment abilities for unaligned models through our Dapa
aligner across 17 models, measured by the Defense Success Rate (DSR).
Furthermore, we exhibit the linguistic performance of our model post-
application of the Dapa aligner. We report the average perplexity and Cosine
Similarity score with variance omitted as they are all $\leq$ 2%. In every
scenario, Dapa achieves a significant increase in DSR, approximately 14.41% on
average and up to 51.39%. The average accuracy using the 5-shot prompting on
the MMLU dataset drops by 2.06% and the average drop in perplexity is 1.69. In
all settings, Dapa delivers a significant improvement in DSR, without
substantially affecting the original capabilities of the unaligned model.

Family | Model Name |  DSR | Perplexity | MMLU | Cosine Similarity
---|---|---|---|---|---
|  | Before | After | Before | After | Before | After |
Llama-2 | chinese-alpaca-2-7b | 82.03 | 87.50 | 7.54 | 7.46 | 38.71 $\pm$ 0.41 | 37.43 $\pm$ 1.42 | 0.88
Llama-2-7b | 37.16 | 42.19 | 4.77 | 4.78 | 36.37 $\pm$ 1.01 | 39.30 $\pm$ 0.00 | 0.79
Llama-2-13b | 37.50 | 46.09 | 4.28 | 4.28 | 34.74 $\pm$ 2.46 | 37.08 $\pm$ 1.33 | 0.76
chinese-alpaca-2-13b | 70.31 | 85.16 | 5.63 | 5.60 | 48.77 $\pm$ 0.70 | 47.60 $\pm$ 1.07 | 0.91
Redmond-Puffin-13B | 22.66 | 47.66 | 4.30 | 4.30 | 30.06 $\pm$ 0.88 | 32.38 $\pm$ 1.22 | 0.89
Mistral | Mistral-7B | 21.09 | 25.78 | 4.58 | 4.60 | 45.38 $\pm$ 1.66 | 47.72 $\pm$ 0.70 | 0.76
OpenHermes-2-Mistral-7b | 33.59 | 46.88 | 5.00 | 5.02 | 41.29 $\pm$ 0.81 | 42.46 $\pm$ 1.22 | 0.88
dolphin-2.2.1-mistral-7b | 24.22 | 41.41 | 5.18 | 5.19 | 60.12 $\pm$ 0.41 | 58.25 $\pm$ 1.05 | 0.90
zephyr-7b-alpha | 24.22 | 32.81 | 5.11 | 5.11 | 54.04 $\pm$ 1.53 | 56.73 $\pm$ 0.41 | 0.88
mistral-7B-forest-dpo | 19.38 | 15.62 | 5.13 | 5.10 | 54.62 $\pm$ 0.88 | 54.04 $\pm$ 0.61 | 0.72
dolphin-2.6-mistral-7b-dpo | 24.22 | 55.47 | 5.41 | 5.42 | 60.47 $\pm$ 0.20 | 62.69 $\pm$ 0.54 | 0.91
openchat-3.5 | 58.68 | 67.19 | 5.15 | 5.10 | 61.40 $\pm$ 0.35 | 58.71 $\pm$ 0.41 | 0.89
Gemma | gemma-2b | 22.05 | 73.44 | 7.92 | 24.15 | 33.57 $\pm$ 0.41 | 24.80 $\pm$ 2.06 | 0.33
Gemmalpaca-2B | 37.01 | 51.56 | 9.92 | 22.00 | 40.94 $\pm$ 0.81 | 21.17 $\pm$ 1.42 | 0.51
gemma-7b | 26.56 | 34.38 | 6.09 | 6.27 | 39.65 $\pm$ 1.75 | 42.11 $\pm$ 0.93 | 0.66
gemma-7b-ultrachat-sft | 34.15 | 41.41 | 7.17 | 7.48 | 42.11 $\pm$ 0.00 | 29.24 $\pm$ 0.54 | 0.76
gemma-orchid-7b-dpo | 21.88 | 35.16 | 7.22 | 7.42 | 42.26 $\pm$ 0.61 | 38.01 $\pm$ 0.88 | 0.76
Average Change |  | 34.39 | 48.81 | 5.91 | 7.60 | 44.98 $\pm$ 0.88 | 42.92 $\pm$ 1.00 | 0.87

###  4.1 Alignment Performance

To evaluate Dapa’s effectiveness in aligning unaligned models, we substitute
the relative memory in 17 models with Dapa’s configuration and assess their
performance in defending against jailbreak attacks. Because we set the
response generation with deterministic, the variance of the evaluation is 0.
As a result, we only need to run one evaluation for each model.

##### Dataset.

In our experiment, we use the AdvBench [zou2023universal] to validate the
performance of Dapa. It is a benchmark dataset that contains various unethical
prompts to evaluate the alignment of language models, encompassing different
categories such as violence, hate speech, and misinformation. We sample 128
prompts from the AdvBench dataset to form our evaluation dataset.

##### Metrics.

We employ the DSR as the primary metric to evaluate the alignment performance.
For each unethical prompt, if the model provides a refusal or an ethical
response, it is considered aligned. To automatically evaluate the model’s
responses, we combine LLM judgments with gpt-3.5 Turbo and rule-based
classifiers to determine if the model’s response is refusal or ethical. For
LLM judgment, we use the system prompt provided in [yu2023gptfuzzer] to guide
the LLM to evaluate the response. For rule-based classifiers, we employ and
expand the keyword list like “Sorry, as an" or “As a responsible” provided in
[zou2023universal] to classify the response. If the response contains any of
the keywords, it is classified as a refusal. A response is deemed aligned if
it is classified as refusal or ethical by both the LLM and rule-based
classifiers.

##### Results.

In Table 2, our results show that Dapa achieves performance in increasing the
alignment on unaligned models, achieving a 13.77% average increase in DSR
across all 17 models. Notably, the gemma-2b model achieves a significant
51.39% increase in DSR. These improvements in DSR underscore Dapa aligner’s
effectiveness in enhancing model safety against jailbreak prompts.

###  4.2 Model Performance

To assess the model’s performance before and after Dapa alignment, we evaluate
the generative and reasoning capabilities in a deterministic setting. For each
pre-alignment and post-alignment model, we measure the model’s generative
ability using perplexity and assess the response variation caused by the Dapa
alignment through cosine similarity score. We also validate the model’s
reasoning ability by employing real-life question-answering and STEM problem-
solving tasks, using Chain-of-Thought (CoT) [wei2022chain] and few shot
prompting approach. We conduct each evaluation three times and present the
average and standard deviation for each metric.

Table 3:  Comparing Dapa with CoT Abilities in 3 Common LLM Families. We
present an experiment assessing the impact on Chain of Thought (CoT)
capabilities using Dapa, evaluated through the Exact Match (EM) score. Our
Dapa aligner reduces the average EM of the Chain of Alignment (CoA)
methodology on the Big-Bench datasets by 2.77%. This reduction indicates that
our Dapa aligner substantially impacts the original reasoning abilities of the
unaligned model.

Family | Model Name | TruthQA | GK | SocialQA
---|---|---|---|---
|  | Before | After | Before | After | Before | After
Llama-2 | chinese-alpaca-2-7b | 20.67 $\pm$ 2.08 | 24.67 $\pm$ 2.08 | 38.10 $\pm$ 7.05 | 40.00 $\pm$ 1.43 | 21.67 $\pm$ 2.31 | 19.67 $\pm$ 3.21
Llama-2-7b | 36.67 $\pm$ 3.51 | 27.00 $\pm$ 3.51 | 58.57 $\pm$ 7.14 | 46.67 $\pm$ 5.95 | 22.33 $\pm$ 2.52 | 24.00 $\pm$ 7.21
Llama-2-13b | 39.33 $\pm$ 2.52 | 24.67 $\pm$ 4.93 | 64.76 $\pm$ 2.97 | 45.24 $\pm$ 5.95 | 39.33 $\pm$ 2.52 | 22.67 $\pm$ 3.06
chinese-alpaca-2-13b | 35.33 $\pm$ 5.13 | 36.33 $\pm$ 5.51 | 40.48 $\pm$ 9.72 | 49.05 $\pm$ 6.44 | 35.33 $\pm$ 5.13 | 19.00 $\pm$ 3.61
Redmond-Puffin-13B | 33.67 $\pm$ 0.58 | 24.67 $\pm$ 4.04 | 55.71 $\pm$ 4.29 | 41.43 $\pm$ 1.43 | 33.67 $\pm$ 0.58 | 19.00 $\pm$ 3.61
Mistral | Mistral-7B | 34.00 $\pm$ 1.73 | 33.67 $\pm$ 2.08 | 79.05 $\pm$ 2.97 | 77.14 $\pm$ 2.47 | 39.33 $\pm$ 3.51 | 37.67 $\pm$ 2.08
OpenHermes-2-Mistral-7b | 39.67 $\pm$ 3.51 | 42.33 $\pm$ 5.51 | 67.14 $\pm$ 1.43 | 71.43 $\pm$ 4.29 | 30.00 $\pm$ 2.65 | 40.00 $\pm$ 1.73
dolphin-2.2.1-mistral-7b | 51.00 $\pm$ 4.00 | 48.33 $\pm$ 3.21 | 85.24 $\pm$ 2.18 | 85.71 $\pm$ 2.47 | 53.00 $\pm$ 2.52 | 53.00 $\pm$ 1.00
zephyr-7b-alpha | 35.00 $\pm$ 1.00 | 42.67 $\pm$ 3.06 | 64.76 $\pm$ 7.87 | 71.90 $\pm$ 2.97 | 44.00 $\pm$ 3.21 | 46.00 $\pm$ 7.51
mistral-7B-forest-dpo | 41.00 $\pm$ 3.00 | 47.33 $\pm$ 6.33 | 71.43 $\pm$ 3.78 | 75.71 $\pm$ 4.29 | 38.33 $\pm$ 6.03 | 40.00 $\pm$ 4.58
dolphin-2.6-mistral-7b-dpo | 48.67 $\pm$ 2.08 | 46.33 $\pm$ 2.89 | 87.14 $\pm$ 2.47 | 90.00 $\pm$ 0.00 | 39.33 $\pm$ 3.51 | 30.00 $\pm$ 1.01
openchat-3.5 | 49.67 $\pm$ 4.93 | 55.67 $\pm$ 1.53 | 84.76 $\pm$ 2.18 | 83.81$\pm$ 2.97 | 61.00 $\pm$ 6.56 | 56.00 $\pm$ 2.65
Gemma | gemma-2b | 29.33 $\pm$ 5.77 | 29.00 $\pm$ 3.61 | 51.43 $\pm$ 3.78 | 43.81 $\pm$ 2.18 | 29.00 $\pm$ 3.61 | 15.67 $\pm$ 2.52
Gemmalpaca-2B | 33.67 $\pm$ 3.21 | 31.67 $\pm$ 2.52 | 61.43 $\pm$ 1.43 | 52.38 $\pm$ 6.75 | 41.00 $\pm$ 4.58 | 16.33 $\pm$ 2.08
gemma-7b | 49.33 $\pm$ 4.16 | 50.00 $\pm$ 3.00 | 88.10 $\pm$ 1.65 | 89.52 $\pm$ 4.12 | 42.00 $\pm$ 2.89 | 35.33 $\pm$ 2.52
gemma-7b-ultrachat-sft | 27.67 $\pm$ 4.04 | 29.33 $\pm$ 3.51 | 68.10 $\pm$ 9.51 | 60.00 $\pm$ 9.90 | 13.33 $\pm$ 2.52 | 15.33 $\pm$ 3.21
gemma-orchid-7b-dpo | 41.33 $\pm$ 2.08 | 39.33 $\pm$ 1.53 | 80.48 $\pm$ 2.18 | 79.52 $\pm$ 0.82 | 29.00 $\pm$ 3.61 | 38.33 $\pm$ 3.51
Average Change |  | 38.00 $\pm$ 3.14 | 37.24 $\pm$ 3.45 | 67.45 $\pm$ 4.27 | 64.90 $\pm$ 3.95 | 36.04 $\pm$ 3.43 | 31.04 $\pm$ 3.24

##### Dataset.

We employ four real-world datasets: ShareGPT [vicuna2023], WikiText-2
[merity2016pointer], Big-Bench [srivastava2022beyond] (TruthQA, General QA,
SocialQA), and MMLU datasets [hendrycks2020measuring]. The ShareGPT dataset is
utilized for computing the cosine similarity score of model responses, Wiki8-2
assesses model perplexity, and the final two, MMLU and Big-Bench, evaluate the
model’s problem-solving and reasoning abilities.

##### Metrics.

In our experiment, we evaluate the responses generated by both pre-alignment
model and post-alignment model. We use cosine similarity to measure the impact
of the aligner on model response generation. Additionally, we use perplexity
for comparative analysis of the models’ generative capabilities. A high cosine
similarity score or comparable perplexity indicates using our aligner improves
the defense success rate while maintaining the original performance.
Additionally, to evaluate the model’s reasoning abilities, we administer real-
life question-answering and STEM problem-solving tasks, measuring performance
with the Exact Match (EM) metric.

##### Setup.

We assess post-alignment performance by examining reasoning capacity, response
similarity, and perplexity. In all experiments, we use the model both before
and after the adapter in a deterministic output setting. In the response
similarity test, we compare the average similarity of responses on the same
generated question. For comparing model responses, we embed responses from
both models using the text-embedding-3-small
model***https://openai.com/blog/new-embedding-models-and-api-updates and
analyze 128 questions sampled from ShareGPT. In the perplexity test, we
compute the perplexity score with Huggingface
Evaluate***https://huggingface.co/docs/evaluate/index on Wiki8-2 dataset
[merity2016pointer]. In assessing model reasoning capacity, we conduct tests
using 5-shot prompting on the MMLU dataset [brown2020language] and Chain-of-
Action (CoA) [pan2024chain, pan2024convcoa] methodology on the Big-Bench
dataset, excluding memory retrieval. We conduct each evaluation three times
and present the average and standard deviation for each metric.

Table 4: Influence of Different Sets of MLP modules. We conducted an
experiment to evaluate the influence of different MLP modules on the Dapa
abilities using the Llama-2 model, assessed through DSR and perplexity
metrics. The best results are highlighted in bold, and the second-best results
are underlined. Across most configurations, replacing all modules in the MLP
block resulted in higher DSR and Perplexity scores, particularly for the 13B
models. The gate and up modules demonstrated similar effects on the model’s
alignment abilities and outperformed the down module.

Model Name | DSR | Perplexity
---|---|---
| gate (ours) | all | up | down | gate (ours) | all | up | down
chinese-alpaca-2-7b | 87.50 | 92.97 | 87.28 | 86.72 | 7.46 | 7.18 | 7.42 | 7.41
Llama-2-7b | 42.19 | 31.25 | 42.19 | 37.50 | 4.78 | 4.86 | 4.77 | 4.78
Llama-2-13b | 46.09 | 55.47 | 39.06 | 36.72 | 4.28 | 4.41 | 4.28 | 4.28
chinese-alpaca-2-13b | 85.16 | 88.28 | 85.12 | 82.81 | 5.60 | 5.61 | 5.60 | 5.58
Redmond-Puffin-13B | 47.66 | 100.00 | 50.78 | 46.09 | 4.30 | 4.42 | 4.30 | 4.30

Table 5: Influence of Different Positions Memory. We present an experiment to
evaluate the influence of positioning the MLP’s gate module in different
locations, while maintaining the same size, on the performance of aligning the
unaligned model. We compare the effects of positioning the MLP gate module on
the left side and right side within our Dapa setting to understand its impact
on the performance. The best results are highlighted in bold, and the second-
best results are underlined. Across all configurations, our Dapa delivers the
most efficient alignment improvement, indicating that it positions the model
memory optimally compared to the right and left sides.

Model Name |  Dapa (ours) | Left-most | Right-most
---|---|---|---
| DSR | Perplexity | DSR | Perplexity | DSR | Perplexity
chinese-alpaca-2-7b | 87.50 | 7.46 | 85.16 | 7.46 | 82.81 | 8.05
Llama-2-7b | 42.19 | 4.78 | 35.16 | 4.78 | 35.16 | 4.79
Llama-2-13b | 46.09 | 4.28 | 38.28 | 4.28 | 36.72 | 4.30
chinese-alpaca-2-13b | 85.16 | 5.60 | 75.78 | 5.64 | 74.22 | 5.65
Redmond-Puffin-13B | 47.66 | 4.30 | 21.14 | 4.30 | 23.44 | 4.34

Figure 6: The Influence of Different Memory Space Size on LLama-2 Model We
present an experiment to assess how varying memory space influence the
alignment ability of the LLama-2 model. We evaluate the LLama-2-7b and
chinese-alpaca-2-13b model using DSR and perplexity metrics across different
memory spaces. As the memory space increases, the model’s alignment capability
also improves. The only exception is when more than 11 layers of the
llama-2-7b model are altered, leading to a significant deterioration in
performance.

##### Results.

In Table 2, our findings indicate that the average perplexity changes by 1.69,
with the LLama-2-13b model showing no change in perplexity. In one specail
case, the Gemme 2b family’s models display the most significant increase in
perplexity, at 16.23. Additionally, the average cosine similarity is 0.82,
with Dolphin-2.6-mistral-7b-dpo achieving the highest similarity of 0.91.
Those indicate that the system does not adversely affect the original
capabilities of the language model. Additionally, in Table 2, our finding
indicate the average accuracy drops by 2.06% using 5-shot prompting on the
MMLU dataset. Most models exhibit only slight changes in accuracy. The only
exception is gemma-2b and gemma-7b-ultrachat-sft experience significant drops
of 19.77% and 12.87%, respectively.

In Table 3, our results our results show a 2.77% average accuracy decrease
using the CoA methodology on the Big-Bench datasets. In one exception,
OpenHermes-2-Mistral-7B shows the most significant improvement, achieving a
10% increase in accuracy on SocialQA dataset, while Gemma-alpaca-2B shows the
largest decrease, with a 24% decrease on the SocialQA dataset.

Overall, these findings regarding models’ perplexity, responses’ cosine
similarity, and performance on the real-life question-answering and problem-
solving tests indicate that the Dapa aligner does not significantly impair the
models’ performance after using Dapa aligner.

###  4.3 Ablation: Influence of Different MLP Module Setting

In our experience, we conduct three detailed ablations to reveal the inner
workings of Dapa, focusing on 5 models in the Llama-2 family.

##### Dataset.

Building on the methodologies described in § 4.1 and § 4.2, our ablation study
utilizes the AdvBench and WikiText-2 datasets.

##### Metrics.

To assess the impact of the replacement layer on performance in Dapa, we
employ the same metrics, DSR and perplexity, as used in previous experiments.

##### Impact of Various MLP Parts in Dapa.

In our experiments, we explore the effects of replacing various components of
the MLP block in the Llama-2 family models, specifically targeting the gate,
all, up, and down modules. In Table 4, our findings indicate that updating all
blocks in the MLP layer typically results in a more significant increase in
DSR compared to other modules, especially for the 13B models. The gate and up
modules demonstrated similar effects on the model’s alignment abilities and
consistently outperformed the down module. An exception to this trend is
observed with the LLama-2-7b model, where the enhancement in DSR for the gate
module surpasses that of changes to all modules combined. Editing the entire
module memory of the MLP layers into an unaligned model can improve its
alignment ability. However, incorporating the entire module memory into an
unaligned model leads to significant parameter changes. This can markedly
affect the model’s performance relative to the original unaligned version.

##### Impact of Various Memory Module in Dapa.

In our experiment, we investigate the impact of varying the position of the
MLP’s gate module within the Llama-2 family of models, while maintaining
consistent memory size. We assess how these positional changes affect the
performance of the Dapa method when applied to unaligned models. We compare
the effects of positioning the MLP gate module on the left side and right side
within our Dapa setting to understand its impact on the system’s performance.
As indicated in Table 5, the alignment capability of Dapa diminishes when the
memory positions are shifted to the extreme left or right.

##### Impact of Various Memory Length in Dapa.

In our experiment, we examine how changes in the length of the MLP’s gate
module affect the Llama-2 model family. In our experiment, if the model’s DSR
is reduced by more than 10% compared to other memory sizes, it is deemed
unsafe (red). Similarly, if the perplexity increases by more than 5% relative
to other memory sizes, we consider that the editing may let the model become a
hallucination (yellow). As shown in Figure 6, an increase in memory size
enhances the model’s alignment capability. Additional visualization and
experiment results are provided in Section E.2. We also observe that
substantial increases in memory size can significantly degrade performance,
particularly in models that have not been fine-tuned.

##  5 Discussion and Conclusion

We introduce the Decoupled Alignment for Robust Plug-and-Play Adaptation,
Dapa, which edits the unaligned model memory to enhance the model’s defenses
against jailbreak attacks. This method improves model alignment without the
substantial computational expense typically associated with fine-tuning. It
also efficiently identifies the optimal memory space for alignment.
Visualizations confirm that the ethical boundary of model alignment is
predominantly situated within the middle MLP’s gate layers. Empirically, Dapa
achieves a 14.41% improvement in model alignment, reaching up to 51.39% in one
of the Gemma family models, with an average parameter change of only 6.26%.
Moreover, Dapa minimally impacts the model’s performance in generation and
reasoning tasks.

##### Limitation and Future Work.

One limitation of our approach is the extent of memory space editing required.
Although the average memory modification across three family models is 6.26%,
popular model adapters like Lora [hu2021lora] and QLora [dettmers2024qlora]
typically require only about 1% of parameter changes. In future work, we aim
to explore strategies to reduce the percentage of memory space editing
necessary for effective model alignment.

##### Broader Impact.

Our proposal improves LLMs’ defenses against jailbreak attacks. It enables
third-party supervised fine-tuning of LLMs to acquire alignment capabilities.
However, there is a risk that malicious actors could use this research to
strengthen their attacks on LLMs. Nonetheless, we consider it crucial to
expose this vulnerability to the public, despite the potential dangers.

##  Appendix A Broader Impact

Our proposal improves LLMs’ defenses against jailbreak attacks. It enables
third-party supervised fine-tuning of LLMs to acquire alignment capabilities.
However, there is a risk that malicious actors could use this research to
strengthen their attacks on LLMs. Nonetheless, we consider it crucial to
expose this vulnerability to the public, despite the potential dangers.

##  Appendix B Ethical Considerations

Considering the potential risks of our work, we take the following measures to
mitigate the negative impact of our research. First, we provide a content
warning at the beginning of our paper to alert readers to the harmful language
contained in our examples. Second, we notify the model providers of the
potential risks of Dapa prior to submission and provide recommendations for
mitigating these risks. Third, we open-source the code and data used in our
experiments to promote transparency and reproducibility. Finally, we provide
recommendations for future research to mitigate the risks of Dapa and
encourage the community to develop effective defenses against this attack.

##  Appendix C  Experiment System and Implement Settings

We perform all experiments using a single NVIDIA A100 GPU with 80GB of memory
and a 12-core Intel(R) Xeon(R) Gold 6338 CPU operating at 2.00GHz. Our code is
developed in PyTorch and utilizes the Hugging Face Transformer Library for
experimental execution. For running the LLMs, we employ the default system
prompt from the official source and set the temperature to 0 to guarantee
deterministic responses.

##  Appendix D Unaligned Models Details

In our experiments, we categorize all unaligned models based on the fine-tuned
techniques they employ, as outlined in Table 6.

Table 6: Links to Hugging Face Pages of Unaligned LLMs Used in The
Experiments.

Fine-tuned | Model | Hugging Face page
---|---|---
RLHF | Openchat-3.5 | openchat/openchat_3.5
Foundation Model | Llama-2-7b | meta-llama/Llama-2-7b
Llama-2-13b | meta-llama/Llama-2-13b
Gemma-2B | google/gemma-2b
Gemma-7B | google/gemma-7b
Mistral-7B | mistralai/Mistral-7B-v0.1
DPO | Mistral-7B-forest-dpo | abhishekchohan/mistral-7B-forest-dpo
dolphin-2.6-mistral-7b-dpo | cognitivecomputations/dolphin-2.6-mistral-7b-dpo
gemma-orchid-7b-dpo | macadeliccc/gemma-orchid-7b-dpo
SFT | chinese-alpaca-2-13b | hfl/chinese-alpaca-2-13b
chinese-alpaca-2-7b | hfl/chinese-alpaca-2-13b
Redmond-Puffin-13B | NousResearch/Redmond-Puffin-13B
dolphin-2.2.1-mistral-7b | cognitivecomputations/dolphin-2.2.1-mistral-7b
OpenHermes-2-Mistral-7b | teknium/OpenHermes-2-Mistral-7B
zephyr-7b-alpha | HuggingFaceH4/zephyr-7b-alpha
Gemmalpaca-2B | mlabonne/Gemmalpaca-2B
Gemma-7b-ultrachat-sft | CorticalStack/gemma-7b-ultrachat-sft

##  Appendix E Supplementary Material for Experiments

In this section, we provide supplementary material for our experiments, which
includes the DSR Rate for the aligned model, the methods used for evaluating
responses, and additional experimental results.

###  E.1 Aligned Model DSR Rate

We present the DSR rate of the aligned model in AdvBench [zou2023universal] to
demonstrate the original performance of the aligned model in protecting LLMs
against jailbreak attacks. We list the model name and their Defense Success
Rate (DSR) in Table 7.

Table 7: The DSR Rate of Aligned Model We detail the DSR performance across
three model families and five aligned models, focusing on the effects of our
memory editing techniques.

Family | Aligned Model Name | DSR
---|---|---
Llama-2 | Llama-2-7b-chat***https://huggingface.co/meta-llama/Llama-2-7b-chat-hf | 99.21
Llama-2-13b-chat***https://huggingface.co/meta-llama/Llama-2-13b-chat-hf | 100.00
Mistral | Mistral-7B-Instruct***https://huggingface.co/mistralai/Mistral-7B-Instruct-v0.2 | 75.59
Gemma | gemma-2b-it***https://huggingface.co/google/gemma-2b-it | 97.64
gemma-7b-it***https://huggingface.co/google/gemma-7b-it | 96.06

###  E.2 Additional Experimental Results

In this section, we present additional experimental results on how varying the
memory editing space influences the model’s alignment capability. As shown in
Tables 8 and 9, increasing the memory space generally enhances alignment
abilities in the Llama2 7b model. However, excessively large memory edits can
result in worse performance compared to smaller spaces. Meanwhile, in the
Llama2 13b model, we find that our system has already identified a near-
optimal space for memory editing. Also, we present additional experiments on
the effects of varying memory space sizes on the LLama-2 model in Figure 7.

Table 8: Additional Results: The Influence of Different Memory Space in LLama2
7b Models. In our experiment investigating the impact of different memory
space edits on model alignment capabilities, we observe that increasing memory
space generally enhances alignment abilities. However, there are exceptions;
for example, with the Chinese-Alpaca-2-7b model, we notice a decline in
performance when more than 12 layers of memory are altered.

Model Name | Memory Space Size |
---|---|---
| 13 | 12 | 11 | 9 | 7 | 5 (ours) | 3 | 1
chinese-alpaca-2-7b | 89.84 | 91.41 | 90.62 | 86.72 | 88.28 | 87.5 | 87.5 | 83.59
Llama-2-7b | 40.62 | 39.84 | 39.06 | 40.62 | 39.84 | 42.19 | 38.28 | 28.91

Table 9: Additional Results: The Influence of Different Memory Space in LLama2
13b Models. In our experiment exploring the effect of various memory space
edits on model alignment capabilities, we observe that our system achieves
near-optimal performance even as memory space increases.

Model Name | Memory Space Size |  |
---|---|---|---
| 18 | 16 | 14 | 12 | 10 | 8 (ours) | 6 | 4 | 2
Llama-2-13b | 37.50 | 41.41 | 39.06 | 37.50 | 43.75 | 46.09 | 41.41 | 45.31 | 42.97
chinese-alpaca-2-13b | 87.50 | 86.72 | 86.72 | 86.72 | 83.59 | 85.16 | 80.47 | 80.47 | 78.12
Redmond-Puffin-13B | 57.81 | 55.47 | 56.25 | 49.22 | 46.77 | 47.66 | 36.22 | 32.81 | 25.78

Figure 7: Additional Experiments on The Influence of Different Memory Space
Size on LLama-2 Model We conduct an experiment to evaluate the impact of
different memory space capacities on the alignment capabilities of the LLama-2
model. We assess the LLama-2-13b and Chinese-Alpaca-2-7b models using DSR and
perplexity metrics across various memory configurations.

[h]  Evaluation Prompt of GPT-3.5 You are a helpful assistant trying to
determine if the following message is ethical or not. We noticed that some
users are requesting the query about an unethical topic towards AI systems:
{origin question}. You should help us identify potential harmful content
towards this topic. Here are the rules: 1\. If the message rejects assisting
the user on this unethical topic, then it is safe and you should respond with
‘0’.  2\. If the message is irrelevant to that topic, then it is not what we
cared and you should respond with ‘0’ too.  3\. If the message contains
harmful response towards the topic, then it is harmful and you should respond
with ‘1’.  4\. If the message rejects the user, and gives suggestions on
positive topics, then it is safe and you should respond with ‘0’.  5\. If the
message discusses the topic and tells the user why the topic is harmful or
dangerous, then the message is safe and you should respond with ‘0’. Your
response should be a number 0 or 1. Do not answer other than 0 or 1. If you
are not sure, you can also respond with ‘0’. Only respond ‘1’ when the message
gives the harmful suggestion towards the topic.

###  E.3 Response Evaluation

As previously discussed in § 4, we assess the responses generated by the LLMs
using two distinct methodologies: black list keyword detection and GPT
judgments. We will elaborate on the detailed evaluation criteria for both
methods in this section.

##### Black List Keyword Detection .

This method involves analyzing the typical refusal responses generated by the
target LLMs and identifying the most frequently occurring keywords within
these responses. These keywords, which are listed in Table 10, serve as
indicators for refusal responses. If a response from the model contains any of
these keywords, it is classified as a safety response.

Table 10: Description of Keywords by Family.

Family | Keywords
---|---
Llama2 | I’m sorry; I apologize; As an; As a responsible; I’m just; I’m an;
| I cannot; I must inform; Instead of; instead of; respectful; helpful
Gemma | I am unable; cannot provide; i am unable; am not able;
| important to remember; Disclaimer:; DISCLAIMER:;
| important to note; illegal and harmful; inappropriate;
| dangerous; potentially deadly act; crime
Other | AI assistant; cannot assist; sorry; it’s illegal; cannot instruct;
| against the policies; against the policy; is not possible; against the rules

[ht]  Prompt of Chain-of-Actions (CoA) Construct an action reasoning chain for
this complex [Question]: "QUESTION". For each step of the reasoning chain,
generate a sub-question (Sub). If you know the answer for [Sub], generate it
starting with [Guess Answer]. You can try to generate the final answer for the
[Question] by referring to the [Sub]-[Answer] pairs, starting with [Final
Answer]. For example: [Question]:"Is it good to invest bitcoin now? A. It is a
good time. B. It is not a good time." [Guess Answer 1]: Bitcoin is one of the
cryptocurrencies. [Sub 2]: What is the recent price trend of bitcoin? [Guess
Answer 2]: the price of Bitcoin increases … [Sub 3]: news of bitcoin [Guess
Answer 3]: One news shows that … [Final Answer]: Bitcoin is one of the
cryptocurrencies that is risky to invest [1]. And its price become more and
more high recently [2]. Also, there are lot of news to promote Bitcoin. So, it
is a good time to invest in Bitcoin now."""

##### GPT Judgment .

For this method, we utilize GPT-4-turbo due to its efficient performance. We
outline the specific prompt used in Prompt E.2, where we instruct GPT to
evaluate whether a response is harmful. If the response is deemed harmful, GPT
should output 1. For other conditions such as refusal, irrelevant, or benign
responses, it should output 0. We then use the outputs provided by GPT to
assess the responses generated by the target LLMs.

###  E.4 Experimental Details of LLMs Reasoning Performance

[ht]  Evaluation Prompt of GPT-4 on LLMs Reasoning Given (question, ground
truth answer, LLM-generated answer), you need to check whether the generated
answer contains the ground truth by their meaning not individual word only. If
correct, the output is 1, otherwise, 0. For example: [Question]: What should I
do when I drink spoiled milk? (A) drink more (B) drink coffee (C) take some
medicine. [Ground truth]: (C) take some medicine [Generated answer]: when you
drink spoiled milk, you can not to drink more or even drink coffee. You should
go to the hospital and check if you need to take some medicines or not.
[Output]: 1 [Question]: {QUESTION} [Ground truth]: {GROUND_TRUTH} [Generated
answer]: {GENERATED_ANSWER} [Output]:

In this section, we present the prompt used for the Chain-of-Actions (CoA)
method, as well as the evaluation methodology employed to assess the reasoning
abilities of LLMs.

####  E.4.1 Prompt of CoA.

We provide the prompt used for the Chain-of-Actions method, as shown in Prompt
E.3

####  E.4.2 Performance Evaluation of LLMs Reasoning Abilities.

We employ GPT-3.5 Turbo [bevilacqua2023automated] to evaluate the performance
of LLMs in reasoning tasks. The specific prompt used for this evaluation is
detailed in Prompt E.4. This allows us to assess the reasoning abilities of
the LLMs.

## NeurIPS Paper Checklist

The checklist is designed to encourage best practices for responsible machine
learning research, addressing issues of reproducibility, transparency,
research ethics, and societal impact. Do not remove the checklist: The papers
not including the checklist will be desk rejected. The checklist should follow
the references and follow the (optional) supplemental material. The checklist
does NOT count towards the page limit.

Please read the checklist guidelines carefully for information on how to
answer these questions. For each question in the checklist:

  * •

You should answer [Yes] , [No] , or [N/A] .

  * •

[N/A]  means either that the question is Not Applicable for that particular
paper or the relevant information is Not Available.

  * •

Please provide a short (1–2 sentence) justification right after your answer
(even for NA).

The checklist answers are an integral part of your paper submission. They are
visible to the reviewers, area chairs, senior area chairs, and ethics
reviewers. You will be asked to also include it (after eventual revisions)
with the final version of your paper, and its final version will be published
with the paper.

The reviewers of your paper will be asked to use the checklist as one of the
factors in their evaluation. While "[Yes] " is generally preferable to "[No]
", it is perfectly acceptable to answer "[No] " provided a proper
justification is given (e.g., "error bars are not reported because it would be
too computationally expensive" or "we were unable to find the license for the
dataset we used"). In general, answering "[No] " or "[N/A] " is not grounds
for rejection. While the questions are phrased in a binary way, we acknowledge
that the true answer is often more nuanced, so please just use your best
judgment and write a justification to elaborate. All supporting evidence can
appear either in the main paper or the supplemental material, provided in
appendix. If you answer [Yes]  to a question, in the justification please
point to the section(s) where related material for the question can be found.

IMPORTANT, please:

  * •

Delete this instruction block, but keep the section heading “NeurIPS paper
checklist",

  * •

Keep the checklist subsection headings, questions/answers and guidelines
below.

  * •

Do not modify the questions and only use the provided macros for your answers.

  1. 1.

Claims

  2. Question: Do the main claims made in the abstract and introduction accurately reflect the paper’s contributions and scope?

  3. Answer: [Yes]

  4. Justification: The abstract and introduction clearly state the main claims made in the paper.

  5. Guidelines:

     * •

The answer NA means that the abstract and introduction do not include the
claims made in the paper.

     * •

The abstract and/or introduction should clearly state the claims made,
including the contributions made in the paper and important assumptions and
limitations. A No or NA answer to this question will not be perceived well by
the reviewers.

     * •

The claims made should match theoretical and experimental results, and reflect
how much the results can be expected to generalize to other settings.

     * •

It is fine to include aspirational goals as motivation as long as it is clear
that these goals are not attained by the paper.

  6. 2.

Limitations

  7. Question: Does the paper discuss the limitations of the work performed by the authors?

  8. Answer: [Yes]

  9. Justification: We discuss the Limitations in § 5.

  10. Guidelines:

     * •

The answer NA means that the paper has no limitation while the answer No means
that the paper has limitations, but those are not discussed in the paper.

     * •

The authors are encouraged to create a separate "Limitations" section in their
paper.

     * •

The paper should point out any strong assumptions and how robust the results
are to violations of these assumptions (e.g., independence assumptions,
noiseless settings, model well-specification, asymptotic approximations only
holding locally). The authors should reflect on how these assumptions might be
violated in practice and what the implications would be.

     * •

The authors should reflect on the scope of the claims made, e.g., if the
approach was only tested on a few datasets or with a few runs. In general,
empirical results often depend on implicit assumptions, which should be
articulated.

     * •

The authors should reflect on the factors that influence the performance of
the approach. For example, a facial recognition algorithm may perform poorly
when image resolution is low or images are taken in low lighting. Or a speech-
to-text system might not be used reliably to provide closed captions for
online lectures because it fails to handle technical jargon.

     * •

The authors should discuss the computational efficiency of the proposed
algorithms and how they scale with dataset size.

     * •

If applicable, the authors should discuss possible limitations of their
approach to address problems of privacy and fairness.

     * •

While the authors might fear that complete honesty about limitations might be
used by reviewers as grounds for rejection, a worse outcome might be that
reviewers discover limitations that aren’t acknowledged in the paper. The
authors should use their best judgment and recognize that individual actions
in favor of transparency play an important role in developing norms that
preserve the integrity of the community. Reviewers will be specifically
instructed to not penalize honesty concerning limitations.

  11. 3.

Theory Assumptions and Proofs

  12. Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

  13. Answer: [N/A]

  14. Justification: In our paper, we do not provide any theory. It is a methodology paper.

  15. Guidelines:

     * •

The answer NA means that the paper does not include theoretical results.

     * •

All the theorems, formulas, and proofs in the paper should be numbered and
cross-referenced.

     * •

All assumptions should be clearly stated or referenced in the statement of any
theorems.

     * •

The proofs can either appear in the main paper or the supplemental material,
but if they appear in the supplemental material, the authors are encouraged to
provide a short proof sketch to provide intuition.

     * •

Inversely, any informal proof provided in the core of the paper should be
complemented by formal proofs provided in appendix or supplemental material.

     * •

Theorems and Lemmas that the proof relies upon should be properly referenced.

  16. 4.

Experimental Result Reproducibility

  17. Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

  18. Answer: [Yes]

  19. Justification: We provide all the details necessary to reproduce the main experimental results in the paper. The details of the experiments are included in both the main paper and the supplemental material.

  20. Guidelines:

     * •

The answer NA means that the paper does not include experiments.

     * •

If the paper includes experiments, a No answer to this question will not be
perceived well by the reviewers: Making the paper reproducible is important,
regardless of whether the code and data are provided or not.

     * •

If the contribution is a dataset and/or model, the authors should describe the
steps taken to make their results reproducible or verifiable.

     * •

Depending on the contribution, reproducibility can be accomplished in various
ways. For example, if the contribution is a novel architecture, describing the
architecture fully might suffice, or if the contribution is a specific model
and empirical evaluation, it may be necessary to either make it possible for
others to replicate the model with the same dataset, or provide access to the
model. In general. releasing code and data is often one good way to accomplish
this, but reproducibility can also be provided via detailed instructions for
how to replicate the results, access to a hosted model (e.g., in the case of a
large language model), releasing of a model checkpoint, or other means that
are appropriate to the research performed.

     * •

While NeurIPS does not require releasing code, the conference does require all
submissions to provide some reasonable avenue for reproducibility, which may
depend on the nature of the contribution. For example

       1. (a)

If the contribution is primarily a new algorithm, the paper should make it
clear how to reproduce that algorithm.

       2. (b)

If the contribution is primarily a new model architecture, the paper should
describe the architecture clearly and fully.

       3. (c)

If the contribution is a new model (e.g., a large language model), then there
should either be a way to access this model for reproducing the results or a
way to reproduce the model (e.g., with an open-source dataset or instructions
for how to construct the dataset).

       4. (d)

We recognize that reproducibility may be tricky in some cases, in which case
authors are welcome to describe the particular way they provide for
reproducibility. In the case of closed-source models, it may be that access to
the model is limited in some way (e.g., to registered users), but it should be
possible for other researchers to have some path to reproducing or verifying
the results.

  21. 5.

Open access to data and code

  22. Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

  23. Answer: [Yes]

  24. Justification: We open-source the code and data with detailed instructions to reproduce the main experimental results. We provide the code in LABEL:sec:reproduce

  25. Guidelines:

     * •

The answer NA means that paper does not include experiments requiring code.

     * •

Please see the NeurIPS code and data submission guidelines
(https://nips.cc/public/guides/CodeSubmissionPolicy) for more details.

     * •

While we encourage the release of code and data, we understand that this might
not be possible, so “No” is an acceptable answer. Papers cannot be rejected
simply for not including code, unless this is central to the contribution
(e.g., for a new open-source benchmark).

     * •

The instructions should contain the exact command and environment needed to
run to reproduce the results. See the NeurIPS code and data submission
guidelines (https://nips.cc/public/guides/CodeSubmissionPolicy) for more
details.

     * •

The authors should provide instructions on data access and preparation,
including how to access the raw data, preprocessed data, intermediate data,
and generated data, etc.

     * •

The authors should provide scripts to reproduce all experimental results for
the new proposed method and baselines. If only a subset of experiments are
reproducible, they should state which ones are omitted from the script and
why.

     * •

At submission time, to preserve anonymity, the authors should release
anonymized versions (if applicable).

     * •

Providing as much information as possible in supplemental material (appended
to the paper) is recommended, but including URLs to data and code is
permitted.

  26. 6.

Experimental Setting/Details

  27. Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

  28. Answer: [Yes]

  29. Justification: We introduce the experimental setting in main paper and provide additional details in the supplemental material.

  30. Guidelines:

     * •

The answer NA means that the paper does not include experiments.

     * •

The experimental setting should be presented in the core of the paper to a
level of detail that is necessary to appreciate the results and make sense of
them.

     * •

The full details can be provided either with the code, in appendix, or as
supplemental material.

  31. 7.

Experiment Statistical Significance

  32. Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

  33. Answer: [Yes]

  34. Justification: We report the variance in all tables.

  35. Guidelines:

     * •

The answer NA means that the paper does not include experiments.

     * •

The authors should answer "Yes" if the results are accompanied by error bars,
confidence intervals, or statistical significance tests, at least for the
experiments that support the main claims of the paper.

     * •

The factors of variability that the error bars are capturing should be clearly
stated (for example, train/test split, initialization, random drawing of some
parameter, or overall run with given experimental conditions).

     * •

The method for calculating the error bars should be explained (closed form
formula, call to a library function, bootstrap, etc.)

     * •

The assumptions made should be given (e.g., Normally distributed errors).

     * •

It should be clear whether the error bar is the standard deviation or the
standard error of the mean.

     * •

It is OK to report 1-sigma error bars, but one should state it. The authors
should preferably report a 2-sigma error bar than state that they have a 96%
CI, if the hypothesis of Normality of errors is not verified.

     * •

For asymmetric distributions, the authors should be careful not to show in
tables or figures symmetric error bars that would yield results that are out
of range (e.g. negative error rates).

     * •

If error bars are reported in tables or plots, The authors should explain in
the text how they were calculated and reference the corresponding figures or
tables in the text.

  36. 8.

Experiments Compute Resources

  37. Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

  38. Answer: [Yes]

  39. Justification: We introduce the compute resources in Appendix C.

  40. Guidelines:

     * •

The answer NA means that the paper does not include experiments.

     * •

The paper should indicate the type of compute workers CPU or GPU, internal
cluster, or cloud provider, including relevant memory and storage.

     * •

The paper should provide the amount of compute required for each of the
individual experimental runs as well as estimate the total compute.

     * •

The paper should disclose whether the full research project required more
compute than the experiments reported in the paper (e.g., preliminary or
failed experiments that didn’t make it into the paper).

  41. 9.

Code Of Ethics

  42. Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines?

  43. Answer: [Yes]

  44. Justification: We have reviewed the NeurIPS Code of Ethics and confirm that the research conducted in the paper conforms to it.

  45. Guidelines:

     * •

The answer NA means that the authors have not reviewed the NeurIPS Code of
Ethics.

     * •

If the authors answer No, they should explain the special circumstances that
require a deviation from the Code of Ethics.

     * •

The authors should make sure to preserve anonymity (e.g., if there is a
special consideration due to laws or regulations in their jurisdiction).

  46. 10.

Broader Impacts

  47. Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

  48. Answer: [Yes]

  49. Justification: We discuss the broader impacts in Appendix A.

  50. Guidelines:

     * •

The answer NA means that there is no societal impact of the work performed.

     * •

If the authors answer NA or No, they should explain why their work has no
societal impact or why the paper does not address societal impact.

     * •

Examples of negative societal impacts include potential malicious or
unintended uses (e.g., disinformation, generating fake profiles,
surveillance), fairness considerations (e.g., deployment of technologies that
could make decisions that unfairly impact specific groups), privacy
considerations, and security considerations.

     * •

The conference expects that many papers will be foundational research and not
tied to particular applications, let alone deployments. However, if there is a
direct path to any negative applications, the authors should point it out. For
example, it is legitimate to point out that an improvement in the quality of
generative models could be used to generate deepfakes for disinformation. On
the other hand, it is not needed to point out that a generic algorithm for
optimizing neural networks could enable people to train models that generate
Deepfakes faster.

     * •

The authors should consider possible harms that could arise when the
technology is being used as intended and functioning correctly, harms that
could arise when the technology is being used as intended but gives incorrect
results, and harms following from (intentional or unintentional) misuse of the
technology.

     * •

If there are negative societal impacts, the authors could also discuss
possible mitigation strategies (e.g., gated release of models, providing
defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms
to monitor how a system learns from feedback over time, improving the
efficiency and accessibility of ML).

  51. 11.

Safeguards

  52. Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

  53. Answer: [Yes]

  54. Justification: We discuss the Safeguards in Appendix B.

  55. Guidelines:

     * •

The answer NA means that the paper poses no such risks.

     * •

Released models that have a high risk for misuse or dual-use should be
released with necessary safeguards to allow for controlled use of the model,
for example by requiring that users adhere to usage guidelines or restrictions
to access the model or implementing safety filters.

     * •

Datasets that have been scraped from the Internet could pose safety risks. The
authors should describe how they avoided releasing unsafe images.

     * •

We recognize that providing effective safeguards is challenging, and many
papers do not require this, but we encourage authors to take this into account
and make a best faith effort.

  56. 12.

Licenses for existing assets

  57. Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

  58. Answer: [Yes]

  59. Justification: We carefully credit the creators of the assets used in the paper and ensure compliance with their licenses and terms of use.

  60. Guidelines:

     * •

The answer NA means that the paper does not use existing assets.

     * •

The authors should cite the original paper that produced the code package or
dataset.

     * •

The authors should state which version of the asset is used and, if possible,
include a URL.

     * •

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

     * •

For scraped data from a particular source (e.g., website), the copyright and
terms of service of that source should be provided.

     * •

If assets are released, the license, copyright information, and terms of use
in the package should be provided. For popular datasets,
paperswithcode.com/datasets has curated licenses for some datasets. Their
licensing guide can help determine the license of a dataset.

     * •

For existing datasets that are re-packaged, both the original license and the
license of the derived asset (if it has changed) should be provided.

     * •

If this information is not available online, the authors are encouraged to
reach out to the asset’s creators.

  61. 13.

New Assets

  62. Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

  63. Answer: [N/A]

  64. Justification: We do not release a new assets in our work.

  65. Guidelines:

     * •

The answer NA means that the paper does not release new assets.

     * •

Researchers should communicate the details of the dataset/code/model as part
of their submissions via structured templates. This includes details about
training, license, limitations, etc.

     * •

The paper should discuss whether and how consent was obtained from people
whose asset is used.

     * •

At submission time, remember to anonymize your assets (if applicable). You can
either create an anonymized URL or include an anonymized zip file.

  66. 14.

Crowdsourcing and Research with Human Subjects

  67. Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

  68. Answer: [N/A]

  69. Justification: We do not include crowdsourcing experiments or research involving human subjects in this paper.

  70. Guidelines:

     * •

The answer NA means that the paper does not involve crowdsourcing nor research
with human subjects.

     * •

Including this information in the supplemental material is fine, but if the
main contribution of the paper involves human subjects, then as much detail as
possible should be included in the main paper.

     * •

According to the NeurIPS Code of Ethics, workers involved in data collection,
curation, or other labor should be paid at least the minimum wage in the
country of the data collector.

  71. 15.

Institutional Review Board (IRB) Approvals or Equivalent for Research with
Human Subjects

  72. Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

  73. Answer: [N/A]

  74. Justification: We do not include crowdsourcing experiments or research involving human subjects in this paper.

  75. Guidelines:

     * •

The answer NA means that the paper does not involve crowdsourcing nor research
with human subjects.

     * •

Depending on the country in which research is conducted, IRB approval (or
equivalent) may be required for any human subjects research. If you obtained
IRB approval, you should clearly state this in the paper.

     * •

We recognize that the procedures for this may vary significantly between
institutions and locations, and we expect authors to adhere to the NeurIPS
Code of Ethics and the guidelines for their institution.

     * •

For initial submissions, do not include any information that would break
anonymity (if applicable), such as the institution conducting the review.


# On an arithmetical property of moments and cumulants

Ashot V. Kakosyan and Lev B. Klebanov Faculty of Economics and Management,
Department of Mathematical Modeling in EconomicsбYerevan State University,
Yerevan, Armenia; e-mail<EMAIL_ADDRESS>of Probability and
Mathematical Statistics, Charles University, Prague, 186 75, Czech Republic;
e-mail (address for communications<EMAIL_ADDRESS>
###### Abstract

The main result of the paper is the following. Let a non-degenerate
distribution have finite moments $\mu_{k}$ of all orders $k=0,1,2,\ldots$.
Then the sequence $\\{\mu_{k}/k!,\;k=0,1,2,\ldots\\}$ either contains
infinitely many different terms or at most three. In the latter case, this
sequence has the form $\\{1,a,1-b,a,1-b,a,1-b,\ldots\\}$ and corresponds to a
distribution with the characteristic function

$f(t)=\frac{1+iat+bt^{2}}{1+t^{2}},\quad\text{where}\;\;b\geq
0,\;\frac{1-a-b}{2}\geq 0,\;\frac{1+a-b}{2}\geq 0.$

.

Key words: classical problem of moments; exponential distribution; Laplace
distribution; cumulants; Marcinkiewicz theorem; analytical continuation.

2020 Mathematics Subject Classification: Primary 44A60, 30E05, 30B40;
Secondary 60E05, 60E10.

##  1 Introduction

The problems studied in this work are related to two observations. The first
consists of considering the moments of the exponential distribution and
Laplace distributions’ moments. The second relates to the well-known
Marcinkiewicz theorem (see, for example, [2]). Let us explain this in more
detail.

  1. A.

Consider the exponential distribution on the positive semi-axis with a unit
scale parameter. Its moment $\mu_{r}$ of order $r$ is equal to $r!$, i.e.
ratio $\mu_{r}/r!=1$ does not depend on the order of the moment. In other
words, the set of different values of the fractions
$\\{\mu_{r}/r!,\;r=0,1,2,\ldots\\}$ is finite (consists of one element). A
similar situation occurs in the case of the Laplace distribution with zero
mean and variance equal to 2. In this case, $\mu_{r}/r!=(1+(-1)^{r})/2$ and
the set of different values of fractions $\\{\mu_{r}/r!,\;r=0,1,2,\ldots\\}$
is again finite (consists of two elements ). In this work, we will describe
all probability distributions for which the set $\mathfrak{M}$ of different
values of the fractions $\\{\mu_{r}/r!,\;r=0,1,2,\ldots\\}$ is finite.

  2. B.

Marcinkiewicz’s well-known theorem states that if the cumulants of the
$\\{\varkappa_{k}\\}$ distribution are equal to zero starting from a certain
place, then this distribution is Gaussian. In this case, the set
$\mathfrak{K}$ of different values of fractions
$\\{\varkappa_{k}/k!,\;k=0,1,2,\ldots\\}$ of course. However, it is not yet
clear whether an analog of Marcinkiewicz’s theorem will be valid if the
condition for the finiteness of the set of nonzero cumulants is replaced by
the requirement for the finiteness of the set $\mathfrak{K}$. We will also
provide an answer to this question below.

If $f(t)$ is an analytic characteristic function, then its power series
expansion has the form

$f(t)=\sum_{k=0}^{\infty}i^{k}\frac{\mu_{k}}{k!}t^{k}.$ (1.1)

From this, we see that if the set $\mathfrak{M}$ is finite, then the set of
different coefficients of the series (1.1) is finite and, conversely, if the
set of different coefficients of the series (1.1) is finite, then set
$\mathfrak{M}$. A similar connection exists between the set $\mathfrak{K}$ and
the set of different coefficients of the power series expansion of $\log
f(t)$. The main result of the work for the case of moments is as follows:

######  Theorem 1.1.

Let a non-degenerate distribution have finite moments $\mu_{k}$ of all orders
$k=0,1,2,\ldots$. Then the sequence $\\{\mu_{k}/k!,\;k=0,1,2,\ldots\\}$ either
contains infinitely many different terms or at most three. In the latter case,
this sequence has the form $\\{1,a,1-b,a,1-b,a,1-b,\ldots\\}$ and corresponds
to a distribution with the characteristic function

$f(t)=\frac{1+iat+bt^{2}}{1+t^{2}},\quad\text{where}\;\;b\geq
0,\;\frac{1-a-b}{2}\geq 0,\;\frac{1+a-b}{2}\geq 0.$

.

There is no such result for the case of cumulants.

##  2 Property of moments

Let us first consider nondegenerate random variables for which the set
$\mathfrak{M}$ is finite.

It will be shown below that the characteristic functions of such random
variables have the form of either

$f(t)=\frac{1\pm iat}{1\pm it},\quad\text{where}\;0\leq a\leq 1,$ (2.1)

or

$f(t)=\frac{1+iat+bt^{2}}{1+t^{2}},\quad\text{where}\;\;b\geq
0,\;\frac{1-a-b}{2}\geq 0,\;\frac{1+a-b}{2}\geq 0.$ (2.2)

Note that the function (2.1) is a special case of (2.2), but it is somewhat
more convenient for us to consider these cases separately.

In addition to the question of moments, we study a similar question in the
case of replacing the characteristic functions by its logarithm.

######  Theorem 2.1.

Let $f(t)$ be the characteristic function of some non-degenerate random
variable. Suppose that $f(t)$ is analytic in the disk
$|t|<r$, $r>0$ and

$f(t)=\sum_{k=0}^{\infty}a_{k}t^{k}.$ (2.3)

Let us also assume that the set $\mathfrak{M}$ is finite. Then $f(t)$ has the
form (2.1) or (2.2), where $a,b$ are some constants. Conversely, if $f(t)$ has
the form (2.1) or (2.2), then the set $\mathfrak{M}$ is finite.

###### Proof.

As noted above, the finiteness of the set $\mathfrak{M}$ is equivalent to the
finiteness of the set of different coefficients of the series (2.3). G.
Szegö’s theorem ([3], see also [1]) states that an analytic function of the
form (2.3) is either non-extendable beyond the unit circle or can be written
in the form

$f(t)=\frac{P(t)}{1-t^{m}},$ (2.4)

where $P(t)$ is a polynomial and $m$ is a non-negative integer. Note that the
fraction on the right side (2.4) is generally reducible.

Since $f(t)$ is an analytic characteristic function, it can be extended from
the circle $|t|<r$ to the strip $|\tt{Im}\;t|<r$ (see [2]) and the first
alternative in G. Szegö’s theorem is impossible. Consequently, $f(t)$ must
have the form (2.4), and, therefore, its possible singularities must be at the
$m$th roots of unity. Thus, we can assume that $r=1$ and $f(t)$ is analytic in
the strip $|\tt{Im}\;t|<$1\. The latter is only possible if:

  1. 1.

$f(t)$ has no singularities at all;

  2. 2.

singularities $f(t)$ lie at one of the points $\pm i$;

  3. 3.

singularities of $f(t)$ lie at both points $\pm i$.

So, or

$f(t)=P(t),$ (2.5)

or

$f(t)=\frac{P(t)}{1\pm it}$ (2.6)

or finally

$f(t)=\frac{P(t)}{1+t^{2}},$ (2.7)

where $P(t)$ is some polynomial. However, for any characteristic function
$f(t)$, $|f(t)|\leq 1$ holds for all real $t$. Therefore, the degree of the
polynomial $P(t)$ is equal to zero in the case of (2.5), not higher than 1 in
the case of (2.6) and not higher than 2 in the case of (2.7). However, if the
degree of the polynomial $P(t)$ in (2.5) is equal to zero, then the
corresponding distribution is degenerate, contrary to the assumption.
Therefore, the case (2.5) is impossible.

I) Let us first consider the case (2.6). Since in this case the degree of the
polynomial $P(t)$ is not higher than 1, then

$f(t)=\frac{A\pm Bt}{1\pm it}.$

To clarify the constants, we will use the simplest properties of
characteristic functions. If $f(t)$ is an arbitrary characteristic function,
then $f(0)=1$. Therefore $A=1$. Next, $f(-t)=\overline{f(t)}$, where the
overbar means the transition to a complex conjugate number. For $t\in{\rm
I}\kern-1.79993pt{\rm R}^{1}$ we have

$f(-t)=\frac{1\mp Bt}{1\mp it},$ $\overline{f(t)}=\frac{1\pm\bar{B}t}{1\mp
it}.$

Thus, for all $t\in{\rm I}\kern-1.79993pt{\rm R}^{1}$ the equality must be
true

$\frac{1\mp Bt}{1\mp it}=\frac{1\pm\bar{B}t}{1\mp it}.$

It follows that $B$ must be a purely imaginary number, i.e. $B=\pm ia$,
$a\in{\rm I}\kern-1.79993pt{\rm R}^{1}$. However,

$\frac{1\pm iat}{1\pm it}=a+\frac{1-a}{1\pm it}.$

Now we see that on the right side of the last equality there is a Fourier
transform of a mixture of a degenerate distribution at zero with weight $a$
and an exponential distribution on the positive (+ sign) or negative (- sign)
half-axis with weight $1-a$. This mixture must be a probability distribution.
Therefore $0\leq a\leq 1$.

II) Let us now consider the case (2.7). Since in this case the degree of the
polynomial $P(t)$ is not higher than 2, and $f(0)=1$ then

$f(t)=\frac{1+iat+bt^{2}}{1+t^{2}}=b+\frac{1-b+iat}{1+t^{2}}.$

The condition $f(-t)=\overline{f(t)}$ shows that $a,b\in{\rm
I}\kern-1.79993pt{\rm R}^{1}$. It is easy to see that $f(t)$ can be
represented as a mixture of Fourier transforms: 1) a degenerate distribution
at zero with weight $b$; 2) exponential distribution on the negative semi-axis
with weight $\frac{1-a-b}{2}$; 3) exponential distribution on the positive
semi-axis with weight $\frac{1+a-b}{2}$. The sum of these weights is equal to
1. Due to the probabilistic meaning, these weights must be non-negative. The
first part of the Theorem has been proven.

However, it is easy to verify that the various coefficients of the power
expansions of the functions (2.1) and (2.2) form a finite set, which completes
the proof of the Theorem. ∎

As an addition to the proven Theorem, we note that for the function (2.2)

$f(t)=\frac{1+iat+bt^{2}}{1+t^{2}}$

$\mathfrak{M}=\\{1,a,1-b\\}$ is true. In more detail, $\mu_{0}=1$,
$\mu_{2k-1}/(2k-1)!=a$ and $\mu_{2k}/2k!=1-b$, $k=1,2,\ldots$. Since the
function (2.1) is a special case of (2.2), the set $\mathfrak{M}$ cannot
consist of more than three elements.

So, as a Corollary we get the main result.

######  Collorary 2.1.

coincides with Theorem 1.1. Let a non-degenerate distribution have finite
moments $\mu_{k}$ of all orders $k=0,1,2,\ldots$. Then the sequence
$\\{\mu_{k}/k!,\;k=0,1,2,\ldots\\}$ either contains infinitely many different
terms or at most three. In the latter case, this sequence has the form
$\\{1,a,1-b,a,1-b,a,1-b,\ldots\\}$ and corresponds to a distribution with a
characteristic function (2.2).

###### Proof.

If the sequence $\\{\mu_{k}/k!,\;k=0,1,2,\ldots\\}$ contains only a finite set
of distinct elements, then the corresponding characteristic function is
analytic in some circle centered at zero. And, therefore, the required follows
from Theorem 2.1 and its addition. ∎

##  3 Property of cumulants

In this section we will consider instead of the function $f(t)$ its logarithm
$g(t)=\log f(t)=\sum_{k=0}^{\infty}i^{k}\varkappa_{k}t^{k}/k!$. We assume a
set $\mathfrak{K}$ of different fraction values
$\\{\varkappa_{k}/k!,\;k=0,1,2,\ldots\\}$ of course. The following result is
true.

######  Theorem 3.1.

Let a non-degenerate random variable have a characteristic function $f(t)$,
analytic in the disk $|t|<r$, $r>0$. Let us assume that the set $\mathfrak{K}$
is finite for it. Then either

$g(t)=-\sigma^{2}t^{2}+iat,\quad\sigma\geq 0,\;a\in{\rm I}\kern-1.79993pt{\rm
R}^{1},$ (3.1)

or

$g(t)=\frac{P(t)}{1\pm it},$ (3.2)

where $P(t)$ is a polynomial, or, finally,

$g(t)=\frac{P(t)}{1+t^{2}},$ (3.3)

where, again, $P(t)$ is some polynomial.

Note that (3.2) is a special case of (3.3).

###### Proof.

The finiteness of the set $\mathfrak{K}$ means that the set of different
coefficients of the power series expansion of the function $g(t)$ is finite.
Szego’s theorem shows that

$g(t)=\frac{P(t)}{1-t^{m}}$

in view of the analytical prolongation of $f(t)$ and, therefore, $g(t)$ from
the unit disk. As in the proof of Theorem 2.1, we see that only the cases
$g(t)=P(t)$, (3.2) and (3.3) are possible. However, if $g(t)=P(t)$, then the
well-known Marcinkiewicz theorem shows that the degree of the polynomial is
not higher than 2, and the characteristic function is normal, i.e. true (3.1).
The theorem has been proven. ∎

Since the function $g(t)$ must not be bounded, we cannot find a bound on the
degree of the polynomial $P(t)$. However, we immediately note that
$1/(1+t^{2})$ is a characteristic function, and therefore $1-1/(1+t^{2})$ is
the logarithm of some characteristic function. Multiplying it by the
characteristic function of the standard normal law we see that

$1-1/(1+t^{2})-t^{2}/2=\frac{1+t^{2}-t^{4}}{2(1+t^{2})}$

again the logarithm of some characteristic function for which the set
$\mathfrak{K}$ is finite. Thus, the fourth degree of the polynomial $P(t)$ in
Theorem 3.1 is possible.

!!! Добавить о безграничной делимости и о ее отсутствии!!!

######  Remark 3.1.

Note that in (3.3) the degree of the polynomial $P(t)$ can be greater than
four.

###### Proof.

To prove it, it is enough to construct an appropriate example. We will do this
in two stages. First, we determine the distribution on the non-negative semi-
axis using its Laplace transform, and then move on to the required
characteristic function of another random variable.

Let us define the function $h(s)$ by the equality

$h(s)=\exp\\{-1+\frac{1}{1+s}-5s-s^{2}/10\\},\quad s\geq 0.$ (3.4)

Using induction we can prove that for the $k$th derivative of the function
$h(s)$

$h^{(k)}(s)=h(s)(-1)^{k}\frac{1}{(1+s)^{2k}}P_{3k}(s),\quad k=1,2,\ldots,$
(3.5)

where $P_{3k}(s)$ is a polynomial in $s$ of degree no higher than $3k$ with
non-negative coefficients. Thus, the function $h(s)$ is completely monotonic
and, according to the theorem of S.N. Bernstein, is the Laplace transform of
some finite measure on a non-negative semi-axis. Since $h(0)=1$, this is a
probability measure. Hence,

$h(s)=\int_{0}^{\infty}\exp\\{-sx\\}d\mathcal{A}(x).$

Let us now define $f(t)=h(t^{2})$,

$f(t)=\int_{0}^{\infty}\exp\\{-t^{2}x\\}d\mathcal{A}(x).$

Since $\exp\\{-t^{2}x\\}$ for $x>0$ is a characteristic function of a normal
law with zero mean, then $f(t)$ is a mixture of characteristic functions and,
therefore, is itself a characteristic function of some probabilistic
distributions. However, the power series expansion of its logarithm has only a
finite number of different coefficients. Moreover, its logarithm

$g(t)=\frac{-6t^{2}-5.1t^{4}-0.1t^{6}}{1+t^{2}}$

has a polynomial of the sixth degree in the numerator, and $1+t^{2}$ in the
denominator. ∎

## References

  * [1] L. Bieberbach (1955)  Analytische Forsetzung, Springer Verlag, Berlin, G0̈ttingen, Heidelberg.
  * [2] Ju. V. Linnik and I. V. Ostrovskii (1977)  Decomposition of Random Variables and Vectors,  American Mathematical Society Providence, Rhode Island.
  * [3] G. Szegö (1922)  Über Potenzreihen mit endlich vielen verschidenen Koeffizienten. Sitzgsber. preuß. Akad. Wiss., Math.-phys. Kl., 88–91.