A Systematic Study of Training-Free Methods for Trustworthy Large Language Models
Not on the map. Why?
Abstract (arXiv)
As Large Language Models (LLMs) receive increasing attention and are being deployed across various domains, their potential risks, including generating harmful or biased content, producing unsupported claims, and exhibiting vulnerabilities to adversarial attacks, have drawn significant attention. To enable quick and low-cost adaptation, training-free methods have recently emerged as cost-effective alternatives to post-training alignment techniques. Despite their promising results, these methods are evaluated inconsistently across the literature, cover limited dimensions of trustworthiness, and can introduce undesirable side effects, such as utility degradation and increased brittleness. To fully assess the impacts of these training-free methods, we take a step back and systematically re-evaluate the effectiveness of existing training-free methods against various trustworthy settings and their influence on utility, robustness, and computational overhead. We also categorize these methods into three levels (input, internal, and output) based on where they intervene in the model's information flow during inference. Using this taxonomy, we conduct a comprehensive analysis of various representative and effective methods from each level across different LLM families and sizes. Our analysis highlights several trade-offs and unresolved challenges in current approaches. We summarize key findings and limitations in the existing literature, and propose practical recommendations for balancing trustworthiness, utility, and robustness in LLMs without the need for additional training.
Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 49 of its 56 references that are in the map. First posted on arXiv 17 Apr 2026.
Builds on
49 of 56 references.
References · 49
- 2020Language Models are Few-Shot Learnerscited by 32,419
- 2022Training language models to follow instructions with human feedbackcited by 15,971
- 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,380
- 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
- 2020Measuring Massive Multitask Language Understandingcited by 7,963
- 2017Deep reinforcement learning from human preferencescited by 3,912
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
- 2021TruthfulQA: Measuring How Models Mimic Human Falsehoodscited by 2,975
- 2019The Curious Case of Neural Text Degenerationcited by 2,916
- 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
- 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
- 2023Steering Llama 2 via Contrastive Activation Additioncited by 1,085
37 more
- 2022Red Teaming Language Models with Language Modelscited by 1,026
- 2022Mass-Editing Memory in a Transformercited by 1,001
- 2023A Watermark for Large Language Modelscited by 725
- 2021BBQ: A Hand-Built Bias Benchmark for Question Answeringcited by 701
- 2023DecodingTrust: A Comprehensive Assessment of Trustworthiness in GPT Modelscited by 518
- 2023XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Modelscited by 505
- 2023Jailbreaking ChatGPT via Prompt Engineering: An Empirical Studycited by 498
- 2023"Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Modelscited by 489
- 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrationscited by 431
- 2023Larger language models do in-context learning differentlycited by 394
- 2023DoLa: Decoding by Contrasting Layers Improves Factuality in Large Language Modelscited by 376
- 2023Provable Robust Watermarking for AI-Generated Textcited by 299
- 2023LLM Self Defense: By Self Examination, LLMs Know They Are Being Trickedcited by 244
- 2024Programming Refusal with Conditional Activation Steeringcited by 206
- 2023Defending Large Language Models Against Jailbreaking Attacks Through Goal Prioritizationcited by 170
- 2023RAIN: Your Language Models Can Align Themselves without Finetuningcited by 157
- 2023Who Wrote this Code? Watermarking for Code Generationcited by 141
- 2024JailbreakRadar: Comprehensive Assessment of Jailbreak Attacks Against LLMscited by 95
- 2024InferAligner: Inference-Time Alignment for Harmlessness through Cross-Model Guidancecited by 83
- 2023Alleviating Hallucinations of Large Language Models through Induced Hallucinationscited by 79
- 2023Publicly-Detectable Watermarking for Language Modelscited by 76
- 2024Intention Analysis Makes LLMs A Good Jailbreak Defendercited by 74
- 2025Steering Large Language Model Activations in Sparse Spacescited by 58
- 2024Spectral Editing of Activations for Large Language Model Alignmentcited by 56
- 2024DeAL: Decoding-time Alignment for Large Language Modelscited by 55
- 2024SCANS: Mitigating the Exaggerated Safety for LLMs via Safety-Conscious Activation Steeringcited by 50
- 2024Surgical, Cheap, and Flexible: Mitigating False Refusal in Language Models via Single Vector Ablationcited by 48
- 2024Navigating the OverKill in Large Language Modelscited by 44
- 2025AdaSteer: Your Aligned LLM is Inherently an Adaptive Jailbreak Defendercited by 38
- 2024Model Editing as a Robust and Denoised variant of DPO: A Case Study on Toxicitycited by 35
- 2024ROSE Doesn't Do That: Boosting the Safety of Instruction-Tuned Large Language Models with Reverse Prompt Contrastive Decodingcited by 32
- 2024Break the Breakout: Reinventing LM Defense Against Jailbreak Attacks with Self-Refinementcited by 29
- 2024DeCoRe: Decoding by Contrasting Retrieval Heads to Mitigate Hallucinationscited by 25
- 2024Jailbreak Antidote: Runtime Safety-Utility Balance via Sparse Representation Adjustment in Large Language Modelscited by 23
- 2024Towards Inference-time Category-wise Safety Steering for Large Language Modelscited by 18
- 2025Why Not Act on What You Know? Unleashing Safety Potential of LLMs via Self-Aware Guard Enhancementcited by 8
- 2024Enhancing Multiple Dimensions of Trustworthiness in LLMs via Sparse Activation Controlcited by 5
Built on by
Not cited yet.