Estimating Rare Events in Language Models with Proper Evaluation
Not on the map. Why?
Abstract (arXiv)
Quantifying the risk of rare failures in language models, such as those triggered by adversarial distribution shifts or very large-scale deployments, requires estimating probabilities far too small for random sampling. While recent work has formalized Low Probability Estimation, existing pipelines remain fragile in the rarest regimes: estimators can suffer zero-estimate collapse or systematic bias, and standard evaluation losses can become unstable or poorly matched to asymmetric safety costs. In this work, we introduce Gradient Activation Adaptive Multi-Level Splitting (GA-AMLS), which adapts rare-event Monte Carlo methods to the continuous activation space of language models. Specifically, GA-AMLS uses a gradient-based MCMC kernel to navigate activation space, eliminating the zero-estimate collapse of input-space search and replacing the independence assumptions of prior activation-space estimators with conditional sampling under an explicit, heavier-tailed activation prior. We also propose the Shifted-Power Bregman (SPB) Loss, a proper scoring rule that remains finite for zero-estimates and offers tunable asymmetry between underestimation and overestimation penalties. Experiments on small transformer models reveal a bias-variance tradeoff: GA-AMLS achieves the lowest loss under symmetric evaluation, reducing average log-space squared error relative to the strongest baseline across model sizes, while methods with overestimation bias prevail under asymmetric penalties. Our findings highlight that estimator choice should be matched to deployment context. More broadly, our work establishes activation space as a tractable domain for rare-event estimation in language models, circumventing the brittleness of discrete input-space search.
Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Builds on 26 of its 37 references that are in the map. First posted on arXiv 20 Jul 2026.
Builds on
26 of 37 references.
References · 26
- 2019Exploring the Limits of Transfer Learning with a Unified Text-to-Text Transformercited by 14,599
- 2014Explaining and Harnessing Adversarial Examplescited by 7,364
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
- 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
- 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,336
- 2023Steering Llama 2 via Contrastive Activation Additioncited by 1,085
- 2024Refusal in Language Models Is Mediated by a Single Directioncited by 1,032
- 2023Steering Language Models With Activation Engineeringcited by 922
- 2022LLM.int8(): 8-bit Matrix Multiplication for Transformers at Scalecited by 906
- 2023The Linear Representation Hypothesis and the Geometry of Large Language Modelscited by 716
- 2023Eliciting Latent Predictions from Transformers with the Tuned Lenscited by 623
14 more
- 2024Massive Activations in Large Language Modelscited by 294
- 2026Scaling Monosemanticity: Extracting Interpretable Features from Claude 3 Sonnetcited by 191
- 2024Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMscited by 173
- 2022Goal Misgeneralization: Why Correct Specifications Aren't Enough For Correct Goalscited by 126
- 2024Defending Against Unforeseen Failure Modes with Latent Adversarial Trainingcited by 88
- 2018A Statistical Approach to Assessing Neural Network Robustnesscited by 54
- 2019Transfer of Adversarial Robustness Between Perturbation Typescited by 25
- 2025Forecasting Rare Language Model Behaviorscited by 19
- 2024Estimating the Probabilities of Rare Outputs in Language Modelscited by 16
- 2025Using Mechanistic Interpretability to Craft Adversarial Attacks against Large Language Modelscited by 10
- 2026Estimating Tail Risks in Language Model Output Distributionscited by 9
- 2026Rare Event Analysis of Large Language Modelscited by 8
- 2024High-accuracy sampling from constrained spaces with the Metropolis-adjusted Preconditioned Langevin Algorithmcited by 4
- 2026Estimating the expected output of wide random MLPs more efficiently than samplingcited by 1
Built on by
Citing papers per year: 2026: 1.
1 paper.
- 2026Quantifying Behavioral Tails in Black-Box Language Models27 Sep 2026