MUSE-D: Multi-domain Strategies in AI and Astronomy

• MUSE-D implements a fine-grained safety alignment in large language models by converting multi-turn attack trajectories into turn-level preference datasets with a DPO-style objective.
• In astronomical instrumentation, MUSE-D refers to a data reduction system that calibrates raw CCD outputs into science-ready 3D data cubes using robust geometrical and spectral calibration methods.
• For deep extragalactic surveys, MUSE-D (or MUSE-Deep) enables long-duration integral-field spectroscopy to detect faint Lyα emitters and analyze high-redshift cosmic structures.

Searching arXiv for papers referring to “MUSE-D” and closely related usages. MUSE-D is a context-dependent designation rather than a single research object. In current arXiv usage, it denotes a fine-grained safety-alignment defense for multi-turn jailbreak mitigation in LLMs, the MUSE Data Reduction System for the Multi Unit Spectroscopic Explorer, and several deep-survey programs or tiers built around MUSE integral-field spectroscopy, including MUSE-Deep, the MUSE Deep Layer of the Hubble Ultra Deep Field survey, and the MUSE Deep Lensed Field on MACS J0416 (Yan et al., 18 Sep 2025, Weilbacher et al., 2015, Kerutt et al., 2022, Inami et al., 2017, Vanzella et al., 2020).

1. Terminological scope and disambiguation

The label “MUSE-D” appears in multiple technical literatures with distinct expansions and workflows. In the material summarized here, the suffix $D$ stands for defense, data reduction, or deep, depending on domain.

Usage of MUSE-D	Domain	Core meaning
MUSE-D	LLM safety	Fine-grained safety-alignment defense within the MUSE red-teaming framework
MUSE-D	Astronomical instrumentation	MUSE Data Reduction System transforming raw CCD data into calibrated data cubes
MUSE-D / MUSE-Deep	Extragalactic spectroscopy	Deep integral-field survey tier for Ly$\alpha$ emitters in the HUDF/UDF
MUSE Deep Layer	HUDF spectroscopy	3′$\times$3′ deep mosaic of nine adjacent 1′$\times$1′ pointings
MUSE Deep Lensed Field	Strong-lensing spectroscopy	Deep MUSE program on MACS J0416 exploiting lensing magnification

A common source of confusion is to assume that “MUSE-D” refers to a single framework. In the literature considered here, it does not. The LLM-safety usage is centered on turn-level preference optimization, whereas the astronomical usages concern either instrument calibration and cube reconstruction or deep spectroscopic surveys (Yan et al., 18 Sep 2025, Weilbacher et al., 2015, Kerutt et al., 2022, Inami et al., 2017, Vanzella et al., 2020).

2. MUSE-D as fine-grained safety alignment for multi-turn dialogue

Within the framework introduced in "MUSE: MCTS-Driven Red Teaming Framework for Enhanced Multi-Turn Dialogue Safety in LLMs" (Yan et al., 18 Sep 2025), MUSE-D is the defense half of a two-part red-teaming system, with MUSE-A as the attack generator. MUSE-D sits downstream of MUSE-A and takes as input the full tree of multi-turn attack trajectories discovered by MUSE-A, including both final successful jailbreak dialogues and intermediate “high-risk” turns. From these trajectories it constructs a turn-level preference dataset, then fine-tunes the base LLM via a granular extension of Direct Preference Optimization. At inference time the tuned model is used as the defense model $\pi_{\theta_d}$. The central design choice is early intervention: because the model is exposed not only to outright unsafe completions but also to the conversational “stepping stones” that lead there, it learns to refuse or safely rephrase at vulnerable turns rather than only at the final malicious request.

The workflow is explicit. MUSE-A is first run to collect multi-turn dialogues. Every turn $t$ in every dialogue is then labeled either as a “successful-attack endpoint” or as a “high-risk intermediate node,” based on the MCTS risk ratio exceeding a threshold $\tau$. For each such turn, a preference triple $(\tilde{c}_t, y_t, y_t^{safe})$ is formed, where $y_t$ is the unsafe model response and $y_t^{safe}$ is a safer rewrite generated by self-reflection. Fine-tuning then uses a turn-level DPO-style loss that encourages the model to assign higher probability to $\alpha$0 than to $\alpha$1 in context $\alpha$2.

Formally, MUSE-D defines a per-turn objective on a curated preference dataset $\alpha$3, with temperature $\alpha$4 and fixed reference model $\alpha$5: $\alpha$6

$\alpha$7

$\alpha$8

The interpretation given in the paper is boundary-tightening: the loss directly maximizes the log-probability gap between safe and unsafe continuations at each vulnerable context.

The data construction procedure is equally granular. MUSE-A produces a tree of dialogues, and every generated trajectory of up to $\alpha$9 turns is walked. A turn is marked “high-risk” whenever the MCTS statistic $\times$0 exceeds $\times$1, with $\times$2 set to $\times$3 in experiments. For successful endpoints, $\times$4, $\times$5 is the unsafe response to $\times$6, and $\times$7 is a safer rewrite generated by self-reflection prompt. For high-risk nodes, $\times$8, $\times$9 is the model response, and $\times$0 is a safe rewrite. Context encoding is simple concatenation of dialogue history tokens with the malicious query $\times$1 or user input $\times$2; no special graph or pointer encoding is used. Endpoint and intermediate triples are mixed uniformly in the fine-tuning data loader.

The reported training setup uses safety-alignment data from BeaverTails with approximately $\times$3 multi-turn scenarios, $\times$4, $\times$5, $\times$6 epochs, batch size $\times$7, and learning rate $\times$8 on $\times$9A100 GPUs. Evaluation covers an in-distribution model, Llama-3-8B, and two out-of-distribution models, Llama-3-70B and Qwen2.5-7B. Safety is measured by Attack Success Rate on HarmBench under three multi-turn attacks—CoA, ActorAttack, and MUSE-A—while helpfulness is measured by zero-shot accuracy on GSM8K, MMLU, GPQA, and MT-Bench. For Llama-3-8B, the reported ASR values are $\pi_{\theta_d}$0 for Instruct, $\pi_{\theta_d}$1 for $\pi_{\theta_d}$2DPO, and $\pi_{\theta_d}$3 for $\pi_{\theta_d}$4MUSE-D, with no statistically significant helpfulness drop. For Llama-3-70B, the strongest-attack ASR improves from $\pi_{\theta_d}$5 to $\pi_{\theta_d}$6 with GSM8K, MMLU, GPQA, and MT-Bench remaining within $\pi_{\theta_d}$7 absolute. For Qwen2.5-7B, the MUSE-A attack ASR improves from $\pi_{\theta_d}$8 to $\pi_{\theta_d}$9, again with negligible helpfulness loss. The paper also reports that MUSE-D reduces single-turn attack ASR by up to $t$0 absolute, despite not being trained on single-turn data (Yan et al., 18 Sep 2025).

Theoretical claims are deliberately limited. MUSE-D is stated not to come with a formal PAC-style guarantee, and there is no provable bound on unseen jailbreak types. Its rationale rests on two observations: including intermediate high-risk turns converts a sparse-label problem into a dense training signal, and the DPO-style margin objective maximizes the gap between safe and unsafe continuations at vulnerable contexts. The paper’s stated limitations are static fine-tuning, heuristic dependence on MCTS risk scores, and the absence of formal robustness guarantees; proposed extensions include online RL in a “DirectLMA” style, iterative adversarial training via SEAS, and hybrid decoding-level defenses (Yan et al., 18 Sep 2025).

3. MUSE-D as the MUSE Data Reduction System

In astronomical instrumentation, MUSE-D denotes the MUSE Data Reduction System described by Weilbacher et al. in "The MUSE Data Reduction Pipeline: Status after Preliminary Acceptance Europe" (Weilbacher et al., 2015). Here the objective is to transform raw data recorded separately in $t$1 IFUs by $t$2 CCDs into a fully calibrated, scientifically usable data cube. MUSE is composed of $t$3 identical Image Slicer Integral Field Units, each re-imaging its $t$4 slice of sky onto a $t$5 CCD. The full field covers nearly $t$6 with $t$7 spaxels and $t$8 in the spectral direction, for a total of $t$9 slices across all IFUs.

The data-reduction architecture is divided into two layers. Basic processing is performed per IFU and includes overscan trimming, bias subtraction, flat-fielding, geometrical calibration, and generation of a pixel table. The outcome of this stage is not yet a data cube but a BOX-TABLE representation in which each detected pixel becomes a row carrying detector coordinates, identifiers, flux, variance, and related quantities. Post-processing is global and includes wavelength calibration, sky subtraction in the single-resampled pixel-table domain, flux calibration, and cube reconstruction onto a regular $\tau$0 grid, together with an associated variance cube.

Several algorithmic components are central. Geometrical calibration uses a multi-pinhole mask stepped vertically through the focal plane to derive, for each slice, a mapping from detector coordinates to sky coordinates and spectral-pixel coordinate. A $\tau$1-D polynomial fit encodes the slice tilt and offset in the focal plane. Wavelength calibration fits arc-line exposures with a low-order polynomial or Chebyshev expansion, yielding typical residuals of $\tau$2 across the $\tau$3–$\tau$4 range. Flux calibration derives a sensitivity function $\tau$5 from spectrophotometric standard-star observations, and variance is propagated through calibration and cube reconstruction. For interpolation from an irregularly sampled pixel table to a regular cube, MUSE-D adopts the “single-resampling” paradigm, with a modified Shepard kernel in $\tau$6 and linear or spline interpolation in $\tau$7.

The implementation is in C/C++ using ESO’s Common Pipeline Library, with recipes invokable from the command line or via Python through the Python-CPL interface; integration into Astro-WISE uses the same interface. Pixel tables contain approximately $\tau$8–$\tau$9 million rows per exposure, each row about $(\tilde{c}_t, y_t, y_t^{safe})$0 bytes, and memory-mapped I/O is used to stream chunks through processing stages. Parallelization is mixed: early basic processing originally spawned $(\tilde{c}_t, y_t, y_t^{safe})$1 independent processes, one per IFU, while later CPL updates enabled full internal parallelization with POSIX threads; post-processing uses OpenMP for sky subtraction, wavelength rebinning, and cube building. The reported performance on a $(\tilde{c}_t, y_t, y_t^{safe})$2-core, $(\tilde{c}_t, y_t, y_t^{safe})$3 server is approximately $(\tilde{c}_t, y_t, y_t^{safe})$4–$(\tilde{c}_t, y_t, y_t^{safe})$5 minutes for basic processing per IFU, $(\tilde{c}_t, y_t, y_t^{safe})$6 minutes for wavelength calibration and sky subtraction across all $(\tilde{c}_t, y_t, y_t^{safe})$7 IFUs in parallel, and $(\tilde{c}_t, y_t, y_t^{safe})$8 minutes for cube reconstruction of approximately $(\tilde{c}_t, y_t, y_t^{safe})$9 pixels onto a $y_t$0 grid, for a total wall-clock time of about $y_t$1 minutes on $y_t$2 cores.

Results from Preliminary Acceptance Europe on 2013-09-10 are reported as end-to-end validation using the internal calibration unit and the Instrument Numerical Model. The stated achievements were slice positions known to better than $y_t$3 arcsec RMS, wavelength solution residuals $y_t$4 RMS over each slice, flat-field stability $y_t$5, and sky-subtraction residuals $y_t$6 of the bright sky-line peak in the final cube. Automated nightly reductions and unit-test suites were also running continuously during instrument assembly, with regressions caught within hours (Weilbacher et al., 2015).

4. MUSE-D as MUSE-Deep and the HUDF Deep Layer

In deep-survey nomenclature, MUSE-D often abbreviates MUSE-Deep, a program designed to push integral-field spectroscopy of high-redshift Ly$y_t$7-emitting galaxies to much fainter emission-line fluxes than the one-hour MUSE-Wide tier (Kerutt et al., 2022). MUSE-Deep consists of nine adjacent mosaic pointings of $y_t$8 each, covering a total contiguous area of $y_t$9, plus a single ultra-deep UDF10 pointing of $y_t^{safe}$0. Each pointing covers a $y_t^{safe}$1 field with $y_t^{safe}$2 spatial sampling and delivers a datacube from $y_t^{safe}$3 to $y_t^{safe}$4, sampled at $y_t^{safe}$5 per layer, with spectral resolution $y_t^{safe}$6–$y_t^{safe}$7 across the band. Typical seeing was $y_t^{safe}$8 at $y_t^{safe}$9. Data reduction used the standard ESO MUSE pipeline, including bias subtraction, flat-fielding, wavelength calibration, illumination correction, and sky subtraction, followed by astrometric and flux calibration and an “effective variance” recalibration to correct for an approximately $\alpha$00 resampling increase in noise.

For source finding and line measurement, emission-line sources were detected with LSDCat in a blind search at a post-pipeline $\alpha$01 threshold of $\alpha$02, yielding $\alpha$03 Ly$\alpha$04-emitter candidates in the nine mosaic fields and $\alpha$05 in UDF10. Spectra were extracted with a PSF-weighted Moffat aperture, while total Ly$\alpha$06 fluxes were measured in three Kron-radius apertures from LSDCat to include extended Ly$\alpha$07 halos. One-dimensional spectra were fit with an asymmetric Gaussian profile, from which FWHM, asymmetry, double-peak fraction, and peak separation were derived. Rest-frame equivalent widths were computed as

$\alpha$08

with continuum flux density measured from the nearest redward HST band and objects undetected at $\alpha$09 assigned the local $\alpha$10 flux-density limit, producing lower limits on $\alpha$11. Morphological measurements for HST counterparts used GALFIT Sérsic modeling; the derived half-light radii span $\alpha$12–$\alpha$13, with median $\alpha$14.

The statistical results emphasize the role of survey depth. The MUSE-Deep objects dominate the low-$\alpha$15 tail, with $\alpha$16 having $\alpha$17, and only approximately $\alpha$18 exceeding $\alpha$19, compared with approximately $\alpha$20 in MUSE-Wide. Exponential fits to the $\alpha$21 distribution return $\alpha$22. The highest securely measured $\alpha$23 in the full sample is $\alpha$24, while the most extreme lower limit for an HST-dark source is $\alpha$25. The study reports weak or no correlations between $\alpha$26 and Ly$\alpha$27 line-shape parameters or UV axis ratio, together with a modest anti-correlation between UV half-light radius and $\alpha$28, suggesting that the highest-$\alpha$29 objects tend to be compact but do not occupy a unique locus in other observables (Kerutt et al., 2022).

A closely related usage appears in the Hubble Ultra Deep Field survey, where “MUSE Deep Layer” refers to the $\alpha$30 mosaic of nine adjacent $\alpha$31 pointings, observed over eight GTO runs between September 2014 and February 2016 (Inami et al., 2017). Each pointing received approximately $\alpha$32 hours of on-source integration under photometric, sub-arcsecond seeing, and MUSE delivered continuous $\alpha$33–$\alpha$34 spectroscopy at $\alpha$35. The reduction workflow begins with ESO/MUSE-pipeline pixtables, followed by cube resampling, HST-tied astrometric alignment, flux calibration, a tailored self-calibration step, masked excision of instrumental artifacts, and optimized sky subtraction. Emission-line objects were identified both from HST-prior subcubes and with blind-search tools including ORIGIN and MUSELET.

The Deep Layer produced $\alpha$36 unique redshifts with $\alpha$37 over $\alpha$38, drawn from both continuum-selected and emission-line-selected samples. Approximately $\alpha$39 lie at $\alpha$40, while the remainder are at $\alpha$41. Continuum magnitudes span $\alpha$42 mag, and line fluxes span $\alpha$43 to $\alpha$44. The mosaic reaches $\alpha$45 completeness at $\alpha$46 mag and about $\alpha$47 completeness to approximately $\alpha$48 mag. Catalog products include positions, redshifts, confidence flags, line classes, defect flags, HST magnitudes, and measured line fluxes, released via the CDS (Inami et al., 2017).

5. MUSE-D as the MUSE Deep Lensed Field

A further astronomical usage is the MUSE Deep Lensed Field, abbreviated MDLF rather than MUSE-D in the paper title, but explicitly described as a deep MUSE program on the Hubble Frontier Field cluster MACS J0416.1–2403 (Vanzella et al., 2020). The observational strategy uses VLT/MUSE in Wide-Field Mode on a $\alpha$49 field centered northeast of the cluster core, with a total on-sky exposure of $\alpha$50 on the NE pointing, plus an $\alpha$51 SW pointing with an effective depth of approximately $\alpha$52 because of poorer seeing. Spectral coverage is $\alpha$53–$\alpha$54 at dispersion $\alpha$55, with $\alpha$56 and median PSF FWHM $\alpha$57. Reduction combines the ESO MUSE Pipeline v2.8.1, MPDAF self-calibration, astrometric registration to HST F606W, and ZAP for residual sky subtraction.

The achieved depth is described both in direct and lensing-corrected terms. The measured $\alpha$58 line-flux sensitivity is approximately $\alpha$59 in a $\alpha$60 aperture with $\alpha$61 at $\alpha$62, while regions with magnification $\alpha$63 correspond to equivalent blank-field exposures $\alpha$64, and $\alpha$65 to $\alpha$66, with intrinsic line limits approaching a few $\alpha$67. The equivalent blank-field exposure is written $\alpha$68.

The program combines deep spectroscopy with lens modeling. The final sample contains $\alpha$69 multiple images grouped into $\alpha$70 families from $\alpha$71 background galaxies, all with spectroscopic redshifts in $\alpha$72 and positional RMS $\alpha$73 in the lens model. The lens equation is written $\alpha$74, with magnification $\alpha$75. The model uses $\alpha$76 multiple images of $\alpha$77 distinct components together with $\alpha$78 cluster galaxies, allowing recovery of critical curves and magnification gradients.

A central scientific output is the census of compact high-redshift substructure. The study identifies $\alpha$79 clumps across $\alpha$80 high-$\alpha$81 galaxies over $\alpha$82, with de-lensed absolute UV magnitudes in $\alpha$83, median approximately $\alpha$84, and physical sizes from approximately $\alpha$85 down to $\alpha$86. In the best-resolved cases, with tangential magnifications $\alpha$87, inferred effective radii of $\alpha$88 are reported as consistent with bound star clusters. High-ionization UV metal lines and He II $\alpha$89 are detected individually for extremely faint sources, and a stacked spectrum of $\alpha$90 sources at $\alpha$91 shows C IV, He II, O III], C III], and Mg II with line ratios consistent with stellar-photoionized gas of low metallicity. The paper frames these results as preparatory for JWST and ELT studies of gravitational telescopes (Vanzella et al., 2020).

6. Cross-domain significance of the label

Across these usages, MUSE-D consistently denotes a technically specific intermediate layer in a larger pipeline, but the layer itself differs radically by field. In LLM safety, MUSE-D converts multi-turn attack trajectories into turn-level preference triples and a margin-based DPO objective for $\alpha$92 (Yan et al., 18 Sep 2025). In astronomical instrumentation, MUSE-D converts raw CCD frames into pixel tables and then into calibrated $\alpha$93 data cubes (Weilbacher et al., 2015). In deep extragalactic survey work, MUSE-D or MUSE-Deep denotes long-integration integral-field spectroscopy used to derive Ly$\alpha$94 catalogs, equivalent-width distributions, and large spectroscopic redshift samples (Kerutt et al., 2022, Inami et al., 2017). In the lensing literature, the deep MUSE program on MACS J0416 uses the same instrument class to obtain spectroscopic confirmation, lens constraints, and sub-galactic structure measurements in highly magnified sources (Vanzella et al., 2020).

The main misconception to avoid is lexical rather than technical: “MUSE-D” is not a single acronym with a stable cross-domain meaning. In the literature surveyed here, interpretation depends entirely on context. In machine learning it is a defense model for dialogue safety; in astronomy it names either a reduction pipeline or a deep observing tier. This suggests that citations, surrounding terminology, and the presence of domain markers such as $\alpha$95, DPO, IFU, pixtable, Ly$\alpha$96, or lens magnification are indispensable for disambiguation (Yan et al., 18 Sep 2025, Weilbacher et al., 2015, Kerutt et al., 2022, Inami et al., 2017, Vanzella et al., 2020).