发现MoE模型安全依赖少数专家,提出可定位并干预的检测方法。
SAFEx: Analyzing Vulnerabilities of MoE-Based LLMs via Stable Safety-critical Expert Identification
- 基于稳定性筛选关键安全专家,区分内容识别与响应控制两类功能。
- 仅禁用12个选定专家,拒绝率下降22%,证明安全行为高度集中。
- 轻量级适配可提升对抗提示下的拒绝能力,无需全模型重训练。
基于混合专家(MoE)架构的大语言模型在效率和可扩展性上表现优异,但其路由机制引入了安全对齐挑战,现有技术难以应对。本文首次形式化并系统分析了位置脆弱性——即安全行为依赖特定专家模块的问题。提出SAFEx分析框架,通过稳定性筛选方法可靠识别、表征并验证安全关键专家,并将其分解为两组:有害内容检测组(HCDG)负责识别用户输入中的有害内容,有害响应控制组(HRCG)则负责控制模型行为以生成安全响应。在配置为48层、每层128专家、顶8路由(共6,144专家)的Qwen3-30B-A3B模型上,禁用12个选定专家导致拒绝率下降22%。进一步采用LoRA进行轻量级适配,针对HRCG进行负权重融合,可在不重训全模型的情况下提升对抗提示下的拒绝能力。结果表明,位置脆弱性是MoE模型特有的安全挑战,并为专家级干预提供了高效可行路径。
原文摘要 · Abstract (English)
Large language models with Mixture-of-Experts (MoE) architectures achieve efficiency and scalability, yet their routing mechanisms introduce safety alignment challenges insufficiently addressed by techniques developed for dense models. In this work, the MoE-specific safety risk of positional vulnerability-that safety-aligned behaviors rely on specific expert modules-is formalized and systematically analyzed. An analytical framework, SAFEx, is presented to robustly identify, characterize, and validate safety-critical experts via a stability-based expert selection procedure, and to decompose them into two functional groups: the Harmful Content Detection Group (HCDG), which specializes in identifying and recognizing harmful content within user inputs, and the Harmful Response Control Group (HRCG), which specializes in controlling and enforcing model behaviors to generate appropriate safety responses. Expert-level interventions are conducted to probe causality and to test mitigation. Targeted masking of SAFEx-selected experts reveals that safety behavior is highly concentrated. On Qwen3-30B-A3B, configured with 48 MoE-FFN layers and 128 experts per layer under top-8 routing (48x128=6,144 experts in total), disabling 12 selected experts reduces the refusal rate by 22%. In addition, lightweight adaptation is performed using LoRA under three configurations-the HRCG, the union of HCDG and HRCG, and all experts-and the resulting updates are composed through negative weight merging targeted at the HRCG, leading to improved refusal under adversarial prompts without full-model retraining. These results establish positional vulnerability as a distinct MoE-specific safety challenge and provide a practical, compute-efficient pathway for expert-level safety interventions within routed architectures.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。