将安全拒绝机制转为离线权重更新，无需运行时干预。
$C$-$ΔΘ$: Circuit-Restricted Weight Arithmetic for Selective Refusal
- 用稀疏电路定位拒绝相关计算，仅更新其关联参数。
- 更新量小于总参数5%，实现选择性拒绝且保持模型能力。
- 适合需大规模部署安全控制的LLM系统开发者。
现代大模型部署需在规模上执行安全策略，但许多控制依赖推理时干预，带来持续计算开销和部署复杂性。激活引导虽广泛应用，但需运行时钩子且成本随生成次数增长；条件变体虽提升选择性，仍保留推理时控制路径。我们探究能否将选择性拒绝完全移至离线阶段：能否将特定类别拒绝的机理提炼为仅作用于特定电路的权重更新，并以标准检查点形式部署？本文提出C-Δθ：（i）利用EAP-IG定位拒绝因果计算的稀疏电路；（ii）仅在该电路支持的参数上计算约束权重更新ΔθC（通常<5%参数）。应用ΔθC后，得到可直接替换的编辑版检查点，无需推理时钩子，将成本从每次请求干预转移为一次性离线更新。我们在拒绝与效用基准上评估了类别目标选择性和能力保留效果。
原文摘要 · Abstract (English)
Modern deployments require LLMs to enforce safety policies at scale, yet many controls rely on inference-time interventions that add recurring compute cost and serving complexity. Activation steering is widely used, but it requires runtime hooks and scales cost with the number of generations; conditional variants improve selectivity by gating when steering is applied but still retain an inference-time control path. We ask whether selective refusal can be moved entirely offline: can a mechanistic understanding of category-specific refusal be distilled into a circuit-restricted weight update that deploys as a standard checkpoint? We propose C-Δθ Circuit Restricted Weight Arithmetic}, which (i) localizes refusal-causal computation as a sparse circuit using EAP-IG and (ii) computes a constrained weight update ΔθC supported only on that circuit (typically <5% of parameters). Applying ΔθC yields a drop-in edited checkpoint with no inference-time hooks, shifting cost from per request intervention to a one-time offline update. We evaluate category-targeted selectivity and capability retention on refusal and utility benchmarks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。