发现稀疏专家模型中存在可被操纵的危险路由，可能让安全输出变有害。
Sparse Models, Sparse Safety: Unsafe Routes in Mixture-of-Experts LLMs
- 提出路由器安全重要性评分，识别关键危险路由节点。
- 仅遮蔽5个高危路由器，攻击成功率提升至0.79，超4倍增长。
- 新框架F-SOUR能精准发现动态输入下的隐蔽危险路径，适合安全研究者。
通过在Transformer层中引入路由器选择性激活专家，混合专家（MoE）架构显著降低大语言模型（LLM）的计算开销，同时保持优异性能，尤其适用于参数量庞大的模型。然而，以往研究多关注效率与实用性，忽视了该稀疏架构带来的安全风险。本文首次揭示：MoE LLM的安全性与架构一样稀疏，存在‘危险路由’——一旦激活，可将原本安全的输出转变为有害内容。我们提出路由器安全重要性评分（RoSais），量化各层路由器的安全关键程度；仅操纵高RoSais路由器即可改变默认路由，导致输出失守。例如，在JailbreakBench上，遮蔽DeepSeek-V2-Lite中的5个路由器，攻击成功率（ASR）提升超4倍至0.79，暴露潜在风险。进一步提出细粒度令牌-层级随机优化框架F-SOUR，显式建模输入令牌的序列性与动态性，可在四类代表性MoE LLM中实现平均ASR 0.90（JailbreakBench）和0.98（AdvBench）。最后，我们提出安全感知路由禁用与路由器训练等防御方向，为未来红队测试与模型安全提供参考。代码已开源：https://github.com/TrustAIRLab/UnsafeMoE。
原文摘要 · Abstract (English)
By introducing routers to selectively activate experts in Transformer layers, the mixture-of-experts (MoE) architecture significantly reduces computational costs in large language models (LLMs) while maintaining competitive performance, especially for models with massive parameters. However, prior work has largely focused on utility and efficiency, leaving the safety risks associated with this sparse architecture underexplored. In this work, we show that the safety of MoE LLMs is as sparse as their architecture by discovering unsafe routes: routing configurations that, once activated, convert safe outputs into harmful ones. Specifically, we first introduce the Router Safety importance score (RoSais) to quantify the safety criticality of each layer's router. Manipulation of only the high-RoSais router(s) can flip the default route into an unsafe one. For instance, on JailbreakBench, masking 5 routers in DeepSeek-V2-Lite increases attack success rate (ASR) by over 4$\times$ to 0.79, highlighting an inherent risk that router manipulation may naturally occur in MoE LLMs. We further propose a Fine-grained token-layer-wise Stochastic Optimization framework to discover more concrete Unsafe Routes (F-SOUR), which explicitly considers the sequentiality and dynamics of input tokens. Across four representative MoE LLM families, F-SOUR achieves an average ASR of 0.90 and 0.98 on JailbreakBench and AdvBench, respectively. Finally, we outline defensive perspectives, including safety-aware route disabling and router training, as promising directions to safeguard MoE LLMs. We hope our work can inform future red-teaming and safeguarding of MoE LLMs. Our code is provided in https://github.com/TrustAIRLab/UnsafeMoE.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。