arXiv:2603.23268cs.LGcs.AI2026-03被引 3

提出统一方法定位大模型中的安全电路,可精准识别并操控安全功能组件。

SafeSeek: Universal Attribution of Safety Circuits in Language Models

  • 用可微二值掩码通过梯度下降搜索多粒度安全电路。
  • 在后门攻击中发现0.42%稀疏电路,移除后成功率从100%降至0.4%。
  • 适用于安全对齐与对抗攻击研究,支持高效安全微调。

机制可解释性表明,大型语言模型中的安全关键行为(如对齐、越狱、后门攻击)源于特定的功能组件。然而,现有安全归因方法因依赖启发式、领域特定的指标和搜索算法,在泛化性和可靠性上存在不足。为此,我们提出 extit{SafeSeek},一个统一的安全可解释性框架,通过优化识别出功能完整的安全电路。不同于仅关注单一注意力头或神经元的方法, extit{SafeSeek} 引入可微二值掩码,基于安全数据集进行梯度下降,提取多粒度电路,并结合安全电路微调(Safety Circuit Tuning),利用这些稀疏电路实现高效的安全部署微调。我们在两个关键场景中验证该方法:(1) 后门攻击:识别出一个仅占0.42%稀疏度的后门电路,其消融使攻击成功率(ASR)从100%降至0.4%,同时保持超过99%的通用性能;(2) 安全对齐:定位到包含3.03%注意力头和0.79%神经元的对齐电路,移除后导致ASR从0.8%飙升至96.9%,而将其排除在助人型微调之外时,仍能维持96.5%的安全保留率。

原文摘要 · Abstract (English)

Mechanistic interpretability reveals that safety-critical behaviors (e.g., alignment, jailbreak, backdoor) in Large Language Models (LLMs) are grounded in specialized functional components. However, existing safety attribution methods struggle with generalization and reliability due to their reliance on heuristic, domain-specific metrics and search algorithms. To address this, we propose \ourmethod, a unified safety interpretability framework that identifies functionally complete safety circuits in LLMs via optimization. Unlike methods focusing on isolated heads or neurons, \ourmethod introduces differentiable binary masks to extract multi-granular circuits through gradient descent on safety datasets, while integrates Safety Circuit Tuning to utilize these sparse circuits for efficient safety fine-tuning. We validate \ourmethod in two key scenarios in LLM safety: \textbf{(1) backdoor attacks}, identifying a backdoor circuit with 0.42\% sparsity, whose ablation eradicates the Attack Success Rate (ASR) from 100\% $\to$ 0.4\% while retaining over 99\% general utility; \textbf{(2) safety alignment}, localizing an alignment circuit with 3.03\% heads and 0.79\% neurons, whose removal spikes ASR from 0.8\% $\to$ 96.9\%, whereas excluding this circuit during helpfulness fine-tuning maintains 96.5\% safety retention.

安全对齐可解释性后门攻击电路定位

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。