arXiv:2604.27401cs.CLcs.LG2026-04被引 1

通过两次前向传播定位大模型中负责特定行为的神经元,实现精准干预。

Perturbation Probing: A Two-Pass-per-Prompt Diagnostic for FFN Behavioral Circuits in Aligned LLMs

  • 用两次前向传递生成因果假设,无需反向传播即可识别关键神经元。
  • 在安全拒绝任务中,仅20个神经元就控制80%响应格式,且几乎不引发有害输出。
  • 可精准编辑模型行为,如修复事实错误或消除多轮谄媚回应,适用于模型调试与对齐研究。

扰动探测通过每提示两次前向传递、无需反向传播的方式,为大语言模型中前馈网络(FFN)神经元生成任务相关的因果假设,并通过约150次一次性干预遍历所有识别出的神经元。在八个行为回路、十三个模型及四类架构中,我们识别出两种电路结构:抑制型电路在强化学习人类反馈(RLHF)压制预训练倾向时出现;在安全拒绝任务中,约50个神经元(占全部神经元0.014%)控制拒绝模板,其删除使520个AdvBench提示中的80%响应格式改变,同时仅有3例(520中)产生有害合规,且均带免责声明。路由型电路用于分布于注意力机制中的预训练行为;在满足双语训练、FFN到跳过信号比介于0.3至1.1之间、线性可表征等三个条件的19个模型中的3个,通过残差流方向注入可将英语输出转为中文,覆盖580个基准提示的99.1%。该干预在其余16个模型及数学、代码、事实回路中失效,揭示方向引导的边界。同一两次前向传递计算出的FFN-to-skip信号比可区分两类结构并预测合适干预方式。电路拓扑随架构变化,从Qwen的集中式FFN瓶颈到Gemma的归一化保护电路。在Qwen3.5-2B中,删除20个神经元可消除多轮谄媚屈服,放大10个相关神经元则使事实纠正率从52%提升至88%(200个TruthfulQA提示)。结果表明,扰动探测为理解RLHF组织的行为提供了机制洞察,并提供了一套实用的模板层精准编辑工具。

原文摘要 · Abstract (English)

Perturbation probing generates task-specific causal hypotheses for FFN neurons in large language models using two forward passes per prompt and no backpropagation, followed by a one-time intervention sweep of about 150 passes amortized across all identified neurons. Across eight behavioral circuits, 13 models, and four architecture families, we identify two circuit structures that organize LLM behavior. Opposition circuits appear when RLHF suppresses a pre-training tendency. In safety refusal, about 50 neurons, or 0.014 percent of all neurons, control the refusal template; ablating them changes 80 percent of response formats on 520 AdvBench prompts while producing near-zero harmful compliance, 3 of 520 cases, all with disclaimers. Routing circuits appear for pre-training behaviors distributed through attention. For language selection, residual-stream direction injection switches English to Chinese output on 99.1 percent of 580 benchmark prompts in the 3 of 19 tested models that satisfy three observed conditions: bilingual training, FFN-to-skip signal ratio between 0.3 and 1.1, and linear representability. The same intervention fails on the other 16 models and on math, code, and factual circuits, defining the limits of directional steering. The FFN-to-skip signal ratio, computed from the same two forward passes, distinguishes the two structures and predicts the appropriate intervention. Circuit topology varies by architecture, from Qwen's concentrated FFN bottleneck to Gemma's normalization-shielded circuit. In Qwen3.5-2B, ablating 20 neurons eliminates multi-turn sycophantic capitulation, while amplifying 10 related neurons improves factual correction from 52 percent to 88 percent on 200 TruthfulQA prompts. These results show that perturbation probing offers mechanistic insight into RLHF-organized behavior and a practical toolkit for precision template-layer editing.

神经机制模型对齐干预编辑

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。