通过对比搜索定位关键神经元，实现不降质的指令拒答控制。
Targeted Neuron Modulation via Contrastive Pair Search
- 基于正负样本对比，仅用前向传播定位0.1%关键神经元。
- 删掉这些神经元后拒答率下降超50%，且输出流畅无退化。
- 适合想精准干预模型行为的研究者或安全应用开发者。
语言模型经过指令微调后能拒绝有害请求，但其内在机制仍不明确。现有调控方法作用于残差流，在高干预强度下会损害输出连贯性，限制实际应用。本文提出对比神经元归因（CNA），仅通过前向传播即可识别出在有害与良性提示间差异最显著的0.1% MLP神经元，无需梯度或额外训练。在指令模型中，移除这些神经元使标准越狱测试中的拒答率下降超过50%，同时保持所有干预强度下的语言流畅性和非退化性。在Llama与Qwen架构（1B至72B参数）上对基线模型与指令模型进行对比发现，基线模型也存在类似的晚期层判别结构，但调控这些神经元仅引发内容变化而非行为改变。结果表明，神经元级干预可实现可靠的行为调控，且避免残差流方法的质量损失。更广泛地，研究暗示对齐微调将预存的判别结构转化为稀疏、可靶向的拒答门控机制。
原文摘要 · Abstract (English)
Language models are instruction-tuned to refuse harmful requests, but the mechanisms underlying this behavior remain poorly understood. Popular steering methods operate on the residual stream and degrade output coherence at high intervention strengths, limiting their practical use. We introduce contrastive neuron attribution (CNA), which identifies the 0.1% of MLP neurons whose activations most distinguish harmful from benign prompts, requiring only forward passes with no gradients or auxiliary training. In instruct models, ablating the discovered circuit reduces refusal rates by over 50% on a standard jailbreak benchmark while preserving fluency and non-degeneracy across all steering strengths. Applying CNA to matched base and instruct models across Llama and Qwen architectures (from 1B to 72B parameters), we find that base models contain similar late-layer discrimination structures but steering these neurons produces only content shifts, not behavioral change. These results demonstrate that neuron-level intervention enables reliable behavioral steering without the quality tradeoffs of residual-stream methods. More broadly, our findings suggest that alignment fine-tuning transforms pre-existing discrimination structure into a sparse, targetable refusal gate.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。