arXiv:2605.29708cs.CL2026-05中稿 · EMNLP被引 1

发现MoE模型安全机制依赖少数专家,提出新方法精准突破其防护漏洞。

RASET: Router-Agnostic Safety-Critical Expert Tuning Exposes Localized Safety Enforcement Failures in Mixture-of-Experts LLMs

论文配图:RASET: Router-Agnostic Safety-Critical Expert Tuning Exposes Localized Safety Enforcement Failures in Mixture-of-Experts LLMs
图 1 · 摘自论文原文
  • 通过对比路由敏感性识别关键安全专家,仅微调局部参数。
  • 在5个模型上实现平均50.5%的高安全绕过率,优于基线37.6点。
  • 适用于检测和强化对专家级安全机制的对抗攻击,适合安全研究者。

Mixture-of-Experts (MoE) 大语言模型依赖稀疏、由路由器驱动的专家激活,但安全对齐如何与路由驱动的专家专业化相互作用仍不清楚。普遍认为,有害请求可通过路由至专门拒绝的专家来控制安全行为。本文提供实证证据揭示不同图景:对齐的 MoE 模型中,路由模式主要由主题驱动,而安全行为可在几乎不改变内在路由路径的情况下被轻易改变。受此启发,我们提出 RASET(Router-Agnostic Safety-Critical Expert Tuning),一种红队框架,用于探测局部化于少数专家的安全执行失败,同时保持模型固有的路由行为。RASET 通过对比路由敏感性准则识别安全关键专家,并仅对选定专家进行参数高效微调,相较于依赖路由引导的干预方式,显著降低语义扰动。在五个开源权重的 MoE 主干模型上,RASET 实现平均 50.5% 的高质量安全绕过率(ASR_{hq}),比最强基线提升 37.6 点。结果揭示了一种独特的 MoE 安全风险,强调需要具备专家感知能力的对齐机制。

原文摘要 · Abstract (English)

Mixture-of-Experts (MoE) LLMs rely on sparse, router-driven expert activation, yet how safety alignment interacts with routed expert specialization remains underexplored. A common intuition is that safety behavior may be controlled by routing harmful requests to distinct refusal-oriented experts. In this work, we provide empirical evidence for a different picture: routing patterns in aligned MoE LLMs are largely topic-driven, while safety behavior can be altered with little change to the model's intrinsic routing path. Motivated by this observation, we present RASET (Router-Agnostic Safety-Critical Expert Tuning), a red-teaming framework that probes safety enforcement that is localized in a small subset of experts while preserving the model's intrinsic routing behavior. RASET identifies safety-critical experts via a contrastive routing-sensitivity criterion and applies parameter-efficient tuning only to the selected experts, minimizing semantic disruption relative to router-steering interventions. Across five open-weight MoE backbones, RASET achieves high-quality safety-bypass yield (50.5% average $ASR_{hq}$, +37.6 points over the strongest baseline). These results reveal a distinct MoE safety risk, highlighting the need for expert-aware alignment mechanisms.

MoE模型安全绕过专家定位红队测试

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。