发现语言模型对齐失效的可操作激活方向，跨架构修复效果有限。
Actionable Activation Directions for Detecting and Mitigating Emergent Misalignment Across Language Model Families
- 通过差异均值法找到统一的激活方向，可区分对齐与失准状态。
- 减去该方向使代码泄露减少21-51点，验证内容特异性。
- 跨模型迁移虽有效但缺乏特异性，建议用同模型探测审计。
在不安全代码上微调语言模型会引发内部结构不明的对齐失效。我们探究这种失效是否对应于跨架构共享的可因果操控的激活空间方向。在四个指令微调模型家族（Qwen2.5-1.5B、Gemma-2-2B、Llama-3.2-1B、Ministral-3-3B）上进行相同微调后，差异均值方向在各模型最后一层实现99.6%的对齐与失准激活分离。通过减去该方向进行因果操控，代码泄露降低21-51点，且安全代码对照确认内容特异性。通过岭回归进行跨架构迁移，行为抑制最大达46点，但随机与正交方向表现相当，无法通过特异性控制。识别出两层特异性结构：模型内方向具有因果特异性和可操作性；跨模型方向虽具因果真实性但无特异性。出现非对称迁移拓扑，其中Gemma和Qwen为几何源，Llama为接收端。研究揭示线性跨架构修正的边界，建议采用模型内探测进行审计。
原文摘要 · Abstract (English)
Fine-tuning language models on insecure code induces emergent misalignment with poorly understood internal structure. We investigate whether this misalignment corresponds to a causally actionable activation-space direction shared across architectures. Across four instruction-tuned model families (Qwen2.5-1.5B, Gemma-2-2B, Llama-3.2-1B, Ministral-3-3B) finetuned identically, a difference-in-means direction achieves 99.6% separation of aligned and misaligned activations at each model's final layer. Causal steering by subtracting this direction reduces code spillover by 21-51 points, while a secure-code control confirms content specificity. Cross-architecture transfer via ridge regression maps yields large behavioral suppression (up to 46 points) but fails specificity controls as random and orthogonal directions perform comparably. We identify a two-tier specificity structure: within-model directions are causally specific and actionable; cross-model directions are causally real but non-specific. An asymmetric transfer topology emerges, with Gemma and Qwen acting as geometric donors and Llama as a receiver. These findings define the limits of linear cross-architecture correction and recommend within-model probing for auditing.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。