CNT: Safety-oriented Function Reuse across LLMs via Cross-Model Neuron Transfer

1. Problem Statement

The widespread deployment of Large Language Models (LLMs) creates a critical need for post-hoc safety modifications. Existing models often fail to align with evolving safety requirements, or new scenarios demand specific security adjustments. Current solutions face significant limitations:

• Fine-tuning/Retraining: Requires costly data collection and computational resources.
• Knowledge Editing: Primarily revises existing internal knowledge rather than acquiring new functional capabilities.
• Model Fusion: Typically merges entire models, lacking the granularity to selectively reuse specific functions from open-source models.
• Pruning: Removing neurons to disable functions often degrades overall model utility and fails to completely suppress target behaviors due to residual activations.

The paper proposes a shift from constructing safety functions from scratch to reusing existing safety-related functionality from external, open-source LLMs without training or supervised data.

2. Methodology: Cross-Model Neuron Transfer (CNT)

CNT is a post-hoc framework that grafts safety-oriented functionality from a Donor Model ($F_d$) to a Recipient Model ($F_r$) by transferring a minimal subset of neurons (weights). It operates under the constraint that both models share the same architecture.

The process involves four key components:

A. Donor Model Selection & Compatibility (NTRR)

To ensure transferred neurons function correctly, the donor and recipient must be compatible.

• Neural Transfer Rejection Rate (NTRR): A metric quantifies compatibility. It involves randomly transferring a small proportion of weights (e.g., 10%) from the donor to the recipient and measuring the KL Divergence between their output distributions. A lower NTRR indicates higher compatibility.

B. Low-Noise Probing Request Construction

To accurately locate neurons responsible for a specific function, the method uses differential analysis.

• Challenge: Naive request pairs (e.g., harmful vs. harmless) often differ in structure or context, introducing noise.
• Solution: The authors generate Low-Noise Request Pairs:
  • F-req (With-function): A prompt that strongly activates the target function (e.g., a harmful request).
  • Fl-req (Function-less): A prompt generated by a commercial chatbot that preserves the structure, context, and topic of the F-req but removes the specific functional element triggering the target behavior.
  • This minimizes irrelevant activation variations, isolating the neurons specific to the target function.

C. Path-wise Function Gap Attribution

Standard gradient-based attribution fails here because the donor and recipient are independently trained (no continuous optimization path).

• Virtual Interpolation Path: The method defines a linear path between the recipient weights ($\theta_r$) and donor weights ($\theta_d$): $\theta^{(k)} = \theta_r + \frac{k}{N}(\theta_d - \theta_r)$.
• Integration: It integrates gradients along this path to calculate an Attribution Score ($A_i$) for each weight. This score quantifies how much a specific weight difference contributes to the "function gap" (the performance difference in the target task).
• Objective Function: The loss function $L$ balances minimizing the gap on the target function while preserving the recipient's behavior on non-target tasks (using the Fl-reqs).

D. Weight Transfer

• Selection: The top $p\%$ of weights with the highest attribution scores are selected.
• Transfer: These weights are replaced in the recipient model with the corresponding weights from the donor.
• Optimization: The transfer rate $p$ is tuned via binary search to maximize function transfer while minimizing utility degradation.

3. Key Contributions

1. Novel Framework (CNT): Introduces a training-free, post-hoc method to reuse safety functions across LLMs by transferring minimal neuron subsets, eliminating the need for supervised datasets.
2. Dual Capability: Supports both Function Addition (injecting safety alignment into an unaligned model) and Function Deletion (removing safety alignment to simulate a disalignment attack).
3. Technical Innovations:
   • NTRR: A metric for quantifying cross-model compatibility.
   • Low-Noise Probing: A technique to generate differential request pairs that isolate functional neurons.
   • Path-wise Attribution: A gradient-integration method to attribute function gaps across independently trained models.
4. Extensive Evaluation: Validated on 7 popular LLMs (including Dense and MoE architectures) across three scenarios: Safety Disalignment, Alignment Enhancement, and Bias Removal.

4. Experimental Results

The authors evaluated CNT against baselines like LoRA (fine-tuning), Model Surgery, Refusal Direction (RD), and ActSVD.

• Function Deletion (Disalignment Attack):

  • CNT successfully suppressed safety alignment, achieving an average 77.13% increase in HarmBench scores (indicating successful bypass).
  • Utility Preservation: Minimal degradation in general capabilities (MMLU drop of only 1.37%), significantly outperforming pruning-based methods which caused larger drops.
  • Comparison: Outperformed RD and ActSVD-OP in safety suppression metrics while maintaining better utility.

• Function Addition (Alignment Enhancement):

  • CNT improved Refusal Accuracy (RA) by 40.84% on average for unaligned models.
  • Utility: Achieved a slight MMLU gain (+0.26), whereas baselines like Model Surgery caused significant utility drops (-12.48%).
  • Efficiency: Required only 0.012%–0.24% of total weights to be transferred.

• Bias Removal:

  • Successfully reduced Stereotype Scores (SS) from 77.47 to 64.73 while maintaining high ICAT scores, demonstrating applicability beyond safety alignment.

• Architectural Universality:

  • Effective across models ranging from 3B to 16B parameters, including Dense (Llama, Mistral, Yi) and MoE (DeepSeek) architectures.

5. Significance and Insights

• Paradigm Shift: Moves the field from "training from scratch" to "functional reuse," leveraging the vast open-source ecosystem to solve safety issues cost-effectively.
• Mechanism of Action: The paper provides a crucial insight into why transfer works better than pruning. Pruning removes neurons, but residual activations can still trigger the function. CNT replaces neurons with compatible weights from a donor, inducing counter-activations that actively overwrite or neutralize the target function's logic, leading to more robust suppression with less collateral damage to general capabilities.
• Layer Sensitivity: The study reveals that safety functions are not uniformly distributed; transferring weights from middle layers is often more effective than early or late layers.
• Practicality: The method requires no labeled training data, only a small set of probing prompts, making it highly deployable in scenarios where data is scarce or retraining is impossible.

In conclusion, CNT demonstrates that specific safety functionalities are modular and transferable across models, offering a precise, efficient, and training-free solution for adapting LLMs to evolving safety and ethical requirements.