Technical Summary: RouteHijack

Problem Statement

As Large Language Models (LLMs) increasingly adopt Mixture-of-Experts (MoE) architectures to scale capacity efficiently, their safety robustness remains under-explored. Existing adversarial attacks face significant limitations when applied to MoE models:

• Prompt-based jailbreaks rely on heuristic search, are brittle, and transfer poorly.
• Model intervention methods (e.g., expert pruning, logit manipulation) require privileged access to internal weights or activations, which is unrealistic in standard deployment scenarios.
• Optimization-based attacks (e.g., GCG), while input-only, are fundamentally ill-suited for MoE models. They are designed for dense architectures, failing to account for the non-differentiable Top-K routing mechanism. Furthermore, they are output-centric, optimizing for specific token prefixes (e.g., "Sure, here is") rather than the internal routing dynamics that govern safety behavior. This often leads to unstable optimization or models that initially comply but subsequently refuse.

There is currently no effective, input-only optimization-based attack capable of bypassing safety mechanisms in MoE LLMs while maintaining coherent generation.

Methodology: RouteHijack

The authors propose RouteHijack, a routing-aware adversarial framework that exploits the structural vulnerability of MoE models: the concentration of safety-aligned behaviors within a small, specialized subset of experts. The attack operates under realistic input-only constraints at deployment time, utilizing a surrogate model for offline optimization.

The framework consists of two primary stages:

1. Response-Driven Expert Localization

Unlike prior methods that analyze activations based on input prompts (which confounds safety behavior with prompt semantics), RouteHijack employs response-driven contrastive profiling.

• Mechanism: For a given malicious query, the model generates two responses: a safe refusal ($a_{safe}$) and a compliant harmful answer ($a_{harm}$). The method compares expert activation frequencies between these two responses, isolating experts that are specifically active during refusal versus harmful generation.
• Utility-Aware Filtering: To prevent degrading the model's general capabilities, the method filters out "polysemantic" experts that contribute to both safety and general language modeling. It selects safety-critical experts ($E_{safe}$) and harmful experts ($E_{harm}$) based on their differential activation, penalizing those with high general activation frequencies.

2. Routing-Aware Optimization (Ternary Loss)

RouteHijack constructs a universal adversarial suffix ($x_{adv}$) optimized to manipulate the router's decision at the boundary token ($t^*$) before autoregressive decoding begins. The optimization minimizes a ternary loss ($L_{total}$) comprising three components:

• Safety Suppression ($L_{suppress}$): Minimizes the routing probability of the identified safety experts ($E_{safe}$) to weaken the model's primary defense mechanism.
• Bounded Harmful Promotion ($L_{promote}$): Maximizes the routing probability of harmful experts ($E_{harm}$) but imposes a bounded constraint (hinge loss). This prevents the router from collapsing onto a few experts, which would cause semantic degradation, ensuring the model remains fluent.
• Refusal Unlikelihood ($L_{refusal}$): Penalizes the generation of refusal tokens (e.g., "sorry," "cannot") during the initial decoding steps ($W=5$). This prevents the model from reverting to refusal trajectories even if the initial routing is manipulated.

The optimization uses a gradient-guided discrete search (similar to GCG) but targets the continuous router softmax probabilities prior to the non-differentiable Top-K truncation, enabling stable gradient propagation.

Key Contributions

1. RouteHijack Framework: The first optimization-based, input-only attack specifically designed for MoE LLMs that directly influences expert selection through input perturbations.
2. Response-Driven Profiling: A novel method to isolate safety-critical and harmful experts by contrasting model responses rather than input prompts, providing a more precise characterization of internal safety mechanisms.
3. Routing-Aware Objective: A ternary loss function that jointly controls expert activation and early-stage decoding dynamics, overcoming the non-differentiability of MoE routing.
4. Empirical Validation: Comprehensive evaluation across seven state-of-the-art MoE LLMs (covering sparse, shared-expert, and grouped routing variants) and three MoE-based Vision Language Models (VLMs).

Experimental Results

• Attack Success Rate (ASR): RouteHijack achieves an average ASR of 69.3% across seven MoE LLMs, with a peak of 89.1%. This significantly outperforms the best white-box baseline (SAFEx, 33.3%) and standard optimization-based attacks (GCG, 21.9%).
• Utility Preservation: The attack incurs a minimal average utility drop of 1.3% across five NLU benchmarks (CoLA, RTE, WinoGrande, OpenBookQA, ARC-Challenge), demonstrating that the utility-aware filtering successfully preserves general language capabilities.
• Transferability:
  • Sibling Models: Optimized suffixes transfer zero-shot across five sibling MoE variants, raising the average ASR from 27.7% to 61.2%.
  • Multimodal: The attack generalizes to MoE-based VLMs, increasing the average ASR from 2.47% to 38.7%, indicating that routing vulnerabilities are inherent to the MoE architecture regardless of modality.
• Mechanistic Validation: Analysis confirms that the attack successfully shifts routing probabilities at the boundary token (Target Expert Suppression Rate of -28.75% and Target Harmful Promotion Rate of +28.51%), and these shifts propagate through the autoregressive generation process.

Significance and Claims

The paper claims that RouteHijack exposes a fundamental vulnerability in sparse expert architectures: safety alignment is not uniformly distributed but is concentrated in a small subset of experts. This concentration creates a localized attack surface that can be exploited via routing manipulation.

The authors argue that current safety alignment methods (e.g., RLHF, DPO) are insufficient because they focus on output distributions without addressing the underlying sparse routing dynamics. The findings suggest that:

1. Routing is a Modality-Agnostic Risk: Vulnerabilities in the routing mechanism affect both text and vision-language models.
2. Black-Box Threat: The ability to transfer attacks across sibling models implies that even proprietary, black-box MoE models are at risk if they share a routing backbone with open-weight variants.
3. Need for New Defenses: The paper concludes that robust defenses must move beyond output-level alignment to include routing-aware regularization during training (to distribute safety behaviors more broadly) or inference-time routing audits to detect anomalous expert activation patterns.