Technical Summary: Understanding Safety-Sensitive Expert Behavior in Mixture-of-Experts LLMs

1. Problem Statement

Mixture-of-Experts (MoE) Large Language Models (LLMs) utilize sparse, router-driven activation, where tokens are directed to a specific subset of feed-forward experts. A prevailing intuition in safety alignment suggests that refusal to harmful requests is achieved by routing inputs to distinct, "refusal-oriented" experts, separate from those handling the topic.

This paper challenges that intuition, asking: When an aligned MoE model refuses a harmful request, is the refusal induced by routing to a distinct set of safety-specialized experts, or is it mediated by representations within the same topic-specialized experts that would otherwise process the request?

The authors posit that if safety behavior is controlled primarily by routing, then altering the router's decision should be the most effective way to bypass safety. Conversely, if safety is embedded within the expert parameters themselves, routing patterns might remain stable even when safety behavior flips. Understanding this distinction is critical for developing robust safety mechanisms and evaluating MoE vulnerabilities.

2. Methodology

2.1 Empirical Probes for Routing Behavior

To investigate the relationship between routing and safety, the authors conducted three complementary empirical probes across aligned MoE models:

1. Teacher-Forced Behavioral Contrast: The authors compared routing patterns for the same harmful prompt under two conditions: a safety-aligned refusal continuation and a teacher-forced compliant continuation.
2. Prompt-Level Refusal-Style Contrast: Using benign prompts, they prepended refusal prefixes to induce refusal-style responses and compared the resulting routing against the original benign requests and cross-topic controls.
3. Matched Safety-Intent Contrast: They constructed paired prompts where the topic and syntactic structure were preserved, but the unsafe intent was removed (e.g., changing "how to make a bomb" to "how to make a toy").

Metrics: Routing similarity was quantified using Jensen-Shannon (JS) divergence of router logits and the overlap of the top-$k$ activated experts.

Findings: Across all probes, changes in refusal/compliance behavior or safety intent resulted in significantly smaller routing shifts compared to changes in the request topic. This suggests that MoE routers are primarily topic-driven, while safety enforcement resides within the representations of the experts naturally activated for that topic, rather than in a separate routing path.

2.2 RASET Framework

Motivated by the finding that safety behavior can be altered without disrupting the intrinsic routing path, the authors propose RASET (Router-Agnostic Safety-critical Expert Tuning). This is a red-teaming framework designed to induce harmful content while preserving the model's topic-specialized computation.

Key Steps:

1. Identification of Safety-Critical Experts:

   • The framework calculates a Safety Sensitivity Score ($S_{l,i}$) for each expert $i$ at layer $l$.
   • This score is derived from a contrastive routing-sensitivity criterion: $S_{l,i} = A(l, i; D_{harm}) - \lambda \cdot A(l, i; D_{norm})$.
   • This contrasts the expert's activation on harmful queries ($D_{harm}$) against benign instructions ($D_{norm}$), suppressing experts that are generally active (topic-general) and highlighting those disproportionately recruited for harmful requests.
   • The top-$K$ experts with the highest scores are selected as the key set $\Phi_{key}$.

2. Constrained Expert-Level Adaptation:

   • Freezing: The router, shared components, and all non-selected experts are frozen.
   • Fine-Tuning: Parameter-efficient tuning (PEFT) is applied only to the selected experts ($\theta_{\Phi}$).
   • Loss Functions:
     • $L_{violate}$: A dual strategy that penalizes refusal patterns (e.g., "Sorry, I cannot") and promotes affirmative prefixes (e.g., "Sure, here is...") paired with unsafe queries. It uses a max-margin penalty to prevent unbounded optimization.
     • $L_{preserve}$: Ensures general capabilities are maintained by minimizing the negative log-likelihood (NLL) on benign instructions ($D_{norm}$) and applying L2 regularization to keep tuned parameters close to their pre-trained states.
   • Objective: $L_{total} = L_{violate} + L_{preserve}$.

3. Key Contributions

1. Empirical Evidence on Routing Dynamics: The paper provides controlled evidence that in aligned MoE models, routing is largely driven by semantic topic structure rather than the binary distinction between refusal and compliance. Safety-related behavior can change significantly without corresponding large shifts in the routing path.
2. RASET Framework: The introduction of a diagnostic, expert-level adaptation framework that freezes the router. This allows for the controlled analysis of safety-sensitive expert representations and demonstrates that safety alignment can be compromised through localized parameter changes without disrupting the model's functional specialization.
3. Evaluation Across Diverse Backbones: The study evaluates this phenomenon across five open-weight MoE backbones (OLMoE, DeepSeek-V2, Qwen3, Phi-3.5, and GPT-oss), showing consistent localized safety failure modes.

4. Results

4.1 Red-Teaming Performance

RASET was evaluated against baselines like Greedy Coordinate Gradient (GCG) across five MoE models.

• Attack Success Rate (ASR): RASET achieved the highest yield under all strictness levels.
  • $ASR_{raw}$ (Safeguard Violation): 78.6% average.
  • $ASR_{valid}$ (Valid Violation): 74.0% average.
  • $ASR_{hq}$ (High-Quality Violation): 50.5% average.
• Comparison: RASET outperformed the strongest baseline (GCG) by an average of 37.6 points on the $ASR_{hq}$ metric.

4.2 Preservation of General Capabilities

• Parameter Efficiency: RASET updates only 0.12%–0.95% of model parameters.
• Utility Retention: The framework preserves significantly better benign utility compared to router-manipulation baselines.
  • TruthfulQA: Average drop of 5.4 points (68.9% $\to$ 63.4%).
  • MMLU: Average drop of 7.5 points (69.9% $\to$ 62.4%).

4.3 Routing Stability

Crucially, RASET preserves the model's intrinsic routing logic:

• JS Divergence: The shift in router logits between pre-tuned and post-tuned models remained below 0.04 for benign tasks and 0.08 for harmful tasks.
• Expert Overlap: The overlap of the top-8 experts remained high (e.g., >7.0 out of 8 for benign tasks, ~5.66 for harmful tasks).
• Conclusion: The model continues to dispatch tokens to the same topic-relevant experts; the safety bypass is achieved because the underlying expert parameters have been "reprogrammed," not because the routing path was altered.

5. Significance and Claims

The paper claims that these findings reveal a distinct safety risk in MoE architectures: safety alignment can be compromised through small, localized expert-level changes even when the model's routing behavior remains largely intact.

• Implication for Safety: Current safety mechanisms that rely on router steering or assume safety is isolated in specific "refusal experts" may be insufficient. Safety enforcement appears to be distributed within the representations of topic-specialized experts.
• Implication for Attacks: Router-steering interventions (forcing tokens to different experts) may alter safety behavior but often at the cost of semantic fidelity and utility, as they misdirect tokens away from the experts specialized for the requested topic.
• Future Direction: The authors highlight the need for expert-aware alignment mechanisms that jointly account for router behavior, expert specialization, and the robustness of expert parameters themselves.

The paper concludes that RASET's success in flipping safety behavior while maintaining routing consistency supports the view that expert-level adaptation is a potent vector for circumventing safety in MoE LLMs.