💻 computer science

Moving the Safety Barrier: Dynamic Routing Adaptive Alignment Against White-Box Attacks

This paper proposes Dynamic Routing Adaptive Alignment (DRAA), a framework that enhances large foundation models' robustness against white-box attacks by identifying and localizing safety routes, then training compensatory pathways to maintain refusal behavior even when primary safety mechanisms are compromised.

Original authors: Shangze Li, Chuancheng Shi, Simiao Xie, Lingzhi He, Cheng Ji, Zifeng Cheng, Fei Shen, Chao Wu, Tat-Seng Chua

Published 2026-08-05

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Shangze Li, Chuancheng Shi, Simiao Xie, Lingzhi He, Cheng Ji, Zifeng Cheng, Fei Shen, Chao Wu, Tat-Seng Chua

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are walking through a massive, bustling library where the books can talk back to you. This is the world of Large Foundation Models (LFMs), the super-smart AI brains that power everything from writing assistants to chatbots. For these AI systems to be safe, they need a "safety guard" inside their brain that stops them from answering dangerous questions, like "How do I build a bomb?" or "How do I hack a bank?" For a long time, scientists thought this guard was a single, sturdy door. They built defenses to lock that door tight. But recently, hackers (the "white-box attackers") figured out they could peek inside the library's blueprints, find exactly where that door is, and simply remove the hinges. Once the door is gone, the AI forgets how to say "no" and happily helps with the bad stuff. The big question is: how do we build an AI that doesn't rely on just one door, but can instantly build a new wall if the old one gets knocked down?

This is exactly what the paper "Moving the Safety Barrier: Dynamic Routing Adaptive Alignment Against White-Box Attacks" tackles. The authors, led by Shangze Li and colleagues, realized that the old way of building AI safety was too rigid. They propose a new framework called DRAA (Dynamic Routing Adaptive Alignment). Think of it like training a security guard not just to stand in front of a specific door, but to learn how to instantly reroute traffic through a secret tunnel whenever that door is blocked.

Here is how their "magic trick" works, broken down into simple steps:

1. Finding the "Magic Door"
First, the researchers had to figure out exactly which part of the AI's brain was doing the "saying no." They fed the AI safe questions (like "How do I bake a cake?") and unsafe questions (like "How do I steal a cake?"). By comparing how the AI's brain cells (neurons) lit up for each, they pinpointed the specific "safety route"—a specific path of neurons that acts as the main guard.

2. Breaking the Door on Purpose
Next, they did something risky: they temporarily "turned off" that main safety route in the AI's brain. They asked the AI the dangerous questions again. As expected, without its main guard, the AI started giving bad answers. This was the "failure" they needed to study.

3. Teaching a Detour
This is the clever part. The researchers took those moments where the AI failed (because the main door was gone) and used them to teach the AI a new lesson. They said, "Hey, when the main guard is missing, you must find another way to say 'no'." They used a special training method called DR-DPO (Dynamic Routing Direct Preference Optimization). Imagine this as a game where the AI is forced to learn a "detour" strategy. The training locks the original safety neurons so the AI can't just rely on them; it has to find new, hidden pathways in its brain to handle the danger.

4. The Result: A Super-Resilient AI
The paper tested this on several different AI models, including Qwen2.5 and LLaMA-3.2. The results were impressive. When hackers tried to "prune" (cut out) the known safety neurons, the old AI models collapsed and gave harmful answers. But the DRAA-trained models? They kept saying "no."

For example, on a 14-billion-parameter model called Qwen2.5-14B, the standard defense failed completely when the safety route was attacked, letting through 270 out of 313 harmful prompts. The DRAA model, however, only let through 5 out of 313. Even on smaller models like the 1.5-billion-parameter version, DRAA reduced the failure rate from 248 down to just 43.

The authors also checked if this new "detour" skill made the AI dumber at normal tasks. They tested it on math problems (GSM8K) and general knowledge (ARC). The results showed that the AI remained just as smart and helpful as before; it just gained a superpower to stay safe even when its main defense was destroyed.

Why This Matters
The paper suggests that relying on a single, static safety path is a fatal flaw in AI security. If an attacker knows where the guard is, they can remove it. DRAA suggests a better way: build redundancy. By training the AI to dynamically switch to backup routes when the main one is compromised, we create a system that is much harder to break. The authors found that this method works not just for text, but also for images and videos (multimodal models), making it a robust shield against the next generation of AI attacks.

In short, the paper argues that safety shouldn't be a single locked door; it should be a flexible network of paths that can reroute traffic instantly, ensuring the AI stays safe no matter how hard someone tries to break in.

Technical Summary: Dynamic Routing Adaptive Alignment (DRAA)

1. Problem Statement

The widespread deployment of Large Foundation Models (LFMs) has shifted safety threats from black-box jailbreaks to white-box structural attacks. In these scenarios, attackers with access to internal parameters can precisely identify and sever the specific neurons or causal pathways responsible for safe refusal.

Existing defense mechanisms rely on static safety units or fixed refusal pathways (e.g., freezing specific neurons or anchoring weights). The paper argues that these methods suffer from a "static component" assumption: they presume the protected structures remain intact during deployment. Under white-box threats, once these fixed defensive routes are precisely pruned or perturbed, the model's refusal capability collapses entirely because it lacks compensatory mechanisms. The core problem is the lack of dynamic redundancy in current safety alignment, making models fragile against targeted route-level attacks.

2. Methodology: Dynamic Routing Adaptive Alignment (DRAA)

The proposed framework, DRAA, reformulates safety alignment as a route-recovery problem. Instead of merely reinforcing a single static path, DRAA aims to endow models with the ability to dynamically reconstruct safe behaviors when critical pathways are compromised. The framework consists of three main stages:

A. Safety Route Localization

DRAA first identifies the specific "safety route" the model currently relies on for safe refusal.

Mechanism: It contrasts internal activations between safe and unsafe calibration samples.
Metrics: It calculates two scores for neurons in each layer:
1. Effect Size (ES): Measures the distributional separation between safe and unsafe inputs.
2. Safety Activation Shift (SAS): Measures the directional amplification of activation under unsafe inputs relative to the layer mean.
Outcome: A set of neurons $S$ (the safety route) is defined as the union of neurons with high ES and SAS scores across layers.

B. Causal Failure Mining

To train the model to handle the failure of its primary safety route, DRAA simulates targeted attacks.

Intervention: The identified safety route $S$ is temporarily masked (zeroed out) during inference.
Data Construction: The system collects samples where the intact model produces a safe refusal ( $y_{ori}$ ), but the route-disabled model fails and generates an unsafe response ( $y_{cut}$ ).
Preference Pairs: These cases form "failure-aware preference pairs" $(x, y_{ori}, y_{cut})$ , creating a dataset ( $D_{fail}$ ) that specifically targets scenarios where the primary safety mechanism is broken.

C. Dynamic Routing Direct Preference Optimization (DR-DPO)

The final stage trains the model to learn compensatory routes without reinforcing the now-vulnerable primary route.

Route Locking: During the DPO optimization process, the parameters corresponding to the identified safety route $S$ are frozen (via gradient masking in LoRA adapters).
Objective: The model is forced to minimize the preference loss using only the unrestricted parameter space ( $\theta_R$ ).
Strategy: This implements a "detour when blocked" strategy. The model cannot simply strengthen the existing fragile route; it must discover and strengthen latent, alternative pathways (compensatory routes) within the remaining parameters to maintain safe refusal behavior even when the primary route is disabled.
Inference: During actual inference, the safety route remains active, but the newly learned compensatory routes provide additional defensive capacity if the primary route is perturbed.

3. Key Contributions

Framework Proposal: Introduction of DRAA, which shifts safety alignment from protecting static nodes to dynamically reconstructing refusal mechanisms under attack.
DR-DPO Objective: A novel optimization objective that locks the safety route during training, forcing the model to learn compensatory pathways in the unattacked parameter space.
Empirical Validation: Extensive experiments demonstrating that DRAA significantly enhances robustness against severe white-box pruning attacks while preserving general utility.

4. Experimental Results

The paper evaluates DRAA across various LLM backbones (Qwen2.5, LLaMA-3.2, Gemma, Phi) and Multimodal LLMs (Qwen2.5-VL, LLaVA) under four pruning settings: ORI (no pruning), ES, SAS, and FULL (union of ES and SAS neurons).

Robustness to Pruning: Under the strongest FULL pruning setting, DRAA consistently achieves the lowest Attack Success Rate (ASR) compared to baselines like SN-Tune, RLHF-Safety, and SafeNeuron.
- Example: On Qwen2.5-7B, DRAA reduced the FULL ASR to 26/313, whereas the original model had 279/313 and SafeNeuron had 183/313.
- Example: On LLaMA-3.2-8B, DRAA achieved an ASR of 11/313 under FULL pruning, compared to 221/313 for the original model.
Multimodal Safety: DRAA demonstrated superior robustness in visual jailbreak scenarios (VL-Question and NSFW tasks), reducing FULL ASR significantly (e.g., from 174/313 to 5/313 on Qwen2.5-VL-7B for VL-Question).
Generalization to Unseen Attacks: DRAA maintained robustness against unseen white-box attack mechanisms (GRAD, WANDA, ABLATE) not used during training, indicating it does not merely overfit to specific pruning patterns.
Utility Preservation: The method preserved general capabilities (measured by ARC, GSM8K, TruthfulQA) without significant degradation.
Efficiency: The approach adds negligible inference-time overhead. Localization takes ~0.58 minutes for 1,000 samples, and training takes ~12.7 minutes. After merging adapters, the model retains original parameter counts and inference speeds.

5. Significance and Claims

The paper claims that DRAA addresses a critical vulnerability in current safety alignment: the reliance on static, single-point defenses that collapse under targeted white-box attacks. By introducing dynamic compensatory routes, the framework restructures the underlying pathway dependence of model safety.

The authors emphasize that DRAA does not just improve safety against known attacks but fundamentally changes the model's architecture to be attack-resilient. The "detour when blocked" mechanism ensures that even if an attacker successfully identifies and severs the primary safety neurons, the model retains the ability to refuse harmful requests via alternative, learned pathways. This approach offers a more robust paradigm for deploying LFMs in open environments where internal parameters may be exposed to adversaries.