Research map / Large language models / Language, safety and interpretability

SAFEx: Analyzing Vulnerabilities of MoE-Based LLMs via Stable Safety-critical Expert Identification

NeurIPS 2025 · Large language models › Language, safety and interpretability · approach: Safety alignment of LLMs · 1 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes SAFEx, a stability-selection-based framework that identifies safety-critical experts in MoE LLMs, shows masking a few of them sharply lowers refusal, and uses LoRA on selected experts with negative weight merging to improve refusal under jailbreaks.

Problem

MoE LLMs may rely on a small set of specific experts for safety-aligned behavior (positional vulnerability), which existing dense-model safety analyses do not address.

Approach

Stability-based Expert Selection (SES) repeatedly bootstraps prompt subsets, estimates per-expert activation frequencies, and intersects top-ranked experts across resamples to find stable harmful-content and refusal-control experts, which are then validated by linear probes and expert masking.

Key results

• Masking 12 selected experts in Qwen3-30B-A3B reduces refusal rate from 93.6% to 71.6% (a 22.0% drop).
• Masking 12 experts changes AIME-2024 score on Qwen3-30B-A3B from 77.4 to 75.2, suggesting problem-solving is mostly preserved.
• Negative (subtractive) merging of LoRA updates on E_id ∪ E_ctrl raises Qwen3-30B-A3B refusal on adversarial prompts from 47.7% to 81.5%.

Measured effects reported in the paper

Surprising findings

• Without stability selection, masking only 15 experts in Qwen3-30B-A3B drops refusal by just 7.0%, and the paper notes the two settings yield markedly different expert sets.
• Under jailbreak, MoE Qwen3-30B-A3B lost 48.4% refusal versus 27.8% for the dense Qwen3-32B-Instruct.

Limitations

• Evaluated only on a few MoE models (Mixtral, Qwen1.5-MoE, deepseek-moe, Qwen3-30B-A3B), with generalization to larger MoE systems left to future work.
• Refusal labels rely on an LLM judge (DeepSeek-V3) with a rubric rather than human annotation.
• Jailbreak prompts were generated by an external model, and the dataset is small (500 per group).

Experimental setup

Datasets: D_Regular (harmful prompts from existing benchmarks) D_Jailbreak (rewritten by DeepSeek-V3/R1) D_Benign (openai-moderation-api-evaluation, wildguardtest) toxic dataset safety dataset

Benchmarks: AIME-2024

Metrics: refusal rate accuracy precision recall F1-score

Baselines: Qwen1.5-MoE-A2.7B-Chat deepseek-moe-16b-chat Mixtral-8x7B-Instruct-v0.1 Qwen3-32B-Instruct Qwen1.5-32B-Chat Mistral-7B-v0.1 BadMoE

Builds on: stability selection LoRA Top-k routing

Closest papers by meaning

• Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To! (ICLR 2024 · similarity 0.89)
• RSafe: Incentivizing proactive reasoning to build robust and adaptive LLM safeguards (NeurIPS 2025 · similarity 0.89)
• Navigating the Safety Landscape: Measuring Risks in Finetuning Large Language Models (NeurIPS 2024 · similarity 0.89)
• UpSafe℃: Upcycling for Controllable Safety in Large Language Models (NeurIPS 2026 · similarity 0.88)
• Controllable Safety Alignment: Inference-Time Adaptation to Diverse Safety Requirements (ICLR 2025 · similarity 0.88)
• Towards Understanding Safety Alignment: A Mechanistic Perspective from Safety Neurons (NeurIPS 2025 · similarity 0.88)