Research map / Large language models / Language, safety and interpretability

UpSafe℃: Upcycling for Controllable Safety in Large Language Models

NeurIPS 2026 · Large language models › Language, safety and interpretability · approach: Safety alignment of LLMs

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes UpSafe℃, which upcycles safety-critical layers (found by linear probes) into a sparse MoE with safety experts, trains them with a two-stage SFT on STAR-1, and adds an inference-time safety temperature to trade off safety and utility.

Problem

LLMs remain vulnerable to harmful content and jailbreaks, and existing safety methods (external guardrails, inference-time guidance, post-training alignment) struggle to balance safety, utility, and controllability at inference time.

Approach

Identify safety-sensitive layers via linear probe validation loss, duplicate their MLPs into safety experts under a sparse MoE router that acts as a soft guardrail, train in two stages (safety experts, then router on mixed data), and expose a safety temperature that biases routing logits at inference.

Key results

• Across six models, UpSafe℃ (tau=0.5) reaches 100% safety on JBB and StrongREJECT and improves average safety over SFT-only by about 5.6% on WildChat and 7.8% on WildJailbreak (per the paper's text).
• On general benchmarks, UpSafe℃ improves average general performance by 4.5% over SFT-only and 0.5% over the single-stage MoE (per the paper's text).
• Safety temperature traces a Pareto-like safety-utility curve on WildJailbreak and XSTest that covers vanilla and SFT-only operating points.

Surprising findings

• Probing distilled R1 models directly gave less consistent safety-critical layer identification, so the paper reused layers from their instruction-tuned counterparts.

Limitations

• Relies on a single safety dataset (STAR-1) for training, and the SFT-only and MoE baselines are trained on the same data.
• Safety judged by GPT-4o alone, with no human evaluation.
• Full MoE parameter count grows substantially (about 1.6-1.9B added) compared to the LoRA baseline.

Experimental setup

Datasets: STAR-1

Benchmarks: StrongREJECT JBB WildChat WildJailbreak XSTest MMLU Math-500 HumanEval

Metrics: safety rate non-refusal rate pass@1 accuracy

Baselines: Vanilla models SFT-only (LoRA) single-stage MoE SafeKey

Builds on: Mixture of Experts upcycling LoRA SafeKey

Closest papers by meaning

• Jailbreak Antidote: Runtime Safety-Utility Balance via Sparse Representation Adjustment in Large Language Models (ICLR 2025 · similarity 0.92)
• Navigating the Safety Landscape: Measuring Risks in Finetuning Large Language Models (NeurIPS 2024 · similarity 0.91)
• Controllable Safety Alignment: Inference-Time Adaptation to Diverse Safety Requirements (ICLR 2025 · similarity 0.90)
• RSafe: Incentivizing proactive reasoning to build robust and adaptive LLM safeguards (NeurIPS 2025 · similarity 0.90)
• Safety Depth in Large Language Models: A Markov Chain Perspective (NeurIPS 2025 · similarity 0.90)
• Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To! (ICLR 2024 · similarity 0.90)