Source-linked AI summary
RARE: Decoupling Representation Steering from Expert Routing in Mixture-of-Experts Language Models
Zhibo Zhang, Zhen Ouyang, Ling Shi, Kailong Wang
TL;DR
Representation steering in MoE models is challenged by perturbations that can disrupt expert routing. RARE projects perturbations into router-invisible subspaces and corrects downstream routing drift, improving steering across models and tasks while preserving routing consistency.
Problem
Dense-model representation steering can alter MoE router logits, redirect tokens to different experts, and weaken steering effects.
Method
RARE projects behavioral perturbations onto router-invisible subspaces and applies downstream corrections to suppress propagated routing drift.
Results
RARE improves the primary steering metric over Clean and RepE in all 18 model–scenario combinations across six MoE architectures and three behavioral tasks.
Takeaways & Limitations
The results support preserving native routing as an architectural consideration for representation engineering in MoE models.
Takeaways & Limitations
Preserving secondary properties remains scenario- and estimator-dependent, and the explanation involving semantic computation paths remains an architecture-level hypothesis.
Abstract
from arXiv · showhide
Representation engineering offers a lightweight means of controlling language-model behavior by modifying intermediate hidden states, but its direct application to Mixture-of-Experts (MoE) models introduces a structural mismatch. We first verify this failure mode through a series of empirical studies and find that preserving clean routing substantially recovers steering performance and that routing is more sensitive to semantic content than to behavioral changes under controlled content. Motivated by these findings, we introduce RARE, a router-agnostic representation engineering framework for MoE language models. RARE projects arbitrary behavioral perturbations onto the null space of the router matrix, thereby removing router-visible components, and further corrects routing drift propagated to selected downstream layers. To decide the best perturbation estimator in this framework, we evaluate five estimators on six heterogeneous open-weight MoE models across three steering scenarios: harmfulness, truthfulness, and factual editing. On harmfulness steering, RARE reaches an average attack success rate of 53.3% while retaining 67.8% MMLU accuracy, yielding a stronger aggregate effectiveness--utility trade-off than baselines. It further improves average TruthfulQA MC1 accuracy from 41.0% to 58.6% and CounterFact efficacy from 16.8% to 96.3%. These results support routing consistency as an important architectural consideration for adapting representation engineering to MoE models.
1 Introduction
MoE routing creates a mismatch for representation steering because hidden-state perturbations can redirect tokens to different experts. The paper studies this mismatch and introduces RARE to steer representations while preserving native routing.
- Directly transferring dense-model steering to MoEs can alter router logits, redirecting tokens to different expert sets and weakening steering effects.
- Routing changes less when response behavior changes under fixed query semantics than when the semantic content of the query changes.
- RARE projects behavioral perturbations onto router-invisible subspaces and corrects downstream routing drift while preserving naturally selected experts.
- 53.3% average harmfulness ASR is achieved while retaining 67.8% normal capacity accuracy across the evaluated MoE settings.
- RARE evaluates five perturbation estimators across six heterogeneous MoE models and three behavioral control tasks.
2 Related Work
Prior MoE steering methods use expert selection as a behavioral control interface, whereas RARE preserves native routing and modifies representations processed by the selected experts.
- Representation engineering controls language-model behavior by intervening on continuous internal representations without updating the full model.
- Recent MoE steering methods influence behavior by selectively activating, deactivating, or masking behavior-associated experts.
- Expert-selection interventions couple behavioral modification with changes to native routing and may disrupt input-conditioned expert capacity and computation.
- RARE decouples behavioral steering from expert allocation by preserving the original routing pattern and intervening on selected-expert representations.
3 Empirical Study: MoE Routing Primarily Tracks Query Semantics
Controlled probes show that MoE routing primarily tracks query semantics rather than refusal behavior or safety intent. The resulting recommendation is to preserve native expert allocation during representation steering.
- Controlled routing probes: Same-query refusal/compliance pairs exhibit lower routing-distribution divergence and higher Top-8 expert overlap than cross-query refusal controls.
- Controlled routing probes: Changing response mode within coding or translation domains produces minor routing shifts, with JSD values of 0.0346 and 0.0098.
- Controlled routing probes: Cross-domain changes between translation and coding produce substantially larger routing divergence than response-mode changes within a task domain.
- Findings: Across the probes, routing changes less under controlled behavior or intent changes than under semantic-content changes.
- Answer to RQ1: Effective MoE representation engineering should treat routing as a computation-path constraint and minimize perturbation-induced changes to native expert allocation.
4 Methodology
RARE constructs behavioral perturbations from contrastive hidden representations, projects them into router-invisible directions, and corrects routing drift propagated to protected downstream layers.
- Notation: The MoE router maps hidden representations through layer-specific router matrices into routing probabilities and selects the top-k experts.
- Perturbation construction: Contrastive hidden representations are collected at designated tokens and layers, then used to produce fixed layer-wise perturbation vectors.
- Layer selection: Intervention layers are selected by behavioral separability, while router-protected layers are selected by router-logit discrepancy.
- Perturbation estimators: The five estimators encode different geometries: translation, decision-boundary normal, principal subspace, pooled covariance, and class-specific second-order geometry.
- Router-agnostic projection: RARE removes router-visible perturbation components by projecting raw directions into the null space of the router matrix.
- Router-agnostic projection: Runtime correction suppresses propagated router-logit drift at protected layers while retaining router-invisible components of edited representations.
5 Evaluation
RARE is evaluated across six open-weight MoE models and three behavioral-control scenarios, with estimator comparisons and baseline analyses measuring steering efficacy, capability, and locality.
- Six open-weight MoE models are evaluated across harmfulness steering, truthfulness steering, and factual editing.
- 58.6% TruthfulQA MC1 accuracy and 96.3% CounterFact ES are the highest reported average estimator results.
- AffineGaussian is the strongest default for steering efficacy, whereas LDA offers a better efficacy–locality trade-off when side-effect preservation matters.
- RARE with AffineGaussian improves the primary steering metric over Clean and RepE in all 18 model–scenario combinations.
- 53.3% harmfulness ASR is achieved while retaining the highest average MMLU accuracy among intervention methods.
- Secondary-property preservation remains scenario- and estimator-dependent, and DeepSeek-specific shared experts are offered only as an architecture-level hypothesis.
6 Conclusion
The paper finds that routing drift weakens conventional representation steering, motivates RARE’s router-invisible interventions, and supports routing consistency as an architectural consideration for MoE steering.
- Routing drift substantially weakens conventional steering, while routing is more sensitive to query semantics than to behavioral changes under controlled content.
- RARE projects behavioral perturbations onto router-invisible subspaces and corrects routing drift propagated to downstream layers.
- Across six heterogeneous MoE models and three behavioral-control tasks, AffineGaussian delivers strong intervention efficacy and improved efficacy–utility trade-offs.
LLM Use Disclosure
The appendix reports LLM assistance in data-generation, evaluation organization, and table drafting, with author verification of outputs and references.
- An LLM generated five distinct expressions for each CounterFact record, with constraint-violating outputs regenerated.
- LLM assistance was also used to organize experimental results and draft LaTeX tables, while authors verified outputs and references.
- Three probes compare routing variation induced by continuation behavior, response mode, unsafe intent, and query semantics.
A.1 Dataset Sources and Pair Construction
The routing analysis constructs controlled comparisons that vary response behavior, semantic content, or safety intent while preserving other properties where possible. Routing divergence is then measured to determine whether MoE routing follows query semantics more than behavioral changes.
- Controlled datasets: Three controlled datasets disentangle semantic content, response behavior, and safety intent in MoE routing.The datasets use coding, translation, and harmful-request sets.
- Pair construction: Same-topic comparisons pair original requests with refusal-inducing variants, while cross-topic controls compare refusal-inducing coding and translation requests.The shared refusal prefix is excluded from aligned-token routing statistics.
- Pair construction: Matched harmful–benign pairs change safety intent while preserving semantic domain, entities, request type, and approximate surface structure.Random within-category pairs provide controls with broader topic variation.
- Routing analysis: Routing divergence uses averaged Jensen–Shannon divergence, top-8 expert overlap, and analyzed-token routing distributions.Higher overlap and lower JSD indicate more similar routing.
- Findings: Changing continuation behavior under the same query produces less routing variation than changing the underlying query or semantic domain.Original and refusal-inducing queries retain similar routing, while translation, coding, and harmful queries form distinct semantic groups.
B.1 Backbone MoE Models and Experimental Setups
Experiments evaluate RARE and reproduced baselines across six open-weight MoE models and three steering scenarios. Harmfulness evaluation measures attack success alongside MMLU capability preservation, while truthfulness uses disjoint TruthfulQA construction and evaluation subsets.
- Backbone models: Six heterogeneous open-weight MoE models cover conventional sparse, fine-grained, and compressed expert designs.The suite includes DeepSeek, Mixtral, Phi-3.5, Phi-mini, Qwen3, and GPT-oss.
- Baselines: Baselines are reproduced using their original implementations and recommended settings, including RepE, SAFEx, and SteerMoE+AIM.RepE uses PCA-based representation reading and intervention, while SAFEx masks safety-critical experts and SteerMoE+AIM changes expert activation or deactivation.
- Harmfulness steering: Harmfulness steering uses 200 harmful ADVBENCH instructions and 200 benign ALPACA instructions for behavioral contrasts, with representations extracted at the final prompt token.Evaluation uses held-out JailbreakBench and MaliciousInstruct instructions.
- Harmfulness steering: ASR measures the proportion of evaluation instructions eliciting harmful responses, while MMLU accuracy measures preserved general capability.Harmfulness is classified with HarmBench, and MMLU uses a 228-question, 5-shot subset.
- Truthfulness steering: Truthfulness steering constructs behaviorally opposed pairs from TruthfulQA Best and Incorrect Answers, extracts teacher-forced response representations, and intervenes during the first five decoding steps.Construction and evaluation use disjoint 200-question subsets; MC1 records whether the truthful candidate has the highest conditional likelihood.
B.5 Factual Editing Experimental Implementations
Factual editing uses sampled CounterFact records, generated paraphrastic contrast pairs, and likelihood-based efficacy and locality tests. The router-agnostic projection is separately isolated by comparing otherwise identical AffineGaussian interventions with and without routing preservation.
- Dataset construction: CounterFact provides 21,919 records, from which 200 records are randomly sampled for factual editing.Each record contains subject, rewrite, original-object, counterfactual-object, paraphrase, and neighborhood prompts.
- Contrast construction: Five distinct expressions are generated per record to preserve the subject–relation query while varying lexical choice and syntactic structure.Each valid expression is paired separately with the original and counterfactual object using identical formatting.
- Evaluation: Editing efficacy succeeds when the counterfactual object has higher length-normalized conditional log-likelihood than the original object on the rewrite prompt.Locality uses a sampled neighborhood prompt and reverses the desired likelihood ordering.
- Projection ablation: Routing preservation raises average ASR from 14.6% with direct AffineGaussian injection to 53.3%, a gain of 38.7 percentage points.The improvement appears across all six models, ranging from 20.0 points on Phi-mini to 64.0 points on DeepSeek.
- Projection ablation: DeepSeek-V2-Lite’s ASR increases from 13.5% to 77.5% with routing preservation, supporting compatibility with its hybrid routed-and-shared-expert architecture.The paper cautions that this single architecture does not establish a causal link between shared experts and projection gain.
C.2 Verification of Routing Preservation
The verification compares edited and clean router logits under harmfulness steering and finds that direct injection creates persistent routing drift, while the complete projection pipeline largely preserves the native routing trajectory.
- Routing drift: Routing discrepancies from direct injection can persist and become amplified as perturbations propagate through subsequent Transformer blocks.The increase is not strictly monotonic, but the overall pattern shows later-layer amplification.
- Projection effects: The complete projection pipeline reduces router-logit discrepancies by several orders of magnitude, with most displayed layers below 10−5.Several protected layers approach numerical precision.
- Projection effects: Residual deviations remain at a few layers, with the largest reaching 4.0 × 10−3 at layer 25, still substantially below direct-injection discrepancies.The residuals do not eliminate routing differences at every layer.
- Pipeline mechanism: The local null-space projection removes router-visible perturbation components, while downstream correction removes deviations reintroduced by nonlinear propagation.Together, the components target immediate and propagated sources of routing drift.
- Hyperparameter selection: Estimator-specific strengths are selected independently because the five estimators produce perturbations with different native geometries and scales.The strength is incorporated as αC rather than added as a global coefficient after projection; values are selected on held-out validation data.