PaperlayerView exact revision on arXiv

Source-linked AI summary

SEAL: Reinforcing Global Safety in Mixture-of-Experts through Shared Expert ALignment

Qingyu Meng, Yiwei Zha, Jiahuan Pei, Koen Hindriks, Herbert Bos, Min Chen

arXiv:2609.02293v1cs.LGcs.AIcs.CR

TL;DR

MoE safety is vulnerable because adversaries can manipulate or bypass sparse routing to avoid safety-critical experts. The paper reinforces always-active shared experts with SEAL and SEAL++, reporting reduced attack success with small capability cost, while noting scope and evaluation limitations.

  • Problem

    Sparse routing makes MoE safety depend on which experts are activated, leaving harmful prompting, malicious fine-tuning, and neuron pruning as attack surfaces that router-focused defenses may not fully address.

  • Method

    SEAL trains DPO-based LoRA adapters restricted to shared-expert projections, and SEAL++ adds an orthogonal constraint preserving pre-existing safety-critical subspaces.

  • Results

    Across four architectures and multiple attack scenarios, SEAL provides consistent safety gains at negligible utility cost and can compose with router-level defenses.

  • Takeaways & Limitations

    Shared experts provide a practical router-independent surface for anchoring safety alignment in hybrid MoE architectures.

  • Takeaways & Limitations

    Models lacking shared experts fall outside scope, protection may be limited when safety is distributed across routed experts, and mechanism-level adversaries exploiting the CSE mask are not evaluated.

Abstract

from arXiv · show

Mixture-of-Experts (MoE) is a scaling architecture for large language models that activates only a small subset of expert modules per token, enabling massive parameter growth with nearly constant computation. Recent Hybrid MoE architecture adds \textit{shared experts} to capture consistently useful representations, further improving stability and generalization. MoE now powers many flagship open-source and commercial models, yet remains vulnerable to adversarial attacks. Specifically, sparse routing introduces a structural vulnerability: MoE safety hinges on which experts are activated, and adversaries can subvert this selection through jailbreak prompts, malicious fine-tuning, and weight-level pruning of safety-critical neurons. Existing defenses primarily focus on hardening the router, but an adversary may still manipulate or bypass the routing trajectory due to the routing process's nondeterministic nature, thereby collapsing the defense. To cope with this problem, we first identify theoretically and empirically that shared expert, an always-activated component containing a small proportion of safety-critical neurons, can overcome the uncertainty of sparsely activated routing path and serve as a router-independent anchor to enhance global safety alignment. Based on this insight, we propose SEAL, a training-time parameter-efficient defense that produces a plug-and-play adapter attached to shared expert, and SEAL++, a variant that adds an orthogonal constraint preserving pre-existing safety subspaces during training. We evaluate SEAL and SEAL++ across six attack scenarios that combine three adversarial inputs (harmful prompting, jailbreak, malicious fine-tuning) with and without neuron pruning. SEAL reduces attack success rate (ASR) by up to 60\%, at a capability cost of at most 1.4\% on a five-benchmark average. Additionally, SEAL can seamlessly integrate with router-level ......

1 Introduction

MoE scales language models through sparse expert routing, but this routing creates a safety vulnerability because adversaries can manipulate which experts are activated. The paper identifies always-active shared experts as a router-independent safety surface and proposes SEAL and SEAL++ to reinforce it.

  • Motivation: MoE activates only a small subset of experts per token, allowing parameter counts to grow while per-token computation remains roughly constant.The architecture underlies widely deployed models, including GPT-OSS, Llama 4, Qwen3.5, Nemotron-3, and Mixtral.
  • Motivation: Sparse routing makes safety depend on expert selection, enabling harmful prompts, malicious fine-tuning, and pruning attacks to degrade safety.These attacks target routing distributions, model parameters, or safety-critical neurons.
  • Motivation: Existing router-level and routed-expert defenses remain dependent on the router delivering tokens to safety-relevant experts.They therefore do not fully address adversaries that manipulate or bypass routing.
  • Key insight: Shared experts contain safety-relevant neurons at a shared-to-routed density ratio between 0.63 and 0.89 across four models while executing on every token.Their unconditional execution leaves their safety contribution active regardless of routing state.
  • Proposed defenses: SEAL trains DPO-based LoRA adapters on shared-expert projections, while SEAL++ adds an orthogonal constraint preserving pre-existing safety-critical directions.SEAL modifies only ∼0.25% of model parameters, and the methods use parameters distinct from those targeted by router-level defenses.

2 Preliminaries

MoE replaces selected dense feed-forward layers with routed experts, while hybrid MoE additionally includes shared experts that execute for every token. This unconditional execution creates the routing-independent structural basis for the paper’s defense surface.

  • Transformer and MoE Architectures: Dense Transformers use all feed-forward parameters on every forward pass, directly coupling parameter count to per-token computation.MoE decouples these quantities by conditionally activating experts.
  • Transformer and MoE Architectures: An MoE router assigns scores to E experts and activates the top-k experts for each token, with k ≪ E.Different tokens therefore traverse different subsets of model parameters.
  • Hybrid MoE and Shared Experts: A hybrid MoE partitions feed-forward capacity into shared and routed experts with distinct execution conditions.The shared-expert component is introduced alongside routed expert modules.
  • Hybrid MoE and Shared Experts: Shared experts execute unconditionally on every token, whereas routed experts activate only when selected by the router.This structural asymmetry makes shared experts a unique router-independent defense surface.

3 Threat Model

The threat model orders adversaries by escalating privileges: black-box prompt access, attacker-controlled fine-tuning, and direct parameter editing. These capabilities enable distinct routes to undermine safety through prompts, gradients, or neuron pruning.

  • Adversary capabilities: Ainput allows black-box attackers to submit arbitrary prompts and observe outputs while lacking detailed access to architecture, weights, or routing.Prompt injection and jailbreaks may shift routing away from safety-critical experts.
  • Adversary capabilities: Atrain gives attackers model weights and a training framework for supervised fine-tuning on harmful instruction-response data.This can modify routed experts and corrupt refusal behavior across the parameter space.
  • Adversary capabilities: Aweight permits direct reading and editing of model parameters without gradient-based training.Attackers can profile activations, identify safety-critical neurons, and mask them at inference time.
  • Pruning attacks: Selective neuron pruning can substantially degrade safety while preserving general capability, making weight-level attacks practical for local or inference-only deployments.The scenario includes malicious weight surgery, red-team ablation, and post-training sparsification.
  • Defense requirements: The defense design requires training-time white-box access, a safe-versus-unsafe preference dataset, and lightweight parameter-efficient modules while preserving utility.These requirements define the defender’s operating conditions.

4 Our Method

SEAL targets shared experts as a router-independent safety surface because they execute on every token, while restricting training to a compact parameter subset. SEAL++ additionally preserves identified safety-critical neuron subspaces with an orthogonal constraint.

  • Motivation: Shared experts execute on every token regardless of routing, providing a safety fallback that remains active when the router is compromised.This complements router-dependent defenses by adding a defense surface whose execution does not depend on routing state.
  • Motivation: Safety augmentation in shared experts reduces exposure to routing manipulation while avoiding updates to routing weights and routed experts.Shared experts are compact, and restricting updates helps avoid introducing routing perturbations or representation conflict with task-specific knowledge.
  • SEAL: SEAL restricts LoRA adaptation to shared-expert projection layers and freezes all other parameters.The method attaches low-rank adapters to shared expert projections, leaving the router and routed experts untouched.
  • SEAL: SEAL trains the adapters with DPO on safety preference triples using the frozen base model as the implicit reference policy.The training procedure attaches adapters, freezes other parameters, disables the adapters to obtain the reference policy, and optimizes DPO.
  • SEAL++: SEAL++ adds an orthogonal constraint that penalizes updates projecting onto identified safety subspaces.The constraint protects pre-existing safety-critical representations; these neurons typically comprise 1–3% of the intermediate dimension.

5 Evaluation

The evaluation tests SEAL and SEAL++ across four hybrid MoE architectures, multiple attack scopes, and capability benchmarks. Shared-expert training generally improves safety across direct, compound, and malicious-fine-tuning attacks while preserving capability, but transfer depends on where safety is concentrated.

  • Evaluation setup: The evaluation covers four hybrid MoE architectures, four scope settings, direct and compound attacks, and five capability benchmarks.Methods are compared as Original, SEAL, and SEAL++ across no-attack, shared-only, routed-only, and shared+routed settings.
  • Direct attacks: SEAL lowers harmful-prompt ASR on every architecture, including DeepSeek from 61.3% to 8.5% (−52.8%).Reductions are also reported for Qwen1.5, GLM, and Qwen3.5, with architecture-dependent magnitudes.
  • Malicious fine-tuning: Defended models retain lower post-MFT ASR than Original on every architecture after fine-tuning on 300 harmful examples.For example, Qwen3.5 SEAL reaches 47.1% versus 53.2% for Original, while GLM SEAL++ reaches 58.5% versus 77.8%.
  • Compound attacks: SEAL++ retains substantial advantages under compound attacks, including a DeepSeek gap of 56.4% at both-scope and a Qwen1.5 reduction from 94.1% to 44.7% under MFT+pruning.The defense remains effective when attackers concentrate pruning on unprotected components.
  • Cross-architecture limitations: On Qwen3.5, routed-scope ASR increases from 5.9% to 13.2% under defense, while baseline and shared-scope safety improve.This reflects safety concentration in routed experts and limits transfer from shared-expert augmentation.
  • Cross-scope transfer: Shared-expert-only training transfers to routed-scope attacks, reducing DeepSeek ASR from 74.2% to 14.0% under SEAL++ without updating routed experts.GLM shows the same pattern, with routed-scope ASR decreasing from 48.0% to 21.7%.
  • Ablation: Shared-expert training is indispensable in the ablation: routed-only training fails to meaningfully reduce both-scope ASR, whereas adding routed experts to SEAL yields further improvement.On Qwen1.5, SE updates only 0.25% of parameters yet reduces harmful base-scope ASR from 27.5% to 13.1%.

6 Related Work

Related work addresses MoE safety through attack analysis, router hardening, routed-expert repair, and modular fine-tuning. SEAL extends modular adaptation by targeting shared experts specifically for safety augmentation with orthogonal subspace constraints.

  • MoE Safety Attacks: MoE safety attacks vary by attacker access, component-location mechanism, and intervention applied after safety-relevant components are identified.The reviewed attacks include input-only jailbreaks, routing probes, and weight-level interventions.
  • MoE-Specific Defenses: Existing MoE-specific defenses include KL-based routing alignment and selective repair of safety-critical routed experts.These approaches seek to preserve safety-expert activation or prevent unsafe routing bypasses.
  • Modular MoE Fine-Tuning: Modular MoE fine-tuning studies selectively adapt experts or pathways to reduce cost while preserving task performance.The literature also distinguishes shared experts’ high-frequency linguistic features from routed experts’ domain-specific knowledge.
  • Comparison framework: Table 7 compares prior approaches by MoE-specific design, neuron-level granularity, and router-independent operation.These dimensions frame the positioning of the proposed defense.

7 Discussion

The discussion finds that shared-expert safety training often transfers across attack scopes with low capability cost, but its reach depends on shared-expert size and safety concentration. The authors identify architectural and evaluation boundaries and outline extensions toward dual-path shared experts.

  • Cross-scope transfer: Shared-expert-only training typically lowers pruning ASR by a factor of three to four across attack scopes on DeepSeek, GLM, and Qwen1.5.Qwen3.5 is a limit case because its shared expert has only d_ffn=512 neurons.
  • Cross-scope transfer: On Qwen3.5, shared-expert training helps direct attacks but may trail the undefended model under routed or both-scope prompt-level compound attacks.The small shared expert cannot offset pruning damage concentrated in routed experts.
  • Capability cost: Restricting updates to shared experts keeps capability cost within one point on the five-benchmark average by leaving routed task knowledge untouched.The authors contrast this property with full-model alignment.
  • Limitations: SEAL is architecturally compatible with router hardening, input filtering, and post-hoc projection, but empirical validation of these compositions remains future work.Models without shared experts, such as Mixtral, are outside the study’s scope.
  • Future work: Future work proposes dual-path shared experts that dedicate some shared capacity to safety while preserving general-purpose roles elsewhere.The discussion also calls for richer safety-neuron identification and broader evaluation.

8 Conclusion

The paper identifies shared experts as a router-independent safety surface and introduces SEAL and SEAL++ to reinforce alignment through lightweight adapters. Across multiple architectures and attacks, the defenses provide consistent safety gains while preserving utility and composing with router-level protection.

  • Conclusion: Shared experts provide a router-independent surface for anchoring safety alignment in hybrid MoE architectures.They are overlooked safety components previously studied for knowledge aggregation.
  • Conclusion: SEAL and SEAL++ reinforce shared-expert parameters with lightweight LoRA adapters while leaving routing and routed experts untouched.SEAL++ adds an orthogonal constraint to the shared-expert alignment procedure.
  • Conclusion: Across four architectures spanning 14B to 35B parameters and three safety-misalignment operations, SEAL provides consistent safety gains at negligible utility cost.The evaluated operations are prompt injection, malicious fine-tuning, and neuron-level pruning.
  • Conclusion: Shared experts establish a practical defense surface for enhancing MoE safety alignment and can compose with router-level defenses for layered protection.The conclusion presents this as the combined implication of the reported results.

Ethical Considerations

The work studies adversarial attacks on language-model safety using published attacks applied to the authors’ own models in controlled settings. It uses profiling datasets solely for activation analysis and does not deploy harmful outputs.

  • Ethical Considerations: All attacks come from published academic work and are applied exclusively to the authors’ own models in controlled settings.The paper notes that some adversarial contents may be offensive in nature.
  • Ethical Considerations: Profiling datasets AdvBench and HarmBench are used solely for activation analysis.The paper states that no harmful outputs were deployed.

Open Science

The paper documents its notation, datasets, training setup, computational environment, and pruning-cost analysis. It reports that SEAL++ increases pruning cost on DeepSeek and Qwen1.5 while preserving original safety-neuron identity in those models.

  • Open Science: SEAL training uses LoRA rank r=64, scaling factor α=128, three epochs, learning rate 5×10^-5, batch size 16, and DPO temperature β=0.1.The safety-subspace rank is r_s=32, and SEAL++ uses λ_orth=0.1 unless otherwise stated.
  • Open Science: The paper releases notation and dataset documentation, including distinct profiling and training sources and disjoint jailbreak and capability evaluation sets.Table 8 summarizes notation, while Table 9 describes dataset phases and separation.
  • Open Science: The experiments use bf16 on Qwen1.5-MoE-A2.7B, GLM-4.7-Flash, and Qwen3.5-35B-A3B, and fp32 on DeepSeekMoE-16B.Qwen1.5 and DeepSeek use 2× NVIDIA H100 GPUs; GLM and Qwen3.5 use 4× H100.
  • Open Science: γ≥4.3 on DeepSeek raises the pruning cost amplification factor, with ASR of 17.3% versus 73.7% at the both scope.On Qwen1.5, the same both-scope quantity changes from 26.3% to 16.6% with γ≥1.6.
  • Open Science: SEAL++ preserves original safety neurons, with Jaccard overlap above 0.83 on Qwen1.5 and DeepSeek.The proposed mechanism penalizes updates to safety-critical dimensions while allowing additional safety signal in unconstrained dimensions.
  • Open Science: Safety-critical neurons constitute approximately 3% of total neurons, motivating pruning-based vulnerability analysis.The paper identifies these neurons through activation differentials and a z-score threshold ζ>0, default ζ=2.0.

F Representational Analysis

Representational analyses indicate that SEAL preserves safety separability and harmful-benign structure, although representational similarity varies across architectures. The defense also incurs low computational and storage overhead and introduces no additional inference FLOPs after adapter merging.

  • Safety concept separability: >96% probe accuracy separates harmful from benign inputs across all layers and conditions, with average accuracy changing by less than 0.2% after SEAL training.This indicates that safety concepts remain linearly decodable from shared-expert representations.
  • Representational similarity: CKA remains 0.97 on Qwen1.5 and DeepSeek, while GLM reaches 0.38–0.66 and Qwen3.5 reaches 0.76–0.78.The lower CKA values on deeper architectures are accompanied by near-perfect probe accuracy.
  • Embedding visualization: UMAP projections maintain or improve harmful-benign cluster structure across all four architectures, with silhouette scores stable or increasing.The analysis reports that training does not collapse the activation space.
  • Safety-neuron identity preservation: Mean safety-neuron Jaccard overlap is 0.91 for Qwen1.5, 0.83 for DeepSeek, 0.59–0.79 for GLM, and 0.45–0.47 for Qwen3.5.GLM shows more neuron identity preservation with SEAL than SEAL++, while Qwen3.5 has the lowest overlap.
  • Computational overhead: SEAL++ adds roughly 35 GFLOPs per step for Qwen1.5-MoE and 20 GFLOPs for DeepSeekMoE, under 0.02% of the DPO pass.Trainable parameters are 0.22–0.25% of total parameters, and merged adapters add zero inference FLOPs.
  • Computational overhead: Safety-subspace bases require at most 21.2 MB of storage alongside the adapter checkpoint.The overhead analysis concerns lightweight deployment of the safety-subspace bases.

I Sensitivity Analysis

The orthogonal-constraint analysis finds architecture-dependent ASR effects at selected weights, while Qwen1.5 remains insensitive across a broader sweep and capability changes stay small. Interpretability analysis further indicates that safety concept separability is preserved.

  • Full-training ablation: Raising λorth from 0.1 to 1.0 reduced DeepSeek shared-scope ASR from 21.5% to 8.8%, with marginal changes on other scopes.The reported effect was architecture-dependent and suggested concentration of safety representations in the shared-expert subspace.
  • Capability: Average capability across benchmarks varied by at most 1.8% from Original across models and defense methods.Table 11 reports per-benchmark capability for all evaluated models and defense methods.
  • Fine-grained sweep: Across seven λorth values from 0.01 to 10.0, pruning-attack ASR and MMLU accuracy on Qwen1.5 remained effectively constant.The sweep used a 500-step training proxy representing 26% of the full training run.
  • Interpretability: Linear probing and CKA analyses across four architectures indicate that all methods preserve safety concept separability.

J Training Dynamics of Routed and Shared Experts

Training dynamics show higher DPO reward margins for shared-expert conditions than routed-only conditions on Qwen1.5. The figure evidence links this margin gap to stronger defense performance, while other analyses examine constraint sensitivity and neuron identity.

  • Reward margins: R-top3 reward margins plateaued lower than shared-expert conditions, consistent with weaker defense in Table 6.Joint shared-plus-routed conditions tracked shared-expert training closely.
  • Reward margins: Shared-expert training reached a final DPO reward margin of 5.3, versus 3.3 for routed-only R-top3.R-top3 developed margins 38% lower than SE under a matched parameter budget.
  • Constraint sensitivity: Pruning-attack ASR and MMLU accuracy remained constant across three orders of magnitude of λorth on Qwen1.5-MoE.The figure reports mean ±1σ across individual attack configurations.
  • Neuron identity: Qwen1.5 and DeepSeek preserved more than 80% of safety-neuron identity after training when safety encoding was concentrated in shared experts.Qwen3.5 showed substantially more redistribution.
  • Neuron identity: Figure 7 compares per-layer Jaccard overlap of safety-neuron identity before and after training across four architectures.
Loading 2609.02293v1…