PaperlayerView exact revision on arXiv

Source-linked AI summary

SEDATE: Do Large Language Models Share an Aggression Circuit Across Languages?

Sagnik Basu, Sayan Das, Somnath Banerjee, Animesh Mukherjee

arXiv:2610.33542v1cs.CLcs.AI

TL;DR

The paper addresses limited understanding of whether harmful generation across languages relies on shared or language-specific internal mechanisms. It introduces SEDATE, a training-free framework that detects aggression-related neurons and conditionally edits generation. Across seven languages and four model families, it reports better safety than strong baselines while retaining general capabilities, with similar trends on unseen languages and additional datasets.

  • Problem

    Existing methods can be data- and compute-intensive or vulnerable to adversarial reformulations, and prior work offers limited understanding of whether harmful generations across languages arise from shared or language-specific mechanisms.

    Source: §1 · p. 1

  • Method

    SEDATE is a training-free, token-level framework that conditionally suppresses identified neurons, redirects the residual stream, and can fall back to refusal.

    Source: OUR CONTRIBUTIONS · p. 2, §4.2 · p. 4

  • Results

    Across 7 languages and 4 model families, SEDATE outperforms the unintervened model and strong baselines while retaining general capabilities, with similar trends across 4 unseen languages and 4 additional datasets.

    Source: §7 · p. 8

  • Takeaways & Limitations

    The identified cross-lingual aggression-sensitive neurons form a shared internal target that SEDATE uses as both an aggression indicator and a corrective intervention target.

    Source: §7 · p. 8

Abstract

from arXiv · show

As the applications of AI continue to expand across various multimodal and multilingual domains, ensuring safe and responsible deployment of these systems has become an important concern. A wide-range of interventions have been proposed to make AI responses safer and more reliable. They often incur substantial computational or annotation costs, or cannot be extended to multilingual settings. In this work, we propose Selective Detection And Targeted Editing (SEDATE), a training-free approach based on detect-edit-verify strategy. SEDATE first detects the responsible neurons, edits them as and when necessary and finally verifies the model responses; all without any additional model training. We evaluate SEDATE across 7 languages and 4 model families. We further evaluate its effectiveness across 4 out-of-distribution languages and 4 additional datasets. We show that SEDATE achieves substantially superior safety scores across all languages and models over the best-performing baseline while retaining the general capabilities and incurring negligible overhead. Our results are robust, with the trends remaining similar for out-of-distribution languages and datasets.

1 Introduction

The introduction asks whether multilingual aggressive generation uses shared or language-specific neurons, a question framed as relevant to interpretability and safety control. It presents SEDATE as a training-free, conditional intervention built around aggression-sensitive neurons.

1 Introduction

  • Existing safety methods can require substantial curated data and compute, while prompt defenses can remain vulnerable; prior inference-time work offers limited insight into cross-language mechanisms.The introduction frames this gap as a question of whether harmful generations arise from shared or language-specific internal mechanisms.Source: §1 · p. 1

RESEARCH QUESTION

  • The paper asks whether aggressive generation relies on different neurons across languages or a shared set, with implications for a common control target versus language-specific interventions.The introduction connects the question to interpretability and safety control.Source: RESEARCH QUESTION · p. 1
  • SEDATE monitors an aggression signal at each decoding step, intervening only above a threshold through neuron suppression and residual-stream redirection, with refusal after persistent elevation.The signal threshold is calibrated on benign validation data; below threshold, generation proceeds without modification.Source: RESEARCH QUESTION · p. 2

OUR CONTRIBUTIONS

  • The contributions identify aggression-selective neurons with AAPE, define CLAO to find a shared cross-lingual core, and propose a training-free token-level framework combining suppression, redirection, and fallback refusal.The evaluation examines the neurons as indicators and intervention targets and considers the safety–utility trade-off across multiple languages.Source: OUR CONTRIBUTIONS · p. 2

2 Related work

Related work covers multilingual safety failures and inference-time representation interventions. SEDATE is positioned as extending cross-lingual neuron research to aggression, using a shared core as both detector and intervention target.

Multilingual safety, alignment, and attacks

  • Prior work documents uneven multilingual safety and bypasses through translated or reformulated harmful requests, while common training-based defenses are data- and compute-heavy and prompt defenses remain vulnerable.The authors distinguish documenting where multilingual safety breaks from explaining why.Source: §2 · p. 2

Interventions, interpretability, and cross-lingual neurons

  • SEDATE builds on inference-time representation interventions and neuron-level interpretability, extending prior cross-lingual neuron findings to an aggression-selective core used as both detector and intervention target.The passage cites language-specific neurons (Tang et al., 2024; Kojima et al., 2024), low-resource transfer (Xu et al., 2025), and shared cross-lingual safety (Zhang et al., 2026).Source: §2 · p. 2

3 Preliminaries

The preliminaries define neuron activation and AAPE-based aggression selectivity, then use language-specific neuron sets to form a cross-lingual core. The framework also defines an aggression signal for monitoring that core.

3 Preliminaries

  • AAPE compares a neuron's activation probabilities on aggressive and non-aggressive corpora, using their normalized pair's binary entropy to characterize selectivity.Low entropy indicates the neuron fires almost exclusively on one corpus; preference for aggressive content makes it aggression-selective.Source: §3 · p. 3
  • The aggression neuron set contains the k lowest-entropy neurons among those that prefer aggressive content, with k determined by manipulation ratio ρ.The selection is computed from per-language corpora in the multilingual setting.Source: §3 · p. 3
  • CLAO measures agreement between language-specific aggression-neuron sets, while their intersection forms the core of neurons selective for aggression in every target language.SEDATE monitors this core in multilingual deployment.Source: §3 · p. 3
  • The aggression signal is the mean rectified activation over a neuron set at a decoding prefix, indicating whether the model is leaning toward aggressive content.The passage notes that this signal can be read during the forward pass with almost no cost.Source: §3 · p. 3

4 SEDATE: Selective detection and targeted editing

SEDATE replaces blunt static masking with a detect-edit-verify strategy that intervenes only when an aggression signal crosses a calibrated threshold. Offline calibration defines the signal, steering direction, and refusal fallback; online inference leaves below-threshold generation untouched and edits or refuses when needed.

4 SEDATE: Selective detection and targeted editing

  • Static masking modifies the model even on harmless content and removes an aggressive signal without specifying a safer alternative.SEDATE instead acts only when the signal exceeds its calibrated threshold.Source: §4 · p. 3, DETECT, EDIT, VERIFY · p. 3

DETECT, EDIT, VERIFY

  • SEDATE requires no fine-tuning; its components are computed offline from the corpora used to identify the monitored neurons.When editing is triggered, neurons are softly scaled down rather than zeroed, alongside the residual-stream steering step.Source: DETECT, EDIT, VERIFY · p. 3

4.1 Offline calibration

  • At each decoding step, the aggression signal determines whether generation passes unchanged, receives an edit, or reaches refusal.Figure 1(b) depicts this pass/edit/refuse decision using the signal read from the shared core.Source: §4.1 · p. 4, Figure 1 · p. 4
  • The trigger threshold is calibrated from the aggression signal on held-out non-aggressive validation data, while steering vectors encode the non-aggressive-minus-aggressive residual-stream direction.Thresholds may be calibrated per language or globally; the refusal template is a fixed string that bypasses the language model.Source: §4.1 · p. 4

4.2 Online inference

  • Above threshold, SEDATE jointly suppresses monitored neurons and steers the residual stream toward a non-aggressive representation; persistent over-threshold signals trigger a refusal template.The verification loop returns the template after the signal remains high beyond a patience window.Source: §4.2 · p. 4

5 Experimental setup

The experiments build multilingual aggressive and non-aggressive corpora, evaluate base and instruction-tuned models, and compare SEDATE with prompt-based and inference-time baselines. They also test transfer to additional datasets and languages using multiple safety metrics.

5.1 Datasets

  • The base corpora contain 3,745 aggressive and 4,577 non-aggressive examples after translations are filtered for at least 90% back-translation similarity.The source is TechHazardQA; a well-guardrailed LLM generates the non-aggressive corpus.Source: §5.1 · p. 5

5.2 Models

  • Evaluation covers Llama 3.1 8B, Mistral 7B v0.3, and Qwen2.5 7B, each in base and instruction-tuned forms.For each model, the authors identify aggression neurons and dynamically edit their activations.Source: §5.2 · p. 5

5.3 Baseline methods

  • The baselines are safe prompting, Safety arithmetic, and Soteria with language-specific function vectors; training-based methods are out of scope.Safety arithmetic and Soteria are inference-time interventions.Source: §5.3 · pp. 5–6

5.4 Out-of-distribution (OOD) experiments

  • Robustness tests apply the original neuron set to four additional datasets and four OOD languages, including Korean, Portuguese, Russian, and Arabic.The additional datasets are HarmEval, HarmfulQA, HEx-PHI, and XThreatBench.Source: §5.4 · p. 6

5.5 Metrics

  • Safety is measured with length-normalized Beaver cost-model scores and Llama Guard unsafe rates, with Gemini pairwise judging SEDATE against safe prompting.Lower Beaver cost relative to the unmodified model indicates safer responses; unsafe-rate changes are reported relative to that model in Appendix E.Source: §5.5 · p. 6

6 Results

SEDATE improves safety across models and languages, including held-out datasets and languages, while human ratings indicate that safety gains do not come at the cost of coherence. General capabilities largely remain close to the unintervened model, with exceptions on some benchmarks and models.

6.1 Safety evaluation on TechHazardQA

  • SEDATE outperforms all baselines across seven models and seven languages on TechHazardQA, with larger average reductions on base than instruct models.The average reduction is 0.20 points for base models versus 0.16 points for instruct models.Source: §6.1 · pp. 6–7, Table 1 · p. 7

6.2 Out-of-distribution evaluation

  • With Score, steering vectors, and threshold θ fixed from TechHazardQA, SEDATE improves safety on unseen datasets and languages, with only a modest drop on held-out languages.The unseen datasets are HarmfulQA, HarmEval, XThreatBench, and HexPhi.Source: §6.2 · p. 7, Table 2 · p. 7, Table 3 · p. 8

6.3 Human evaluation

  • In a 70-pair human study across seven languages, SEDATE was at least as safe as safe prompting on 76% of prompts and at least as coherent on 66%.Each language contributed 10 prompts; annotators judged safety and coherence.Source: §6.3 · p. 8, Table 4 · p. 8

6.4 General capability evaluation

  • SEDATE stays within 0.11 points on Belebele for six of seven models and within 0.23 points on GSM8K, MNLI, and SQuAD, with larger exceptions on Mistral-base Belebele and CNN/DailyMail.CNN/DailyMail ROUGE drops by up to 7.6 points; the passage attributes this to violence or crime in news activating aggression neurons.Source: §6.4 · p. 8

7 Conclusion

The conclusion reports a cross-lingual set of aggression-responsive neurons and presents SEDATE as a training-free intervention using that set. Across the reported evaluations, SEDATE improves safety while retaining general capabilities and coherence.

7 Conclusion

  • AAPE and CLAO identify a cross-lingual set of aggression-selective feed-forward neurons, which the paper describes as a largely language-invariant circuit.SEDATE monitors the neurons, suppresses them and steers the residual stream when a calibrated threshold is crossed, with refusal as a fallback.Source: §7 · p. 8
  • Across seven languages and four model families, SEDATE outperforms the unintervened model and strong baselines while retaining general capabilities, and generalizes to four unseen languages and four additional datasets.The conclusion also reports preserved coherence in human evaluation.Source: §7 · p. 8

A General capability results

The appendix evaluates SEDATE against the unintervened model on five capability benchmarks across seven models. It also provides the safe prompt and the instructions used for pairwise LLM judging.

A General capability results

  • The capability evaluation uses five benchmarks, with accuracy for Belebele, MNLI, and GSM8K, F1 for SQuAD, and ROUGE-L for CNN/DailyMail.The same core neuron set and unchanged hyperparameters are used across seven models.Source: A General capability results · p. 11, Table 5 · p. 12

B Safe prompt

  • The safe prompt instructs the assistant to answer in the question’s language, be precise and concise, and avoid harmful or misleading content.It wraps the user query with the responsible-answering instruction.Source: SAFE PROMPT · p. 11, B Safe prompt · p. 11

C LLM-as-a-judge prompt

D LLM-as-a-judge results

The LLM-as-a-judge comparison favors SEDATE over safe prompting overall. The reported Aya-instruct results also show a sizable SEDATE advantage among non-tied comparisons.

D LLM-as-a-judge results

  • SEDATE receives a 64.61% overall win rate against safe prompting, compared with the best baseline’s 13.69%.The judge prioritizes safety before coherence and relevance.Source: D LLM-as-a-judge results · p. 12, Table 6 · p. 12
  • For Aya-instruct, SEDATE wins 40.71% of comparisons versus 8.60% for safe prompting, while 50.69% are ties.The passage attributes the frequent ties to saturated safety refusal rates.Source: D LLM-as-a-judge results · p. 12

E Unsafe rate results

Across evaluated models and languages, SEDATE substantially reduces unsafe generations, including for instruction-tuned models. The reductions span all seven target languages.

E Unsafe rate results

  • SEDATE substantially reduces unsafe generations across evaluated models and languages, according to Llama Guard 3.The unsafe rate is the percentage of outputs flagged as “Unsafe.”Source: E Unsafe rate results · p. 12
  • Absolute unsafe-rate reductions exceed 50 percentage points in several cases for Mistral-base and Llama-base.Instruction-tuned models also show gains, including a 40.12% absolute reduction for Mistral-instruct in English and up to 14.60% for Llama-instruct in Japanese.Source: E Unsafe rate results · p. 12
  • Unsafe-rate reductions across all seven target languages indicate that the shared cross-lingual neuron set mitigates harm across languages.The authors also report that SEDATE patches residual vulnerabilities left by standard safety fine-tuning.Source: E Unsafe rate results · p. 13

F Discussion

SEDATE reduces the monitored aggression signal across languages, with the largest safety improvements coinciding with the most complete gap elimination in the Mistral models. The discussion examines both the aggressive-versus-benign gap and the signal’s distribution.

F Discussion

  • The discussion compares α on unmodified and intervened forward passes to assess whether SEDATE reduces the signal it monitors.The signal is computed once without intervention and once with suppression and steering applied.Source: F Discussion · p. 13
  • After intervention, the positive aggressive-versus-non-aggressive α gap shrinks in every model and language, nearly vanishing for both Mistral models.Before intervention, gaps range from roughly 0.04 to 0.10; the Mistral models, with the most complete gap elimination, also have the largest safety improvements among base and instruct models, respectively.Source: F Discussion · p. 13
  • For Mistral-base, the intervened α curve lies below the raw curve at every percentile, indicating a downward shift across the distribution.In English, α drops by roughly two-thirds at the median, from about 0.135 to 0.045, and by about 63% at the 99th percentile, from 0.235 to 0.086.Source: F Discussion · p. 13

G Computing infrastructure

  • Figure 2 presents mean α gaps before and after intervention across seven languages, while Figure 3 plots Mistral-base aggression-signal percentile curves.Figure 3 specifies γ = 0.5 and β = 0.05, distinguishing the raw first pass from the intervened second pass.Source: Figure 2 · p. 14, Figure 3 · p. 14

Related papers

Loading 2610.33542v1…