Large Language Lobotomy: Jailbreaking MoE Models via Silent Experts
Large Language Lobotomy: Jailbreaking Mixture-of-Experts via Expert Silencing
Quick read
Based on 论文全文 （AI 生成）; refer to the original
The paper proposes L3, a training-free, architecture-agnostic jailbreak method that bypasses safety alignment by identifying and silencing the experts critical to refusal in MoE models. The method first classifies expert routing trajectories with an LSTM, then locates safety experts via gradient attribution, and adaptively silences the top-ranked experts at inference time. On eight open-source MoE models, the average attack success rate rises from 7.3% to 70.4%, reaching up to 86.3%; most models need fewer than 20% of in-layer experts silenced to bypass guardrails, and general language ability drops by 3.5% on average. On six of the eight models, L3 achieves a higher attack success rate than the previous GateBreaker.
- MoE 大模型只激活少量专家，作者发现安全行为（如拒答）集中在少数专家而非均匀分布，这带来新的攻击面：攻击者若能定位并关闭这些专家，就可能绕过安全对齐。
- 提出 L3，一种免训练、与架构无关的越狱框架：先记录专家路由轨迹，用轻量 LSTM 区分良性/恶意路由序列，再通过梯度归因定位安全专家；随后在推理时自适应地把最相关的专家 logit 置为负无穷，直到模型输出有害内容。
- 在八个开源 MoE 模型上，自适应专家静默把平均攻击成功率从 7.3% 提升到 70.4%，最高达 86.3%；多数模型静默不到 20% 的层内专家即可绕过拒答，且通用语言能力下降有限；相比 GateBreaker 在八个模型中的六个上更高。
- 作者指出安全能力集中与 MoE 的专家专业化目标存在根本冲突，强制冗余可能损害性能；防御可考虑专家完整性检查或独立验证器，但会增加开销；L3 目前是白盒设定，黑盒迁移留作未来方向。
The paper reports attack success rates for expert silencing on eight open-source MoE models and points out the structural weakness that safety capabilities are concentrated in a small number of experts.