Sparse Models, Sparse Safety: Unsafe Routing in MoE Large Language Models
Sparse Models, Sparse Safety: Unsafe Routes in Mixture-of-Experts LLMs
Quick read
Based on 论文全文 （AI 生成）; refer to the original
The researchers identify a structural vulnerability in MoE large language models called "unsafe routing": once specific sparse routing configurations are activated, they convert harmful questions that would normally be refused into harmful outputs. The authors first propose the RoSais metric to quantify the importance of each layer's router to safety, finding that safety-critical routers are concentrated in a few layers; on JailbreakBench, masking just 5 routers in DeepSeek-V2-Lite raises the attack success rate from 0.15 to 0.79, an increase of more than 4 times. They then propose the F-SOUR framework, which progressively searches for specific unsafe routes by token and layer, achieving average attack success rates of 0.90 and 0.98 on JailbreakBench and AdvBench respectively across four MoE model families: DeepSeek-V2-Lite, Mixtral-8x7B, OLMoE-1B-7B, and Qwen1.5-MoE-A2.7B.
- MoE 大模型通过 router 稀疏激活专家以降低计算成本，但此前研究多关注性能与效率，忽视了这种稀疏结构带来的安全风险。作者提出 MoE 的安全性可能与其架构一样稀疏，即存在可被利用的 unsafe routes。
- 作者先提出 RoSais 指标，量化每层 router 对安全的重要性，通过随机掩码高 RoSais 的 router 把安全输出翻转为有害输出；再提出 F-SOUR 框架，按 token 和 layer 逐层搜索具体的 unsafe route，不修改专家权重。
- 在 DeepSeek-V2-Lite 上仅掩码 5 个 router，JailbreakBench 的 ASR 从 0.15 升到 0.79；F-SOUR 在四个 MoE 模型家族上平均 ASR 达 0.90（JailbreakBench）和 0.98（AdvBench），优于 GCG、TAP、SAFEx、SteerMoE 等基线。
- 作者只评估了每个 MoE 家族的一个代表模型，RoSais 仅用 affirmative token 最大对数概率增益这一简单信号，掩码方式可能低估攻击面，F-SOUR 的随机化与尝试次数有预算限制，且方法假设可白盒访问 routing scores，可能不适用于闭源 API。
The paper treats MoE routing selection itself as an attack surface, provides a reproducible routing manipulation method, and offers a new dimension for safety evaluation of open-source MoE models.