Can pruning neurons jailbreak LLMs? Mask2Shield adds a safety shield to LLMs

Researchers from Guangdong University of Finance and Economics, Shandong University, and the University of Southern Queensland proposed Mask2Shield (M2S), which uses masked forward alignment to keep LLMs able to refuse malicious requests even after safety neurons are pruned. During training, the method uses NeuroStrike probes to locate FFN neurons sensitive to malicious prompts, forcibly zeroes the activations of these neurons in forward propagation to simulate pruning attacks, and uses the frozen original model as a teacher to perform KL distillation on benign prompts, preserving normal question-answering ability. The researchers tested on 10 instruction-tuned models including Qwen2.5, Llama3/3.2, Gemma, Phi-4, and DeepSeek-R1-Distill-Qwen: after pruning, the original models had 80 to 279 successful attacks on 313 malicious prompts, which dropped to 1 to 44 after M2S hardening; the researchers also validated with the TwinBreak attack on HarmBench, AdvBench, JailbreakBench, and StrongREJECT.