语言模型中的安全对齐通过两个机制上截然不同的系统运作：拒绝神经元（控制有害知识是否被表达）和概念神经元（编码有害知识本身）。通过针对每个系统中的单个神经元，我们在横跨两个模型家族、参数量从1.7B到70B的七个模型上，展示了两种失效方向——通过抑制绕过对明确有害请求的安全防护，以及通过放大从无害提示中诱导出有害内容——且无需任何训练或提示词工程。我们的发现表明，安全对齐并非稳健地分布在模型权重中，而是由单个神经元介导，每个神经元在因果上足以控制拒绝行为——抑制任何一个被识别的拒绝神经元，就能绕过针对多种有害请求的安全对齐。
- ‡ 同等贡献
- † 马里兰大学帕克分校
- ** 在苹果公司期间完成的工作
相关阅读与更新。
VLSU：绘制面向AI安全的联合多模态理解边界
多模态基础模型的安全评估通常将视觉和语言输入分开处理，忽略了联合解读带来的风险——即原本无害的内容在组合后可能变得有害。现有方法也无法清晰区分明显不安全的内容与边缘案例，导致对真正有害内容出现过度拦截或拒绝不足的问题。我们提出了视觉语言安全理解（VLSU），一个全面的……
解耦安全适配器实现高效护栏与灵活的推理时对齐
本文已被ICLR 2026的“可信AI、可解释性、鲁棒性与跨模态安全原则设计”研讨会接收。
现有的AI安全范式，如护栏模型和对齐训练，往往在推理效率或开发灵活性上有所妥协。我们引入了解耦安全适配器（DSA），这是一个通过解耦安全特定……来应对这些挑战的新框架。
探索机器学习领域的机遇。
Safety alignment in language models operates through two mechanistically distinct systems: refusal neurons that gate whether harmful knowledge is expressed, and concept neurons that encode the harmful knowledge itself. By targeting a single neuron in each system, we demonstrate both directions of failure — bypassing safety on explicit harmful requests via suppression, and inducing harmful content from innocent prompts via amplification — across seven models spanning two families and 1.7B to 70B parameters, without any training or prompt engineering. Our findings suggest that safety alignment is not robustly distributed across model weights but is mediated by individual neurons that are each causally sufficient to gate refusal behavior — suppressing any one of the identified refusal neurons bypasses safety alignment across diverse harmful requests.
- ‡ Equal contribution
- † University of Maryland, College Park
- ** Work done while at Apple
Related readings and updates.
VLSU: Mapping the Limits of Joint Multimodal Understanding for AI Safety
Safety evaluation of multimodal foundation models often treats vision and language inputs separately, missing risks from joint interpretation where benign content becomes harmful in combination. Existing approaches also fail to distinguish clearly unsafe content from borderline cases, leading to problematic over-blocking or under-refusal of genuinely harmful content. We present Vision Language Safety Understanding (VLSU), a comprehensive…
Disentangled Safety Adapters Enable Efficient Guardrails and Flexible Inference-Time Alignment
This paper was accepted at the Principled Design for Trustworthy AI, Interpretability, Robustness, and Safety across Modalities Workshop at ICLR 2026.
Existing paradigms for ensuring AI safety, such as guardrail models and alignment training, often compromise either inference efficiency or development flexibility. We introduce Disentangled Safety Adapters (DSA), a novel framework addressing these challenges by decoupling safety-specific…