跳转至

定位安全对齐：大语言模型中MLP层与网络中部模块编码拒绝行为

文章背景与核心概要

大语言模型的安全对齐通常被视为贯穿整个网络的分布式属性，但其在实际应用中的脆弱性表明，拒绝行为可能集中在较小的一组参数中。为了探究安全对齐的拒绝机制具体编码在何处，本文作者通过将对齐模型的权重移植到匹配的未对齐基础模型中，在多个粒度上进行了深入研究。

研究结果表明，拒绝行为高度集中于多层感知机（MLP）权重和网络中部（特别是第8至11层）。具体而言，MLP权重驱动拒绝行为迁移的效果比注意力权重高出至少2.7倍。此外，安全相关组件的组合表现出非加性特征——添加更多对齐的块有时反而会降低整体的拒绝性能，而精选的块子集甚至可以超越完整的MLP移植效果。这项研究揭示了当前大语言模型中安全对齐的局部化和交互敏感性，为理解对齐脆弱性以及实施针对性的安全干预提供了重要见解。

摘要 (Abstract)

大语言模型中的安全对齐通常被视为整个网络的分布式属性，然而其实际操作中的脆弱性表明，拒绝行为可能集中在一组较小的参数中。本研究通过将对齐模型的权重以多种粒度移植到匹配的未对齐基础模型中，探讨了安全对齐的拒绝机制编码在何处。使用两个开源模型对和四个安全基准，我们开展了实验，以比较替换注意力权重、MLP权重、连续层区域以及MLP模块的效果。在两个模型系列中，拒绝迁移均由MLP权重主导：替换MLP参数比替换注意力参数能够恢复显著更多的恶意提示词拒绝能力，在各个基准测试中增益至少高出2.7倍。在MLP堆栈中，与拒绝相关的参数表现出一致的中部网络集中趋势，因为在所有六次针对模型-数据集对的贪婪搜索中，跨越第8-11层的模块总是被优先选择。结果还表明，安全相关组件的组合是非加性的：在六条贪婪搜索轨迹中的五条中，添加更多对齐的模块反而会降低拒绝性能，并且选择性的模块子集在恶意拒绝、良性过度拒绝或两者兼顾方面可以优于完整的MLP移植。最后，转移到OR-Bench的贪婪顺序随用于推导它们的源基准而变化，这表明存在依赖于基准的精度-覆盖率权衡。这些结果表明，当前LLM中的安全对齐既是局部化的又是对交互敏感的，为理解对齐脆弱性和潜在的目标安全干预途径提供了深入见解。

Safety alignment in large language models is often treated as a distributed property of the entire network, yet its practical brittleness suggests that refusal behavior may be concentrated in a smaller set of parameters. This work addresses where safety-aligned refusal is encoded by transplanting weights from aligned models into matched unaligned base models at multiple levels of granularity. Using two open-weight model pairs and four safety benchmarks, we conducted experiments to compare the effects of replacing attention weights, MLP weights, contiguous layer regions, and MLP blocks. Across both model families, refusal transfer is dominated by MLP weights: replacing MLP parameters recovers substantially more malicious-prompt refusal than replacing attention parameters, with gains of at least 2.7 times more across benchmarks. Within the MLP stack, refusal-relevant parameters exhibit a consistent mid-network concentration, as the block spanning layers 8-11 is selected first in all six greedy searches over model-dataset pairs. The results also show that the composition of safety-relevant components is non-additive: in five of six greedy trajectories, adding more aligned blocks can reduce refusal performance, and selective block subsets can outperform full MLP transplantation on malicious refusal, benign over-refusal, or both. Finally, greedy orders transferred to OR-Bench vary with the source benchmark used to derive them, indicating a benchmark-dependent precision-coverage trade-off. These results suggest that safety alignment in current LLMs is both localized and interaction-sensitive, offering insight into alignment brittleness and potential avenues for targeted safety interventions.