大语言模型的脑部手术：通过专家沉默进行混合专家模型的劫持
Large Language Lobotomy: Jailbreaking Mixture-of-Experts via Expert Silencing
AI总结：
通过专家沉默技术，L$^3$攻击显著提高了MoE LLMs的劫持成功率，揭示了效率与安全之间的矛盾。
摘要：
混合专家（MoE）架构的快速采用标志着大型语言模型（LLMs）部署的重大转变。MoE LLMs通过仅激活每个token的少量参数来提高扩展效率，但其路由结构引入了新的安全攻击面。我们发现，MoE LLMs中的安全关键行为（例如拒绝）集中在少量专家中，而非均匀分布。基于此，我们提出了大语言模型的脑部手术（L$^3$），一种无需训练、架构无关的攻击方法，通过利用专家路由动态来破坏安全对齐。L$^3$学习与拒绝相关的路由模式，将安全行为归因于特定专家，并自适应地沉默最安全相关的专家，直到产生有害输出。我们在八种最先进的开源MoE LLMs上评估了L$^3$，并显示我们的自适应专家沉默将平均攻击成功率从7.3%提高到70.4%，达到最高86.3%，优于先前的无训练MoE劫持方法。此外，绕过护栏通常需要沉默少于20%的层专家，同时大致保持通用语言功能。这些结果揭示了效率驱动的MoE设计与稳健安全对齐之间的根本矛盾，并激励未来在MoE LLMs中更稳健地分布安全机制，采用架构和路由感知的方法。
英文摘要：
The rapid adoption of Mixture-of-Experts (MoE) architectures marks a major shift in the deployment of Large Language Models (LLMs). MoE LLMs improve scaling efficiency by activating only a small subset of parameters per token, but their routing structure introduces new safety attack surfaces. We find that safety-critical behaviors in MoE LLMs (e.g., refusal) are concentrated in a small set of experts rather than being uniformly distributed. Building on this, we propose Large Language Lobotomy (L$^3$), a training-free, architecture-agnostic attack that compromises safety alignment by exploiting expert routing dynamics. L$^3$ learns routing patterns that correlate with refusal, attributes safety behavior to specific experts, and adaptively silences the most safety-relevant experts until harmful outputs are produced. We evaluate L$^3$ on eight state-of-the-art open-source MoE LLMs and show that our adaptive expert silencing increases average attack success from 7.3% to 70.4%, reaching up to 86.3%, outperforming prior training-free MoE jailbreak methods. Moreover, bypassing guardrails typically requires silencing fewer than 20% of layer-wise experts while largely preserving general language utility. These results reveal a fundamental tension between efficiency-driven MoE design and robust safety alignment and motivate distributing safety mechanisms more robustly in future MoE LLMs with architecture- and routing-aware methods.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
