对拒绝的忠实性：神经元选择器的因果审计
Faithfulness to Refusal: A Causal Audit of Neuron Selectors
AI总结：
针对归因分数识别神经元行的因果有效性未经验证的问题，通过单次神经元行置零的配对审计，验证归因方法在识别冗余行、实现安全拒绝行为上的因果有效性，揭示排序稳定性不能代表因果有效性。
摘要：
归因分数越来越多地用于确定语言模型中哪些神经元行对剪枝、可解释性和安全编辑等应用至关重要，但这类分数是否能识别出具有因果重要性的神经元行，很少得到直接验证。我们基于单次神经元行置零操作设计了两组配对审计来解决这一问题。首先我们在语言建模层面审计选择器：在五款大语言模型上，归因方法识别非必要神经元行的表现大幅优于基于激活值和幅值的基线方法。随后我们将同一干预手段改造为行为测试，使用有害-良性对比信号驱动测试：经归因得到的神经元行足以让模型生成针对仇恨和犯罪内容的拒绝回复，同时将良性场景下的过度拒绝率维持在低位，还能保留语言模型的流畅性，且该效果具有特异性——相同深度的层匹配随机对照组无法实现该效果。排名高度稳定的选择器反而可能属于因果有效性最差的序列。此外，拒绝行为存在于一个冗余子空间中，不同归因方法可通过几乎互不相交的神经元行集实现拒绝功能，因此得到的编辑结果是充分集的一种实现形式，而非唯一机制。上述结果表明，排序稳定性这类代理指标无法捕捉直接因果审计能够发现的各类选择器失效问题。
英文摘要：
Attribution scores increasingly identify which neuron rows of a language model matter for applications such as pruning, interpretability, and editing for safety, yet whether they identify causally important rows is rarely tested directly. We address this with two paired audits built on one-shot neuron-row zeroing. We first audit selectors at the language-modeling level: attribution methods substantially outperform activation and magnitude-based baselines at identifying dispensable rows across five LLMs. We then adapt the same intervention into a behavior test by driving it with a contrastive harmful-versus-benign signal; the attributed rows are sufficient to install refusal on hate and crime while keeping benign over-refusal low and preserving language model fluency, and specific in that layer-matched random controls at the same depths fail. Highly rank-stable selectors can be among the least causally valid. Refusal moreover lives in a redundant subspace, where different attribution methods install it through largely disjoint row sets, so the recovered edit is one realization of a sufficient set rather than a unique mechanism. Together, these findings show that rank-stability proxies miss the kinds of selector failures a direct causal audit can surface.%
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
