Decomposing Refusal Steering in Mixture-of-Experts Models
cs.CL, cs.LG
Submitted: 2026-06-02
Updated: 2026-09-19
Code: https://github.com/andyrdt/refusal
License: http://creativecommons.org/licenses/by-sa/4.0/
The gist: Safety alignment in instruction-tuned large language models (LLMs) depends on a model's ability to reliably refuse harmful or disallowed requests.
Terminology
Abstract
Safety alignment in instruction-tuned large language models (LLMs) depends on a model's ability to reliably refuse harmful or disallowed requests. Recent work has shown that a steering vector can be applied to a dense LLM during inference to suppress refusal behavior and induce responses to harmful requests. We extend this refusal steering method to three open-source Mixture-of-Experts (MoE) LLMs to decompose and better understand how refusal mechanisms operate across MoE components. We find that steering performance is uninhibited by the complex routing patterns inherent to the MoE architecture, and that a single expert recovers 78% of the full steering effect on average when free to select its own location. However, expert-level steering only recovers 54% on average when constrained to the location used by full-layer steering, a gap that widens further under safety-related system prompts. Our results also show that refusal signals captured by these steering methods differ from those captured by expert routing behavior. Together, these results suggest that refusal behavior is distributed unevenly across the MoE LLM architecture rather than governed by a single unified mechanism.
Sources
- GPT-4 Technical Report
- gpt-oss-120b & gpt-oss-20b Model Card
- Mixture of Tunable Experts -- Behavior Modification of DeepSeek-R1 at Inference Time
- DeepSeekMoE: Towards Ultimate Expert Specialization in Mixture-of-Experts Language Models
- Toy Models of Superposition
- Steering MoE LLMs via Expert (De)Activation
- Scaling Reasoning, Losing Control: Evaluating Instruction Following in Large Reasoning Models
- A Closer Look at the Limitations of Instruction Tuning
- Activation Surgery: Jailbreaking White-box LLMs without Touching the Prompt
- Mixtral of Experts
- SAFEx: Analyzing Vulnerabilities of MoE-Based LLMs via Stable Safety-critical Expert Identification
- Not All Experts are Equal: Efficient Expert Pruning and Skipping for Mixture-of-Experts Large Language Models
- Refusal in LLMs is an Affine Function
- OLMoE: Open Mixture-of-Experts Language Models
- Probing Semantic Routing in Large Mixture-of-Expert Models
- In-context Learning and Induction Heads
- COSMIC: Generalized Refusal Direction Identification in LLM Activations
- Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context
- Steering Language Models With Activation Engineering
- OpenMoE: An Early Effort on Open Mixture-of-Experts Language Models
Related papers
- Exploring Solution Divergence and Its Effect on Large Language Model Problem Solving
- Ishigaki-IDS-Bench: A Benchmark for Generating Information Delivery Specification from BIM Information Requirements
- Subliminal Steering: Stronger Encoding of Hidden Signals
- MedStruct-S: A Benchmark for Key Discovery, Key-Conditioned QA and Semi-Structured Extraction from OCR Clinical Reports
- The End of Transformers? On Challenging Attention and the Rise of Sub-Quadratic Architectures
- Untangling the Mechanisms of Misleading Context in Medical Question Answering