aiqbench analysis
This research dissects the mechanistic circuit responsible for multilingual safety refusals in MoE models, revealing that harm detection and refusal generation are distinct processes separated by a specific "writer" component. The study quantifies the costs of intervening on this circuit, demonstrating that suppressing an attention opposer is a viable strategy to align lower-resource languages with English standards without expensive architectural changes.
Decided Upstream, Written Late: Locating and Pricing the Cross-Lingual Refusal Circuit of a Multilingual MoE
arXiv:2608.08032v2 Announce Type: replace-cross Abstract: Safety alignment in multilingual models is uneven: a model that reliably refuses a harmful request in English will often comply with the same request in a lower-resource language. We trace this gap mechanistically in sarvam, an Indic-multilingual mixture-of-experts reasoning model, and find it is not a failure to detect harm. Harm is encoded as an internal direction that is nearly language-invariant in mid-network (English-vs-Indic cosine ${\approx}0.9$ at $L11$), and steering that direction upstream causally controls refusal. But the detection direction is orthogonal to the change that actually writes the refusal, which is late and assembled over the course of generation rather than read off in a single forward pass. We attribute the write to a specific, localizable circuit, a mixture-of-experts writer held in check by an attention opposer and price every way of intervening on it: damping the opposer is cheap and effective, amplifying the writer is a cost wall, and surgical edits to the responsible heads do nothing. The circuit's organization, and the gradient method that exposes it, recur in a second, unrelated MoE model, while the lever's strength is architecture-specific. The result is a cost-measured map of where a multilingual safety repair can land, and what it costs
Abstract:Safety alignment in multilingual models is uneven: a model that reliably refuses a harmful request in English will often comply with the same request in a lower-resource language. We trace this gap mechanistically in sarvam, an Indic-multilingual mixture-of-experts reasoning model, and find it is not a failure to detect harm. Harm is encoded as an internal direction that is nearly language-invariant in mid-network (English-vs-Indic cosine ${\approx}0.9$ at $L11$), and steering that direction upstream causally controls refusal. But the detection direction is orthogonal to the change that actually writes the refusal, which is late and assembled over the course of generation rather than read off in a single forward pass. We attribute the write to a specific, localizable circuit, a mixture-of-experts writer held in check by an attention opposer and price every way of intervening on it: damping the opposer is cheap and effective, amplifying the writer is a cost wall, and surgical edits to the responsible heads do nothing. The circuit's organization, and the gradient method that exposes it, recur in a second, unrelated MoE model, while the lever's strength is architecture-specific. The result is a cost-measured map of where a multilingual safety repair can land, and what it costs
Artificial Intelligence (cs.AI); Computation and Language (cs.CL)
arXiv:2608.08032 [cs.AI]
(or arXiv:2608.08032v2 [cs.AI] for this version)
https://doi.org/10.48550/arXiv.2608.08032 Focus to learn more arXiv-issued DOI via DataCite
attn18_eos_judged.jsonl
attn18_eos_judged_summary.json
doseresponse.jsonl
flip_sweep.jsonl
grad_attrib.jsonl
opposer_damp_ppl.json
qwen_labels.json
qwen_lever.jsonl
qwen_mechanism.json
refusal_trajectory.csv
steer_layer_sweep.csv
steer_layer_sweep_raw.jsonl
steered_propagation.csv
steered_propagation_raw.jsonl
steering_pilot_v6.jsonl
surgical_ppl.json
(17 additional files not shown) You must enabled JavaScript to view entire file list.
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 326 words
