TraceRouter: Robust Safety for Large Foundation Models via Path-Level Intervention
Fuente:
arXiv
Guardado en:
| Autores principales: | , , , , , , , |
|---|---|
| Formato: | Preprint |
| Publicado: |
2026
|
| Materias: | |
| Acceso en línea: | |
| Etiquetas: |
Agregar Etiqueta
Sin Etiquetas, Sea el primero en etiquetar este registro!
|
| _version_ | 1866910006451896320 |
|---|---|
| author | Shi, Chuancheng Li, Shangze Lu, Wenjun Wu, Wenhua Wang, Cong Cheng, Zifeng Shen, Fei Chua, Tat-Seng |
| author_facet | Shi, Chuancheng Li, Shangze Lu, Wenjun Wu, Wenhua Wang, Cong Cheng, Zifeng Shen, Fei Chua, Tat-Seng |
| contents | Despite their capabilities, large foundation models (LFMs) remain susceptible to adversarial manipulation. Current defenses predominantly rely on the "locality hypothesis", suppressing isolated neurons or features. However, harmful semantics act as distributed, cross-layer circuits, rendering such localized interventions brittle and detrimental to utility. To bridge this gap, we propose \textbf{TraceRouter}, a path-level framework that traces and disconnects the causal propagation circuits of illicit semantics. TraceRouter operates in three stages: (1) it pinpoints a sensitive onset layer by analyzing attention divergence; (2) it leverages sparse autoencoders (SAEs) and differential activation analysis to disentangle and isolate malicious features; and (3) it maps these features to downstream causal pathways via feature influence scores (FIS) derived from zero-out interventions. By selectively suppressing these causal chains, TraceRouter physically severs the flow of harmful information while leaving orthogonal computation routes intact. Extensive experiments demonstrate that TraceRouter significantly outperforms state-of-the-art baselines, achieving a superior trade-off between adversarial robustness and general utility. Our code will be publicly released. WARNING: This paper contains unsafe model responses. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2601_21900 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | TraceRouter: Robust Safety for Large Foundation Models via Path-Level Intervention Shi, Chuancheng Li, Shangze Lu, Wenjun Wu, Wenhua Wang, Cong Cheng, Zifeng Shen, Fei Chua, Tat-Seng Computer Vision and Pattern Recognition Artificial Intelligence Computers and Society Multimedia Despite their capabilities, large foundation models (LFMs) remain susceptible to adversarial manipulation. Current defenses predominantly rely on the "locality hypothesis", suppressing isolated neurons or features. However, harmful semantics act as distributed, cross-layer circuits, rendering such localized interventions brittle and detrimental to utility. To bridge this gap, we propose \textbf{TraceRouter}, a path-level framework that traces and disconnects the causal propagation circuits of illicit semantics. TraceRouter operates in three stages: (1) it pinpoints a sensitive onset layer by analyzing attention divergence; (2) it leverages sparse autoencoders (SAEs) and differential activation analysis to disentangle and isolate malicious features; and (3) it maps these features to downstream causal pathways via feature influence scores (FIS) derived from zero-out interventions. By selectively suppressing these causal chains, TraceRouter physically severs the flow of harmful information while leaving orthogonal computation routes intact. Extensive experiments demonstrate that TraceRouter significantly outperforms state-of-the-art baselines, achieving a superior trade-off between adversarial robustness and general utility. Our code will be publicly released. WARNING: This paper contains unsafe model responses. |
| title | TraceRouter: Robust Safety for Large Foundation Models via Path-Level Intervention |
| topic | Computer Vision and Pattern Recognition Artificial Intelligence Computers and Society Multimedia |
| url | https://arxiv.org/abs/2601.21900 |