Sparse Models, Sparse Safety: Unsafe Routes in Mixture-of-Experts LLMs

By introducing routers to selectively activate experts in Transformer layers, the mixture-of-experts (MoE) architecture significantly reduces computational costs in large language models (LLMs) while maintaining competitive performance, especially for models with massive parameters. However, prior work has largely focused on utility and efficiency, leaving the safety risks associated with this sparse architecture underexplored. In this work, we show that the safety of MoE LLMs is as sparse as their architecture by discovering $\text{\emph{unsafe routes}}$: routing configurations that, once activated, convert safe outputs into harmful ones. Specifically, we first introduce the $\underline{\text{Ro}}$uter $\underline{\text{Sa}}$fety $\underline{\text{i}}$mportance $\underline{\text{s}}$core ($\textbf{RoSais}$) to quantify the safety criticality of each layer's router. Manipulation of only the high-RoSais router(s) can flip the default route into an unsafe one. We further propose a $\underline{\text{F}}$ine-grained token-layer-wise $\underline{\text{S}}$tochastic $\underline{\text{O}}$ptimization framework to discover more concrete $\underline{\text{U}}$nsafe $\underline{\text{R}}$outes ($\textbf{F-SOUR}$), which explicitly considers the sequentiality and dynamics of input tokens. Across four representative MoE LLM families, F-SOUR achieves an average ASR of 0.90 and 0.98 on JailbreakBench and AdvBench, respectively. Finally, we outline defensive perspectives, including safety-aware route disabling and router training, as promising directions to safeguard MoE LLMs. We hope our work can inform future red-teaming and safeguarding of MoE LLMs. Our code is available at https://github.com/TrustAIRLab/UnsafeMoE.

Large language models often use a design (i.e., Mixture-of-Experts) that activates only part of the model for each word, which helps reduce computing costs. This efficiency comes with a new safety concern: the model’s answer can change depending on which internal route is used. We study whether some of these routes can make a model ignore its usual safety behavior and give harmful answers. Across several open-source models, we find that changing a small number of internal choices can greatly increase unsafe responses. We also develop a method to find such risky routes more systematically. Our results suggest that safety testing should look not only at what users type, but also at how the model internally decides which parts to use.