TraceRouter: Robust Safety for Large Foundation Models via Path-Level Intervention

Despite their capabilities, large foundation models (LFMs) remain susceptible to adversarial manipulation. Current defenses predominantly rely on the ``locality hypothesis", suppressing isolated neurons or features. However, harmful semantics act as distributed, cross-layer circuits, rendering such localized interventions brittle and detrimental to utility. To bridge this gap, we propose \textbf{TraceRouter}, a path-level framework that traces and disconnects the causal propagation circuits of illicit semantics. TraceRouter operates in three stages: (1) it pinpoints a sensitive onset layer by analyzing attention divergence; (2) it leverages sparse autoencoders (SAEs) and differential activation analysis to disentangle and isolate malicious features; and (3) it maps these features to downstream causal pathways via feature influence scores (FIS) derived from zero-out interventions. By selectively suppressing these causal chains, TraceRouter physically severs the flow of harmful information while leaving orthogonal computation routes intact. Extensive experiments demonstrate that TraceRouter significantly outperforms state-of-the-art baselines, achieving a superior trade-off between adversarial robustness and general utility. Our code will be publicly released. WARNING: This paper contains unsafe model responses.

This paper introduces TraceRouter, a new safety method for large AI models. Its starting point is a simple but important observation: unsafe behavior in AI models is usually not caused by one isolated “bad neuron.” Instead, harmful meanings are formed and passed along through internal pathways across many layers of the model. That means if we only try to suppress a few suspicious neurons or features, the defense may be fragile. The model might still find another route to produce unsafe outputs, especially under jailbreak prompts or adversarial attacks. TraceRouter therefore shifts the focus from individual components to causal information flow. The core idea is: trace how harmful information moves inside the model, then selectively block the key paths that carry it. A useful analogy is an electrical circuit. Traditional defenses are like noticing a spark and turning off a large part of the machine. That may stop the danger, but it can also damage normal performance. TraceRouter instead tries to identify the specific dangerous wires and cut only those connections. In theory, this gives a better balance between safety and usefulness. The method works by first detecting where harmful semantic signals begin to emerge inside the model. Then it identifies the internal features associated with those harmful concepts. Finally, it maps how these features influence later neurons and layers, reconstructing the pathway that leads toward unsafe output. Once that pathway is found, TraceRouter intervenes on it directly. The paper’s broader message is that model safety should not only be about filtering outputs or adding refusal rules. We also need to understand the internal mechanics of how unsafe content is represented and propagated. This is closer to “mechanistic safety”: instead of treating the model as a black box, the authors try to locate the actual computational routes responsible for harmful behavior. Why does this matter? Because current models are becoming more capable, more multimodal, and more widely deployed. A safety method that simply makes models more conservative may reduce risk, but it can also make them less helpful. TraceRouter points toward a more precise approach: block unsafe reasoning paths while preserving general intelligence and normal user-facing capabilities. Of course, this is still a research-stage method. The results need broader replication, and real-world safety systems will likely require multiple layers of defense. But the paper is interesting because it reframes the problem: safer AI may depend not just on better training data or stronger moderation, but on understanding and controlling how meaning flows inside the model itself.