Safety kernel improves cross language defenses in large language models
Safety Kernel: Mechanistic Alignment for Cross-Lingual Defense in LLMs
Computation and Language
Summary
Large language models aren't equally safe when used in different languages, allowing bad inputs in some languages to get past safety checks. The authors studied which internal parts of the model (individual neurons) control safety across languages and found a shared group called the safety kernel. By focusing on adjusting only these neurons, their method can better stop unsafe content across many languages, even ones they didn't train on, while keeping the model's general abilities mostly unchanged.
What this means in practice
- •For multilingual ai developers: Enhance safety features in language models to prevent harmful prompts across many languages by updating only key neurons.
- •For content moderation teams: Improve detection and blocking of unsafe content in multiple languages using models that have targeted safety neuron adjustments.
Authors
Chengyu Xie, Fei Shen, Shuyi Miao, Yue Feng, Jian Yu, Pengyang Shao, Yijun Tian, Xiaoyu Du
Abstract
The safety capabilities of large language models (LLMs) are highly uneven across different languages, often allowing cross-lingual attacks to bypass safety guardrails. Existing alignment methods predominantly rely on external alignment signals and provide limited insight into underlying neuron-level mechanisms, making it difficult to provide a unified internal target for cross-lingual safety interventions. To address this, we analyze cross-lingual safety behavior at the neuron level and identify a compact set of safety-related neurons shared across languages, termed the safety kernel (SK). Specifically, we first utilize multilingual parallel safe and unsafe prompts to compute safety contrast with activation responsiveness (SCAR) scores, identifying language-wise safety-neuron candidates from internal activation patterns. We then intersect the resulting language-wise safety-neuron sets to obtain the SK, and validate its functional relevance to cross-lingual safety behavior through activation suppression and activation-state transfer interventions. Finally, building on the SK coordinates, we introduce SK-Masked LoRA, which constrains LoRA adaptation to the feed-forward network (FFN) output dimensions corresponding to the SK, thereby focusing safety-related changes on the cross-lingually shared neuron coordinates. Extensive experiments demonstrate that SK-Masked LoRA substantially reduces attack success rates across multiple languages, including languages excluded from SK discovery, while intervening on only a small fraction of internal neuron coordinates and producing generally limited changes in the model's general capabilities.