arXiv cs.CL· Chuancheng Shi, Shangze Li, Wenhua Wu, Hengzhi Chen, Fei Shen, Li Zhuo, Zhiyong Wang, Tat-Seng Chua·· 12 小时前AI 评分31
TraceRouter++：基于最优传输的因果语义路由重对齐
TraceRouter++: Causal Semantic Routing Realignment via Optimal Transport
AI 导读
TraceRouter++ 提出一种路由级安全干预框架，通过“发现-追踪-重对齐”范式定位有害输入激活的因果路由通路，并用约束最优传输的软路由重对齐将不安全激活边缘分布导向安全参考分布。该方法在 LLM、MLLM 和扩散模型上均优于所评估的基线，在提升对抗鲁棒性的同时保持较好的安全-效用权衡。
正文 · 原文
Abstract:Despite their remarkable capabilities, large foundation models (LFMs) remain susceptible to adversarial manipulation. Current safety intervention methods primarily rely on the \textit{locality hypothesis}, rigidly suppressing isolated neurons or features. However, harmful semantics manifest as distributed, cross-layer circuits, rendering localized ablations both brittle against complex jailbreaks and detrimental to general utility. To bridge this gap, we propose TraceRouter++, a routing-level safety intervention framework that explicitly traces safety-relevant causal routing pathways activated under harmful inputs and realigns their unsafe activation states. Our framework operates in a \textit{Discover-Trace-Realign} paradigm: it first pinpoints a sensitive onset layer via attention divergence and disentangles dense activations into interpretable routing features using sparse autoencoders (SAEs). Subsequently, it maps these features to downstream causal circuits via feature influence scores (FIS). Crucially, departing from rigid suppression paradigms, TraceRouter++ introduces a constrained optimal transport (OT)-based soft routing realignment. By formulating safety intervention as a tractable coordinate-wise marginal optimal transport approximation, our method redirects unsafe activation marginals toward safe-reference marginals within causally identified routing subspaces while preserving non-selected coordinates at the intervention point. This mechanism safely redirects malicious semantic flows while leaving orthogonal computational routes intact. Extensive experiments across representative large language models (LLMs), multimodal large language models (MLLMs), and diffusion models (DMs) show that TraceRouter++ outperforms evaluated baselines, improving adversarial robustness while maintaining a favorable safety-utility trade-off. WARNING: This paper contains unsafe model responses.
| Subjects: | Computation and Language (cs.CL) |
| Cite as: | arXiv:2611.04878 [cs.CL] |
| (or arXiv:2611.04878v2 [cs.CL] for this version) | |
| https://doi.org/10.48550/arXiv.2611.04878 arXiv-issued DOI via DataCite |
Submission history
From: Shangze Li [view email]
[v1]
Tue, 3 Nov 2026 13:30:34 UTC (3,513 KB)
[v2]
Wed, 4 Nov 2026 04:53:28 UTC (3,513 KB)
来源：arXiv cs.CL · arxiv.org