Moving the Safety Barrier: Dynamic Routing Adaptive Alignment Against White-Box Attacks
Localize cross-layer safety routes in MLPs and use failures induced by route masking to train compensatory defenses against white-box attacks.
The short version
Dynamic Routing Adaptive Alignment localizes a model’s existing safety route and temporarily disrupts it to collect defense failures. Those failures become preference pairs for learning alternatives. During optimization, the identified route is locked so that updates must recruit compensatory computation elsewhere.
The framework therefore trains against an internal counterfactual: what should the model do when its preferred safety route is compromised? Route-level diagnostics then examine whether the resulting robustness is actually supported by the proposed compensation.
A resilient safety boundary depends on how the model responds when its usual route to refusal is unavailable.
Learning from an internal failure
The pipeline localizes a route, mines failure-aware preferences, and trains compensatory routing.
View in the paperWhy this matters
A static refusal pathway can become a predictable target in an open-weight model. Ordinary safety training may reinforce the same dependency, leaving unclear whether the model can preserve its behavior after that pathway is attacked.
How it works
- Contrast safe and unsafe internal activations to identify the model’s safety route.
- Mask that route and mine the resulting failures to construct failure-aware preference pairs.
- Apply dynamic-routing DPO with the original route locked, encouraging compensatory support outside it.
Challenging the compensation hypothesis
The double-lesion diagnostic compares the original, route-pruned, and route-plus-compensation-pruned conditions.
View in the paperWhat the study finds
The paper reports safety and utility under route-level pruning across language and multimodal models. A double-lesion diagnostic disrupts both the original route and identified compensatory components; the additional degradation supports the compensation account within that test. Route visualizations and ablations examine how the alternatives emerge.
Where alternative support appears
The visualization traces identified route components before and after intervention.
View in the paperWhat this means
This reframes alignment as preparation for changes to the model’s internal operating conditions. Deliberately producing a known mechanism failure can supply targeted supervision about the behavior that must survive, turning interpretability into a way to construct useful training data.
The crucial question is whether the learned alternatives remain effective under new interventions. Joint route-disruption tests are valuable because they challenge the proposed mechanism directly. They also help distinguish a demonstrated compensatory route from a broad claim of immunity to arbitrary white-box changes.
Paper and resources
This is an introduction to the linked paper. Refer to the original for method definitions, evaluation settings, and complete results.
Cite this work
@misc{moving_safety_barrier,
title = {Moving the Safety Barrier: Dynamic Routing Adaptive Alignment Against White-Box Attacks},
author = {Li, Shangze and Shi, Chuancheng and Xie, Simiao and He, Lingzhi and Ji, Cheng and Cheng, Zifeng and Shen, Fei and Wu, Chao and Chua, Tat-Seng},
year = {2026},
eprint = {2608.02674},
archivePrefix = {arXiv},
url = {https://arxiv.org/abs/2608.02674}
}