No Single Neuron of Failure: Distributed Safety Alignment Against White-Box Attacks
Locate critical refusal neurons in MLPs and train compensatory safety with targeted masking and dropout against white-box attacks.
The short version
Distributed Safety Alignment examines a vulnerability of open-weight models: an attacker who can manipulate internal neurons may disable a narrow refusal mechanism. DSA first uses activation and loss-gradient information to locate refusal-related FFN coordinates, then perturbs those coordinates during realignment.
Targeted masking and stochastic dropout encourage the model to recruit compensatory capacity. The objective is to make refusal less dependent on a small, easily disrupted set of components, while retaining the language and multimodal abilities that make the model useful.
A safety mechanism becomes more resilient when its useful computation has trained alternatives.
Training distributed safety support
Refusal-neuron localization is followed by alignment with targeted masking and stochastic dropout.
View in the paperWhy this matters
High refusal accuracy on an intact model does not reveal how concentrated the underlying mechanism is. If a small intervention can remove most of that behavior, ordinary output evaluations can overstate the robustness of the alignment.
How it works
- Localize refusal-related FFN coordinates with a direction-aware first-order Taylor score combining activations and loss gradients.
- Apply targeted deterministic masking and stochastic dropout during safety realignment.
- Evaluate disruption of dominant and compensatory neurons alongside general language and multimodal utility.
Following compensatory routes
The visualization tracks refusal-related components recruited after successive internal disruptions.
View in the paperWhat the study finds
The paper compares robustness under neuron-pruning attacks, studies the contribution of masking and dropout, and tracks newly recruited refusal routes under successive disruptions. Its quantitative ablations pair attack success rates with ARC utility, making robustness and capability preservation visible together.
Which components contribute?
Ablations compare training perturbations and localization criteria under a fixed evaluation protocol.
View in the paperWhat this means
The study connects interpretability to fault tolerance. Finding a compact mechanism can help explain a behavior, while also revealing where that behavior is fragile. Training alternative computational support turns that diagnosis into a concrete alignment objective.
Redundancy is useful when the alternatives preserve the intended decision rather than merely move the same dependency. Successive-intervention analyses help test that distinction. The reported robustness is defined by the tested attacks and budgets, motivating broader adaptive evaluations of the trained alternatives.
Paper and resources
This is an introduction to the linked paper. Refer to the original for method definitions, evaluation settings, and complete results.
Cite this work
@misc{no_single_neuron,
title = {No Single Neuron of Failure: Distributed Safety Alignment Against White-Box Attacks},
author = {Xie, Simiao and Shi, Chuancheng and Li, Shangze and Wu, Wenhua and Shen, Fei and Zhou, Ying and Wang, Zhiyong and Chua, Tat-Seng},
year = {2026},
eprint = {2608.01414},
archivePrefix = {arXiv},
url = {https://arxiv.org/abs/2608.01414}
}