SafeNexus: Discovering and Steering Modality-Universal Safety Neurons in MLLMs
Probe MLPs for safety neurons shared by text, image, and audio, then steer activations or apply targeted calibration to improve cross-modal safety.
The short version
SafeNexus first identifies safety-related neurons for individual modality settings, then studies their shared intersection. Targeted suppression examines whether these modality-universal neurons influence safety across input combinations, connecting their overlap to observable behavior.
The same coordinates support two interventions: an inference-time activation amplifier and a calibrator that selectively fine-tunes them. These are distinct adaptation routes, allowing the study to compare direct activation control with learned changes to the shared safety mechanism.
A cross-modal defense needs a mechanism that remains relevant when the source of risk changes modality.
Locate, intersect, and steer
The framework links neuron localization to modality-universal safety sets and two steering strategies.
View in the paperWhy this matters
Extending a language model to images, audio, or combined inputs changes how risks enter the computation. A defense that works for one modality may fail to engage when the same harmful intent reaches the model through another interface.
How it works
- Localize functionality-related FFN neurons from intermediate activations and importance scores.
- Identify modality-bound safety sets and test the functional relevance of their shared intersection.
- Compare activation amplification with targeted calibration on safety, utility, and over-refusal measurements.
Testing universal-neuron relevance
The original table compares safety and utility after random masking or shared-neuron suppression.
View in the paperWhat the study finds
Masking modality-universal neurons degrades safety across the tested modality combinations more than matched random controls. The paper evaluates an amplifier and a calibrator on several multimodal models and benchmarks, with additional checks on general capabilities, over-refusal, and transfer to video-related settings.
Two routes to safer behavior
Benchmark results compare activation amplification and learned calibration with multimodal defense baselines.
View in the paperWhat this means
The study treats cross-modal consistency as a property of an identifiable internal mechanism. That makes it possible to ask whether a failure comes from missing safety knowledge, limited access to a shared mechanism, or a modality-specific route that does not engage it effectively.
The two intervention routes also clarify the cost of control: changing activations and learning parameter updates solve different adaptation problems. Their comparison can inform when a compact shared target is sufficient, and when broader or differently localized alignment is needed.
Paper and resources
This is an introduction to the linked paper. Refer to the original for method definitions, evaluation settings, and complete results.
Cite this work
@misc{safenexus,
title = {SafeNexus: Discovering and Steering Modality-Universal Safety Neurons in MLLMs},
author = {Yu, Jian and Shen, Fei and Wang, Cong and Wang, Jian and Jin, Lu and Du, Xiaoyu and Tang, Jinhui and Chua, Tat-Seng},
year = {2026},
eprint = {2607.28969},
archivePrefix = {arXiv},
url = {https://arxiv.org/abs/2607.28969}
}