Safety Kernel: Mechanistic Alignment for Cross-Lingual Defense in LLMs
Probe outputs of MLP (FFN) modules for cross-language safety neurons and restrict LoRA updates to the shared safety kernel.
The short version
Safety Kernel identifies a compact set of safety-related neuron coordinates shared across languages. SCAR scores combine activation responsiveness and safety contrast on parallel safe and unsafe prompts; intersecting the language-wise candidate sets produces the kernel.
Suppression and activation-state transfer test its functional relevance. SK-Masked LoRA then restricts adaptation to the corresponding FFN output dimensions, linking the diagnosed shared mechanism to a specific parameter-update scope.
Cross-language alignment can be organized around a shared internal target whose behavior is tested before tuning.
From kernel discovery to masked adaptation
The framework connects language-wise scoring, shared-set validation, and SK-guided LoRA updates.
View in the paperWhy this matters
External alignment supervision can improve multilingual safety without revealing which internal computation transfers the behavior. A common mechanistic target would help connect the languages used for discovery, the coordinates changed by training, and the languages used for evaluation.
How it works
- Compute language-wise SCAR scores from multilingual parallel safe and unsafe prompts.
- Intersect candidate neuron sets and test the kernel with suppression and activation-state transfer.
- Constrain LoRA adaptation to the selected FFN output dimensions and evaluate cross-language defense and capability retention.
Changing the activation state
Safety outcomes are compared after transferring a refusal-related activation state through kernel coordinates.
View in the paperWhat the study finds
The study combines compactness measurements, masking tests, and activation-state interventions across model backbones. Safety comparisons include languages excluded from kernel discovery, alongside analyses of selection scope, update scope, kernel composition, and general capabilities.
Cross-language defense results
The original table compares attack success rates across languages and alignment baselines.
View in the paperWhat this means
The framework creates a clearer chain from observation to control: identify a shared set, test what changing it does, and tune within its coordinates. This makes multilingual transfer more interpretable than a performance improvement considered without an internal account.
The kernel is defined by the discovery procedure and language set, rather than being an unconditional property of every model. Studying its composition and held-out transfer helps establish when a compact shared target is a useful basis for intervention.
Paper and resources
This is an introduction to the linked paper. Refer to the original for method definitions, evaluation settings, and complete results.
Cite this work
@misc{safety_kernel,
title = {Safety Kernel: Mechanistic Alignment for Cross-Lingual Defense in LLMs},
author = {Xie, Chengyu and Shen, Fei and Miao, Shuyi and Feng, Yue and Yu, Jian and Shao, Pengyang and Tian, Yijun and Du, Xiaoyu},
year = {2026},
eprint = {2610.24614},
archivePrefix = {arXiv},
url = {https://arxiv.org/abs/2610.24614}
}