NeuronGuard: Robust LLM Safety Alignment via Ablation-Aware Safety Signal Redistribution

2026-08-24

AI Summary

为解决大型语言模型面对精心设计的提示和神经元级攻击时的安全性问题，NeuronGuard通过在微调阶段重新分配安全信号至更多神经元来增强模型抵御此类攻击的能力。

Abstract

Safety alignment in large language models (LLMs) remains brittle against a growing spectrum of attacks. Jailbreak attacks bypass safety mechanisms through crafted prompts, while neuron-level attacks directly prune safety-critical neurons post-deployment. Both exploit a common weakness: safety-relevant information concentrates in a sparse neuron subset. We present NeuronGuard, a fine-tuning-stage defense that simultaneously hardens LLMs against both attack classes by redistributing safety signals across a broader set of neurons. NeuronGuard dynamically identifies safety-critical neurons via periodically refreshed per-layer linear classifiers, forces refusal behavior under deliberate neuron ablation, and applies KL-divergence regularization for distributional consistency. A randomized gradient projection strategy preserves downstream task utility by resolving conflicts between the defense and task objectives. We provide a formal guarantee that NeuronGuard strictly reduces the attack success rate (ASR) upper bound, and experiments across three LLMs, six state-of-the-art attack strategies, and multimodal settings confirm near-zero ASR while maintaining task accuracy, including against white-box adaptive adversaries.

Problem

• Safety Alignment
• Large Language Models
• Jailbreak Attacks
• Neuron-level Attacks
• Sparse Neuron Subset

Innovation

• NeuronGuard
• safety signal redistribution
• neuron ablation
• KL-divergence regularization
• randomized gradient projection