Activation Space Interventions Can Be Transferred Between Large Language Models

2025-03-06

AI Summary

This work addresses the challenge of transferring safety interventions across large language models (LLMs) with heterogeneous architectures. Methodologically, it proposes an activation-space alignment framework that enables cross-architecture transfer of safety steering vectors—spanning Llama, Qwen, and Gemma—via jointly optimized linear and nonlinear mapping modules. It further introduces an autoencoder-driven behavioral switching mechanism, achieving millisecond-level, high-precision (>92%) dynamic safety toggling. Notably, it formally defines and solves the “contamination capability disentanglement” task: isolating backdoor knowledge from functional capabilities while preserving utility. Key contributions include: (1) the first multi-architecture safety intervention transfer method for LLMs; (2) a novel contamination capability disentanglement paradigm; and (3) a lightweight, generalizable dynamic safety switch. Experiments demonstrate that smaller models can effectively guide larger ones toward safer behavior, significantly improving robustness against backdoor triggers and harmful prompt responses.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Natural Language Processing: Safety and Robustness
• Multiagent Systems: Adversarial Agents

Application Category

• Semantics and Knowledge: Data modeling to support human-machine intelligence, including LLMs agents, intelligent system behavior, explanations, and user-friendly interactions
• Search and Retrieval-Augmented AI: Search Tool Learning with LLM: Teaching LLMs to invoke search and make use of retrieved information
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs

Abstract

The study of representation universality in AI models reveals growing convergence across domains, modalities, and architectures. However, the practical applications of representation universality remain largely unexplored. We bridge this gap by demonstrating that safety interventions can be transferred between models through learned mappings of their shared activation spaces. We demonstrate this approach on two well-established AI safety tasks: backdoor removal and refusal of harmful prompts, showing successful transfer of steering vectors that alter the models' outputs in a predictable way. Additionally, we propose a new task, extit{corrupted capabilities}, where models are fine-tuned to embed knowledge tied to a backdoor. This tests their ability to separate useful skills from backdoors, reflecting real-world challenges. Extensive experiments across Llama, Qwen and Gemma model families show that our method enables using smaller models to efficiently align larger ones. Furthermore, we demonstrate that autoencoder mappings between base and fine-tuned models can serve as reliable ``lightweight safety switches", allowing dynamic toggling between model behaviors.

Problem

• Transfer safety interventions between AI models
• Remove backdoors and refuse harmful prompts
• Separate useful skills from backdoors in models

Innovation

• Transfer safety interventions via activation space mappings
• Use smaller models to align larger ones efficiently
• Dynamic toggling of model behaviors with autoencoder mappings