No Single Neuron of Failure: Distributed Safety Alignment Against White-Box Attacks

2026-08-02

AI Summary

This work addresses the vulnerability of existing alignment methods that rely on a small subset of safety-related neurons, rendering them susceptible to white-box neuron-level attacks and single-point-of-failure risks. To overcome this limitation, the paper introduces Distributed Safety Alignment (DSA), which achieves redundant encoding of safety capabilities at the neuron level for the first time. DSA identifies critical neurons using a direction-aware first-order Taylor scoring method and applies targeted perturbations through a combination of deterministic masking and stochastic dropout. This strategy compels the model to distribute safety-critical behaviors across multiple neurons rather than concentrating them in a few. As a result, DSA effectively eliminates single-point failures, significantly enhances robustness against white-box attacks, and preserves strong general-purpose performance on both language and multimodal tasks.

Abstract

With the rapid release of open-weight large foundation models, safety threats are shifting from black-box jailbreaks to neuron-level white-box attacks that directly identify and manipulate safety-related neurons. Existing alignment methods often investigate the safety behavior on a small number of neurons, creating fragile single point of failure with limited redundancy. To address this issue, we propose distributed safety alignment (DSA), which redundantly encodes safety capabilities across multiple computational neurons, ensuring that the model maintains its safety baseline even when critical safety neurons are disrupted. Specifically, we localize the intervention to the inputs of the down-projection layers in language-side feed-forward networks and treat each feature coordinate as the activation of an individual neuron. DSA then combines neuron activations with loss gradients to compute a direction-aware first-order Taylor score that globally identifies the neurons that contribute most to the current refusal behavior of the model. Finally, targeted disruption via deterministic masking and stochastic dropout is coupled, forcing the model to abandon narrow safety neurons and redundantly encode safety behavior across multiple compensatory neurons. Extensive experiments show that DSA substantially improves robustness against white-box neuron-level safety attacks while preserving the model's general language and multimodal utility.

Problem

• white-box attacks
• safety alignment
• neuron-level manipulation
• single point of failure
• model robustness

Innovation

• distributed safety alignment
• white-box attacks
• neuron-level robustness
• redundant encoding
• Taylor score