SafeStart: Mitigating the Overlooked Safety Cost of Active Expert Reduction in MoE LLM Serving

Summary

This research shows that serving methods which run fewer experts per token in Mixture-of-Experts language models can weaken refusal of harmful requests. Under a jailbreak, harmful compliance rose by 18.4 points on Qwen1.5-MoE, 9.5 on OLMoE and 6.6 on DeepSeek-V2-Lite. The authors introduce SafeStart, which runs all experts for the prompt and the first eight generated tokens, and keeps at least 85% of the offline decode speedup at batch sizes 8 and 32.

Mitigation

SafeStart runs all experts for the prompt and the first eight generated tokens, and the reduced set of experts afterwards, through a fused kernel in vLLM. The source also advises serving systems to test refusal, not only accuracy, before enabling expert-reduction methods.

Related items

• MediumResearchers Uncover Prompt Adware Hidden in OpenAI Codex Jailbreak ToolkitSimilar attack · The Hacker News
• InfoAddition by Subtraction: Toward Mitigating Fragile Safety Alignment in Large Language ModelsSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• MediumCritical Langflow flaws enable authentication bypass and RCESimilar attack · CSO Online
• MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research
• InfoTraceRouter++: Causal Semantic Routing Realignment via Optimal TransportSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)