Newest papers

Towards Architectural-Level Safety Control: Relocating Hazardous Knowledge into Removable Experts in Mixture-of-Experts Models

Cheng Jin, Zhongtian Ma, Xiao Wang, Han Qi, Xiaoyu Wen, Xiang Wang, Youbang Sun, Xia Hu, Bowen Zhou, Chaochao Lu, Qiaosheng Zhang · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.25791 · cited by 0 works (OpenAlex) · open-access PDF

Japanese

大規模な言語リメイニングは、プレトレーニング中にWebスケールコーポラから幅広い知識を獲得するものであり、誤って使用する場合に危険な知識を含む。そのような知識をモデル自体から除去することによって、一般的な能力を損なうことなく、REarningは望ましいが、それは同じパラメータ内の一般的な能力と深く関連しているため困難である。既存のセキュリティ調節と非学習方法は、通常、これらの共有パラメータにリメイキングし、一般的な基礎レベルでの危険な知識の表現を抑制する傾向があります。結果として、この知識はモデル内にとどまっており、それ以降のFine-Tuningによって容易に回復できます。この制限に対処するために、REX(リメイク可能

Machine translation (Meta M2M100); the English original follows.

Abstract

Large language models acquire broad knowledge from web-scale corpora during pretraining, including knowledge that could be hazardous if misused. Removing such knowledge from the model itself without degrading general capability is desirable but difficult, as it is deeply entangled with general capability within the same parameters. Existing safety alignment and unlearning methods typically adjust these shared parameters, tending to suppress the expression of hazardous knowledge rather than remove it. As a result, the knowledge remains in the model and is readily recoverable by subsequent fine-tuning. To address this limitation, we propose REX (Relocating into Removable EXperts), a knowledge relocation method that separates hazardous knowledge from general capability at the architectural level. Exploiting the modular structure of Mixture-of-Experts models, REX expands the model with a set of new, physically removable experts designated to hold hazardous knowledge. Through expert expansion, selective gradient masking and routing differentiation, it relocates hazardous knowledge out of the original experts and concentrates it in the new ones. Excising these new experts yields a model suitable for public release. This removal holds consistently across Intern-S2, Qwen3.5-35B-A3B and Gemma-4-26B-A4B; on Qwen3.5-35B-A3B, for instance, excision lowers WMDP-Bio accuracy by 48.4 points while MMLU changes by less than 3 points. The excised model matches the strongest of nine unlearning baselines in removing hazardous knowledge, and it is the only one that preserves this removal under subsequent fine-tuning. After 250M tokens of standard fine-tuning on Qwen3.5, the best baseline rebounds on WMDP-Bio from 44.1% to 78.3%, whereas REX rises only from 32.4% to 42.8%.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Hazardous waste, Computer science, Masking (illustration), Set (abstract data type), Modular design, Relocation

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange