Abstract
Mechanistic interpretability reveals that safety-critical behaviors (e.g., alignment, jailbreak, backdoor) in Large Language Models (LLMs) are grounded in specialized functional components. However, existing safety attribution methods struggle with generalization and reliability due to their reliance on heuristic, domain-specific metrics and search algorithms. To address this, we propose \ourmethod, a unified safety interpretability framework that identifies functionally complete safety circuits in LLMs via optimization. Unlike methods focusing on isolated heads or neurons, \ourmethod introduces differentiable binary masks to extract multi-granular circuits through gradient descent on safety datasets, while integrates Safety Circuit Tuning to utilize these sparse circuits for efficient safety fine-tuning. We validate \ourmethod in two key scenarios in LLM safety: \textbf{(1) backdoor attacks}, identifying a backdoor circuit with 0.42\% sparsity, whose ablation eradicates the Attack Success Rate (ASR) from 100\% $\to$ 0.4\% while retaining over 99\% general utility; \textbf{(2) safety alignment}, localizing an alignment circuit with 3.03\% heads and 0.79\% neurons, whose removal spikes ASR from 0.8\% $\to$ 96.9\%, whereas excluding this circuit during helpfulness fine-tuning maintains 96.5\% safety retention.
Abstract (translated)
机制可解释性揭示，大型语言模型（LLMs）中的安全关键行为（如对齐、越狱、后门）根植于特定的功能组件。然而，现有安全归因方法因依赖启发式、领域特定的指标与搜索算法，在泛化性与可靠性方面存在局限。为此，我们提出\ourmethod\——一个通过优化识别LLMs中功能完整安全电路的统一安全可解释性框架。不同于聚焦孤立注意力头或神经元的方法，\ourmethod\引入可微分二值掩码，通过在安全数据集上进行梯度下降提取多粒度电路，同时整合安全电路调优（Safety Circuit Tuning）以利用这些稀疏电路实现高效安全微调。我们在LLM安全的两大关键场景中验证\ourmethod\：\textbf{(1) 后门攻击}，识别出稀疏度仅0.42%的后门电路，其消融将攻击成功率（ASR）从100%降至0.4%，同时保留超过99%的通用性能；\textbf{(2) 安全对齐}，定位出包含3.03%注意力头与0.79%神经元的对齐电路，移除该电路使ASR从0.8%飙升至96.9%，而在助人性微调中排除此电路仍能保持96.5%的安全保留率。
URL
https://arxiv.org/abs/2603.23268
