NeuronGuard: Robust LLM Safety Alignment via Ablation-Aware Safety Signal Redistribution
NeuronGuard is a fine-tuning defense for LLM safety alignment that tries to make refusal behavior robust to both prompt-level jailbreaks and post-deployment neuron-pruning attacks by spreading safety-relevant behavior across many neurons rather than letting it concentrate in a small vulnerable subset. Its neat idea is to train under dynamically identified safety-neuron ablations, with KL consistency and gradient conflict handling to preserve utility, though the abstract’s strong “near-zero ASR” and formal-bound claims will hinge on how realistic the adaptive attacks, neuron-identification procedure, and evaluation coverage are beyond the tested models and settings.
Abstract
Safety alignment in large language models (LLMs) remains brittle against a growing spectrum of attacks. Jailbreak attacks bypass safety mechanisms through crafted prompts, while neuron-level attacks directly prune safety-critical neurons post-deployment. Both exploit a common weakness: safety-relevant information concentrates in a sparse neuron subset. We present NeuronGuard, a fine-tuning-stage defense that simultaneously hardens LLMs against both attack classes by redistributing safety signals across a broader set of neurons. NeuronGuard dynamically identifies safety-critical neurons via periodically refreshed per-layer linear classifiers, forces refusal behavior under deliberate neuron ablation, and applies KL-divergence regularization for distributional consistency. A randomized gradient projection strategy preserves downstream task utility by resolving conflicts between the defense and task objectives. We provide a formal guarantee that NeuronGuard strictly reduces the attack success rate (ASR) upper bound, and experiments across three LLMs, six state-of-the-art attack strategies, and multimodal settings confirm near-zero ASR while maintaining task accuracy, including against white-box adaptive adversaries.