SafeSeek: Universal Attribution of Safety Circuits in Language Models

TL;DR

SafeSeek introduces a unified, optimization-based framework for identifying safety-critical circuits in large language models, enabling reliable safety attribution and effective fine-tuning to mitigate risks.

Contribution

It proposes a differentiable masking method to extract complete safety circuits in LLMs, surpassing heuristic approaches and facilitating safety fine-tuning.

Findings

Identified a backdoor circuit with 0.42% sparsity that drastically reduces attack success.

Localized an alignment circuit with 3.03% heads and 0.79% neurons, affecting safety and utility.

Demonstrated effective safety fine-tuning by removing identified circuits without utility loss.

Abstract

Mechanistic interpretability reveals that safety-critical behaviors (e.g., alignment, jailbreak, backdoor) in Large Language Models (LLMs) are grounded in specialized functional components. However, existing safety attribution methods struggle with generalization and reliability due to their reliance on heuristic, domain-specific metrics and search algorithms. To address this, we propose \ourmethod, a unified safety interpretability framework that identifies functionally complete safety circuits in LLMs via optimization. Unlike methods focusing on isolated heads or neurons, \ourmethod introduces differentiable binary masks to extract multi-granular circuits through gradient descent on safety datasets, while integrates Safety Circuit Tuning to utilize these sparse circuits for efficient safety fine-tuning. We validate \ourmethod in two key scenarios in LLM safety: \textbf{(1) backdoor attacks}, identifying a backdoor circuit with 0.42\% sparsity, whose ablation eradicates the Attack Success Rate (ASR) from 100\% $\to$ 0.4\% while retaining over 99\% general utility; \textbf{(2) safety alignment}, localizing an alignment circuit with 3.03\% heads and 0.79\% neurons, whose removal spikes ASR from 0.8\% $\to$ 96.9\%, whereas excluding this circuit during helpfulness fine-tuning maintains 96.5\% safety retention.