A Single Neuron Is Sufficient to Bypass Safety Alignment in Large Language Models

TL;DR

This paper shows that safety mechanisms in large language models rely on individual neurons, and manipulating just one neuron can bypass safety features or induce harmful content, revealing a lack of robustness.

Contribution

It demonstrates that safety alignment is mediated by single neurons, and targeting these neurons can cause failure modes without retraining or prompt engineering.

Findings

Suppressing a single refusal neuron bypasses safety across multiple models.

Amplifying a single concept neuron induces harmful content from benign prompts.

Safety alignment is not distributed but depends on individual neurons.

Abstract

Safety alignment in language models operates through two mechanistically distinct systems: refusal neurons that gate whether harmful knowledge is expressed, and concept neurons that encode the harmful knowledge itself. By targeting a single neuron in each system, we demonstrate both directions of failure -- bypassing safety on explicit harmful requests via suppression, and inducing harmful content from innocent prompts via amplification -- across seven models spanning two families and 1.7B to 70B parameters, without any training or prompt engineering. Our findings suggest that safety alignment is not robustly distributed across model weights but is mediated by individual neurons that are each causally sufficient to gate refusal behavior -- suppressing any one of the identified refusal neurons bypasses safety alignment across diverse harmful requests.