cs.CRFeb 18, 2026

NeST: Neuron Selective Tuning for LLM Safety

Authors: Sasha Behrouzi, Lichao Wu, Mohamadreza Rostami, Ahmad-Reza Sadeghi

Organizations: Technical University of Darmstadt · University of Bristol

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Safety alignment is essential for the responsible deployment of Large Language Models (LLMs). Yet, existing approaches often rely on heavyweight fine-tuning that is costly to update, audit, and maintain across model families. Full fine-tuning incurs substantial computational and storage overhead, while parameter-efficient methods, e.g., Low-Rank Adaptation (LoRA), trade efficiency for inconsistent safety gains and sensitivity to design choices. Safety intervention mechanisms reduce unsafe outputs without modifying model weights, but do not directly shape or preserve the internal representations that govern safety behavior. We present NeST, a Neuron-Selective Tuning framework for efficient post-hoc safety alignment. NeST identifies safety-relevant feed-forward neurons via activation probing on vanilla harmful and benign prompts, clusters neurons with similar activation profiles, and trains shared cluster-level updates while freezing the rest of the model. Importantly, NeST is trained only on vanilla malicious prompts, without using jailbreak-specific attack data, yet generalizes robustly to diverse jailbreaks. The learned updates are then folded into the original weights, incurring no inference-time overhead. Evaluated on 14 open-weight language and multimodal models, NeST outperforms lightweight baselines and approaches full fine-tuning robustness with significantly fewer trainable parameters. On text-only models, NeST reduces average jailbreak attack success rate from 44.5% to 1.1% while training only 0.4M parameters on average. Across multimodal settings, it reduces ASR from 55.3% to 1.1%, and for downstream fine-tuned variants, it restores safety by reducing ASR from 53.8% to 0.8%. These results show that robust, maintainable safety alignment can be achieved by concentrating adaptation on localized, functionally coherent safety structures.

Figures & tables

Fig. 1: Overview of NeST. Stage 1 identifies safety-relevant neuron clusters in the target model using activation differences between harmful and benign prompts, followed by probing and neuron filtering. Stage 2 trains shared cluster-level safety updates while freezing all non-selected neurons. These base-model clusters are transferable: the same selected neurons and cluster assignments are used to harden downstream models.
Fig. 2: PCA visualization of clustered safety neurons in layer 6 of LLaMA-3.2-1B-Instruct.
Fig. 3: Gradient alignment of safety neurons across layers.
MethodScopeTrain DataEpochs/StepsEval. Data
Baseline---1k jailbreak
Full FTAll params20k direct5 epochs1k jailbreak
LoRAFNN20k direct5 epochs1k jailbreak
Circuit BreakerFNN+ATTN25k≤\leq 150 steps1k jailbreak
NeSTNeuron clusters20k direct5 epochs1k jailbreak
TABLE I: Training and evaluation configurations. Full FT, LoRA, and NeST use the same balanced 20k training set.
Target ModelBaselineFull FTCircuit BreakerSN-TuneLoRANeST
ASRASRPara.ASR Orig.{}_{\text{Orig.}}ASR Exp.{}_{\text{Exp.}}Para.ASRPara.ASRPara.ASRPara.
Llama-3.2-1B40.5%2.1%1,235.835.8%58.1%8.535.9%16.381.4%3.30.3%0.1
Llama-3.2-3B54.2%1.9%3,212.848.1%74.8%18.223.6%43.003.4%5.00.5%0.3
Qwen2.5-7B69.4%1.6%7,615.638.2%79.1%30.367.6%50.1719.2%0.50.6%0.4
Qwen2.5-14B58.1%0.8%14,770.020.1%65.2%51.658.6%122.813.0%18.80.8%1.0
Phi-4-mini25.7%0.3%3,836.024.6%44.5%13.434.2%598.65.7%1.60.7%0.2
TABLE II: ASR and trainable parameters (Param., in millions) across target models and safety adaptation methods.
Target ModelInfer. Settingw/o NeSTw/ NeST
gemma-3-12bText52.6%4.4%
Text & Reasoning52.4%5.1%
Image40.8%0.2%
Image & Reasoning39.8%1.0%
gemma-3-27bText57.1%0.2%
Text & Reasoning58.5%0.2%
TABLE III: ASR with different modalities and inference settings.
Base ModelDownstream (Target) ModelDownstream TaskBaselineDownstream w/o NeSTDownstream w/ NeST
Llama-3.2-1BVikhr-Llama-3.2-1B-InstructRussian language40.5%32.1\%_{{\color[rgb]{0,1,0}-8.4\%}}0.9\%_{{\color[rgb]{0,1,0}-39.6\%}}
Llama-3.2-3BLlama-Doctor-3.2-3B-InstructMedical consultation54.2%64.7\%_{{\color[rgb]{1,0,0}+10.5\%}}0.4\%_{{\color[rgb]{0,1,0}-53.8\%}}
Qwen2.5-7BFin-R1Financial reasoning69.4%72.2\%_{{\color[rgb]{1,0,0}+2.8\%}}0.2\%_{{\color[rgb]{0,1,0}-69.2\%}}
Qwen2.5-14Boxy-1-smallRole play58.1%74.7\%_{{\color[rgb]{1,0,0}+16.6\%}}0.2\%_{{\color[rgb]{0,1,0}-57.9\%}}
Phi-4-miniphi-4-mini-chinese-it-e1Reasoning & STEM25.7%58.0\%_{{\color[rgb]{1,0,0}+32.3\%}}1.4\%_{{\color[rgb]{0,1,0}-24.3\%}}
Phi-4Meditron3-Phi4-14BClinical medicine25.2%39.9\%_{{\color[rgb]{1,0,0}+14.7\%}}1.6\%_{{\color[rgb]{0,1,0}-23.6\%}}
TABLE IV: ASR before and after downstream fine-tuning, with and without post-hoc NeST hardening.
Fig. 4: Utility evaluation before and after NeST fine-tuning across three reasoning benchmarks.
Target ModelJailBreakV-28k DatasetLlama-Guard-3-8B Judge
BaselineFull FTCircuit BreakerSN-TuneLoRANeSTBaselineFull FTCircuit BreakerSN-TuneLoRANeST
Orig.Exp.Orig.Exp.
Llama-3.2-1B23.1%4.1%32.2%41.9%1.1%9.7%0.3%15.1%14.8%18.6%27.9%0.1%12.6%3.3%
Llama-3.2-3B38.0%0.8%38.9%67.3%11.0%9.1%1.5%18.6%4.4%11.1%19.2%4.0%3.4%1.7%
Qwen2.5-7B57.8%1.6%26.4%63.2%32.4%0.8%1.4%28.7%0.3%21.9%31.8%2.4%1.9%8.1%
Qwen2.5-14B26.7%0.2%12.8%58.6%31.8%1.1%1.3%15.7%0.0%11.3%27.5%6.4%0.95%2.5%
TABLE V: Attack success rate (ASR) across target models under two evaluation settings: JailBreakV-28k as the evaluation dataset and Llama-Guard-3-8B as the judge.
Target ModelORRSeed JaccardDataset Jaccard
Llama-3.2-1B1.6%90.5%90.8%
Llama-3.2-3B1.2%87.6%94.9%
Qwen2.5-7B0.2%63.3%83.9%
Qwen2.5-14B0.3%67.4%93.3%
Phi-4-mini1.2%73.5%89.3%
Phi-40.8%68.4%91.7%
TABLE VI: Over-refusal rate (ORR) of NeST on benign prompts and Jaccard overlap of selected safety neurons across different probe seeds and harmful datasets.
Target Modelzthr=2z_{\text{thr}}=2zthr=3z_{\text{thr}}=3zthr=4z_{\text{thr}}=4
Llama-3.2-1B0.0%0.3%1.9%
Llama-3.2-3B0.0%0.5%0.3%
Qwen2.5-7B0.2%0.6%4.7%
Qwen2.5-14B0.1%0.8%2.3%
Phi-4-mini0.8%0.7%5.3%
Phi-40.0%1.3%0.9%
TABLE VII: Impact of the z-threshold.
Target ModelWeakNeSTStrong
ASRPara.ASRPara.ASRPara.
Llama-3.2-1B1.2%0.10.3%0.10.7%1.4
Llama-3.2-3B1.1%0.20.5%0.30.0%4.2
Qwen2.5-7B0.1%0.20.6%0.40.3%5.7
Qwen2.5-14B1.1%0.40.8%1.00.1%12.1
Phi-4-mini3.4%0.10.7%0.20.4%4.2
TABLE VIII: Ablation of safety-neuron selection strength.
More in this topic

LLM Safety Alignment

Large language model safety alignment trains and evaluates systems to follow human policies while resisting harmful requests and misuse.

See all 333 papers

Explore similar work

CardsList
Aug 25, 2026

NeuronGuard: Robust LLM Safety Alignment via Ablation-Aware Safety Signal Redistribution

Safety alignment in large language models (LLMs) remains brittle against a growing spectrum of attacks. Jailbreak attacks bypass safety mechanisms through crafted prompts, while neuron-level attacks directly prune safety-critical neurons post-deployment. Both exploit a common weakness: safety-relevant information concentrates in a sparse neuron subset. We present NeuronGuard, a fine-tuning-stage defense that simultaneously hardens LLMs against both attack classes by redistributing safety signals across a broader set of neurons. NeuronGuard dynamically identifies safety-critical neurons via periodically refreshed per-layer linear classifiers, forces refusal behavior under deliberate neuron ablation, and applies KL-divergence regularization for distributional consistency. A randomized gradient projection strategy preserves downstream task utility by resolving conflicts between the defense and task objectives. We provide a formal guarantee that NeuronGuard strictly reduces the attack success rate (ASR) upper bound, and experiments across three LLMs, six state-of-the-art attack strategies, and multimodal settings confirm near-zero ASR while maintaining task accuracy, including against white-box adaptive adversaries.

Anjun Gao, Yueyang Quan, Yufei Xia +2

University of Louisville · University of North Texas

LLM Safety AlignmentAdversarial Robustness of Language ModelsAdversarial Attacks on LLMsLLM Jailbreak Attacks
AskPDF
Aug 14, 2026

Tripwire: Triggering Aligned Refusal via Statistically Certified Safety Neurons

Neuron- and path-level interventions offer the finest-grained route to defending large language models (LLMs) against jailbreak attacks, yet existing methods fall short of this promise, i.e., they often compromise model utility significantly. Specifically, one line of work suppresses toxic neurons to erase harmful semantics, but since such semantics are distributed across the network, blocking every pathway forces a large intervention footprint. An alternative line of research focus on identify safety neurons using external classifiers. While promising, the existing approaches suffer from compromising neurons that are important for the model utility as well. Moreover, both approaches remain always on and thus perturb every benign request even when no attack is present. To address these limitations, we present \ours{}, a training-free defense that first identifies safety-specific neurons through per-neuron hypothesis tests under false-discovery-rate control together with a utility-specificity filter. Based on this identification, a trigger-style clamp holds the selected neurons at their harmful-conditional mean activations, injecting an internal harmful-input signal that triggers the refusal behavior learned during alignment. The clamp is then realized by two provably equivalent deployment modes, namely a detector-gated inference-time intervention and an offline bias-patch weight edit. Extensive experiments across four safety-aligned LLMs and four representative attacks demonstrate that \ours{} reduces the average attack success rate to at most 2.0% while incurring a utility drop of only 0.5% to 5.3% on MT-Bench, the smallest among all defenses. Code is available at https://anonymous.4open.science/r/Tripwire-65C4.

Wei Zhao, Zhe Li, Peixin Zhang +1

Singapore Management University

LLM SafetyJailbreak DefenseCausal Interventions in Language ModelsRefusal Behavior in Language Models
AskPDF
Aug 26, 2026

NeuronFuzz: Safety Neuron Guided Fuzzing for LLM Safety Evaluation

Safety evaluation is critical for assessing whether aligned Large Language Models (LLMs) remain robust against jailbreak attacks. Existing automated testing methods, however, largely rely on response-level feedback: each candidate prompt typically requires generating a target-model response to evaluate its attack effectiveness. This process is expensive and, more importantly, provides only sparse guidance on strongly aligned models, where most candidates are rejected with the same failure outcome. This paper presents NeuronFuzz, a white-box fuzzing framework that exploits internal safety neurons as continuous execution feedback for LLM safety evaluation. A SafetyOracle converts safety-neuron activations into a continuous safety alarm score that serves as feedback for fuzzing and can be obtained during prefill, eliminating response generation from the fuzzing loop. To construct the SafetyOracle, NeuronFuzz uses template-invariant harmful and benign inputs and stability-aware selection to identify a compact set of safety neurons whose activations capture harmful-intent recognition. Moreover, since the safety alarm score is differentiable, NeuronFuzz uses its gradients to identify safety-sensitive template positions and a masked language model to generate fluent, context-compatible mutations while preserving original harmful payload and avoiding additional optimization variables. We evaluate NeuronFuzz across 21 text and multimodal models. Across five white-box source models, it achieves a 76-100% jailbreak discovery rate, outperforming baselines by up to 48 percentage points. Its optimized templates further transfer zero-shot to open-weight and six proprietary target models, achieving average ASR and top-5 ensemble ASR (EASR) of 69.6%/92.6% and 44.1%/60.0%, respectively.

Zhiyuan Xu, Muhammad Firhard Roslan, Joseph Gardiner +2

University of Bristol

Language Model Safety EvaluationLLM SecurityLLM SafetyAdversarial Attacks on LLMs
AskPDF