cs.LGMar 24, 2026

SafeSeek: Universal Attribution of Safety Circuits in Language Models

Authors: Miao Yu, Siyuan Fu, Moayad Aloqaily, Zhenhong Zhou, Safa Otoum, Xing fan, Kun Wang, Yufei Guo, 

Organizations: University of Science and Technology of China · Squirrel Ai Learning · United Arab Emirates University · Nanyang Technological University · 

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Mechanistic interpretability reveals that safety-critical behaviors (e.g., alignment, jailbreak, backdoor) in Large Language Models (LLMs) are grounded in specialized functional components. However, existing safety attribution methods struggle with generalization and reliability due to their reliance on heuristic, domain-specific metrics and search algorithms. To address this, we propose \ourmethod, a unified safety interpretability framework that identifies functionally complete safety circuits in LLMs via optimization. Unlike methods focusing on isolated heads or neurons, \ourmethod introduces differentiable binary masks to extract multi-granular circuits through gradient descent on safety datasets, while integrates Safety Circuit Tuning to utilize these sparse circuits for efficient safety fine-tuning. We validate \ourmethod in two key scenarios in LLM safety: (1) backdoor attacks, identifying a backdoor circuit with 0.42% sparsity, whose ablation eradicates the Attack Success Rate (ASR) from 100% →\to 0.4% while retaining over 99% general utility; (2) safety alignment, localizing an alignment circuit with 3.03% heads and 0.79% neurons, whose removal spikes ASR from 0.8% →\to 96.9%, whereas excluding this circuit during helpfulness fine-tuning maintains 96.5% safety retention.

Figures & tables

Figure 1: Overview of our SafeSeek framework ( Middle ), with two critical scenarios in LLM safety ( Left ) and case studies ( Right ).
Figure 2: Performance comparison of the base LLM ( Gbase\mathcal{G}_{\mathrm{base}} ), the backdoor model ( Gbkd\mathcal{G}_{\mathrm{bkd}} ), SafeSeek ’s clean model ( Gclean\mathcal{G}_{\mathrm{clean}} ) and backdoor circuit ( Cbkd\mathcal{C}_{\mathrm{bkd}} ) for the Refusal backdoor.
Figure 3: ASR and general utility of base ( G\mathcal{G} ) and SafeSeek ’s unsafe model ( Gunsafe\mathcal{G}_{\mathrm{unsafe}} ) in the safety alignment scenario.
Figure 4: Performance comparison of different models and methods to enhance LLM safety via fine-tuning (LoRA is the baseline).
Appendix figures & tables2 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 5: Performance comparison for additional backdoor types. The left panel displays the Jailbreak Backdoor results, and the right panel displays the Mislabel Backdoor results. Across both tasks, SafeSeek identifies highly sparse circuits ( Cbkd\mathcal{C}_{\mathrm{bkd}} ) that capture high attack capabilities ( ASRp>90%\text{ASR}_{p}>90\% ) while the clean subgraphs ( Gclean\mathcal{G}_{\mathrm{clean}} ) effectively mitigate the attacks.
Figure 6: Multi-dimensional performance comparison of Safety Circuit Tuning (SaCirT). The radar charts illustrate the trade-offs between safety, utility, and parameter efficiency. SafeSeek consistently achieves the best balance, maintaining high safety and utility with minimal parameter updates compared to the Baseline.
More in this topic

LLM Interpretability

Large language model (LLM) interpretability studies how internal representations and computations produce outputs, and how they can be explained or controlled.

See all 778 papers

Explore similar work

CardsList

  1. From Detection to Refusal: Safer LLMs via Circuit-Guided Weight Scaling

    Aug 30, 2026Kuan-Lin Chu, Chung-En Sun, Tsui-Wei WengLLM SafetyRefusal Behavior in Language Models

    Computer Science and Engineering, University of California San Diego · Halıcıoğlu Data Science Institute, University of California San Diego

  2. Breaking Bad: Interpretability-Based Safety Audits of State-of-the-Art LLMs

    Apr 22, 2026Krishiv Agarwal, Ramneet Kaur, Colin Samplawski +6Language Model Safety EvaluationLLM Auditing

    University of Florida · SRI

  3. SafeEvo: Deciphering the Safety Alignment Mechanism and Evolution in Language Models

    Oct 7, 2026Miao Yu, Hao Huang, Lu Yuan +3Refusal Mechanisms in Language ModelsLLM Safety Alignment

    The University of Hong Kong (HKU) · Chinese Academy of Sciences (CAS) · Information Engineering University (IEU) +1