arXiv cs.AI· Erfan Baghaei Potraghloo, Saeid Shokoufa, Seyedarmin Azizi, Arya Fayyazi, Souvik Kundu, Mehdi Kamal, Massoud Pedram·· 2 小时前AI 评分49
SafeStart：缓解 MoE 大语言模型服务中减少激活专家带来的安全隐患
SafeStart: Mitigating the Overlooked Safety Cost of Active Expert Reduction in MoE LLM Serving
AI 导读
论文提出 MoE 大语言模型的专家削减服务方法会削弱模型对有害请求的拒答能力，并介绍 SafeStart 方法在保留大部分加速的同时基本恢复拒答。
正文 · 原文
Abstract:Mixture-of-Experts (MoE) language models send each token through a few of many expert subnetworks. Serving methods make these models faster by running even fewer experts per token, and they are validated on accuracy benchmarks. We show that these methods can weaken the model's refusal of harmful requests, and we introduce SafeStart, which largely restores refusal while keeping most of the speedup. In vLLM on one RTX A6000, keeping about two thirds of the selected experts speeds up offline decoding by 15 to 28% at batch size 8. We find that, at this setting, under a jailbreak that tells the model not to refuse, the share of harmful requests that the model answers rises by 18.4 percentage points on Qwen1.5-MoE, 9.5 on OLMoE, and 6.6 on DeepSeek-V2-Lite, the three of nine models where it rises significantly, while MMLU accuracy drops by less than two points. We discover that most of this increase arises while the model processes the prompt and generates its first few tokens. SafeStart therefore runs all experts for the prompt and the first eight generated tokens, and the reduced set of experts afterwards, through a fused kernel in vLLM. With experts removed, SafeStart keeps at least 85% of the offline decode speedup at batch sizes 8 and 32 and brings the change under this jailbreak to between -2.1 and +1.3 points for three expert-reduction methods on these three models. On 889 held-out requests, in an analysis fixed before generation, truncation raises harmful compliance by 5.8 to 21.4 points, and SafeStart leaves a rise of 0.6 to 2.6 points, non-inferior to the original model on two of the three models. Our results show that faster MoE serving need not cost safety: a serving system can keep most of the gain from running fewer experts by running all of them at the start of each response, and it should test refusal, not only accuracy, before it enables such a method.
| Comments: | 40 pages, 13 figures, 41 tables |
| Subjects: | Artificial Intelligence (cs.AI); Machine Learning (cs.LG) |
| Cite as: | arXiv:2611.06147 [cs.AI] |
| (or arXiv:2611.06147v1 [cs.AI] for this version) | |
| https://doi.org/10.48550/arXiv.2611.06147 arXiv-issued DOI via DataCite (pending registration) |
Submission history
From: Erfan Baghaei Potraghloo [view email]
[v1]
Wed, 4 Nov 2026 08:31:01 UTC (1,719 KB)
来源：arXiv cs.AI · arxiv.org