Zhibo Zhang
Author directoryOther people with similar names: Zhibo Zhang, Zhibo Zhang
2026
RASET: Router-Agnostic Safety-Critical Expert Tuning Exposes Localized Safety Enforcement Failures in Mixture-of-Experts LLMs
Zhibo Zhang | Yuxi Li | Zhen Ouyang | Ling Shi | Kailong Wang
Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing
Zhibo Zhang | Yuxi Li | Zhen Ouyang | Ling Shi | Kailong Wang
Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing
Mixture-of-Experts (MoE) LLMs rely on sparse, router-driven expert activation, yet how safety alignment interacts with routed expert specialization remains underexplored. A common intuition is that safety behavior may be controlled by routing harmful requests to distinct refusal-oriented experts. In this work, we provide empirical evidence for a different picture: ***routing patterns in aligned MoE LLMs are largely topic-driven, while safety behavior can be altered with little change to the model’s intrinsic routing path***.
Motivated by this observation, we present **RASET** (**R**outer-**A**gnostic **S**afety-critical **E**xpert **T**uning), a red-teaming framework that probes whether safety enforcement can be localized in a small subset of experts while preserving the model’s intrinsic routing behavior. **RASET** identifies safety-critical experts via a contrastive routing-sensitivity criterion and applies parameter-efficient tuning only to the selected experts, minimizing semantic disruption relative to router-steering interventions.
Across five open-weight MoE backbones, **RASET** achieves high-quality safety-bypass yield (50.5% average ASRhq, +37.6 points over the strongest baseline). These results reveal a distinct MoE safety risk, highlighting the need for expert-aware alignment, auditing, and robustness mechanisms in deployed MoE systems.
Motivated by this observation, we present **RASET** (**R**outer-**A**gnostic **S**afety-critical **E**xpert **T**uning), a red-teaming framework that probes whether safety enforcement can be localized in a small subset of experts while preserving the model’s intrinsic routing behavior. **RASET** identifies safety-critical experts via a contrastive routing-sensitivity criterion and applies parameter-efficient tuning only to the selected experts, minimizing semantic disruption relative to router-steering interventions.
Across five open-weight MoE backbones, **RASET** achieves high-quality safety-bypass yield (50.5% average ASRhq, +37.6 points over the strongest baseline). These results reveal a distinct MoE safety risk, highlighting the need for expert-aware alignment, auditing, and robustness mechanisms in deployed MoE systems.