New to ShortSpan? We distil the AI-security research that matters into practitioner takeaways — edited by Ben Williams (NCC Group).Get the weekly email
// Analysis
SEAL anchors MoE safety beyond fragile routing
Published: Thu, 03 Sep 2026 • By Theo Solander
Defenses
Research on hybrid Mixture-of-Experts Large Language Models finds sparse routing a safety hole attackers can steer with jailbreak prompts, malicious fine-tuning, or pruning. SEAL trains a small adapter on the always-on shared expert, cutting attack success by up to 60% with about 1% capability loss. SEAL++ hardens against pruning.
Large Language Models (LLMs) that use Mixture-of-Experts (MoE) promise big capacity without paying to run every parameter. Only a few “experts” fire for each token. That sparse routing is great for scale, but it opens a neat side channel for attackers: safety depends on which experts light up. Nudge the router and you can slip past the guard. It’s reminiscent of 1990s firewalls that enforced policy on just one leg of the network; asymmetric routing let packets dodge the rule entirely.
How attackers steer MoE routing
Hybrid MoE models add “shared experts”, components that are always active, to stabilise training. The routed experts still decide most behaviour. Attackers have learned to influence that path. A crafted jailbreak prompt can tilt the router’s probabilities so safety-critical routed experts never get picked. With model weight access, malicious fine-tuning can push the router or expert projections off their safety bearings. Even cruder, pruning neurons associated with safety responses weakens guardrails without heavy compute. Because routing is sparse and a bit nondeterministic, defences that only harden the router can still be bypassed.
What SEAL changes
The new work zeroes in on the shared expert. Since it always runs, it is a rare fixed point in an MoE forward pass. SEAL attaches low-rankadapters (LoRA, for Low-Rank Adaptation) to the shared expert’s projection matrices and tunes them with Direct Preference Optimisation (DPO) on safety preference data. The training is lightweight: roughly 0.06–0.25% of parameters and under 36M trainables in the reported setups, and once merged it adds no inference overhead. SEAL++ adds an orthogonal constraint to preserve existing safety subspaces identified by activation profiling, making it harder for pruning to erase them.
Across four hybrid MoE families (14B–35B), the authors report up to 60% drops in attack success rate for harmful prompts, jailbreaks and malicious fine-tuning, typically at around a 1% capability tax and at most 1.4% on a five-benchmark average. SEAL++ raises the cost of weight-level attacks: on one model the pruning burden increased by a factor γ ≥ 4.3, and on another by γ ≥ 1.6. Training only the routed experts with similar budgets underperforms adjusting the shared expert; combining both helps, but the shared path drives most gains. The representational geometry holds up too: linear probes still separate harmful from benign (>96% per layer), which helps explain the low capability loss. SEAL also composes with router defences, dropping attack success to 4.8% in one setting, more than five times lower than router-only.
There are caveats. This only applies to hybrid MoE designs with shared experts. Where safety mostly lives in routed experts (one Qwen variant is cited), shared-expert tuning has limited or scope-dependent impact and can even raise routed-scope attack success. The evaluation stops at 35B and does not explore adaptive attackers who try to identify and sidestep the protected subspace. Still, the pattern is familiar and useful: move a small, always-on check into the invariant path and you shorten the attacker’s playbook. Expect the next round to probe the edges of that shared subspace, just as spammers learned to skate around early Bayesian filters.
Additional analysis of the original ArXiv paper
📋Original Paper Title and Abstract
SEAL: Reinforcing Global Safety in Mixture-of-Experts through Shared Expert ALignment
Authors: Qingyu Meng, Yiwei Zha, Jiahuan Pei, Koen Hindriks, Herbert Bos, and Min Chen
Mixture-of-Experts (MoE) is a scaling architecture for large language models that activates only a small subset of expert modules per token, enabling massive parameter growth with nearly constant computation. Recent Hybrid MoE architecture adds \textit{shared experts} to capture consistently useful representations, further improving stability and generalization. MoE now powers many flagship open-source and commercial models, yet remains vulnerable to adversarial attacks. Specifically, sparse routing introduces a structural vulnerability: MoE safety hinges on which experts are activated, and adversaries can subvert this selection through jailbreak prompts, malicious fine-tuning, and weight-level pruning of safety-critical neurons. Existing defenses primarily focus on hardening the router, but an adversary may still manipulate or bypass the routing trajectory due to the routing process's nondeterministic nature, thereby collapsing the defense. To cope with this problem, we first identify theoretically and empirically that shared expert, an always-activated component containing a small proportion of safety-critical neurons, can overcome the uncertainty of sparsely activated routing path and serve as a router-independent anchor to enhance global safety alignment. Based on this insight, we propose SEAL, a training-time parameter-efficient defense that produces a plug-and-play adapter attached to shared expert, and SEAL++, a variant that adds an orthogonal constraint preserving pre-existing safety subspaces during training. We evaluate SEAL and SEAL++ across six attack scenarios that combine three adversarial inputs (harmful prompting, jailbreak, malicious fine-tuning) with and without neuron pruning. SEAL reduces attack success rate (ASR) by up to 60\%, at a capability cost of at most 1.4\% on a five-benchmark average. Additionally, SEAL can seamlessly integrate with router-level ......
🔍ShortSpan Analysis of the Paper
Problem
The paper studies safety vulnerabilities in hybrid Mixture-of-Experts (MoE) language models arising from sparse routing. Because only a subset of routed experts is activated per token, safety depends on which experts the router selects; adversaries can exploit this by crafting jailbreak prompts, performing malicious fine-tuning, or pruning safety-critical neurons in weights. Router-focused defences are fragile against nondeterministic or manipulated routing, leaving an unmet need for a router-independent safety mechanism that remains active on every forward pass.
Approach
The authors identify the shared expert, an always-activated MoE component, as a router-independent safety surface. They introduce SEAL, a training-time, parameter-efficient defence that attaches low-rank LoRA adapters to shared-expert projection matrices and trains them with Direct Preference Optimisation (DPO) on human preference safety data. SEAL modifies only a small fraction of parameters (reported 0.06–0.25% and under 36M trainable parameters) and incurs zero inference overhead once merged. SEAL++ augments SEAL with an orthogonal constraint that preserves pre-existing safety-critical subspaces identified by activation-differential profiling, increasing resistance to neuron-level pruning.
Key Findings
SEAL reduces attack success rate (ASR) under diverse threats by up to 60% in isolated conditions while keeping capability degradation small (at most 1.4% on a five-benchmark average reported; typical capability tax near 1%).
SEAL++ further raises robustness to weight-level pruning: on one model (DeepSeek) the orthogonal constraint amplified the pruning cost by γ≥4.3, and on Qwen1.5 γ≥1.6, meaning attackers must prune substantially more neurons to achieve the same ASR.
Across four hybrid MoE architectures spanning 14B to 35B parameters the defence lowered ASR for harmful prompts, jailbreaks and malicious fine-tuning, and retained benefits under compound attacks that combine input attacks with neuron pruning.
Training confined to shared experts suffices and is often necessary: adapting routed experts alone with matched or larger budgets underperforms shared-expert adaptation; combining both yields best results but shared-expert updates drive most gains.
SEAL preserves representational separability: linear probes still decode harmful-versus-benign signals (>96% per layer) and representational similarity remains high for several models, explaining the low capability cost.
SEAL composes conceptually with router-level defences; in composition the paper reports ASR reductions to 4.8% in one setting, more than five times lower than router-only defence alone, though broader empirical composition studies are future work.
Limitations
Evaluation is limited to four open-weight hybrid MoE architectures up to 35B and to models that include shared experts; architectures lacking shared experts lie outside scope. Effectiveness depends on how safety is distributed between shared and routed experts: when safety is predominantly routed (example Qwen3.5) shared-expert training can have limited or scope-dependent effects and in some cases increase routed-scope ASR. The work does not evaluate adversaries that explicitly exploit the safety-mask identification mechanism and notes broader validation at larger scale and diverse vendor recipes is future work.
Implications
Offensive implications are twofold. First, attackers with only input access can manipulate routing distributions via jailbreak prompts to avoid safety-critical routed experts; SEAL reduces this attack surface by anchoring safety in always-active shared parameters. Second, attackers with weight access can perform low-cost neuron pruning or malicious fine-tuning to remove safety behaviour; SEAL++ raises the cost of such interventions by preserving and complementing safety subspaces so attackers must prune a larger neuron set or perform broader weight corruption. Practitioners should expect adaptive adversaries to shift effort to routed experts or attempt to identify and bypass the protected shared-expert subspace; the paper notes such mechanism-level adaptations were not exhaustively evaluated.
- Why it matters for security: Mixture-of-Experts models can be bypassed by routing tricks that bypass safety filters; naive full-model fine-tuning of...
- Core idea: Mixture-of-Experts LLMs use routing to activate subsets of parameters, but certain routing choices can turn safe outputs into harmful one...
- Key idea: safety and harmful-behavior controls in MoE LLMs are concentrated in a small set of expert modules. Targeting or masking just a few expert...
- It shows a lightweight, training-free attack (GateBreaker) can bypass safety checks in sparse MoE LLMs by targeting a small set of gating neurons, p...
- Highlights a new, practical attack surface: steering the internal routing of mixture-of-experts LLMs with crafted inputs to trigger unsafe behavior,...
- It shows a training-free method to bypass safety in mixture-of-experts LLMs by silencing the few experts that enforce refusals, letting harmful outp...
- It shifts safety from bluntly filtering data to using unsafe knowledge in a controlled way via a Mixture-of-Experts setup (SafeMoE), aiming for safe...
- It tackles safety sparsity in Mixture-of-Experts LLMs: safety capabilities sit in a few experts, creating easy bypass points for adversaries.
- It ...
- It presents a way to control how MoE-based models decide which experts to use at inference, by applying masks that steer behavior without retraining...
- Why it matters: In Mixture-of-Experts LLMs, safety gates rely on routing decisions that can drift under fine-tuning, creating a vulnerability to har...
Get the weekly digest
The few AI-security papers that matter, with the practitioner takeaway. No spam.
