Safety-Aligned Large Language Models

• Safety-aligned LLMs are systems with engineered generation policies that deflect harmful outputs using binary classifiers to steer internal reasoning.
• A neuron-level approach categorizes network units into exclusive safety, utility, complex, and redundant types, enabling targeted freezing and repurposing strategies.
• Continual learning strategies and interpretability studies demonstrate how robust, distributed safety mechanisms mitigate adversarial attacks and catastrophic forgetting.

Safety-aligned LLMs are systems in which the generation policy has been explicitly constrained or engineered to refuse, deflect, or otherwise avoid producing harmful or unaligned outputs. Safety alignment in contemporary LLMs primarily involves steering the model’s internal reasoning direction at each generation step, operationalizing safety via a binary classifier that distinguishes between safe and unsafe reasoning trajectories. Pivotal research demonstrates that safety properties in LLMs are implemented through a small number of crucial neuron-level components and can be reliably preserved—even under further fine-tuning or adversarial attacks—by targeting, freezing, or repurposing compact sets of critical neurons or subspaces (Li et al., 2024, Wang et al., 12 Feb 2026).

1. The Superficial Safety Alignment Hypothesis and Binary Safety Control

The Superficial Safety Alignment Hypothesis (SSAH) postulates that safety alignment in LLMs is fundamentally a task of teaching the model to detect, via internal classification, whether its reasoning in response to a user prompt is safe or unsafe, and to select an appropriate action (refuse or comply) accordingly. This is formalized as a reasoning-direction classifier

$$f: X \to \{0,1\}, \quad f(x) = \begin{cases} 1 & \text{if the internal reasoning path for } x \text{ is “safe”} \ 0 & \text{otherwise} \end{cases}$$

Safety-aligned models implement a refusal mechanism with a finite set of K canonical fallback options—with the refusal response $r_{k^*}$ chosen by a scoring function to prevent deterministically repetitive refusals. This framework reduces safety alignment to (a) internal safety classification and (b) policy-controlled response selection, sidestepping the need for highly complex or deeply entangled safety protocols (Li et al., 2024).

2. Neuron-Level Attribute-Critical Components

Empirical studies identify four categories of attribute-critical functional units at the neuron or channel level in safety-aligned LLMs:

• Exclusive Safety Units (ESU): Neurons with high activation variance on safety datasets but negligible activity on utility (general) datasets; typically only 1.3–1.4% of total neurons. They are solely responsible for refusal detection and harmful-query identification.
• Exclusive Utility Units (EUU): Neurons engaged exclusively by utility (QA, factual storytelling) tasks, representing 6–14% of neurons.
• Complex Units (CU): Neurons with moderate, shared variance across both safety and utility data (50–60% of all neurons), underpinning general reasoning and refuse-detection primitives.
• Redundant Units (RU): Low-importance neurons (6–15%) with near-zero variance on both safety and utility, prunable or available for repurposing (Li et al., 2024).

This typology enables neuron-level interventions for both robustifying and optimizing the safety–utility trade-off.

3. Neuron Freezing, Repurposing, and Distributed Safety

Systematic neuron-level ablation studies demonstrate that freezing a small subset of safety-critical neurons (the top 7.5% by safety importance: all ESUs and the top 6% of CUs by safety variance) during downstream task adaptation drastically reduces the attack success rate (ASR) spike induced by fine-tuning—from ΔASR ≈ +15% (unfrozen) to ΔASR ≈ +2–3%. Conversely, selectively repurposing 20% of RU neurons as an "alignment budget" supports rapid adaptation to new safety objectives with ≈1–2% or less loss in general utility, reducing alignment tax by leveraging unused network capacity (Li et al., 2024).

In the SafeNeuron framework (Wang et al., 12 Feb 2026), neuron-level safety alignment is rendered robust by

1. Identifying safety-critical neurons via statistical criteria (activation effect size, safety activation shift) using counterfactually unsafe and safe prompt calibrations,
2. Freezing these neurons during direct preference optimization (DPO), so DPO cannot "route around" existing safety circuits but must create redundant, distributed safety representations in the remaining network.

Empirically, freezing SafeNeuron-identified units robustly prevents neuron pruning attacks and yields distributed, stable internal safety representations, as shown by consistent performance preservation across LLaMA and Qwen model families (up to 14B parameters) and visual-LLMs. Notably, core/shared safety neurons are concentrated in middle and deeper layers, and redundancy-building via iterative preference optimization steadily improves worst-case ASR metrics (Wang et al., 12 Feb 2026).

4. Catastrophic Forgetting and Continual Safety-Preserving Learning

Standard downstream fine-tuning typically leads to severe degradation in safety alignment, a manifestation of catastrophic forgetting. By framing safety maintenance as a continual learning (CL) problem, one can enforce constraints that preserve safety as new tasks are incrementally added. State-of-the-art CL techniques include:

• Memory-based methods: e.g., Dark Experience Replay (DER), which replays logits from a buffer of safety examples and achieves ASR <3% under benign and <6% even under 10–30% poisoned downstream data, with ~1–2pp utility penalty.
• Regularization methods: e.g., Elastic Weight Consolidation (EWC), Learning without Forgetting (LwF), which constrain parameter drift from the safety-aligned reference.
• Model merging approaches: e.g., MagMax, which builds a merged parameter vector from safety and utility deltas per parameter (Alssum et al., 10 Dec 2025).

DER, in particular, dominates across LLaMA2, Mistral, and Gemma models, establishing practical SOTA for service-provider fine-tuning at scale.

5. Interpretability and Attack Surfaces in Safety Alignment

Contemporary research reveals that safety classifiers embedded by alignment methods are often localized in a small region of the network—sometimes as little as 20% of the decoder depth. This over-concentration creates single-point vulnerabilities: surrogate extraction of safety classifiers and white-box jailbreaks against extracted subnetworks yield disproportionately high ASR (e.g., surrogate attacks with 50% LLM layers raise ASR from 22% to 70%, and transfer with >90% fidelity) (Ferrand et al., 27 Jan 2025).

The GOSV analysis demonstrates that safety is not centralized in a single attention head but is distributed across approximately one-third of all attention heads, forming dual, spatially distinct “safety pathways” (Malicious Injection Vectors and Safety Suppression Vectors). Compromising these pathways through activation patching enables white-box jailbreaks that achieve near-total safety breakdown with only ≈30% of heads repatched. This distributed attack surface requires regularization and redundancy of safety circuits across heads to avoid catastrophic vulnerability (Chu et al., 22 Jan 2026).

6. Practical Protocols and Implications for Scalable Safety Alignment

Best practices for scalable and robust safety alignment, as grounded in the SSAH and neuron-level analyses, include:

• Pretraining with standard protocols followed by neuron-level attribution and categorization (ESU, EUU, CU, RU),
• Freezing all ESU plus ~6% of top CUs for any downstream adaptation; alternatively fine-tuning only a fraction of RU units for alignment with minimal impact,
• Iterative supervision (e.g., preference optimization) with neuron-freezing to force safety circuit redundancy,
• Auditing for concentration or over-specialization in internal safety classifiers, and distributing safety via targeted regularization at multiple depths and across attention heads,
• Integrating memory-based continual learning strategies for safety retention under multi-stage task adaptation (Li et al., 2024, Wang et al., 12 Feb 2026, Alssum et al., 10 Dec 2025, Ferrand et al., 27 Jan 2025, Chu et al., 22 Jan 2026).

Neuron-level freezing and task-specific allocation of redundant units yield >80% reduction in alignment compute budgets while minimizing impact on utility. Mechanistic interpretability and distributed safety mechanisms are required to defend against emergent white-box and surrogate-based jailbreak attacks.

---

References:

• "Superficial Safety Alignment Hypothesis" (Li et al., 2024)
• "SafeNeuron: Neuron-Level Safety Alignment for LLMs" (Wang et al., 12 Feb 2026)
• "Unforgotten Safety: Preserving Safety Alignment of LLMs with Continual Learning" (Alssum et al., 10 Dec 2025)
• "Targeting Alignment: Extracting Safety Classifiers of Aligned LLMs" (Ferrand et al., 27 Jan 2025)
• "Attributing and Exploiting Safety Vectors through Global Optimization in LLMs" (Chu et al., 22 Jan 2026)