SafeSeek: Universal Attribution of Safety Circuits in Language Models

Miao Yu, Siyuan Fu, Moayad Aloqaily, Zhenhong Zhou, Safa Otoum, Xing Fan, Kun Wang, Yufei Guo, Qingsong Wen
Proceedings of the 43rd International Conference on Machine Learning, PMLR 306:150235-150254, 2026.

Abstract

Mechanistic interpretability reveals that safety-critical behaviors (e.g., alignment, jailbreak, backdoor) in Large Language Models (LLMs) are grounded in specialized functional components. However, existing safety attribution methods struggle with generalization and reliability due to their reliance on heuristic, domain-specific metrics and search algorithms. To address this, we propose SafeSeek, a unified safety interpretability framework that identifies functionally complete safety circuits in LLMs via optimization. Unlike methods focusing on isolated heads or neurons, SafeSeek introduces differentiable binary masks to extract multi-granular circuits through gradient descent on safety datasets, while integrates Safety Circuit Tuning to utilize these sparse circuits for efficient safety fine-tuning. We validate SafeSeek in two key scenarios in LLM safety: (1) backdoor attacks, identifying a backdoor circuit with 0.42% sparsity, whose ablation eradicates the Attack Success Rate (ASR) from 100% $\to$ 0.4% while retaining over 99% general utility; (2) safety alignment, localizing an alignment circuit with 3.03% heads and 0.79% neurons, whose removal spikes ASR from 0.8% $\to$ 96.9%, whereas excluding this circuit during helpfulness fine-tuning maintains 96.5% safety retention.

Cite this Paper

BibTeX
@InProceedings{pmlr-v306-yu26k, title = {{S}afe{S}eek: Universal Attribution of Safety Circuits in Language Models}, author = {Yu, Miao and Fu, Siyuan and Aloqaily, Moayad and Zhou, Zhenhong and Otoum, Safa and Fan, Xing and Wang, Kun and Guo, Yufei and Wen, Qingsong}, booktitle = {Proceedings of the 43rd International Conference on Machine Learning}, pages = {150235--150254}, year = {2026}, editor = {Zhang, Tong and Dudik, Miroslav and Jaggi, Martin and Agarwal, Alekh and Li, Sharon and Schuurmans, Dale and Zhu, Jerry and Berkenkamp, Felix and Dong, Hanze and Bietti, Alberto}, volume = {306}, series = {Proceedings of Machine Learning Research}, month = {06--11 Jul}, publisher = {PMLR}, pdf = {https://raw.githubusercontent.com/mlresearch/v306/main/assets/yu26k/yu26k.pdf}, url = {https://proceedings.mlr.press/v306/yu26k.html}, abstract = {Mechanistic interpretability reveals that safety-critical behaviors (e.g., alignment, jailbreak, backdoor) in Large Language Models (LLMs) are grounded in specialized functional components. However, existing safety attribution methods struggle with generalization and reliability due to their reliance on heuristic, domain-specific metrics and search algorithms. To address this, we propose SafeSeek, a unified safety interpretability framework that identifies functionally complete safety circuits in LLMs via optimization. Unlike methods focusing on isolated heads or neurons, SafeSeek introduces differentiable binary masks to extract multi-granular circuits through gradient descent on safety datasets, while integrates Safety Circuit Tuning to utilize these sparse circuits for efficient safety fine-tuning. We validate SafeSeek in two key scenarios in LLM safety: (1) backdoor attacks, identifying a backdoor circuit with 0.42% sparsity, whose ablation eradicates the Attack Success Rate (ASR) from 100% $\to$ 0.4% while retaining over 99% general utility; (2) safety alignment, localizing an alignment circuit with 3.03% heads and 0.79% neurons, whose removal spikes ASR from 0.8% $\to$ 96.9%, whereas excluding this circuit during helpfulness fine-tuning maintains 96.5% safety retention.} }
Endnote
%0 Conference Paper %T SafeSeek: Universal Attribution of Safety Circuits in Language Models %A Miao Yu %A Siyuan Fu %A Moayad Aloqaily %A Zhenhong Zhou %A Safa Otoum %A Xing Fan %A Kun Wang %A Yufei Guo %A Qingsong Wen %B Proceedings of the 43rd International Conference on Machine Learning %C Proceedings of Machine Learning Research %D 2026 %E Tong Zhang %E Miroslav Dudik %E Martin Jaggi %E Alekh Agarwal %E Sharon Li %E Dale Schuurmans %E Jerry Zhu %E Felix Berkenkamp %E Hanze Dong %E Alberto Bietti %F pmlr-v306-yu26k %I PMLR %P 150235--150254 %U https://proceedings.mlr.press/v306/yu26k.html %V 306 %X Mechanistic interpretability reveals that safety-critical behaviors (e.g., alignment, jailbreak, backdoor) in Large Language Models (LLMs) are grounded in specialized functional components. However, existing safety attribution methods struggle with generalization and reliability due to their reliance on heuristic, domain-specific metrics and search algorithms. To address this, we propose SafeSeek, a unified safety interpretability framework that identifies functionally complete safety circuits in LLMs via optimization. Unlike methods focusing on isolated heads or neurons, SafeSeek introduces differentiable binary masks to extract multi-granular circuits through gradient descent on safety datasets, while integrates Safety Circuit Tuning to utilize these sparse circuits for efficient safety fine-tuning. We validate SafeSeek in two key scenarios in LLM safety: (1) backdoor attacks, identifying a backdoor circuit with 0.42% sparsity, whose ablation eradicates the Attack Success Rate (ASR) from 100% $\to$ 0.4% while retaining over 99% general utility; (2) safety alignment, localizing an alignment circuit with 3.03% heads and 0.79% neurons, whose removal spikes ASR from 0.8% $\to$ 96.9%, whereas excluding this circuit during helpfulness fine-tuning maintains 96.5% safety retention.
APA
Yu, M., Fu, S., Aloqaily, M., Zhou, Z., Otoum, S., Fan, X., Wang, K., Guo, Y. & Wen, Q.. (2026). SafeSeek: Universal Attribution of Safety Circuits in Language Models. Proceedings of the 43rd International Conference on Machine Learning, in Proceedings of Machine Learning Research 306:150235-150254 Available from https://proceedings.mlr.press/v306/yu26k.html.

Related Material