Mask2Shield: Strengthening LLM Safety against Neuron-Pruning Attacks

2026/07/25 by Ying JinCheng, Minghui Xu, Yinhao Xiao +2
#cs.CR

paper · pdf

Abstract

Large language models (LLMs) are safety-aligned before deployment to reduce harmful content generation. Yet neuron-level pruning attacks show that refusal can depend on a small set of removable units: disabling them can remove safety behavior while leaving much of the model usable. To address this problem, we introduce Mask2Shield (M2S), a masked-forward alignment method that trains a model under this functional pruning. The masked student must recover a safe refusal through the remaining computation, while a frozen, unmasked teacher supplies complete benign answers to limit capability drift. Across ten model configurations, M2S reduces successful recomputed pruning attacks from 80--279 to 1--44 out of 313 prompts while generally preserving four capability benchmarks. We also evaluate M2S with TwinBreak, which uses a different neuron-selection rule and iterative pruning procedure. Together, these results show that M2S makes targeted pruning less effective by reducing reliance on a small, removable safety-neuron set.

Citations

• Beyond Surface Alignment: Rebuilding LLMs Safety Mechanism via Probabilistically Ablating Refusal Direction
• NeuroStrike: Neuron-Level Attacks on Aligned LLMs
• NeuronTune: Fine-Grained Neuron Modulation for Balanced Safety-Utility Alignment in LLMs
• TwinBreak: Jailbreaking LLM Security Alignments based on Twin Prompts
• NeuRel-Attack: Neuron Relearning for Safety Disalignment in Large Language Models
• Qwen2.5 Technical Report
• Phi-4 Technical Report
• The Llama 3 Herd of Models
• External Invariants: A Cryptographic Trust Architecture for Institutional AI Inference
• BlockPruner: Fine-grained Pruning for Large Language Models
• JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Models
• Gemma: Open Models Based on Gemini Research and Technology
• ShortGPT: Layers in Large Language Models are More Redundant Than You Expect
• A StrongREJECT for Empty Jailbreaks
• HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal
• Jailbreaking Black Box Large Language Models in Twenty Queries
• Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!
• AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models
• Universal and Transferable Adversarial Attacks on Aligned Language Models
• Direct Preference Optimization: Your Language Model is Secretly a Reward Model
• Affective Coherence Monitoring for Transformer-Based Language Models
• Training language models to follow instructions with human feedback
• Training Verifiers to Solve Math Word Problems
• TruthfulQA: Measuring How Models Mimic Human Falsehoods
• Think you have Solved Question Answering? Try ARC, the AI2 Reasoning Challenge

Related

• NeuroStrike: Neuron-Level Attacks on Aligned LLMs
• Defense Against LLM Backdoors using Critical Neuron Isolation Pruning
• NeuRel-Attack: Neuron Relearning for Safety Disalignment in Large Language Models
• NeuronTune: Fine-Grained Neuron Modulation for Balanced Safety-Utility Alignment in LLMs
• NLSR: Neuron-Level Safety Realignment of Large Language Models Against Harmful Fine-Tuning