{"id":"5476941c-4f9c-4310-b891-af027bdc0396","arxiv_id":"2607.28969","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":3,"one_line_summary":"Multimodal LLMs have a compact set of shared safety neurons across text, image, and audio; steering them improves cross-modal jailbreak defense with little utility loss.","lead":"This paper identifies a small set of 'universal safety neurons' shared across text, image, and audio in multimodal AI models, and shows that amplifying or fine-tuning just those neurons makes models refuse harmful requests more reliably across input types. It offers a lightweight, interpretable defense for multimodal safety and a concrete step toward understanding where safety behavior is stored in these models.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Probing prefix confound: US-Neurons may encode the safety instruction prefix, not modality-universal harmful semantics; the normal control is not prefix-matched.","rationale":"The reader's weakest assumption is exactly the load-bearing issue. The prefix confound attacks the central claim's validity, not just the strength of effect sizes. The paper's independent support—random-neuron masking controls, random-neuron LoRA comparisons, and zero-shot video transfer—does not rule it out: random neurons are not exposed to the prefix, so they cannot control for instruction-following neurons; the zero-shot video transfer could still be explained by amplifying a generic refusal-instruction circuit triggered by the video text prompt. I do not elevate secondary issues (missing error bars, unverified gradient-agreement assumption in Appendix 3) because those affect confidence intervals and theoretical framing, whereas the prefix confound determines whether the object being steered is actually a modality-universal safety neuron. A matched-prefix control is cheap and decisive, so the correct verdict remains CONDITIONAL as the reader already assigned.","tokens_in":23848,"tokens_out":4996,"duration_ms":45885,"concrete_test":"Re-run the §3.2 probing with a matched control: prepend a non-safety instruction prefix of similar length and illocutionary force (e.g., \"The following request is a hypothetical scenario. Analyze it in detail.\") to the D_normal corpus, or prepend a neutral prefix to both D_unsafe and D_normal. Then recompute BS_T/I/A and US and repeat the Table 2 masking and §3.4 steering experiments. If the US set largely disappears or its suppression/amplification effects shrink to the random-neuron baseline, the original results are driven by the safety-prefix confound rather than modality-universal safety neurons.","verdict_should_be":"UNCHANGED","load_bearing_attack":"In §3.2, the unsafe probing corpus D_unsafe is formed by prepending the instruction \"The following request is harmful or unsafe. Do not answer it directly...\" to every harmful query, while D_normal contains no such prefix. Importance scoring (Eq. 2-3) ranks neurons by mean activation, and the BS set is computed as S(D_unsafe) \\ S(D_normal). Because the prefix is present in all three modality-specific unsafe corpora and absent from all normal corpora, any neuron sensitive to this instruction—or to the meta-linguistic cue \"harmful/unsafe\"—will survive the set difference and appear in BS_T, BS_I, and BS_A. Intersecting these sets to define US (Eq. 5) will therefore select for prefix/refusal-instruction neurons, and the claimed \"modality universality\" may be an artifact of a shared textual prompt rather than evidence for shared cross-modal safety semantics. The masking experiments in Table 2 are consistent with this: suppressing refusal-instruction neurons should degrade safety, and the amplifier/calibrator could work by strengthening a refusal-following circuit, not by steering modality-universal safety neurons. Appendix Q1 acknowledges the design choice but only argues that adding the prefix to benign queries would activate safety mechanisms; it does not test whether the identified neurons respond to the prefix rather than to harmful content. This concern is load-bearing because the central discovery claim—that a compact shared subset of neurons governs cross-modal safety—depends entirely on the probing step.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper presents SafeNexus, a neuron-level safety alignment framework for multimodal LLMs. It locates modality-bound safety neurons (BS-Neurons) as neurons that rank in the top 3% by activation-weighted importance on harmful probes but not on benign probes (§3.2), defines modality-universal safety neurons as the three-way intersection US = BS_T ∩ BS_I ∩ BS_A (§3.3), and provides masking evidence that these neurons are causally relevant to safety. It then proposes two interventions: an activation amplifier (Eq. 6, α=2) and a LoRA calibrator restricted to US-Neurons (Eqs. 7–9, ~0.05% parameters). Across Qwen2.5-Omni-7B, VITA-1.5, and MiniCPM-o-2.6, the methods reportedly reduce ASR by tens of points on Omni-Safe, Lingua-Safe, JALM, and HarmBench with modest utility change, including zero-shot transfer to video. The Appendix provides a potential theory of the calibrator and acknowledges limitations.","tokens_in":24278,"tokens_out":6592,"duration_ms":60311,"significance":"If the discovery claim is taken at face value, the paper would be a meaningful advance: it suggests a compact, cross-modally shared safety substrate and gives two cheap interventions with consistent large gains across three model families. The design has real strengths: random-neuron controls are layer-wise matched, the zero-shot video experiment is informative, and the 0.05% parameter budget is well documented. The main caveat is that the identification procedure is confounded by a fixed safety-instruction prefix present in all unsafe probes and absent from all normal probes (Appendix Q1), so the 'universality' and even the 'safety-semantic' interpretation of US-Neurons are not established. The theoretical analysis in Appendix 3 also states rather than verifies its key assumptions. These issues are addressable and do not, in my view, invalidate the empirical engineering contribution.","major_comments":[{"comment":"The identification of BS-Neurons is confounded by the probing prefix. D_unsafe prepends a fixed safety-oriented instruction ('The following request is harmful or unsafe...'), whereas D_normal contains no such prefix. Because the same prefix appears in all three modality-specific unsafe corpora and in none of the normal corpora, any neuron sensitive to this instruction survives the set difference in Eq. (4) and is therefore included in BS_T, BS_I, and BS_A, hence in US by Eq. (5). The masking results in Table 2 and the amplification results are then equally consistent with US being a set of 'refusal-instruction following' neurons rather than neurons that encode modality-universal harmful semantics. Appendix Q1 acknowledges the design choice but only argues that adding the prefix to benign queries would activate safety mechanisms; it does not test whether the identified neurons respond to","section":"§3.2, Eq. (4)–(5); Appendix Q1"},{"comment":"The theoretical analysis of the calibrator is conditional on unverified assumptions. Eq. (14) asserts χζ=⟨vζ,v_cal⟩>0 for every modality configuration, and Eq. (16) asserts ∥Q_US∇_θV∥_2≤υ with 'υ is small'. Neither quantity is measured or derived from the neuron-localization procedure. With these assumptions inserted, the Taylor argument merely restates that updating in a direction that agrees with all safety gradients improves safety, and that updating in a direction to which the utility gradient has small projection preserves utility. I recommend computing the cosine similarities between v_cal and v_ζ, and the projected utility gradient norm, empirically, or at least reporting the distribution of these quantities; otherwise the theory does not discriminate SafeNexus from random-subspace calibration.","section":"Appendix 3, Eqs. (13)–(16)"},{"comment":"All ASR values appear to be single-run point estimates. Given that masking/amplification deltas are the central evidence, the lack of error bars or multiple seeds makes it hard to judge whether the reported differences are reliable. The hyperparameters p and α are selected using the same safety benchmarks (Figure 3 on Omni-Safe, Figure 4 on Omni-Safe/OmniBench), raising a selection-on-test-set concern. Please report mean±std over at least three seeds for the main comparisons, and separate hyperparameter selection from the final evaluation.","section":"Tables 1–6; Figs. 3–4"}],"minor_comments":[{"comment":"Please clarify whether activations are averaged before multiplication by W_down, and define the per-layer notation S_l explicitly in the text. The current description of the top-p selection is clear in prose but the equations do not carry the layer index.","section":"§3.1, Eq. (3)"},{"comment":"The table is hard to read because the baseline ASR is embedded in the delta notation. Adding an explicit Default column or a separate baseline row would improve interpretability.","section":"Table 3"},{"comment":"The text says 'larger values introduce safety degradation and utility decline' but does not discuss why over-amplification is harmful. A sentence on the suspected mechanism would be useful.","section":"§4.3 / Fig. 4"},{"comment":"The stated limitation that intra-family consistency has not been studied is appreciated; given that limitation, I suggest softening the word 'universal' in the title and abstract, or adding a model-scale ablation to support it.","section":"Appendix 5"}],"recommendation":"major_revision","confidential_remarks":"The paper's empirical results are impressive if the prefix confound can be ruled out. I would ask the authors to rerun identification with a prefix-matched control or no-prefix unsafe probes, and to provide error bars. If the US set collapses under those conditions, the paper should be reframed as steering refusal-prompt-following neurons, and the discovery-of-universal-safety-neurons claim removed. Fit to the venue is otherwise appropriate; the current evidence supports a major revision rather than rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: if you work on multimodal safety, this is worth a read. The paper proposes SafeNexus, which identifies a small set of neurons shared across text, image, and audio modalities, and then shows that amplifying or lightly fine-tuning those neurons substantially improves cross-modal safety without hurting general utility. The empirical work is unusually thorough: three model families, multiple benchmarks, masking and random-neuron controls, a zero-shot transfer to video, and a comparison against a large set of baselines. The two steering strategies are pragmatic and the 0.05% parameter budget is striking. I believe the main empirical claims — that suppressing these neurons raises attack success rate and that steering them lowers it — will replicate. The paper is honest, too; the appendix acknowledges the probing choice and lays out limitations clearly.\n\nThe soft spot is the one the stress-test note flags, and it is load-bearing. The unsafe probing corpus gets the instruction \"The following request is harmful or unsafe. Do not answer it directly...\" while the normal corpus gets no such prefix. So the importance scoring and the set difference BS = S(unsafe) \\ S(normal) are likely selecting neurons that respond to the refusal instruction, not necessarily to harmful semantic content. And because the same prefix is present in all three modality-specific unsafe corpora, the intersection US = BS_T ∩ BS_I ∩ BS_A will be enriched for prefix-following neurons. The masking experiments are consistent with that reading: suppressing refusal-instruction followers should degrade safety. The authors' defense in Q1 is not enough; they need a prefix-matched normal control, or a control where the prefix is added to both harmful and benign inputs. Without that control, the central claim of modality-universal safety neurons is not established.\n\nOther issues are real but secondary. No error bars or seed variance anywhere in the main tables. Hyperparameters (p, α) are tuned on the evaluation benchmarks, and the random-neuron amplification baseline is missing. The theoretical appendix in Appendix 3 is a Taylor-expansion plausibility argument, not a proof; the gradient-agreement condition χζ > 0 is assumed, not verified. That is fine if presented as intuition, but it should not read like a theorem.\n\nBottom line: this is a strong candidate for peer review, not a desk reject. The defense itself is useful and probably works. But the mechanistic interpretation needs the prefix-matched control, and the claims should be scaled down until that control is run. If I were the editor, I would send it out with a request for that experiment plus seed variance.\n\nWho benefits: researchers working on MLLM safety or interpretability. I would bring it to a reading group, and I might cite the practical steering result, but I would not cite the universality claim as established.","headline":"A well-run empirical paper with a genuinely useful defense mechanism, but the central mechanistic discovery claim is weakened by a probing confound that needs to be fixed before publication.","tokens_in":24668,"tokens_out":1289,"would_cite":false,"duration_ms":13337,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"SafeNexus: a compact set of modality-universal safety neurons governs cross-modal safety in MLLMs, and reinforcing these neurons sharply reduces harmful responses across text, image, audio, and video.","keywords":["multimodal large language models","safety alignment","safety neurons","cross-modal jailbreak","activation steering","LoRA calibration","mechanistic interpretability"],"falsifier":"Probe the model with harmful examples both with and without the safety-oriented prefix, and with benign examples both with and without it; if the US-Neuron set changes substantially across these conditions, or if suppressing the original US-Neurons no longer raises attack success rate when the prefix is removed from the probes, the claimed universality is an artifact of the probing prompt.","tokens_in":23747,"feed_emoji":"🛡️","tokens_out":5870,"duration_ms":48515,"temperature":0.7,"pith_summary":"The paper claims that safety behavior in multimodal large language models is governed by a small, shared subset of neurons—called US-Neurons—that respond to harmful intent regardless of whether it arrives as text, image, audio, or combinations. It identifies these neurons by contrasting activation patterns on harmful versus benign inputs within each modality and then intersecting the modality-specific sets. Suppressing this compact set degrades safety across all modalities by roughly 16–22 points on attack success rate while leaving general capability nearly unchanged, which the paper reads as causal evidence for a shared safety substrate. Building on that, SafeNexus reinforces US-Neurons either by amplifying their activations at inference (training-free) or by confining LoRA fine-tuning to them (~0.05% of backbone parameters), cutting attack success rates by up to tens of points across benchmarks while preserving utility and avoiding over-refusal. If correct, this would mean cross-modal safety can be improved through sparse, interpretable neuron-level interventions rather than full retraining or modality-specific shields.","feed_headline":"A tiny neuron set controls cross-modal LLM safety","feed_subtitle":"SafeNexus finds universal safety neurons and shows that amplifying or tuning them cuts attack success by up to tens of points.","key_machinery":"The central object is the modality-universal safety neuron set, US-Neurons, obtained by intersecting modality-bound safety neuron sets (BS-Neurons) discovered separately for text, image, and audio. Neurons are localized as individual rows of an FFN's up/gate projections; their importance is scored as the norm of the averaged activation over a probing corpus multiplied by the corresponding down-projection column, S(N_i^l;D)=||Act(N_i^l;D)·W_down[:,i]||_2, keeping the top p=3% per layer. BS-Neurons for a modality are the unsafe-induced candidates minus the normal-induced candidates. The two intervention mechanisms are an activation-level amplifier, which multiplies US-Neuron activations by (1+","core_discovery":"SafeNexus's central discovery is that cross-modal safety in MLLMs is predominantly controlled by a compact, modality-universal set of safety neurons, defined as US = BS_T ∩ BS_I ∩ BS_A, where each BS set is the top-3% of FFN neurons per layer whose output-aware activation importance is elevated on harmful inputs but not on benign ones. The paper validates the role of these neurons through targeted suppression: masking US-Neurons raises attack success rate by 16–22 points across text, image, audio, and combined settings while utility stays flat, whereas masking equal-sized random neurons has almost no effect. It then shows that reinforcing these same neurons—by scaling their activations with","pith_inferences":["A direct control that applies the same safety-oriented refusal prefix to both harmful and normal probing corpora would isolate whether US-Neurons encode harmful semantics or merely refusal-instruction following; the current protocol leaves this open.","The intersection definition makes US-Neurons smaller as more modalities are added; for a truly universal safety anchor the set should remain stable and effective across modalities, which could be tested by measuring how suppression effects scale as the intersection shrinks.","If the sparse-subspace story generalizes, the locate-then-reinforce recipe may apply to other high-level capabilities (factuality, bias, reasoning) and to future input modalities, making neuron-level intervention a general tool for controlling model behavior.","The zero-shot video result suggests the neurons capture modality-agnostic harmful semantics; a further test would be cross-lingual transfer of the same US-Neuron intervention."],"forward_implications":["If US-Neurons are the shared safety substrate, then suppressing them should (and does) raise attack success rate by 16–22 points across text, image, audio, and combined modalities while leaving utility essentially unchanged.","Amplifying US-Neuron activations at inference (α=2) should reduce attack success rate across multimodal configurations with no training and minimal over-refusal; the paper reports reductions up to roughly 40–60 points on several combinations.","Confining LoRA updates to US-Neurons (~0.05% of backbone parameters) should outperform full fine-tuning and unconstrained LoRA on safety benchmarks while preserving general capability—evidence that the sparse subspace, not parameter count, drives safety alignment.","Because the identified neurons are modality-universal, the same reinforcement transfers zero-shot to a modality never seen in probing or training (video), reducing attack success rate without adaptation.","Cross-modal safety can be improved without trading off utility or inducing over-refusal, so neuron-level steering may be a safer default for aligning new multimodal models than broad fine-tuning."],"fun_headline_variants":["Safety hinge: small neuron group guards all modalities","Modality-proof safety: tune few neurons, block attacks","Universal safety neurons found in MLLMs","One neuron set, all-modal defense"],"cache_read_input_tokens":2304,"weakest_assumption_plain":"The load-bearing premise is that the contrastive probing isolates neurons that respond to harmful content itself; because harmful probes carry a safety-oriented refusal prefix while normal probes do not, the identified 'safety neurons' could instead be neurons that detect and follow that refusal instruction.","fun_headline_variants_meta":{"raw":{"variants":["Safety hinge: small neuron group guards all modalities","Modality-proof safety: tune few neurons, block attacks","Universal safety neurons found in MLLMs","One neuron set, all-modal defense"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000525,"raw_usage":{"total_tokens":2406,"prompt_tokens":813,"completion_tokens":1593,"prompt_tokens_details":{"cached_tokens":256},"prompt_cache_hit_tokens":256,"prompt_cache_miss_tokens":557,"completion_tokens_details":{"reasoning_tokens":1544}},"tokens_in":557,"tokens_out":1593,"duration_ms":11860,"temperature":1.0,"reasoning_tokens":1544,"cache_read_input_tokens":256,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-03T16:16:08.141005+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Probe the model with harmful examples both with and without the safety-oriented prefix, and with benign examples both with and without it; if the US-Neuron set changes substantially across these conditions, or if suppressing the original US-Neurons no longer raises attack success rate when the prefix is removed from the probes, the claimed universality is an artifact of the probing prompt.","supporting_citations":[],"review_version":1}