{"id":"ceadb6ec-19e1-4435-aea8-3a61f3c93190","arxiv_id":"2608.09095","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":7,"one_line_summary":"Safety refusals travel through shared cross-lingual 'pathways' inside LLMs, and fine-tuning only those pathway parameters (under 1%) sharply improves low-resource-language safety.","lead":"The paper finds that large language models route safety refusals through sparse cross-layer 'pathways,' and that high- and low-resource languages share a small bridge of these pathways. Updating only the parameters on this bridge, less than 1% of the model, sharply improves refusal of harmful queries in low-resource languages without hurting general performance.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 'bridge' claim rests on an untested gradient-support assumption; a direct ablation of shared vs. HR-exclusive pathway masks would settle whether P* is truly the transfer locus.","rationale":"The reader's weakest-assumption analysis identifies Appendix A Eq. (10) as the linchpin of the theoretical bridge argument, and I find this is indeed the most load-bearing concern. The paper's title-level claim is that the shared pathway P* is what bridges safety across languages; that claim is formally derived only through the gradient-support assumption. The empirical masking of P* shows that it is causally important, but causal importance is not the same as exclusivity of the transfer route. A direct three-arm ablation comparing shared-only, HR-exclusive, and full-HR masks is the cleanest way to adjudicate: it tests whether P* is necessary for the observed NHR safety gain or merely one useful subset of a larger HR safety pathway. Importantly, this concern does not undermine the paper's demonstrated practical contribution: the controlled comparisons against random-pathway tuning, importance-matched control neurons, leave-one-language-out transfer, and over-refusal checks provide genuine support for the claim that pathway-targeted fine-tuning improves NHR safety with very few updated parameters. The main caveats are the unverified gradient-support assumption and the absence of released code or error bars, both of which are addressable rather than fatal. I therefore agree with the reader's CONDITIONAL verdict and see no reason to move it.","tokens_in":21868,"tokens_out":5385,"duration_ms":68382,"concrete_test":"Run a three-arm mask ablation on each NHR language λ, using the same cross-lingual training data and hyperparameters: (1) update only m = P*_λ (shared pathway), (2) update only m = P_HR \\ P*_λ (HR-exclusive pathway), and (3) update only m = P_HR (full proposed method), matching parameter counts across arms as closely as possible. If arm (1) alone reproduces most of the ASR reduction of arm (3), the shared-bridge claim is supported. If arm (2) alone yields comparable NHR safety improvement, then the shared pathway is not the necessary transfer locus and the central mechanistic claim fails, even though the proposed fine-tuning method may still be effective.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The paper's central mechanistic claim—that the sparse shared pathway P*_lambda = P_lambda ∩ P_HR is the internal bridge through which safety capabilities transfer from HR to NHR languages—is not established by the current experiments. The first-order argument in Appendix A depends on Eq. (10): that each language's safety gradient is primarily supported on its own identified pathway, i.e., ∂_j L_NHR ≈ 0 for j ∉ P_NHR. Only under this assumption does Eq. (13) collapse to a sum over P*, making the shared intersection the dominant contributor to ΔL_NHR in Eq. (16). This assumption is never independently verified. The masking experiments show that P_lambda and P*_lambda are causally relevant to refusal behavior, but output-level causal importance does not imply that the NHR safety gradient has negligible support outside P_NHR. Without Eq. (10), updating HR-only pathway parameters P_HR \\ P* could reduce NHR loss directly, and the conclusion that transfer necessarily routes through P* does not follow. In that case the shared pathway may simply be the most predictive common refusal circuitry, not a distinct 'bridge'. The practical alignment result—under 1% of parameters improving NHR safety—is well supported by the random-pathway and importance-matched controls, so this concern targets the mechanistic interpretation and the theoretical explanation, not the empirical utility.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes to identify cross-layer 'safety pathways' in multilingual LLMs by first localizing safety neurons via contrastive gradient–activation attribution and then connecting them through co-activation and activation-propagation edges. It defines a shared safety pathway P*_lambda = P_lambda ∩ P_HR for each non-high-resource language, validates its causal relevance by masking interventions, and uses it to design a pathways-targeted fine-tuning method that updates only a small fraction of parameters (Eq. 8). Experiments on Gemma-2-9B-it, Llama-3.1-8B-it, and Qwen3-8B, evaluated on AdvBench-x and MultiJail, report state-of-the-art NHR safety ASR with preserved general ability, supported by ablations including random-pathway tuning, importance-matched controls, and leave-one-language-out transfer.","tokens_in":22162,"tokens_out":5998,"duration_ms":67322,"significance":"If the central mechanistic claim holds, the paper offers a practical and interpretable route to improving multilingual safety with under 1% parameter updates, and it moves beyond isolated-neuron analyses to a genuinely cross-layer account. The empirical core is well controlled: random-pathway masking and random-pathway tuning, importance-matched control neurons, and leave-one-language-out transfer are all appropriate comparisons, and the leave-one-out result is a strong falsifiable prediction. The theoretical explanation, however, rests on an untested gradient-support assumption in Appendix A, and the headline SOTA comparisons are reported without variance. The mechanism claim and the empirical utility claim should therefore be separated in the revision.","major_comments":[{"comment":"The assumption that each language's safety gradient is primarily supported on its own pathway, ∂_j L_NHR ≈ 0 for j ∉ P_NHR, is load-bearing: it is what reduces Eq. (13) to Eq. (14) and produces the P*-only conclusion in Eq. (16). The masking experiments in Tables 1–2 demonstrate that P_NHR and P* are causally relevant to refusal behavior, but causal importance does not imply negligible gradient support on the complement. Without Eq. (10), updating P_HR \\ P* could reduce L_NHR directly, so the claim that transfer necessarily routes through P* is not established. I recommend a direct test: compare updating (or masking) P* versus P_HR \\ P* with matched parameter counts, and/or measure the gradient norm of L_NHR on the complement of P_NHR. If HR-exclusive pathway updates also reduce NHR loss, the 'bridge' claim should be weakened to 'shared pathway is predictive common circuitry'.","section":"Appendix A, Eq. (10)"},{"comment":"All ASR entries are single runs without variance or significance tests, yet several headline margins over the strongest baseline are small: on Llama-3.1-8B-it the advantages are 0.81% on AdvBench-x and 0.69% on MultiJail, and on Gemma-2-9B-it they are 0.81% and 1.01%. Since ASR from different random seeds and evaluation subsets can easily vary by more than one percentage point, the 'state-of-the-art' claim is not statistically supported. Report means and standard deviations over at least three seeds for the main comparisons in Tables 3 and 5, or provide bootstrap confidence intervals.","section":"Table 3"},{"comment":"The construction of the binary parameter mask m from the identified pathway sets is underspecified. A co-activation edge e_{ℓ,i→j} connects two FFN channels in adjacent layers; it is unclear whether the mask covers the up-projection/down-projection weights of neuron i, neuron j, or both, and how the same neuron participating in many edges is handled. This mapping is the core of the proposed method and must be precise for reproducibility; please give the exact rule that turns Pλ into the parameter index set used in Eq. (8).","section":"Section 4, Eq. (8)"}],"minor_comments":[{"comment":"The axis labels 'E/glyph1197' and 'B/glyph1197' are rendering artifacts; please replace them with clear text such as 'English' and 'Bengali'.","section":"Figure 6"},{"comment":"The shared-pathway notation is introduced as P⋆_λ = P_λ ∩ P_HR in Section 3.3 but later used as P⋆ = P_HR ∩ P_NHR in Appendix A; unify the subscript convention and define P⋆_λ consistently.","section":"Section 3.3 / Appendix A"},{"comment":"The '#N' value for Ours on Gemma-2-9B-it (3,971) is not the sum of ActProp Pathways (108) and CoAct Pathways (3,923); clarify whether the union has overlaps and how the final pathway count is computed.","section":"Table 4"},{"comment":"The sensitivity analysis varies s_min, z_min, r_min, and ρ, but not the per-layer top-k% or the significance level α; please justify why the fixed values for those two hyperparameters are sufficient.","section":"Appendix B"},{"comment":"The human evaluation is reported only as 'average agreement exceeded 86%'; provide per-language agreement rates, sample sizes, and annotator counts to substantiate the judge reliability claim.","section":"Appendix G"},{"comment":"The leave-one-language-out experiment is run on a single backbone (Gemma-2-9B-it); including at least one additional backbone would make the zero-shot transfer claim considerably more robust.","section":"Table 6"}],"recommendation":"major_revision","confidential_remarks":"The manuscript's title and abstract closely parallel the SS-Neuron baseline (Zhang et al. 2026, 'Who Transfers Safety? Identifying and Targeting Cross-Lingual Shared Safety Neurons'), which is also by overlapping authors. The pathway-level contribution is a genuine extension, but the editor may wish to verify that the novelty disclosure clearly positions this work relative to that prior paper. Additionally, no code is provided; given the many hyperparameters in pathway identification, releasing code or a detailed pseudocode would substantially de-risk reproducibility."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Quick take: this is a credible, well-controlled empirical paper that meaningfully extends the safety-neuron line of work to cross-layer pathways. The practical result—updating under 1% of parameters on HR safety pathways improves NHR refusal substantially—survives the controls the authors ran, including random-pathway tuning, importance-matched control neurons, and leave-one-language-out transfer. I would not desk-reject this.\n\nWhat is new: the construction of safety pathways from co-activation and activation-propagation, the shared intersection P*, and the demonstration that pathway-level tuning beats neuron-level tuning with fewer parameters. The importance-matched control in Appendix G is the right kind of control, and it holds. The sensitivity analysis on pathway-identification hyperparameters is also a plus, and the over-refusal check is honest.\n\nThe soft spot is the mechanistic claim. Appendix A's Eq. (10) assumes each language's safety gradient is supported on its own identified pathway. That is close to the conclusion the theory is meant to establish, and the masking experiments do not independently verify it. Masking P* shows it causally matters for refusal, but it does not show NHR loss gradients are negligible outside P_NHR. So the 'internal bridge' claim is plausible but not proven; P* might be the most predictive common refusal circuitry rather than a distinct transfer channel. The authors themselves walk this back a little in Appendix H by calling it a behaviorally sufficient pathway, but the main text leans on the bridge language more than the evidence supports.\n\nMinor issues: ASR tables are single runs without variance, and no code is released. Both are fixable. The gradient-support assumption is the one thing that needs a direct test—for example, comparing masks over shared pathways versus HR-only pathways, and measuring where the NHR loss gradient actually sits after training.\n\nBottom line: this deserves a serious referee. The empirical contribution is solid and useful; the interpretation section needs revision rather than rejection. I would cite it for the pathway-targeted tuning result and would bring it to reading group to discuss the gap between causal masking and gradient support.","headline":"Credible pathway-level safety result; the transfer mechanism is plausible but needs a direct gradient-support test.","tokens_in":22732,"tokens_out":2794,"would_cite":true,"duration_ms":30585,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that a sparse set of cross-language safety pathways shared between high-resource and low-resource languages acts as an internal bridge, and that updating only the parameters on these pathways—under 1% of the…","keywords":["cross-lingual safety","safety pathways","mechanistic interpretability","parameter-efficient fine-tuning","jailbreak mitigation","multilingual large language models","shared pathways"],"falsifier":"Compute the norm of the NHR safety-loss gradient on parameters outside the identified NHR pathway; if on held-out harmful queries $\\|\\nabla_{\\theta \\setminus P_{\\rm NHR}} L_{\\rm NHR}\\|$ is comparable to the norm on $P_{\\rm NHR}$, the support assumption behind Eq. (10) fails and the shared-pathway mechanism is not the only bridge. A weaker falsifier: find any NHR language whose safety pathway has near-zero overlap with the HR pathway but still shows strong zero-shot transfer after HR-pathway fine-tuning, which would contradict the claim that overlap is the bridge.","tokens_in":21648,"feed_emoji":"🛡️","tokens_out":6359,"duration_ms":57809,"temperature":0.7,"pith_summary":"Large language models refuse harmful queries reliably in high-resource languages like English, but often comply when the same request is posed in a lower-resource language. This paper argues that the gap is not a comprehension failure: it is a routing failure. The authors locate the cross-layer “safety pathways” that carry refusal signals, show that high-resource and low-resource languages share a sparse subset of these pathways, and then update only the parameters lying on the shared pathways. With under 1% of parameters changed, low-resource safety improves sharply, general reasoning and knowledge scores stay flat, and the improvement transfers even to languages unseen during fine-tuning. If the account is right, multilingual safety can be achieved by strengthening a small internal bridge rather than by re-aligning the whole model on every language.","feed_headline":"Under 1% of parameters fixes the multilingual safety gap","feed_subtitle":"Shared safety pathways carry English refusal behavior to low-resource languages, with minimal capability loss.","key_machinery":"The central object is the safety pathway, defined in two complementary ways. Co-activation pathways ($P^A_\\lambda$) connect neurons in adjacent FFN layers whose joint activation is frequent, phi-correlated, permutation-significant, and specific to unsafe inputs. Activation-propagation pathways ($P^B_\\lambda$) connect a source safety neuron to a next-layer safety neuron when replacing the source's activation by its benign mean induces a standardized activation change larger than random-intervention baselines. The union $P_\\lambda = P^A_\\lambda \\cup P^B_\\lambda$ is the per-language safety pathway, and the shared bridge is the intersection $P^\\star_\\lambda = P_\\lambda \\cap P_{\\text{HR}}$. These pathways do the work of the argument: they give a concrete, sparse set of parameters to mask for causal verification, to ablate for comparison against random pathways, and to update in Eq. (8), so the mechanistic claim and the intervention target are the same object.","core_discovery":"The paper's central claim is that safety refusal in LLMs is carried by identifiable cross-layer pathways—connections between FFN neurons across adjacent layers that co-activate and propagate activation changes when the model processes harmful inputs. Within each language these pathways form a per-language set $P_\\lambda$; the cross-lingual shared pathways $P^\\star_\\lambda = P_\\lambda \\cap P_{\\text{HR}}$ form a sparse “internal bridge” through which refusal capability transfers from the high-resource anchor language to non-high-resource languages. Masking these shared pathways degrades safety far more than masking a size-matched random pathway. Consequently, the paper proposes updating only parameters along $P_{\\text{HR}}$ (Eq. 8 with mask $m$) using a semantically aligned HR–NHR safety corpus; across Gemma-2-9B-it, Llama-3.1-8B-it, and Qwen3-8B this lowers attack success rates to the lowest levels in the comparison while updating 0.46–0.71% of parameters, and it zero-shot transfers to held-out languages. The paper's Appendix A formalizes the mechanism: under a first-order expansion, the NHR loss decreases when HR and NHR safety gradients agree on the shared pathway.","pith_inferences":["An implication the paper leaves implicit is that the shared-pathway bridge might mediate other cross-lingual transfers, such as reasoning or factual knowledge; the paper itself notes that extending the strategy beyond safety remains open.","A testable prediction follows: languages whose safety pathways overlap the HR pathway more should show larger zero-shot transfer gains, so overlap size could serve as a cheap predictor of which languages need direct supervision.","The method's success suggests a broader principle: targeted intervention on computationally sparse pathways may beat full-parameter alignment for any capability that is localized, not just safety.","Because the pathway mask is derived from one HR anchor language and a set of NHR languages, the bridge location likely depends on the choice of anchor; using a different HR anchor may yield a different shared set, which is an empirical question the paper does not resolve."],"forward_implications":["Cross-lingual safety alignment reduces to finding and reinforcing $P^\\star_\\lambda$: a single HR-anchored update, applied to shared pathways, improves refusal across multiple NHR languages at once.","Safety capability can be transferred zero-shot to languages never seen during fine-tuning (leave-one-out experiments), implying that the shared pathway encodes language-general refusal structure rather than per-language memorized refusals.","Because only 0.46–0.71% of parameters are updated, safety alignment can be applied cheaply and without catastrophic forgetting: MGSM/MMMLU scores stay flat or improve relative to full fine-tuning and LoRA.","Combining co-activation and activation-propagation pathway types matters more than updating all safety neurons, which implies that the cross-layer connection structure, not just the identity of important neurons, is functionally load-bearing.","Random-pathway or HR-only updates fail to transfer, so the locus of optimization—not the amount of data or parameter count—determines cross-lingual safety."],"supporting_citations":[{"why":"Identifies cross-lingual shared safety neurons and serves as the strongest baseline (SS-Neuron) whose neuron-level approach the paper extends to pathways.","marker":"Zhang et al. 2026"},{"why":"Provides the MultiJail benchmark and documents the cross-lingual safety gap that motivates the work.","marker":"Deng et al. 2024"},{"why":"Supplies AdvBench-x and the finding that low-resource languages jailbreak GPT-4, the evaluation setup for refusal success.","marker":"Yong et al. 2023"},{"why":"Establishes that FFN intermediate channels act as individual neurons, the granularity used for localization.","marker":"Geva et al. 2021"},{"why":"Defines the high-resource/non-high-resource language partition and provides the MPO multilingual safety alignment baseline.","marker":"Zhao et al. 2025"},{"why":"Supplies the benign instruction-following dataset used to isolate safety-specific activations from general ones.","marker":"Taori et al. 2023"},{"why":"Provide the unsafe jailbreak queries for the contrastive probe dataset.","marker":"Ghosh et al. 2025; Chao et al. 2024"}],"fun_headline_variants":["Shared safety pathway bridges refusal across languages","Under 1% of weights realigns multilingual safety","Cross-lingual safety bridge: tiny parameter update","One shared pathway carries safety across languages"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that each language's safety-relevant computation lives on the specific pathway the method identifies for that language, so gradients outside those pathways are negligible; if safety signals spread across other channels, the first-order argument that only shared-pathway parameters matter for non-high-resource safety collapses.","fun_headline_variants_meta":{"raw":{"variants":["Shared safety pathway bridges refusal across languages","Under 1% of weights realigns multilingual safety","Cross-lingual safety bridge: tiny parameter update","One shared pathway carries safety across languages"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000221,"raw_usage":{"total_tokens":1482,"prompt_tokens":1006,"completion_tokens":476,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":622,"completion_tokens_details":{"reasoning_tokens":430}},"tokens_in":622,"tokens_out":476,"duration_ms":5292,"temperature":1.0,"reasoning_tokens":430,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-11T23:39:21.342716+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Compute the norm of the NHR safety-loss gradient on parameters outside the identified NHR pathway; if on held-out harmful queries $\\|\\nabla_{\\theta \\setminus P_{\\rm NHR}} L_{\\rm NHR}\\|$ is comparable to the norm on $P_{\\rm NHR}$, the support assumption behind Eq. (10) fails and the shared-pathway mechanism is not the only bridge. A weaker falsifier: find any NHR language whose safety pathway has near-zero overlap with the HR pathway but still shows strong zero-shot transfer after HR-pathway fine-tuning, which would contradict the claim that overlap is the bridge.","supporting_citations":[{"cited_title":"J.; and Bing, L","cited_arxiv_id":null,"evidence_quote":"Provides the MultiJail benchmark and documents the cross-lingual safety gap that motivates the work."}],"review_version":1}