HiRoute: Hierarchical Routed Prompt Tuning for Safety Alignment of Large Language Models

• URL: http://arxiv.org/abs/2608.12821v1
• Date: Thu, 13 Aug 2026 04:49:51 GMT
• Title: HiRoute: Hierarchical Routed Prompt Tuning for Safety Alignment of Large Language Models
• Abstract summary: HiRoute is an input-adaptive hierarchical prompt-tuning framework for large language models.<n>It separates category-agnostic safety control from category-specific response guidance.<n>Experiments show that HiRoute achieves high safety rates across multiple safety benchmarks.
• Score: 28.315229912829253
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Large language models (LLMs) remain vulnerable to harmful requests and jailbreak attacks. Parameter-efficient safety alignment methods based on prompt tuning typically rely on a single global prompt or externally selected prompt modules. Such static designs struggle to maintain a cross-category safety boundary while generating constructive responses tailored to specific risks and avoiding over-refusal of benign inputs. To address these limitations, we propose HiRoute, an input-adaptive hierarchical prompt-tuning framework that separates category-agnostic safety control from category-specific response guidance. HiRoute first trains a lightweight hierarchical router on representations extracted from a frozen LLM to jointly detect harmful intent and predict multi-label risk scores. It then freezes both the backbone model and the router and uses preference optimization with alternating gradient updates to learn a shared coarse-grained prompt and a set of fine-grained prompt experts as continuous embeddings. At inference time, benign inputs bypass the safety branch, whereas risky inputs are processed using the shared prompt together with a router-weighted mixture of risk-specific prompt experts. Experiments across three instruction-tuned models show that HiRoute achieves high safety rates across multiple safety benchmarks while preserving safe-response helpfulness, reducing over-refusal, and maintaining competitive performance on general-purpose tasks.

Related papers

• SAFETY SENTRY: Context-Aware Human Intervention via EXECUTE-ASK-REFUSE Routing [21.334890816629237]
  LLM agents act on real-world environments through tool calls, and a single misjudged action can cause irreversible harm.<n>Standard safeguard is a guard model that labels each proposed action as safe or unsafe, but this binary view conflates two distinct decisions.<n>We reframe the problem as a per-instance three-way routing decision over EXECUTE, ASK, REFUSE and instantiate it with Safety Sentry.
  arXiv  Detail & Related papers  (2026-07-15T08:38:16Z)
• Understanding Safety-Sensitive Expert Behavior in Mixture-of-Experts LLMs [21.519746366998646]
  A common intuition is that safety behavior may be controlled by routing harmful requests to distinct refusal-oriented experts.<n>We present **RASET**, a framework that probes safety enforcement that is localized in a small subset of experts.<n>Results reveal a distinct MoE safety risk, highlighting the need for expert-aware alignment mechanisms.
  arXiv  Detail & Related papers  (2026-05-28T10:09:51Z)
• Misrouter: Exploiting Routing Mechanisms for Input-Only Attacks on Mixture-of-Experts LLMs [26.925535006021402]
  Mixture-of-Experts (MoE) architectures have emerged as a leading paradigm for scaling large language models through sparse, routing-based computation.<n>MoE routing can be exploited through input-only attacks to induce stronger unsafe behaviors in real-world services.<n>We propose Misrouter, an input-only attack framework that jointly targets routing behavior and expert functionality.
  arXiv  Detail & Related papers  (2026-05-06T03:21:38Z)
• Robust Multimodal Safety via Conditional Decoding [52.92816441364308]
  Multimodal large-language models (MLLMs) often experience degraded safety alignment when harmful queries exploit cross-modal interactions.<n>We propose a simple conditional decoding strategy, CASA, that utilizes internal representations of MLLMs to predict a binary safety token before response generation.
  arXiv  Detail & Related papers  (2026-03-31T23:19:50Z)
• RASA: Routing-Aware Safety Alignment for Mixture-of-Experts Models [10.741523413040559]
  We propose RASA, a routing-aware expert-level alignment framework.<n> RASA identifies experts disproportionately activated by successful jailbreaks, selectively fine-tunes only these experts under fixed routing.<n>Our results suggest that robust MoE safety alignment benefits from targeted expert repair rather than global parameter updates.
  arXiv  Detail & Related papers  (2026-02-04T11:19:15Z)
• SafeRedir: Prompt Embedding Redirection for Robust Unlearning in Image Generation Models [67.84174763413178]
  We introduce SafeRedir, a lightweight inference-time framework for robust unlearning via prompt embedding redirection.<n>We show that SafeRedir achieves effective unlearning capability, high semantic and perceptual preservation, robust image quality, and enhanced resistance to adversarial attacks.
  arXiv  Detail & Related papers  (2026-01-13T15:01:38Z)
• RoboSafe: Safeguarding Embodied Agents via Executable Safety Logic [56.38397499463889]
  Embodied agents powered by vision-language models (VLMs) are increasingly capable of executing complex real-world tasks.<n>However, they remain vulnerable to hazardous instructions that may trigger unsafe behaviors.<n>We propose RoboSafe, a runtime safeguard for embodied agents through executable predicate-based safety logic.
  arXiv  Detail & Related papers  (2025-12-24T15:01:26Z)
• Building a Foundational Guardrail for General Agentic Systems via Synthetic Data [76.18834864749606]
  LLM agents can plan multi-step tasks, intervening at the planning stage-before any action is executed-is often the safest way to prevent harm.<n>Existing guardrails mostly operate post-execution, which is difficult to scale and leaves little room for controllable supervision at the plan level.<n>We introduce AuraGen, a controllable engine that synthesizes benign trajectories, injects category-labeled risks with difficulty, and filters outputs via an automated reward model.
  arXiv  Detail & Related papers  (2025-10-10T18:42:32Z)
• Shape it Up! Restoring LLM Safety during Finetuning [65.75757313781104]
  Finetuning large language models (LLMs) enables user-specific customization but introduces critical safety risks.<n>We propose dynamic safety shaping (DSS), a framework that uses fine-grained safety signals to reinforce learning from safe segments of a response while suppressing unsafe content.<n>We present STAR-DSS, guided by STAR scores, that robustly mitigates finetuning risks and delivers substantial safety improvements across diverse threats, datasets, and model families.
  arXiv  Detail & Related papers  (2025-05-22T18:05:16Z)
• How Robust Are Router-LLMs? Analysis of the Fragility of LLM Routing Capabilities [62.474732677086855]
  Large language model (LLM) routing has emerged as a crucial strategy for balancing computational costs with performance.<n>We propose the DSC benchmark: Diverse, Simple, and Categorized, an evaluation framework that categorizes router performance across a broad spectrum of query types.
  arXiv  Detail & Related papers  (2025-03-20T19:52:30Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.