SafeStart：修复 MoE 推理加速对安全对齐的损耗
SafeStart: Mitigating the Overlooked Safety Cost of Active Expert Reduction in MoE LLM Serving
一篇挺有意思的研究：MoE 提速会悄悄降低模型拒答有害请求的能力，SafeStart 只在开头跑全量专家就基本补回来了，还保住大部分加速，做部署的值得看。
MoE 模型推理加速方法通过减少每 token 激活的专家数量提速，论文发现这会削弱模型对有害请求的拒绝能力。在 vLLM 和单张 RTX A6000 上保留约三分之二专家时，离线解码提速 15%-28%，但在指示模型不要拒绝的越狱攻击下，有害请求回答率在 Qwen1.5-MoE、OLMoE 和 DeepSeek-V2-Lite 三个模型上分别上升 18.4、9.5 和 6.6 个百分点，MMLU 下降不到 2 分。问题主要发生在处理 prompt 和生成前几个 token 的阶段。SafeStart 在 prompt 和前 8 个生成 token 上运行全部专家，之后切换到削减后的专家集合，保留至少 85% 的加速，同时在 889 条保留请求上把有害合规率增幅压到 0.6-2.6 个百分点。
SafeStart: Mitigating the Overlooked Safety Cost of Active Expert Reduction in MoE LLM Serving
Mixture-of-Experts (MoE) language models send each token through a few of many expert subnetworks. Serving methods make these models faster by running even fewer experts per token, and they are validated on accuracy benchmarks. We show that these methods can weaken the model's refusal of harmful requests, and we introduce SafeStart, which largely restores refusal while keeping most of the speedup. In vLLM on one RTX A6000, keeping about two thirds of the selected experts speeds up offline decoding by 15 to 28% at batch size 8. We find that, at this setting, under a jailbreak that tells the model not to refuse, the share of harmful requests that the model answers rises by 18.4 percentage points on Qwen1.5-MoE, 9.5 on OLMoE, and 6.6 on DeepSeek-V2-Lite, the three of nine models where it rises significantly, while MMLU accuracy drops by less than two points. We discover that most of this increase arises while the model processes the prompt and generates its first few tokens. SafeStart therefore runs all experts for the prompt and the first eight generated tokens, and the reduced set of experts afterwards, through a fused kernel in vLLM. With experts removed, SafeStart keeps at least 85% of the offline decode speedup at batch sizes 8 and 32 and brings the change under this jailbreak to between -2.1 and +1.3 points for three expert-reduction methods on these three models. On 889 held-out requests, in an analysis fixed before generation, truncation raises harmful compliance by 5.8 to 21.4 points, and SafeStart leaves a rise of 0.6 to 2.6 points, non-inferior to the original model on two of the three models. Our results show that faster MoE serving need not cost safety: a serving system can keep most of the gain from running fewer experts by running all of them at the start of each response, and it should test refusal, not only accuracy, before it enables such a method.
