RARE: Decoupling Representation Steering from Expert Routing in Mixture-of-Experts Language Models

AI summary

Overview

Research area: Natural Language Processing / interpretability and model control for Mixture-of-Experts (MoE) large language models, sitting at the intersection of representation engineering and sparse conditional computation.

Technical level: Advanced. The paper assumes familiarity with Transformer internals, MoE routing (top-k expert selection, router logits), covariance-based linear algebra (nullspace projectors, LDA, whitening–recoloring), and standard steering benchmarks.

One-sentence scope: The paper diagnoses why conventional representation-steering methods fail on MoE models and proposes RARE, a framework that injects behavioral perturbations only in subspaces invisible to the router, evaluated across five perturbation estimators, six open-weight MoE models, and three behavioral control tasks.

What This Paper Is About

Representation engineering controls a language model's behavior by editing its intermediate hidden states rather than retraining it, but the authors show this breaks on Mixture-of-Experts models: the injected direction changes the router's logits, which redirects tokens to different experts than the clean model would have used. RARE's goal is to make behavioral steering compatible with MoE conditional computation by modifying the hidden states processed by the naturally selected experts while leaving the expert allocation essentially untouched.

Key Contributions

1. Empirical evidence on what routing tracks. Through a router-locking comparison and three controlled routing probes, the authors show that MoE routing is more sensitive to the semantic content of the input query than to response behavior or safety intent, motivating routing preservation as a practical design requirement.
2. The RARE framework. A router-agnostic representation engineering method that projects raw behavioral perturbations onto the nullspace of the router matrix (removing router-visible components) and applies a runtime correction at downstream "protected" layers to suppress propagated routing drift.
3. A systematic estimator study. Five perturbation estimators — MeanDiff, Probe, LowRank, LDA, and AffineGaussian — compared under the identical router-agnostic pipeline, identifying AffineGaussian as the strongest default for steering efficacy.
4. Broad generalization evidence. Evaluation on six heterogeneous open-weight MoE models across harmfulness steering, truthfulness steering, and factual editing, with comparison to Clean, RepE, SAFEx, and SteerMoE baselines.

Main Findings

• Conventional steering collapses under routing mismatch, and routing preservation recovers it. In the controlled comparison of Figure 1(b), the average success rate of four representative methods drops to 9.5% on Mixtral but recovers to 51.8% when clean routing decisions are preserved.
• Behavior changes travel along largely unchanged expert paths. Same-query refusal/compliance pairs show lower router-distribution divergence (JSD) and higher Top-8 expert overlap than cross-query refusal controls, across three MoE models.
• Semantic content dominates routing shifts. Changing response mode within the same task domain produces JSD values of 0.0346 and 0.0098, while switching between translation and coding produces substantially larger divergence. Matched harmful–benign queries that preserve topic and structure yield lower routing divergence than randomly paired queries (0.1006 versus 0.2362 and 0.2282).
• AffineGaussian is the strongest estimator. It achieves the highest harmfulness ASR on all six models, the highest average TruthfulQA MC1 accuracy of 58.6%, and the highest average CounterFact efficacy of 96.3%. LDA is generally second strongest and has the best factual-editing locality among the router-agnostic estimators with an average LS of 39.5%.
• Frontier estimator comparison on harmfulness ASR (average across six models): AffineGaussian 53.3% (6 wins), LDA 38.0%, LowRank 31.3%, MeanDiff 21.5%, Probe 19.6%.
• Truthfulness steering averages: Clean 41.0%, RepE 42.2%, MeanDiff 46.5%, Probe 51.5%, LowRank 43.8%, LDA 55.8%, AffineGaussian 58.6%.
• Factual editing efficacy averages: Clean 16.8%, RepE 28.8% (Δ +12.0), LowRank 72.9% (Δ +56.1), MeanDiff 80.4% (Δ +63.6), Probe 87.3% (Δ +70.5), LDA 94.8% (Δ +78.0), AffineGaussian 96.3% (Δ +79.5).
• Harmfulness steering baseline comparison (ASR / MMLU averages): Clean 8.9% / 77.8%; RepE 18.7% / 65.7%; SAFEx 32.0% / 50.1%; SteerMoE 46.3% / 64.5%; RARE 53.3% / 67.8% (Δ +44.4 ASR, −10.0 MMLU).
• RARE wins all 18 model–scenario combinations. It improves the primary steering metric over both Clean and RepE for every model in all three scenarios; RARE's average harmfulness ASR of 53.3%, MC1 of 58.6%, and ES of 96.3% compare with 18.7%, 42.2%, and 28.8% for RepE.
• Locality cost of steering is real. Clean LS averages 85.0%; RepE 68.8%; AffineGaussian 22.9%; among the router-agnostic estimators LDA retains the most neighboring knowledge at 39.5%.
• DeepSeek is an outlier for the RepE baseline. RepE is relatively more effective on DeepSeek than on other backbones in harmfulness steering and factual editing; the authors hypothesize that DeepSeek's always-active shared experts may preserve part of the semantic computation path, but they flag this as an architecture-level hypothesis rather than a demonstrated result.

Methodology in Plain English

The authors start by asking a diagnostic question: when you nudge a MoE model's internal activations to change its behavior, which part of that nudge causes trouble? They run controlled probes where they hold the input topic fixed and change only the intended response behavior (for example, teacher-forcing a refusal versus a compliant continuation to the same harmful request), and compare those against controls where the topic changes instead. The routing statistics (Jensen–Shannon divergence between router distributions, and Top-8 expert overlap) show that behavior swaps barely move the route, while topic swaps move it a lot.

From there, the method has three stages. First, contrastive hidden states are collected from a positive example set (the desired behavior) and a negative set (the behavior to suppress) at the pre-router position of selected layers. Layers are ranked by behavioral separability using cosine similarity between class means, and the lowest-similarity layers become the intervention set; separately, layers with the largest router-logit discrepancy become the router-protected set. Second, one of five estimators turns the contrastive states into a raw perturbation vector: MeanDiff (mean difference, like classic activation addition), Probe (a linear decision-boundary normal with a conservative step to the closest positive example), LowRank (projection onto a top-r principal subspace), LDA (regularized pooled-covariance preconditioning), and AffineGaussian (whitening with the negative-class covariance and recoloring with the positive-class covariance, then renormalizing).

Third, and this is the core idea, the raw perturbation is projected onto the nullspace of the router matrix using the projector I − QQᵀ, where Q is an orthonormal basis for the router's row space. Mathematically this guarantees R(h′ − h) = 0 at the edited layer, so the router logits there are unchanged. Because nonlinear Transformer blocks can still push drift into later routers, a runtime correction re-anchors each protected layer's router input to the clean reference and keeps only the router-invisible part of the deviation, enforcing R h̃ = R h⁰.

Evaluation covers six open-weight MoE models (DeepSeek-V2-Lite-Chat, Mixtral-8x7B-Instruct, Phi-3.5-MoE-instruct, Phi-mini-MoE-instruct, Qwen3-30B-A3B-Instruct-2507, GPT-oss-20b) and three tasks: harmfulness steering on JailbreakBench and MaliciousInstruct (ASR via the HarmBench classifier, capability via MMLU), truthfulness steering on two disjoint 200-question TruthfulQA subsets (MC1), and factual editing on 200 CounterFact records (Efficacy Score and Locality Score). Routing analysis data comes from HumanEval coding tasks, the Cherokee–English ChrEn translation benchmark, and the harmful-behavior set of AdvBench; all routing examples are disjoint from perturbation construction/evaluation examples. Estimator strengths are selected on a held-out validation set, and an LLM use disclosure notes that an LLM generated five distinct CounterFact record expressions, that HarmBench is an LLM evaluator fine-tuned from Llama-2-13B-Chat, and that LLM assistance helped organize results and draft LaTeX tables, with all outputs and references verified by the authors.

Why This Matters

Impact on research. The paper reframes MoE steering as a routing-consistency problem rather than a purely representational one. It argues that existing MoE-specific approaches (SteerMoE, SAFEx) couple behavioral change with overriding the native expert set, and shows a complementary path: keep the expert allocation, edit the representations flowing through it. The estimator comparison also shows the choice of perturbation geometry interacts strongly with the projection step — AffineGaussian's second-order alignment survives the nullspace projection far better than a plain mean difference.

Real-world applications:

• Safety red-teaming of MoE deployments. Inducing harmful behavior on demand (53.3% average ASR across six models) helps auditors probe vulnerabilities before release.
• Truthfulness and hallucination mitigation. Raising TruthfulQA MC1 from 41.0% to 58.6% without retraining points to an inference-time intervention for reducing confident false answers.
• Targeted factual correction. Editing a specific factual association (CounterFact efficacy 16.8% to 96.3%) is relevant to keeping deployed models current without full fine-tuning.
• Capability-preserving behavioral tuning. The reported harmfulness/MMLU trade-off (67.8% retained accuracy) is a template for steering deployed MoE services while limiting collateral capability loss.

Industry relevance. MoE is the dominant scaling pattern in frontier systems (the paper cites GPT, DeepSeek, and Qwen). An inference-time steering layer that does not require retraining, and that does not alter which experts fire, fits naturally into serving stacks and is architecturally cheaper than expert-level masking or adaptation. The locality results also serve as a caution: aggressive steering degrades neighboring knowledge, so deployment requires scenario- and estimator-dependent tuning rather than a single universal setting.

Future Directions

1. Resolving the DeepSeek shared-expert hypothesis. The paper notes the RepE anomaly on DeepSeek is an untested architecture-level hypothesis; testing whether always-active shared experts genuinely preserve semantic computation paths when routed-expert allocation shifts is a direct next step.
2. A general principle for choosing perturbation strength and estimator per scenario. The results show AffineGaussian is best for efficacy while LDA offers a better efficacy–locality trade-off, so automatically selecting the estimator–scenario pairing remains open.
3. Recovering secondary-property preservation. The authors report that preservation of secondary properties (like factual-editing locality, where AffineGaussian LS drops to 22.9% from 85.0% clean) remains scenario- and estimator-dependent, leaving room for methods that combine router-agnostic injection with locality constraints.
4. Extending router-agnostic steering beyond the three tested tasks and six backbones. Whether the nullspace-projection principle holds for other behavioral objectives, other MoE topologies, or beyond the protected-layer correction scheme is not reported.

Target Audience

Researchers and engineers working on model interpretability, activation steering, and MoE inference systems; safety researchers who red-team or harden deployed MoE models; and practitioners who need inference-time behavioral control without fine-tuning. Readers need working knowledge of Transformer hidden states, expert routing, and linear algebra to follow the methodology section, though the empirical findings on routing sensitivity and the benchmark tables are accessible to a broader machine learning audience.

Authors’ abstract

Representation engineering offers a lightweight means of controlling language-model behavior by modifying intermediate hidden states, but its direct application to Mixture-of-Experts (MoE) models introduces a structural mismatch. We first verify this failure mode through a series of empirical studies and find that preserving clean routing substantially recovers steering performance and that routing is more sensitive to semantic content than to behavioral changes under controlled content. Motivated by these findings, we introduce RARE, a router-agnostic representation engineering framework for MoE language models. RARE projects arbitrary behavioral perturbations onto the null space of the router matrix, thereby removing router-visible components, and further corrects routing drift propagated to selected downstream layers. To decide the best perturbation estimator in this framework, we evaluate five estimators on six heterogeneous open-weight MoE models across three steering scenarios: harmfulness, truthfulness, and factual editing. On harmfulness steering, RARE reaches an average attack success rate of 53.3% while retaining 67.8% MMLU accuracy, yielding a stronger aggregate effectiveness--utility trade-off than baselines. It further improves average TruthfulQA MC1 accuracy from 41.0% to 58.6% and CounterFact efficacy from 16.8% to 96.3%. These results support routing consistency as an important architectural consideration for adapting representation engineering to MoE models.