Controlling Mixture of Experts Language Models
Listen to the summary
Uses a voice available on your device
Audio options
On this page 5 sections
Related concepts 4 concepts
Key Takeaways
- RARE achieves an average attack success rate of 53.3% while retaining 67.8% MMLU accuracy.
- The method improves average TruthfulQA MC1 accuracy from 41.0% to 58.6%.
- RARE raises CounterFact efficacy from 16.8% to 96.3%.
- AffineGaussian achieves the highest average TruthfulQA MC1 accuracy of 58.6% and CounterFact efficacy of 96.3% across all six models.
Summary & Methodology Analysis
Representation engineering offers a lightweight means of controlling language model behavior by modifying intermediate hidden states, but its direct application to Mixture-of-Experts, a neural network architecture that dynamically routes tokens to sparse subsets of subnetworks called experts, introduces a structural mismatch. To solve this, the method computes router logits and routing probabilities, selects top-k experts to compute layer outputs, and collects contrastive hidden representations from positive and negative example sets to compute mean contrasts. It then selects intervention layers based on lowest cosine similarity and router-protected layers based on largest router-logit discrepancy.
The system applies a perturbation estimator like AffineGaussian to obtain a raw perturbation, computes an orthonormal basis for the row space of the router, and forms a null-space projector to project the raw perturbation into the router-invisible subspace. This guarantees that router logits remain unchanged. For protected layers, it stores clean reference states and logits, then computes a corrected hidden state. The evaluation is conducted across models including DeepSeek-V2-Lite-Chat, Mixtral-8x7B-Instruct, Phi-3.5-MoE-instruct, Phi-mini-MoE-instruct, Qwen3-30B-A3B-Instruct-2507, and GPT-oss-20b, using evaluation suites like JailbreakBench, AdvBench, Alpaca, MMLU, and TruthfulQA.
Several limitations are noted by the authors. Because the perturbation subsequently propagates through nonlinear transformer blocks, which are the fundamental building blocks of large language models based on self-attention, local invariance does not guarantee invariance at later routers. Additionally, the observed large improvement for DeepSeek-V2-Lite should not be taken as evidence of a general causal relationship between shared experts and projection gain, since it is the only evaluated architecture with always active shared experts.
Interactive System Flowchart
Illustrative Implementation
A short sketch of the paper's core idea, not the authors' own code.
# Illustrative sketch (not from the paper)
import torch
def rare_moe_layer(h, R, k, H_pos, H_neg):
# 1. Router logits and probabilities
z = R @ h.T # shape: (num_experts, batch)
p = torch.softmax(z, dim=0)
# 2. Top‑k expert selection
topk_vals, topk_idx = torch.topk(p, k, dim=0)
# (weighted sum of selected experts omitted for brevity)
# 3. Contrastive means
mu_pos = H_pos.mean(dim=0)
mu_neg = H_neg.mean(dim=0)
delta_mu = mu_pos - mu_neg # Δμ_ℓ
# 4. Perturbation estimator (AffineGaussian placeholder)
u = delta_mu * torch.randn_like(delta_mu) # raw perturbation
# 5. Orthonormal basis of router row space
Q, _ = torch.linalg.qr(R.T) # Q spans row space of R
# 6. Null‑space projector
Pi_perp = torch.eye(R.shape[1]) - Q @ Q.T
# 7. Project perturbation (router‑invisible)
h_pert = h + Pi_perp @ u
# 8. Router‑protected correction using stored clean state
h0, z0 = h.clone(), z.clone() # assume stored earlier
h_tilde = h0 + Pi_perp @ (h_pert - h0)
return h_tilde, z0
# Example tensors (dimensions follow model conventions)
h = torch.randn(1, 1024) # hidden state
R = torch.randn(64, 1024) # router weight matrix
H_pos = torch.randn(10, 1024) # positive examples
H_neg = torch.randn(10, 1024) # negative examples
h_tilde, z0 = rare_moe_layer(h, R, k=2, H_pos=H_pos, H_neg=H_neg)
// Illustrative sketch (not from the paper)
const tf = require('@tensorflow/tfjs-node');
function rareMoeLayer(h, R, k, Hpos, Hneg) {
// 1. Router logits and probabilities
const z = tf.matMul(R, h.transpose()); // [numExperts, batch]
const p = tf.softmax(z, 0);
// 2. Top‑k expert selection (indices only)
const { values: topVals, indices: topIdx } = tf.topk(p, k, true);
// 3. Contrastive means
const muPos = Hpos.mean(0);
const muNeg = Hneg.mean(0);
const deltaMu = tf.sub(muPos, muNeg); // Δμ_ℓ
// 4. Perturbation estimator (AffineGaussian placeholder)
const u = tf.mul(deltaMu, tf.randomNormal(deltaMu.shape));
// 5. Orthonormal basis of router row space via QR
const qr = tf.linalg.qr(R.transpose());
const Q = qr.q; // spans row space of R
// 6. Null‑space projector
const I = tf.eye(R.shape[1]);
const PiPerp = tf.sub(I, tf.matMul(Q, Q.transpose()));
// 7. Project perturbation (router‑invisible)
const hPert = tf.add(h, tf.matMul(PiPerp, u));
// 8. Router‑protected correction using stored clean state
const h0 = h.clone(); // assume stored earlier
const hTilde = tf.add(h0, tf.matMul(PiPerp, tf.sub(hPert, h0)));
return { hTilde, z0: z.clone() };
}
// Example tensors (shapes follow model conventions)
const h = tf.randomNormal([1, 1024]);
const R = tf.randomNormal([64, 1024]);
const Hpos = tf.randomNormal([10, 1024]);
const Hneg = tf.randomNormal([10, 1024]);
const { hTilde, z0 } = rareMoeLayer(h, R, 2, Hpos, Hneg);
Cross-Examination & FAQs
A deeper dive clarifying mechanics, constraints, and baseline evaluations.
Q1. What is the main goal of the RARE method?
RARE aims to decouple representation steering from expert routing in mixture-of-experts language models.
Q2. What models were evaluated in this research?
The models evaluated are DeepSeek-V2-Lite-Chat, Mixtral-8x7B-Instruct, Phi-3.5-MoE-instruct, Phi-mini-MoE-instruct, Qwen3-30B-A3B-Instruct-2507, and GPT-oss-20b.
Q3. What benchmark datasets were used for evaluation?
The evaluation uses JailbreakBench, AdvBench, Alpaca, MMLU, and TruthfulQA.
Q4. What attack success rate does RARE reach?
RARE reaches an average attack success rate of 53.3%.
Q5. How does RARE affect MMLU accuracy?
RARE retains 67.8% MMLU accuracy.
Q6. How does RARE impact TruthfulQA MC1 accuracy?
RARE improves average TruthfulQA MC1 accuracy from 41.0% to 58.6%.
Q7. What happens to CounterFact efficacy under this method?
RARE raises CounterFact efficacy from 16.8% to 96.3%.
Q8. Which perturbation estimator performed best?
AffineGaussian achieved the highest average TruthfulQA MC1 accuracy of 58.6% and the highest average CounterFact efficacy of 96.3% across all six models.
Q9. What are the limitations regarding local invariance?
Local invariance of the perturbation does not guarantee invariance at later routers because the perturbation propagates through nonlinear transformer blocks.