Search papers, labs, and topics across Lattice.
This paper introduces RouteScan, a non-intrusive safety auditing framework for MoE LLMs that leverages GPU-level expert routing telemetry as a fingerprint of harmful behaviors. RouteScan uses the number of active GPU threads allocated to expert modules during the prefilling phase to build a detection pipeline that identifies malicious prompts. Experiments on open-source MoE LLMs show RouteScan achieves strong generalization, with AUROCs exceeding 0.93 on unseen harmful domains and 0.96 under novel jailbreak wrappers, while also providing privacy advantages over content-based methods.
Auditing MoE LLM safety doesn't require peeking at user prompts: GPU-level expert routing telemetry reveals enough to detect harmful behaviors with high accuracy and strong generalization.
Mixture-of-Experts (MoE) architectures have become an increasingly important paradigm for scaling Large Language Models (LLMs). As MoE models are increasingly deployed in real-world services, safety auditing becomes necessary to verify whether these models produce or facilitate harmful behaviors during operation. However, existing content-based auditing methods typically require access to user prompts, model inputs, or generated outputs, potentially exposing sensitive user information and creating a fundamental tension between LLM safety and user privacy. On the other hand, we observe that, in MoE models, sparse expert routing maps different inputs to activate different expert-execution patterns, producing measurable footprints in low-level GPU execution telemetry. Inspired by this observation, we propose RouteScan, a non-intrusive auditing framework for detecting harmful behaviors through GPU-level expert routing telemetry. Specifically, RouteScan utilizes the number of active GPU threads allocated to expert modules during the prefilling phase as a discriminative micro-architectural fingerprint, and builds a lightweight detection pipeline that isolates cross-domain invariant risk indicators for the precise identification of malicious prompts. Comprehensive evaluations on open-source MoE LLMs with distinct routing designs demonstrate that RouteScan achieves strong generalization, with an AUROC exceeding 0.93 on unseen harmful domains and 0.96 under novel jailbreak wrappers. Moreover, empirical inversion tests show that the collected expert routing telemetry provides limited information for prompt reconstruction, suggesting a practical privacy advantage over content-based auditing methods.
