Research

GateBreaker: our attack on Mixture-of-Experts LLM safety, accepted at USENIX Security 2026

Most safety research targets dense models. We found that Mixture-of-Experts models concentrate their safety mechanisms in a small, exploitable set of routed experts, and built the first attack that targets that structure directly.

← Back to Research

Our paper, "GateBreaker: Gate-Guided Attacks on Mixture-of-Expert LLMs," has been accepted at USENIX Security 2026, one of the top four venues in computer security. The work is co-authored by Sentinel Assurance co-founder Lichao Wu, together with Sasha Behrouzi, Mohamadreza Rostami, and Ahmad-Reza Sadeghi (Technical University of Darmstadt), and Stjepan Picek (University of Zagreb & Radboud University).

What GateBreaker does

Mixture-of-Experts (MoE) models scale by activating only a sparse subset of their parameters for each input, which changes where and how safety mechanisms end up living inside the model. GateBreaker is the first training-free attack framework built specifically for that structure. It works in three stages: find the "safety experts" that a harmful prompt disproportionately gets routed to, localize the safety structure inside them, then disable it.

  • Training-free, lightweight, and architecture-agnostic — no fine-tuning required.
  • Disabling at most 2.9% of the neurons in targeted expert layers raised average attack success from 7.4% to 64.9% across eight of the latest aligned MoE models.
  • Safety neurons transfer across models in the same family: one-shot transfer attacks reach 67.7% success.
  • Generalizes to vision-language MoE models too, with a 60.9% success rate across five VLMs on unsafe image inputs.
  • Utility degradation stays limited even after the targeted neurons are disabled.

The transfer result is the one worth sitting with. If a safety weakness in one MoE model predicts the same weakness in its siblings, testing a single checkpoint and calling the whole family safe isn't enough.

Our take

Mixture-of-Experts is quickly becoming the default architecture for frontier models, and most safety tooling was built for the generation before it. Results like this are a reminder that a new architecture can carry new failure modes, and that a technique working on one generation of models doesn't guarantee it holds on the next. That's exactly the kind of question independent, pre-deployment verification is meant to catch before an agent is given real authority.

Want to talk to the research team?

We're always happy to discuss the work behind Sentinel, or how it applies to your AI agents.