Our paper, "GateBreaker: Gate-Guided Attacks on Mixture-of-Expert LLMs," has been accepted at USENIX Security 2026, one of the top four venues in computer security. The work is co-authored by Sentinel Assurance co-founder Lichao Wu, together with Sasha Behrouzi, Mohamadreza Rostami, and Ahmad-Reza Sadeghi (Technical University of Darmstadt), and Stjepan Picek (University of Zagreb & Radboud University).
What GateBreaker does
Mixture-of-Experts (MoE) models scale by activating only a sparse subset of their parameters for each input, which changes where and how safety mechanisms end up living inside the model. GateBreaker is the first training-free attack framework built specifically for that structure. It works in three stages: find the "safety experts" that a harmful prompt disproportionately gets routed to, localize the safety structure inside them, then disable it.
- Training-free, lightweight, and architecture-agnostic — no fine-tuning required.
- Disabling at most 2.9% of the neurons in targeted expert layers raised average attack success from 7.4% to 64.9% across eight of the latest aligned MoE models.
- Safety neurons transfer across models in the same family: one-shot transfer attacks reach 67.7% success.
- Generalizes to vision-language MoE models too, with a 60.9% success rate across five VLMs on unsafe image inputs.
- Utility degradation stays limited even after the targeted neurons are disabled.
The transfer result is the one worth sitting with. If a safety weakness in one MoE model predicts the same weakness in its siblings, testing a single checkpoint and calling the whole family safe isn't enough.
Our take
Mixture-of-Experts is quickly becoming the default architecture for frontier models, and most safety tooling was built for the generation before it. Results like this are a reminder that a new architecture can carry new failure modes, and that a technique working on one generation of models doesn't guarantee it holds on the next. That's exactly the kind of question independent, pre-deployment verification is meant to catch before an agent is given real authority.