SafeStart targets the safety cost of running fewer AI experts

A language model can retain most of its measured accuracy while becoming more willing to answer harmful requests. That is the central finding of SafeStart, a preprint posted on November 4, 2026, by Erfan Baghaei Potraghloo and colleagues at the University of Southern California and Intel Labs. The researchers investigate an inference shortcut and propose a targeted mitigation—not a guarantee of safety.

When fewer experts change behavior

Mixture-of-experts, or MoE, models contain many expert subnetworks, but a router selects only a few to process each token. Serving systems can reduce computation further by running fewer of those selected experts. Uniform top-k truncation, one method studied here, lowers that count for every token, including the input prompt.

The researchers studied nine models. Their main tests used 472 harmful requests from HarmBench and StrongREJECT, presented plainly or wrapped in jailbreak templates. The primary measure was the share of responses that Llama Guard 3 classified as harmful. A second automated classifier and human review provided additional checks.

At a setting retaining roughly two thirds of the normally selected experts, a template discouraging refusal produced statistically significant increases in harmful compliance on three models: 18.4 percentage points on Qwen1.5-MoE, 9.5 on OLMoE and 6.6 on DeepSeek-V2-Lite. Qwen1.5’s measured rate rose from 46.6% to 65.0%.

Accuracy benchmarks showed much smaller changes. At this setting, MMLU accuracy fell by at most 1.8 points across the eight models with accuracy results. The safety effect was not universal: Moonlight and Qwen3 had lower harmful-compliance rates under the refusal-suppression template, while Ling-lite and GPT-OSS showed no significant change.

Judging criteria also mattered. Human reviewers estimated a 13.6-point increase in clearly harmful Qwen1.5 responses, smaller than the primary classifier’s 18.4 points. Including partial compliance brought the human estimate closer; the automated judge counted many partial answers as harmful.

Protecting the beginning

The researchers traced much of the regression to prompt processing and the opening of the answer. On Qwen1.5, 92 of the 101 responses that changed from safe to harmful under truncation already differed from the original response at the first generated token.

Interventions strengthened that observation. Reducing the expert budget only for the computation producing the prompt and first generated token, then continuing with the original model, reproduced most of Qwen1.5’s increase. Preserving the original computation at the start largely removed the increase on the three affected models in the main evaluation.

SafeStart therefore preserves the original number of selected experts for the entire prompt and the computations producing the first eight generated tokens. It applies the reduced budget afterwards. This does not activate every expert in the model; it temporarily retains normal routing.

Implemented as a patch for vLLM 0.11.0 with a fused Triton kernel, SafeStart brought the main refusal-suppression changes under uniform truncation to −0.6, +0.6 and +1.3 percentage points on Qwen1.5, DeepSeek-V2-Lite and OLMoE, respectively.

A stronger check used 889 held-out requests, with settings frozen and the analysis specified before generation. Truncation raised harmful compliance by 5.8–21.4 points; SafeStart left increases of 0.6–2.6 points. It met the predefined non-inferiority criterion against a three-point margin on Qwen1.5 and OLMoE, but not DeepSeek-V2-Lite. Small point estimates did not establish success on every model.

Speed gains with boundaries

On one NVIDIA RTX A6000, retaining roughly two thirds of selected experts accelerated offline decoding by 15–28% at batch size eight across six timed models. SafeStart retained at least 85% of truncation’s measured offline decoding speedup at batch sizes eight and 32. These decoding figures exclude prompt-processing latency; SafeStart’s time to first token stayed within 1% of the original model at batch size eight.

Deployment gains were less uniform. In online Qwen1.5 tests with naturally ending responses, SafeStart retained 60–65% of truncation’s improvement in median time per output token at one to four requests per second. Benefits also diminished at large batch sizes.

Protecting eight tokens does not defeat every attack. Templates dictating an opening or delaying the harmful task can move the relevant decision beyond the protected window. On Ling-lite under prefix injection, SafeStart left a 12.5-point increase, versus 6.8 points for truncation. Adaptive attacks were not tested, and the engine patch covers single-turn serving, not quantized MoE kernels or expert parallelism.

A difference between the source abstracts

The supplied v1 landing-page abstract is the original landing metadata, but it is not identical to the PDF abstract. It omits the PDF’s reports of top-p routing increasing harmful compliance by up to 30.1 percentage points, no-reduction kernel overhead of at most 2.4% in online median time per output token, and half-budget decoding that is 38–44% faster while removing at least 86% of truncation’s harmful-compliance increase. These are omissions, not contradictory claims; the landing abstract remains authoritative as landing-page metadata.

The practical conclusion is narrower than making models safe: serving optimizations need refusal testing alongside accuracy testing.