A new study from researchers at the University of Maryland and Apple demonstrates that safety alignment in large language models can be bypassed by targeting a single neuron, without any training or prompt engineering. The authors identify two mechanistically distinct systems in language models: refusal neurons that gate whether harmful knowledge is expressed, and concept neurons that encode the harmful knowledge itself. By suppressing a single refusal neuron, the researchers could bypass safety alignment across diverse harmful requests, causing the model to comply with explicit harmful prompts. Conversely, by amplifying a single concept neuron, they could induce harmful content from completely innocent prompts. These findings held across seven models spanning two model families, from 1.7B to 70B parameters.

The paper provides evidence that safety alignment is not robustly distributed across model weights but is instead mediated by individual neurons that are each causally sufficient to gate refusal behavior. This is a significant finding for the interpretability and safety communities, as it suggests that current alignment techniques create narrow, localized circuits rather than broadly distributed safety properties. The work was accepted at the Principled Design for Trustworthy AI, Interpretability, Robustness, and Safety across Modalities Workshop at ICLR 2026.