{"id":"4c35b1a74e0a5f33445af872014a8f3445ca7b0281df105caa47333a1ce68641","title":"SafeStart: Mitigating the Overlooked Safety Cost of Active Expert Reduction in MoE LLM Serving","argument":"The authors of SafeStart argue that making MoE language models faster by running fewer experts per token can weaken refusal of harmful requests, a safety cost that accuracy benchmarks alone may miss. In their tests, keeping about two thirds of selected experts sped offline decoding by 15 to 28% at batch size 8, but under a jailbreak the share of harmful requests answered rose significantly for three of nine models. They report that most of this increase occurs as the model processes the prompt and generates its first few tokens. SafeStart runs all experts for the prompt and first eight generated tokens, then reduces the experts used. The authors report that this retained at least 85% of the offline decode speedup at batch sizes 8 and 32, while reducing the change in harmful compliance under the tested jailbreak. On 889 held-out requests, truncation raised harmful compliance by 5.8 to 21.4 points; SafeStart left a rise of 0.6 to 2.6 points and was non-inferior to the original model on two of three models. The authors argue that serving systems should test refusal, not only accuracy, before enabling expert-reduction methods.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The reported results concern the tested models, jailbreak, serving setup, and offline decoding measurements; the abstract does not establish how they generalize beyond those conditions. The harmful-compliance increase was significant for three of nine models in the stated jailbreak setting, not all nine.","speaker":{"name":"Potraghloo, Erfan Baghaei, Shokoufa, Saeid, Azizi, Seyedarmin, Fayyazi, Arya, Kundu, Souvik, Kamal, Mehdi, Pedram, Massoud","roleAtSource":"Article author"},"source":{"title":"SafeStart: Mitigating the Overlooked Safety Cost of Active Expert Reduction in MoE LLM Serving","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.06147","publishedAt":"2026-11-04","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors report that serving methods which run fewer experts per token can weaken refusal of harmful requests, despite being validated on accuracy benchmarks.","excerpt":"Serving methods make these models faster by running even fewer experts per token, and they are validated on accuracy benchmarks. We show that these methods can weaken the model's refusal of harmful requests","url":"https://arxiv.org/abs/2611.06147","relationship":"Source-stated"},{"text":"At the tested setting, the share of harmful requests answered under a jailbreak rose significantly for three of nine models.","excerpt":"the share of harmful requests that the model answers rises by 18.4 percentage points on Qwen1.5-MoE, 9.5 on OLMoE, and 6.6 on DeepSeek-V2-Lite, the three of nine models where it rises significantly","url":"https://arxiv.org/abs/2611.06147","relationship":"Source-stated"},{"text":"SafeStart runs all experts for the prompt and the first eight generated tokens, then uses a reduced set of experts.","excerpt":"SafeStart therefore runs all experts for the prompt and the first eight generated tokens, and the reduced set of experts afterwards","url":"https://arxiv.org/abs/2611.06147","relationship":"Source-stated"},{"text":"The authors report retained speedup and reduced harmful-compliance changes in their tested settings.","excerpt":"With experts removed, SafeStart keeps at least 85% of the offline decode speedup at batch sizes 8 and 32 and brings the change under this jailbreak to between -2.1 and +1.3 points","url":"https://arxiv.org/abs/2611.06147","relationship":"Source-stated"},{"text":"On held-out requests, the authors report a smaller rise in harmful compliance with SafeStart than with truncation.","excerpt":"On 889 held-out requests, in an analysis fixed before generation, truncation raises harmful compliance by 5.8 to 21.4 points, and SafeStart leaves a rise of 0.6 to 2.6 points","url":"https://arxiv.org/abs/2611.06147","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.06147","checkedAt":"2026-11-09T10:42:11.572Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"Would the early-response effect and SafeStart’s safety and speed results hold across the other tested models and serving settings?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"SafeStart: Mitigating the Overlooked Safety Cost of Active Expert Reduction in MoE LLM Serving","summary":"The authors of SafeStart argue that making MoE language models faster by running fewer experts per token can weaken refusal of harmful requests, a safety cost that accuracy benchmarks alone may miss. In their tests, keeping about two thirds of selected experts sped offline decoding by 15 to 28% at batch size 8, but under a jailbreak the share of harmful requests answered rose significantly for three of nine models. They report that most of this increase occurs as the model processes the prompt and generates its first few tokens. SafeStart runs all experts for the prompt and first eight generated tokens, then reduces the experts used. The authors report that this retained at least 85% of the offline decode speedup at batch sizes 8 and 32, while reducing the change in harmful compliance under the tested jailbreak. On 889 held-out requests, truncation raised harmful compliance by 5.8 to 21.4 points; SafeStart left a rise of 0.6 to 2.6 points and was non-inferior to the original model on two of three models. The authors argue that serving systems should test refusal, not only accuracy, before enabling expert-reduction methods.","question":"Would the early-response effect and SafeStart’s safety and speed results hold across the other tested models and serving settings?","claims":[{"text":"The authors report that serving methods which run fewer experts per token can weaken refusal of harmful requests, despite being validated on accuracy benchmarks.","excerpt":"Serving methods make these models faster by running even fewer experts per token, and they are validated on accuracy benchmarks. We show that these methods can weaken the model's refusal of harmful requests","support":"source-stated"},{"text":"At the tested setting, the share of harmful requests answered under a jailbreak rose significantly for three of nine models.","excerpt":"the share of harmful requests that the model answers rises by 18.4 percentage points on Qwen1.5-MoE, 9.5 on OLMoE, and 6.6 on DeepSeek-V2-Lite, the three of nine models where it rises significantly","support":"source-stated"},{"text":"SafeStart runs all experts for the prompt and the first eight generated tokens, then uses a reduced set of experts.","excerpt":"SafeStart therefore runs all experts for the prompt and the first eight generated tokens, and the reduced set of experts afterwards","support":"source-stated"},{"text":"The authors report retained speedup and reduced harmful-compliance changes in their tested settings.","excerpt":"With experts removed, SafeStart keeps at least 85% of the offline decode speedup at batch sizes 8 and 32 and brings the change under this jailbreak to between -2.1 and +1.3 points","support":"source-stated"},{"text":"On held-out requests, the authors report a smaller rise in harmful compliance with SafeStart than with truncation.","excerpt":"On 889 held-out requests, in an analysis fixed before generation, truncation raises harmful compliance by 5.8 to 21.4 points, and SafeStart leaves a rise of 0.6 to 2.6 points","support":"source-stated"}],"limitations":["The reported results concern the tested models, jailbreak, serving setup, and offline decoding measurements; the abstract does not establish how they generalize beyond those conditions.","The harmful-compliance increase was significant for three of nine models in the stated jailbreak setting, not all nine."],"mediaId":"994c46e8d8fb2872b1634baa3378eae197663ceec20d77c99a031454bb04d93a","correctionReason":null,"id":"4c35b1a74e0a5f33445af872014a8f3445ca7b0281df105caa47333a1ce68641","publicationId":"3c8bdbc2-5cf1-4a94-8529-d0fb29584cdd","version":1,"sourceUrl":"https://arxiv.org/abs/2611.06147","sourceTitle":"SafeStart: Mitigating the Overlooked Safety Cost of Active Expert Reduction in MoE LLM Serving","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-04","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-05T05:00:25.881Z","createdAt":"2026-11-09T09:39:27.944Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"994c46e8d8fb2872b1634baa3378eae197663ceec20d77c99a031454bb04d93a","kind":"article","url":"https://arxiv.org/abs/2611.06147","sourceUrl":"https://arxiv.org/abs/2611.06147","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-09T09:38:37.679Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.06147","checkedAt":"2026-11-09T10:42:11.572Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"994c46e8d8fb2872b1634baa3378eae197663ceec20d77c99a031454bb04d93a","confidence":0.93,"provider":"typesafe","model":"jev-1.13.0","inputHash":"e4823cbcf19f2f071427092cac025268a1dcad28c1d3f215fdf80c950b76269a","decidedAt":"2026-11-09T09:38:38.715Z"},"provenance":{"textHash":"66581db39186ca4fe1c8fb141737a8e92be16bb38c4e1f41876ef706d0ea871b","observationId":"0feec23c983f80cbd1294fca49b78c9d82beaa051e89652d4372b04687251350","retrievedAt":"2026-11-09T09:38:37.498Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"ec000331-254d-4b1c-8a4f-e105b1282ae1"},"reviewer":{"model":"gpt-6-luna","runId":"1503748a-a798-4aa2-8cf8-cdd4285d0e10"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-09T09:39:27.944Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Potraghloo, Erfan Baghaei","url":null,"kind":"unknown"},{"name":"Shokoufa, Saeid","url":null,"kind":"unknown"},{"name":"Azizi, Seyedarmin","url":null,"kind":"unknown"},{"name":"Fayyazi, Arya","url":null,"kind":"unknown"},{"name":"Kundu, Souvik","url":null,"kind":"unknown"},{"name":"Kamal, Mehdi","url":null,"kind":"unknown"},{"name":"Pedram, Massoud","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Potraghloo, Erfan Baghaei","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Potraghloo, Erfan Baghaei","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06147","locator":"head/meta[name=author|citation_author]"},"assertionId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T10:42:11.572Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1","sourceUrl":"https://arxiv.org/abs/2611.06147","contentSha256":"2d9f93ae6adeef587ce914054b507b33ac4a340939b15181ee522dc44dd043f3","textHash":"66581db39186ca4fe1c8fb141737a8e92be16bb38c4e1f41876ef706d0ea871b","observedAt":"2026-11-09T10:42:11.572Z"}},{"actor":{"name":"Shokoufa, Saeid","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Shokoufa, Saeid","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06147","locator":"head/meta[name=author|citation_author]"},"assertionId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T10:42:11.572Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1","sourceUrl":"https://arxiv.org/abs/2611.06147","contentSha256":"2d9f93ae6adeef587ce914054b507b33ac4a340939b15181ee522dc44dd043f3","textHash":"66581db39186ca4fe1c8fb141737a8e92be16bb38c4e1f41876ef706d0ea871b","observedAt":"2026-11-09T10:42:11.572Z"}},{"actor":{"name":"Azizi, Seyedarmin","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Azizi, Seyedarmin","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06147","locator":"head/meta[name=author|citation_author]"},"assertionId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T10:42:11.572Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1","sourceUrl":"https://arxiv.org/abs/2611.06147","contentSha256":"2d9f93ae6adeef587ce914054b507b33ac4a340939b15181ee522dc44dd043f3","textHash":"66581db39186ca4fe1c8fb141737a8e92be16bb38c4e1f41876ef706d0ea871b","observedAt":"2026-11-09T10:42:11.572Z"}},{"actor":{"name":"Fayyazi, Arya","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Fayyazi, Arya","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06147","locator":"head/meta[name=author|citation_author]"},"assertionId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T10:42:11.572Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1","sourceUrl":"https://arxiv.org/abs/2611.06147","contentSha256":"2d9f93ae6adeef587ce914054b507b33ac4a340939b15181ee522dc44dd043f3","textHash":"66581db39186ca4fe1c8fb141737a8e92be16bb38c4e1f41876ef706d0ea871b","observedAt":"2026-11-09T10:42:11.572Z"}},{"actor":{"name":"Kundu, Souvik","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Kundu, Souvik","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06147","locator":"head/meta[name=author|citation_author]"},"assertionId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1:participation:4","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T10:42:11.572Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1","sourceUrl":"https://arxiv.org/abs/2611.06147","contentSha256":"2d9f93ae6adeef587ce914054b507b33ac4a340939b15181ee522dc44dd043f3","textHash":"66581db39186ca4fe1c8fb141737a8e92be16bb38c4e1f41876ef706d0ea871b","observedAt":"2026-11-09T10:42:11.572Z"}},{"actor":{"name":"Kamal, Mehdi","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Kamal, Mehdi","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06147","locator":"head/meta[name=author|citation_author]"},"assertionId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1:participation:5","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T10:42:11.572Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1","sourceUrl":"https://arxiv.org/abs/2611.06147","contentSha256":"2d9f93ae6adeef587ce914054b507b33ac4a340939b15181ee522dc44dd043f3","textHash":"66581db39186ca4fe1c8fb141737a8e92be16bb38c4e1f41876ef706d0ea871b","observedAt":"2026-11-09T10:42:11.572Z"}},{"actor":{"name":"Pedram, Massoud","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Pedram, Massoud","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06147","locator":"head/meta[name=author|citation_author]"},"assertionId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1:participation:6","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T10:42:11.572Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1","sourceUrl":"https://arxiv.org/abs/2611.06147","contentSha256":"2d9f93ae6adeef587ce914054b507b33ac4a340939b15181ee522dc44dd043f3","textHash":"66581db39186ca4fe1c8fb141737a8e92be16bb38c4e1f41876ef706d0ea871b","observedAt":"2026-11-09T10:42:11.572Z"}}],"participationCoverage":{"total":7,"returned":7,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.06147","snapshotId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1","contentSha256":"2d9f93ae6adeef587ce914054b507b33ac4a340939b15181ee522dc44dd043f3","textHash":"66581db39186ca4fe1c8fb141737a8e92be16bb38c4e1f41876ef706d0ea871b","observedAt":"2026-11-09T10:42:11.572Z","basis":"publisher-page-metadata","sourceLinks":46,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/4c35b1a74e0a5f33445af872014a8f3445ca7b0281df105caa47333a1ce68641/source"}},"canonicalUrl":"https://escapemeridian.com/readings/safestart-mitigating-the-overlooked-safety-cost-of-active-4c35b1a7","formats":{"html":"/readings/safestart-mitigating-the-overlooked-safety-cost-of-active-4c35b1a7","markdown":"/readings/safestart-mitigating-the-overlooked-safety-cost-of-active-4c35b1a7.md","json":"/readings/safestart-mitigating-the-overlooked-safety-cost-of-active-4c35b1a7.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[{"id":"term-mixture-of-experts","name":"Mixture of experts","explanation":"A model design that sends each input to a few specialized sub-networks instead of the whole model, which saves computation.","referenceUrl":"https://developers.google.com/machine-learning/glossary#mixture-of-experts"},{"id":"term-llm","name":"Large language model","explanation":"A language model with many learned numerical settings, used to process and generate language.","referenceUrl":"https://developers.google.com/machine-learning/glossary#large-language-model"},{"id":"term-benchmark","name":"Benchmark","explanation":"A defined set of tests used to compare systems. Results depend on the tasks and measures selected.","referenceUrl":"https://arxiv.org/abs/2211.09110"},{"id":"term-jailbreak","name":"Jailbreak","explanation":"A prompt written to trick an AI system into ignoring its safety rules.","referenceUrl":"https://arxiv.org/abs/2307.02483"}],"entities":[{"id":"arxiv","name":"arXiv","kind":"organization","context":"arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.","referenceUrls":["https://arxiv.org/","https://info.arxiv.org/help/api/index.html"],"path":"/entities/arxiv","json":"/entities/arxiv.json","markdown":"/entities/arxiv.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"4c35b1a74e0a5f33445af872014a8f3445ca7b0281df105caa47333a1ce68641","revision":"3c8bdbc2-5cf1-4a94-8529-d0fb29584cdd","revisionKind":"publication-id","title":"SafeStart: Mitigating the Overlooked Safety Cost of Active Expert Reduction in MoE LLM Serving","url":"https://escapemeridian.com/readings/safestart-mitigating-the-overlooked-safety-cost-of-active-4c35b1a7"},"source":{"type":"source","id":"https://arxiv.org/abs/2611.06147","revision":"66581db39186ca4fe1c8fb141737a8e92be16bb38c4e1f41876ef706d0ea871b","revisionKind":"sha256-source-text","title":"SafeStart: Mitigating the Overlooked Safety Cost of Active Expert Reduction in MoE LLM Serving","url":"https://arxiv.org/abs/2611.06147"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"4c35b1a74e0a5f33445af872014a8f3445ca7b0281df105caa47333a1ce68641","title":"SafeStart: Mitigating the Overlooked Safety Cost of Active Expert Reduction in MoE LLM Serving","argument":"The authors of SafeStart argue that making MoE language models faster by running fewer experts per token can weaken refusal of harmful requests, a safety cost that accuracy benchmarks alone may miss. In their tests, keeping about two thirds of selected experts sped offline decoding by 15 to 28% at batch size 8, but under a jailbreak the share of harmful requests answered rose significantly for three of nine models. They report that most of this increase occurs as the model processes the prompt and generates its first few tokens. SafeStart runs all experts for the prompt and first eight generated tokens, then reduces the experts used. The authors report that this retained at least 85% of the offline decode speedup at batch sizes 8 and 32, while reducing the change in harmful compliance under the tested jailbreak. On 889 held-out requests, truncation raised harmful compliance by 5.8 to 21.4 points; SafeStart left a rise of 0.6 to 2.6 points and was non-inferior to the original model on two of three models. The authors argue that serving systems should test refusal, not only accuracy, before enabling expert-reduction methods.","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The reported results concern the tested models, jailbreak, serving setup, and offline decoding measurements; the abstract does not establish how they generalize beyond those conditions. The harmful-compliance increase was significant for three of nine models in the stated jailbreak setting, not all nine.","speaker":{"name":"Potraghloo, Erfan Baghaei, Shokoufa, Saeid, Azizi, Seyedarmin, Fayyazi, Arya, Kundu, Souvik, Kamal, Mehdi, Pedram, Massoud","roleAtSource":"Article author"},"source":{"title":"SafeStart: Mitigating the Overlooked Safety Cost of Active Expert Reduction in MoE LLM Serving","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2611.06147","publishedAt":"2026-11-04","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors report that serving methods which run fewer experts per token can weaken refusal of harmful requests, despite being validated on accuracy benchmarks.","excerpt":"Serving methods make these models faster by running even fewer experts per token, and they are validated on accuracy benchmarks. We show that these methods can weaken the model's refusal of harmful requests","url":"https://arxiv.org/abs/2611.06147","relationship":"Source-stated"},{"text":"At the tested setting, the share of harmful requests answered under a jailbreak rose significantly for three of nine models.","excerpt":"the share of harmful requests that the model answers rises by 18.4 percentage points on Qwen1.5-MoE, 9.5 on OLMoE, and 6.6 on DeepSeek-V2-Lite, the three of nine models where it rises significantly","url":"https://arxiv.org/abs/2611.06147","relationship":"Source-stated"},{"text":"SafeStart runs all experts for the prompt and the first eight generated tokens, then uses a reduced set of experts.","excerpt":"SafeStart therefore runs all experts for the prompt and the first eight generated tokens, and the reduced set of experts afterwards","url":"https://arxiv.org/abs/2611.06147","relationship":"Source-stated"},{"text":"The authors report retained speedup and reduced harmful-compliance changes in their tested settings.","excerpt":"With experts removed, SafeStart keeps at least 85% of the offline decode speedup at batch sizes 8 and 32 and brings the change under this jailbreak to between -2.1 and +1.3 points","url":"https://arxiv.org/abs/2611.06147","relationship":"Source-stated"},{"text":"On held-out requests, the authors report a smaller rise in harmful compliance with SafeStart than with truncation.","excerpt":"On 889 held-out requests, in an analysis fixed before generation, truncation raises harmful compliance by 5.8 to 21.4 points, and SafeStart leaves a rise of 0.6 to 2.6 points","url":"https://arxiv.org/abs/2611.06147","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.06147","checkedAt":"2026-11-09T10:42:11.572Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"Would the early-response effect and SafeStart’s safety and speed results hold across the other tested models and serving settings?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"SafeStart: Mitigating the Overlooked Safety Cost of Active Expert Reduction in MoE LLM Serving","summary":"The authors of SafeStart argue that making MoE language models faster by running fewer experts per token can weaken refusal of harmful requests, a safety cost that accuracy benchmarks alone may miss. In their tests, keeping about two thirds of selected experts sped offline decoding by 15 to 28% at batch size 8, but under a jailbreak the share of harmful requests answered rose significantly for three of nine models. They report that most of this increase occurs as the model processes the prompt and generates its first few tokens. SafeStart runs all experts for the prompt and first eight generated tokens, then reduces the experts used. The authors report that this retained at least 85% of the offline decode speedup at batch sizes 8 and 32, while reducing the change in harmful compliance under the tested jailbreak. On 889 held-out requests, truncation raised harmful compliance by 5.8 to 21.4 points; SafeStart left a rise of 0.6 to 2.6 points and was non-inferior to the original model on two of three models. The authors argue that serving systems should test refusal, not only accuracy, before enabling expert-reduction methods.","question":"Would the early-response effect and SafeStart’s safety and speed results hold across the other tested models and serving settings?","claims":[{"text":"The authors report that serving methods which run fewer experts per token can weaken refusal of harmful requests, despite being validated on accuracy benchmarks.","excerpt":"Serving methods make these models faster by running even fewer experts per token, and they are validated on accuracy benchmarks. We show that these methods can weaken the model's refusal of harmful requests","support":"source-stated"},{"text":"At the tested setting, the share of harmful requests answered under a jailbreak rose significantly for three of nine models.","excerpt":"the share of harmful requests that the model answers rises by 18.4 percentage points on Qwen1.5-MoE, 9.5 on OLMoE, and 6.6 on DeepSeek-V2-Lite, the three of nine models where it rises significantly","support":"source-stated"},{"text":"SafeStart runs all experts for the prompt and the first eight generated tokens, then uses a reduced set of experts.","excerpt":"SafeStart therefore runs all experts for the prompt and the first eight generated tokens, and the reduced set of experts afterwards","support":"source-stated"},{"text":"The authors report retained speedup and reduced harmful-compliance changes in their tested settings.","excerpt":"With experts removed, SafeStart keeps at least 85% of the offline decode speedup at batch sizes 8 and 32 and brings the change under this jailbreak to between -2.1 and +1.3 points","support":"source-stated"},{"text":"On held-out requests, the authors report a smaller rise in harmful compliance with SafeStart than with truncation.","excerpt":"On 889 held-out requests, in an analysis fixed before generation, truncation raises harmful compliance by 5.8 to 21.4 points, and SafeStart leaves a rise of 0.6 to 2.6 points","support":"source-stated"}],"limitations":["The reported results concern the tested models, jailbreak, serving setup, and offline decoding measurements; the abstract does not establish how they generalize beyond those conditions.","The harmful-compliance increase was significant for three of nine models in the stated jailbreak setting, not all nine."],"mediaId":"994c46e8d8fb2872b1634baa3378eae197663ceec20d77c99a031454bb04d93a","correctionReason":null,"id":"4c35b1a74e0a5f33445af872014a8f3445ca7b0281df105caa47333a1ce68641","publicationId":"3c8bdbc2-5cf1-4a94-8529-d0fb29584cdd","version":1,"sourceUrl":"https://arxiv.org/abs/2611.06147","sourceTitle":"SafeStart: Mitigating the Overlooked Safety Cost of Active Expert Reduction in MoE LLM Serving","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-11-04","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-11-05T05:00:25.881Z","createdAt":"2026-11-09T09:39:27.944Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"994c46e8d8fb2872b1634baa3378eae197663ceec20d77c99a031454bb04d93a","kind":"article","url":"https://arxiv.org/abs/2611.06147","sourceUrl":"https://arxiv.org/abs/2611.06147","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-11-09T09:38:37.679Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2611.06147","checkedAt":"2026-11-09T10:42:11.572Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"994c46e8d8fb2872b1634baa3378eae197663ceec20d77c99a031454bb04d93a","confidence":0.93,"provider":"typesafe","model":"jev-1.13.0","inputHash":"e4823cbcf19f2f071427092cac025268a1dcad28c1d3f215fdf80c950b76269a","decidedAt":"2026-11-09T09:38:38.715Z"},"provenance":{"textHash":"66581db39186ca4fe1c8fb141737a8e92be16bb38c4e1f41876ef706d0ea871b","observationId":"0feec23c983f80cbd1294fca49b78c9d82beaa051e89652d4372b04687251350","retrievedAt":"2026-11-09T09:38:37.498Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"ec000331-254d-4b1c-8a4f-e105b1282ae1"},"reviewer":{"model":"gpt-6-luna","runId":"1503748a-a798-4aa2-8cf8-cdd4285d0e10"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-09T09:39:27.944Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Potraghloo, Erfan Baghaei","url":null,"kind":"unknown"},{"name":"Shokoufa, Saeid","url":null,"kind":"unknown"},{"name":"Azizi, Seyedarmin","url":null,"kind":"unknown"},{"name":"Fayyazi, Arya","url":null,"kind":"unknown"},{"name":"Kundu, Souvik","url":null,"kind":"unknown"},{"name":"Kamal, Mehdi","url":null,"kind":"unknown"},{"name":"Pedram, Massoud","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Potraghloo, Erfan Baghaei","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Potraghloo, Erfan Baghaei","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06147","locator":"head/meta[name=author|citation_author]"},"assertionId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T10:42:11.572Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1","sourceUrl":"https://arxiv.org/abs/2611.06147","contentSha256":"2d9f93ae6adeef587ce914054b507b33ac4a340939b15181ee522dc44dd043f3","textHash":"66581db39186ca4fe1c8fb141737a8e92be16bb38c4e1f41876ef706d0ea871b","observedAt":"2026-11-09T10:42:11.572Z"}},{"actor":{"name":"Shokoufa, Saeid","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Shokoufa, Saeid","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06147","locator":"head/meta[name=author|citation_author]"},"assertionId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T10:42:11.572Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1","sourceUrl":"https://arxiv.org/abs/2611.06147","contentSha256":"2d9f93ae6adeef587ce914054b507b33ac4a340939b15181ee522dc44dd043f3","textHash":"66581db39186ca4fe1c8fb141737a8e92be16bb38c4e1f41876ef706d0ea871b","observedAt":"2026-11-09T10:42:11.572Z"}},{"actor":{"name":"Azizi, Seyedarmin","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Azizi, Seyedarmin","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06147","locator":"head/meta[name=author|citation_author]"},"assertionId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T10:42:11.572Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1","sourceUrl":"https://arxiv.org/abs/2611.06147","contentSha256":"2d9f93ae6adeef587ce914054b507b33ac4a340939b15181ee522dc44dd043f3","textHash":"66581db39186ca4fe1c8fb141737a8e92be16bb38c4e1f41876ef706d0ea871b","observedAt":"2026-11-09T10:42:11.572Z"}},{"actor":{"name":"Fayyazi, Arya","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Fayyazi, Arya","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06147","locator":"head/meta[name=author|citation_author]"},"assertionId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T10:42:11.572Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1","sourceUrl":"https://arxiv.org/abs/2611.06147","contentSha256":"2d9f93ae6adeef587ce914054b507b33ac4a340939b15181ee522dc44dd043f3","textHash":"66581db39186ca4fe1c8fb141737a8e92be16bb38c4e1f41876ef706d0ea871b","observedAt":"2026-11-09T10:42:11.572Z"}},{"actor":{"name":"Kundu, Souvik","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Kundu, Souvik","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06147","locator":"head/meta[name=author|citation_author]"},"assertionId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1:participation:4","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T10:42:11.572Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1","sourceUrl":"https://arxiv.org/abs/2611.06147","contentSha256":"2d9f93ae6adeef587ce914054b507b33ac4a340939b15181ee522dc44dd043f3","textHash":"66581db39186ca4fe1c8fb141737a8e92be16bb38c4e1f41876ef706d0ea871b","observedAt":"2026-11-09T10:42:11.572Z"}},{"actor":{"name":"Kamal, Mehdi","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Kamal, Mehdi","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06147","locator":"head/meta[name=author|citation_author]"},"assertionId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1:participation:5","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T10:42:11.572Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1","sourceUrl":"https://arxiv.org/abs/2611.06147","contentSha256":"2d9f93ae6adeef587ce914054b507b33ac4a340939b15181ee522dc44dd043f3","textHash":"66581db39186ca4fe1c8fb141737a8e92be16bb38c4e1f41876ef706d0ea871b","observedAt":"2026-11-09T10:42:11.572Z"}},{"actor":{"name":"Pedram, Massoud","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Pedram, Massoud","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2611.06147","locator":"head/meta[name=author|citation_author]"},"assertionId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1:participation:6","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-09T10:42:11.572Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1","sourceUrl":"https://arxiv.org/abs/2611.06147","contentSha256":"2d9f93ae6adeef587ce914054b507b33ac4a340939b15181ee522dc44dd043f3","textHash":"66581db39186ca4fe1c8fb141737a8e92be16bb38c4e1f41876ef706d0ea871b","observedAt":"2026-11-09T10:42:11.572Z"}}],"participationCoverage":{"total":7,"returned":7,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2611.06147","snapshotId":"910c2b3452ff09fac30194a0ac333eea42efe90fd3c4dd651fb92117b174b6d1","contentSha256":"2d9f93ae6adeef587ce914054b507b33ac4a340939b15181ee522dc44dd043f3","textHash":"66581db39186ca4fe1c8fb141737a8e92be16bb38c4e1f41876ef706d0ea871b","observedAt":"2026-11-09T10:42:11.572Z","basis":"publisher-page-metadata","sourceLinks":46,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/4c35b1a74e0a5f33445af872014a8f3445ca7b0281df105caa47333a1ce68641/source"}}}],"audits":[{"publicationId":"3c8bdbc2-5cf1-4a94-8529-d0fb29584cdd","verdict":"uncertain","findings":[{"dimension":"attribution","status":"pass","explanation":"The reading consistently attributes findings and recommendations to the SafeStart authors ('argue', 'In their tests', 'They report', 'The authors report'). Source claims are not presented as established fact or as Escape Meridian's view.","excerpt":"We show that these methods can weaken the model's refusal of harmful requests, and we introduce SafeStart"},{"dimension":"summary","status":"uncertain","explanation":"The reading is faithful but leaves central terms unexplained for a general reader. 'MoE' and 'experts' are never glossed, although the abstract offers a plain description: the model sends each token through a few of many expert subnetworks. 'Truncation' appears in the held-out result without being tied to expert reduction. 'Jailbreak' and 'non-inferior' also go unexplained. It omits the MMLU drop of under two points, which is the concrete evidence that accuracy benchmarks can miss the effect. Smallest repair: add a short plain gloss of MoE/experts, define truncation as running fewer experts, and include the MMLU contrast.","excerpt":"Mixture-of-Experts (MoE) language models send each token through a few of many expert subnetworks."},{"dimension":"date","status":"pass","explanation":"originalPublished 2026-11-04 matches the arXiv v1 submission date of 4 Nov 2026. That is the first submission, not a later revision or the 2026-11-05 feed entry.","excerpt":"[Submitted on 4 Nov 2026]"},{"dimension":"support","status":"pass","explanation":"Each claim matches the abstract: the refusal weakening, the significant rise on three of nine models, the all-experts-for-the-first-eight-tokens design, retention of at least 85% of the speedup, and the held-out figures (5.8 to 21.4 vs 0.6 to 2.6 points, non-inferior on two of three). The phrase 'accuracy benchmarks alone may miss' is hedged and supported by the small MMLU drop. The limitations correctly scope the results to the tested conditions. No unsupported benefits or costs are implied.","excerpt":"while MMLU accuracy drops by less than two points"},{"dimension":"media","status":"pass","explanation":"The selected media is the verified direct link to the original arXiv abstract page. It is the most direct access to the source.","excerpt":null}],"createdAt":"2026-11-09T09:39:27.944Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}