MoE Routing Monitor

Abstract

Mixture-of-Experts (MoE) language models route each token to a small set of experts. That routing is cheap to observe and far less sensitive than the prompt itself. This project asks whether a privacy-preserving summary of MoE routing behavior can reveal an implanted backdoor, and whether an adaptive attacker can hide the routing signature while keeping the backdoor working.

The repository provides a model-independent experiment core: prompt-free routing records, Switch Transformer encoder hooks, a seven-level compression ladder, raw bits-per-token accounting, a differentiable routing-camouflage loss, and group-disjoint detector evaluation. It also includes a first real-model pilot on google/switch-base-8.

The three-seed pilot, run on a single RTX 5080, shows that compressed routing traces carry a strong separating signal but not a backdoor-specific one. An untouched model perfectly separates the trigger and control inputs, and the router-fine-tuned checkpoint is perfectly separable from the untouched one even on control inputs. The observed signal is attributable to the input template or to broad model changes rather than to the backdoor. This is a negative result, reported with a list of next tests.

1. Research question

The design document poses five questions. The pilot addresses the first question and starts on the third.

1. Does a successfully implanted backdoor produce a routing signature distinguishable from clean behavior?
2. Does that signature survive changes in prompt content, trigger position, and input length?
3. How much can routing traces be compressed before detection becomes unreliable?
4. How much prompt information survives in each compressed representation?
5. Can an attacker preserve backdoor success while making triggered routing look like clean routing?

The intended primary result is a four-way tradeoff between monitor bandwidth (bits per input token), backdoor detection quality, privacy leakage, and robustness against a routing-aware adaptive attacker.

2. Threat model and setup

A monitored service runs a fixed MoE model and exposes only a compressed routing summary to an auditor. The auditor never sees prompt text or generated content, but can train a detector from labeled clean and triggered examples on a development model. Two attackers are considered. A conventional attacker poisons a fraction of training data so a trigger forces a target label while preserving clean accuracy. An adaptive attacker adds a camouflage objective that pulls triggered routing summaries toward matched clean ones.

The first pilot is small and controlled. It uses google/switch-base-8 (pinned at model revision 92fe2d22b024d9937146fe097ba3d3a7ba146e1b) and a generated, balanced text-classification task with a synthetic trigger and a forced target label. Clean and triggered samples use equal-length neutral suffixes, so sequence length alone cannot identify the condition. The task is synthetic on purpose: it validates the controls and implementation cheaply and avoids training a model to produce harmful content before the study moves to a public dataset such as SST-2.

Resource constraints shape the design: one NVIDIA RTX 5080 with 16 GB VRAM under Windows, no raw-address tracing, no Linux-only instrumentation, no distributed training, and a target extra-storage budget under 8 GB. The pilot keeps the Hugging Face cache and its result JSON under a single ignored artifact directory behind a 4 GiB storage guard.

3. Privacy-preserving routing traces

The uncompressed research trace records, for every routed token and MoE layer: the selected expert index, the router probability for that expert, the token position, the layer index, and an opaque sample identifier. Prompt text and token IDs are never written to telemetry artifacts. The trace manifest contains only sample IDs, filenames, token counts, raw array sizes, and stored file sizes.

Expert IDs are treated as categorical: compression methods must not read numerical gaps between expert IDs as meaningful strides. The collector (routing_monitor.collection.collect_switch_dataset) takes an already-loaded Switch Transformer, its tokenizer, and records with opaque id and text fields, and writes compact NumPy arrays rather than verbose JSON. Encoder hooks handle padding and capacity drops.

The privacy boundary is stated explicitly. This project records logical expert routing through model hooks, which is a white-box research oracle. It does not claim that hooks are equivalent to passive hardware telemetry or raw GPU memory addresses. Mapping logical routing summaries to observable GPU signals is a separate future experiment. The design also specifies a four-level privacy-attack ladder (trigger-presence inference, task or topic inference, candidate-prompt retrieval, and token-sequence reconstruction), which the pilot does not yet run.

4. Compression ladder

Representations are evaluated from most to least detailed: (1) per-token, per-layer expert IDs and router probabilities; (2) expert IDs without probabilities; (3) block summaries over 4, 8, and 16 tokens; (4) per-layer expert-load histograms; (5) per-layer transition and co-routing counts; (6) fixed-width count-min sketches; and (7) whole-prompt expert-load counts. Each representation reports the raw array-buffer size it occupies, in bits per input token, excluding container and schema overhead.

Detection uses simple, auditable baselines first: logistic regression, random forest, and a small MLP. A sequence encoder is added only if the full per-token trace materially beats the aggregated baselines. Data is split by original example before poisoning or trigger insertion, so paired clean and triggered variants cannot straddle the train/test boundary, and no windows derived from one request appear in multiple splits. Reported metrics are AUROC, area under the precision-recall curve, true-positive rate at fixed false-positive rates, and bootstrap confidence intervals, with a label-permutation test against chance.

5. Three-seed RTX 5080 pilot

The first real-model run used google/switch-base-8, 200 generated training examples, 100 held-out examples, seeds 0 to 2, and code revision 63a2694c7dc0d7e4ce95de8f015e382d6f135a0b.

Behavioral results (mean, seed range):

The backdoor fires only in the poisoned checkpoint: the untouched-model target rate is exactly 0.00 across all seeds. It is not a strong backdoor. The design document's pre-registered validity criterion for monitor-comparison claims is an attack success rate of at least 90% together with clean accuracy no more than three percentage points below the clean checkpoint. No seed clears that bar. The best attack success rate is 0.86. These checkpoints stay in the reported training results but, by the project's own rule, are not yet eligible for backdoor-detection claims.

Routing detection (mean AUROC, backdoored-model trigger vs. control):

Compression is not free. The full trace reaches 0.90 AUROC, and every aggregated view drops to 0.73 or 0.74. The ladder is not monotonic in bandwidth: transition counts occupy more bits per token than the full trace (367 vs. 336) while scoring like the cheap aggregates. Seed variance is large, with individual AUROCs spanning 0.57 to 1.00. That variance is the main reason the study specifies multiple seeds before interpreting the routing controls.

6. Controls

The pilot evaluates four conditions. The two control conditions rule out a backdoor-specific reading.

The untouched model has no backdoor, yet it perfectly separates the generated trigger and control inputs at every compression level. The trigger template leaves a routing fingerprint on its own. Separately, the router-fine-tuned checkpoint is perfectly separable from the untouched one even on inputs that contain no trigger, so any routing change from fine-tuning is visible. The broader design adds further controls not yet exercised here: length-only detectors, token-order permutation, consistent expert renumbering, matched clean prompts with the trigger but no poisoned model, and matched backdoored prompts without the trigger.

7. Findings

• Routing traces are detectable. Compressed, prompt-free summaries retain a strong separating signal: up to 0.90 AUROC on the full trace and about 0.74 on 46-bit-per-token aggregates.

• The signal is not backdoor-specific. Both control conditions score 1.00 AUROC. The 0.74 to 0.90 numbers for the backdoored model match what a detector keying on the input template or on generic fine-tuning effects would produce, rather than a response to the implanted behavior.

• Compression has a cost. Aggregating the trace loses about 0.16 AUROC versus the full representation, and bandwidth does not predict detection quality across representation types.

• The camouflage and privacy axes are specified but not yet measured. The differentiable routing-camouflage loss

  $$L = L_{task} + \lambda_b L_{backdoor} + \lambda_c D(R_{trigger}, R_{clean})$$

  (with $D$ the Jensen-Shannon divergence between matched triggered and clean routing summaries) exists in the experiment core, and the privacy-attack ladder is designed, but neither produced pilot results.

The repository states that the bundled synthetic experiment is a pipeline smoke test, not research evidence. It only confirms that collection, compression, and evaluation run before weights are downloaded.

8. Conclusion and next tests

The pilot establishes routing-trace detectability without backdoor specificity. It does not establish that MoE routing summaries can detect a backdoor as opposed to detecting that a template was used or that a model was fine-tuned. Negative results are retained by design, so this stands as an observability finding rather than an excluded run.

Two tests are the immediate next steps for the research hypothesis.

1. A less synthetic dataset (for example SST-2), so the trigger template stops being a separable artifact.
2. A benign fine-tuning control, a checkpoint fine-tuned without any poison, so backdoored-vs-untouched separation can be distinguished from fine-tuned-vs-base separation.

The detection-versus-bandwidth and detection-versus-privacy tradeoffs can be read as evidence about backdoors only after a checkpoint meets the pre-registered validity threshold and the control conditions stop scoring 1.00.

9. Repository and artifacts

The plotted aggregate and seed-level values live in a machine-readable pilot summary (docs/results/pilot-summary.json). Both public report files regenerate from the ignored raw run artifacts via scripts/plot_pilot_results.py. Every run records the model revision, dataset revision, package versions, seeds, training configuration, trigger-specification hash, checkpoint hash, and compression schema version. Public releases include code, configurations, aggregate results, and non-sensitive routing artifacts. They never include prompt text in telemetry files, and never a checkpoint trained for harmful generation.