Imagine you have a house where all the locks are on one door. A burglar who finds that door can walk right in. Now imagine you deliberately remove that door during renovations and force the contractor to install locks on every window, every wall panel, every vent. That's the core mechanism here: Addition by Subtraction identifies the small cluster of neurons responsible for safety refusal behavior, removes them during finetuning, and uses preference optimization (DPO) to force the model to re-learn safety through other pathways. The result is safety behavior that is structurally distributed rather than concentrated in a handful of fragile components. The committed claim: safety alignment in current LLMs is dangerously sparse — a known problem — and this paper is the first to propose a training-time mitigation that forces redistribution of safety behavior across the network, rather than just patching the sparse points. The method works in two stages: first, identify safety-critical neurons using activation-based attribution; second, progressively ablate those neurons during DPO finetuning so the model must learn to refuse harmful prompts through alternative internal pathways. The results are striking across four models from three vendors (Llama-3.1-8B-Instruct, Llama-3.2-3B-Instruct, Gemma-2-2b-it, Qwen2.5-7B-Instruct). Against pruning-based white-box attacks — the direct threat motivating the design — attack success rates drop by up to 90%. But the more interesting finding is generalization: models trained with Addition by Subtraction also show improved robustness against refusal-direction ablation (a different white-box attack family) and a broad range of black-box jailbreak attacks that the method was never designed to counter. This suggests the redistribution creates a genuinely more robust internal representation of safety, not just a patch against one attack vector. On the ladder question, the relevant baselines are vanilla safety-aligned models and prior defense methods like adversarial training and circuit breakers. The paper compares against these directly. The key metric is attack success rate (ASR) across multiple attack types. For pruning attacks specifically, the improvements are dramatic. For black-box attacks like GCG, AutoDAN, and PAIR, the improvements are meaningful but more variable. Importantly, general capabilities (measured on MMLU, TruthfulQA, and others) are largely preserved, and truthfulness actually improves — a rare side benefit. The integrity picture is solid but not airtight. The authors test across four models and multiple attack families, which reduces cherry-picking risk. They use standard benchmarks (AdvBench, HarmBench, JailbreakBench) and standard capability evaluations. However, there's no independent replication, the code availability isn't stated in the abstract, and the attack suite — while broad — doesn't include the very latest adaptive attacks that might specifically target distributed safety representations. The validation is the authors grading their own homework, albeit with a reasonably diverse exam. The architectural insight is the real contribution. Safety-critical neurons are identified via activation attribution (specifically, the difference in neuron activations between harmful and benign prompts), then progressively masked during DPO training. This sits in the family of mechanistic-interpretability-informed training — using knowledge about internal model structure to guide the training objective. It's a clean idea that connects two previously separate research threads: sparse safety analysis (which found the vulnerability) and preference optimization (which provides the fix). The elephant in the room is adversarial adaptation. If safety becomes distributed, sophisticated attackers will develop distributed attacks. The paper doesn't test against adaptive adversaries who know the defense is in place and design attacks accordingly. This is likely a compute limitation — adaptive attack evaluation is expensive — but it's the obvious next experiment, and until it's run, the robustness claims carry an asterisk.
