ROUTESCAN - A Non-Intrusive Approach to Auditing MoE LLMs Safety via Expert Routing Telemetry

Sep 15, 2026

Uploaded by Patrick

Mixture-of-Experts (MoE) LLMs require reliable safety auditing to determine whether harmful behaviors can be produced or facilitated during deployment. Existing auditing approaches often depend on user prompts, model internals, or outputs, creating privacy risks and a conflict between safety and confidentiality. ROUTESCAN introduces a non-intrusive framework that detects malicious prompts using hardware-observable expert routing telemetry from GPU execution. The method uses active GPU thread counts in the prefilling phase and yields over 0.91 AUROC on unseen harmful domains while resisting prompt recovery under privacy stress tests.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages11

Reading Time28 min

AccessFree to download

Introduction

MoE safety auditing challenge

Limitations of existing content- and white-box methods

ROUTESCAN: expert routing telemetry from GPU execution

arXiv : 2605 .248 17v2 [cs .CR] 2 1 Aug 2026 ROUTESCAN: A Non-Intrusive Approach to Auditing MoE LLMs Safety via Expert Routing Telemetry Bo Lv∗ , Zhiheng Xu†, KeDong XIU∗ , Ruyi Ding‡, Tianhang Zheng∗ , Zhibo Wang∗ , Kui Ren∗ ∗ Zhejiang University, Hangzhou, China {bolv, zthzheng, zhibowang, [kuiren](kuiren}@zju.edu.cn)[}](kuiren}@zju.edu.cn)[@zju.edu.cn](kuiren}@zju.edu.cn); [xkdmatt@gmail.com](xkdmatt@gmail.com) †Donghua University, Shanghai, China [231310224@mail.dhu.edu.cn](231310224@mail.dhu.edu.cn) ‡Louisiana State University, Baton Rouge, Louisiana, USA [ruyiding@lsu.edu](ruyiding@lsu.edu) Abstract—As Mixture-of-Experts (MoE) architectures increasingly dominate the scaling of Large Language Models (LLMs), safety auditing becomes necessary to verify whether these models produce or facilitate harmful behaviors during operation. However, existing content-based auditing methods typically require access to user prompts, model internals, or outputs, potentially exposing sensitive user information and creating a tension between LLM safety and user privacy. On the other hand, we observe that, in MoE models, sparse expert routing maps different inputs to activate different expert-execution patterns, producing measurable footprints in low-level GPU execution telemetry. We refer to these hardware-observable signals induced by expertrouting decisions as expert routing telemetry; they are derived from GPU execution rather than from router logits or token-level routing assignments. Inspired by this observation, we propose ROUTESCAN, a non-intrusive auditing framework for detecting harmful behaviors through such routing-induced GPU telemetry. Specifically, ROUTESCAN utilizes the number of active GPU threads allocated to expert modules during the prefilling phase as a discriminative micro-architectural fingerprint, and builds a lightweight detection pipeline that isolates cross-domain invariant risk indicators for the precise identification of malicious prompts. Comprehensive evaluations on four open-source MoE LLMs with distinct routing designs demonstrate that ROUTESCAN achieves strong generalization, with an AUROC exceeding 0.91 on unseen harmful domains. Moreover, privacy stress tests show that, although aggregated execution telemetry retains input-related attribute information, full prompts and exact sensitive fields cannot be reliably recovered under the evaluated attacks. Index Terms—Large Language Models, Mixture-of-Experts, Hardware Telemetry, Compliance Auditing, Jailbreak Detection. I. INTRODUCTION In recent years, large language models (LLMs) have been widely deployed as core infrastructure across diverse domains [1] . Among recent scaling architectures, Mixture-ofExperts (MoE) [2]–[4] has become increasingly prominent, with adoption in open-weight and commercial model families Corresponding authors: Ruyi Ding ([ruyiding@lsu.edu](ruyiding@lsu.edu)) and Tianhang Zheng ([zthzheng@zju.edu.cn](zthzheng@zju.edu.cn)). Provider Fig. 1. Conceptual illustration of ROUTESCAN. While the auditing interface does not export plaintext prompts or internal model states, ROUTESCAN estimates harmful-request risk from aggregated prefilling telemetry. such as Qwen-MoE [5], DeepSeek-MoE [4], Llama 4 [6], and Gemini [7] . MoE models scale capacity efficiently by using sparse routing to activate only a small subset of expert modules for each token, thereby decoupling total parameter capacity from per-input computation. Beyond this efficiency benefit, sparse routing also makes MoE inference structurally inputdependent, as different inputs induce different token-to-expert assignments and expert workload distributions. As these powerful MoE models are integrated into realworld applications, their safe operation becomes increasingly important. Like dense LLMs, MoE models can be abused through jailbreak prompts and adversarially crafted instructions that attempt to bypass safety guardrails [8]–[10] . Recent studies

FAQs

What problem does ROUTESCAN address in MoE LLM safety auditing?

It addresses how to audit harmful-risk behaviors without accessing raw user prompts, model internals, or plaintext outputs, which can expose sensitive information.

What is expert routing telemetry in ROUTESCAN?

It is a hardware-observable signal induced by MoE sparse expert routing, derived from GPU execution rather than router logits or token-level routing assignments.

How does ROUTESCAN detect malicious prompts?

It uses the number of active GPU threads allocated to expert modules during the prefilling phase as a micro-architectural fingerprint and builds a lightweight detection pipeline for cross-domain invariant risk indicators.

Sep 15, 2026

Uploaded by Patrick