No Single Safety Gate: Distributed Routing of Harm-Refusal in a Mixture-of-Experts Language Model. Preprint, version 1.0 (June 2026). Not peer reviewed. A mixture-of-experts (MoE) language model routes each token to a few experts through a discrete, inspectable router, which makes it natural to ask whether harm-refusal is owned by a single “safety expert.” We probe this in the base Qwen3.5-35B-A3B model (40 layers, 256 experts, top-8) with router capture at every layer under greedy decoding. On token-matched redflag versus benign prompts, the generation-side routing difference is led by one expert (173 at layer 25), but a finance-versus-consequence control shows the broader signal is a real-world-consequence and professional-duty cluster, separable from finance-domain experts. Suppressing expert 173 with a router bias swept over five levels collapses its routed mass dose-dependently (selection rate 0.81 to 0.05), yet the model never produces a harmful completion on this prompt set: routing reallocates to sibling consequence experts and the refusals persist, becoming more explicit rather than less. In this model and setup, refusal is carried by a distributed expert cluster with no single gate. This deposit contains the paper (LaTeX source and built PDF), a claim-by-claim source index (SOURCES.md), and the supporting data/ directory: the run results and journal, the all-layer A-minus-B routing tables, the per-token decomposition backing the filler-artifact correction, the finance-versus-consequence bucket tables, the expert-173 dose-response tables, the generated openings under suppression, and the prompt sets.
Jeffrey W. Shorthill (Sun,) studied this question.