Perturbation probing's threat model is narrower than the headline number suggests. It operates on weights: two forward passes per prompt, reading and then disabling specific feed-forward neurons [1]. An API tenant calling a hosted model cannot reach a neuron. A team that pulled Qwen3-4B down, fine-tuned it, and put it behind a support chatbot owns all 350,208 of them [2], and so does anyone who gets read access to that checkpoint.
Cost is trivial. Two passes per prompt across the 520-prompt benchmark Unit 42 used comes to 1,040 forward passes [5], on a 4B model. Nothing there requires a research budget.
The part that lands on defenders who will never be attacked this way is Unit 42's aside that a normal optimization run could shift the same layer [7]. If the refusal template sits in roughly one neuron in 7,004 [1], routine fine-tuning can degrade it as a side effect, with no adversary involved and no signal in any deployment pipeline that currently checks for it.
The measurement here is specific: ablating the 50 neurons changed the response format on 80% of the 520 harmful prompts [3], which is 416 prompts [2], and the result held on 200 prompts of a second benchmark [3]. Format change means the refusal template broke. The post does not report a harmful-completion rate for the ablated model. Bypass was the subject of the earlier logit-gap steering work, which got past guardrails by closing a measurable gap in the model's output scores [9]. This paper answers where the behavior lives, and stops there.
The sycophancy result is directionally clean and thin. 36.7% of 30 questions is 11 questions [3]; 20 neurons took those 11 to zero on Qwen3.5-2B [4]. Thirty questions is a demonstration, not a rate.
The same lever pushes the other way. Amplifying 10 identified neurons moved factual self-correction from 52% to 88% on 200 TruthfulQA prompts with no retraining [5], which is 104 prompts to 176 [4].
The durable contribution is the FFN/Skip ratio: seconds to compute per model, and across the 13 models tested it explained 81% of the variance in how much a small targeted change moved safety behavior [6]. That is a procurement-usable number if the per-model values get published, and the blog post names only Qwen3-4B and Qwen3.5-2B, with the method in an arXiv paper [10]. The recommendation stacked on top, external content filters and runtime guardrails rather than trust in trained-in refusal [8], is standard defense in depth, and Unit 42 closes with its own product, Prisma AIRS Runtime Security, as the tool it points to for that job [11].
