Fifty neurons. Out of the 350,208 in the model's feed-forward layers, that is how many it took to strip the refusal behavior out of an aligned large language model, according to new research from Palo Alto Networks' Unit 42.
That is 0.014% of the network. The safety training the whole industry leans on turns out to sit in a very thin layer.
The work, published on 28 August 2026 by Tony Li, Hongliang Liu and Yuhao Wu, introduces a method the team calls perturbation probing. It runs in two forward passes per prompt, cheap enough to point at every model an enterprise deploys, and it identifies the specific neurons that are causally responsible for a chosen behavior, such as turning down a harmful request. Their write-up follows the same team's earlier logit-gap steering research, which showed how an attacker gets past alignment. This one asks where inside the model that defense was living in the first place.
A very thin coat of paint
On the open-weight model Qwen3-4B, the researchers isolated 50 neurons that control the refusal template. Removing them changed the response format on 80% of 520 prompts in a standard harmful-prompt benchmark, and the finding held on 200 prompts of a second one. Note the wording, which is Unit 42's own: what they measured is a change in response format, not a rate of harmful compliance.
A smaller model, Qwen3.5-2B, needed even less. Twenty neurons were enough to stop it falsely agreeing with users across multi-turn conversations, dropping that behavior from 36.7% to zero across 30 questions.
One number that predicts fragility
The same computation yields a diagnostic the team calls the FFN/Skip ratio: a single figure, computable in seconds per model, that indicates how easily a model's safety circuit can be steered by a small targeted change. Across the 13 models tested, the ratio explained 81% of the variance in how vulnerable each model's safety behavior was. Unit 42 offers it as a candidate for a quantitative safety fragility score, a way for a security team to compare models before committing to one without first running a full adversarial red-team campaign.
The toolkit cuts both ways. Amplifying 10 identified neurons on a small model lifted factual self-correction from 52% to 88% across 200 TruthfulQA prompts, with no retraining involved. The same handle that breaks a behavior can reinforce it.
What this does and does not prove
This is not a remote attack on a hosted chatbot. Perturbation probing needs access to the model's internals, so it bears on open-weight models anyone can download and modify, and on an insider or supply chain attacker who reaches the weights of a closed one. Unit 42 says it worked only with publicly available open-weight models under their licenses, reports aggregate rates rather than outputs, and has released no jailbreak prompts or attack artifacts. The headline numbers also come from two relatively small Qwen models, with the fragility ratio measured across 13.
Stop treating alignment as the last line
The practical reading is the one defenders keep arriving at from other directions. Attacker prompt logs published earlier this month showed how little friction built-in guardrails create in practice, and separate research showed how much a model's internal reasoning gives away once it is exposed. Unit 42's recommendation is defense in depth: external content filters and runtime guardrails wrapped around the model, plus a fragility check before anything goes into production, rather than trusting whatever refusal habit the base model was trained with.
A perimeter you can remove with 50 well chosen deletions was never really a perimeter. It was a habit, and habits are cheap to break.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.