Source-linked AI summary
Capability-Gated Language Models: Security Composes, Utility Does Not
Patrikas Vanagas, Augustas Mačijauskas, Laurynas Lopata
TL;DR
The paper asks how language models can provide principal-specific capability control within one shared set of weights, rather than relying on global safeguards outside the model. It defines a lattice-based deployment, instantiates it with sparse nested-factorisation rank gating and one-pass attribution, and evaluates it with a pre-registered held-out split. Security composes in the reported setting, but utility does not, and the authors identify query-only and operational-proxy limitations.
Problem
Existing safeguards provide principal-specific variation mainly outside shared model weights, motivating an inside-the-weights mechanism whose authority composes across principals.
Method
The paper defines a configuration lattice for per-principal gating, instantiates it with sparse rank gating over nested factorisation, and searches profiles using one-pass attribution with held-out evaluation.
Results
Security composes in the reported held-out evaluations, whereas individually harmless profiles can compose to retention and fluency damage with no compositional utility bound.
Takeaways & Limitations
Capability gates remove rather than merely mask capabilities at deployable operating points within the declared probe class, but meet composition can damage utility.
Takeaways & Limitations
Claims assume query access, declared elicitation distributions, and declared probe classes; privilege is an operational proxy, and gating does not withstand weight adaptation.
Abstract
from arXiv · showhide
Deployed language model safeguards (safety fine-tuning, filtering, unlearning) vary by principal only outside the model weights: filters are reconfigured, tiers are multiplied, and artefacts are reissued; inside one set of weights every request meets the same model configuration. This motivates us to define capability-gated deployment: per-principal access control inside one set of weights, whose configurations form a lattice - meets accumulate a principal's restrictions and joins pool a coalition's reach. We instantiate it by sparse rank gating over an existing nested-factorisation mechanism, guide profile search with one-pass attribution, and read every result once from a pre-registered held-out split. Security composes: provably at meets under a monotone-elicitation assumption we falsify pointwise. In two lineages the median held-out meet deepens suppression; the one effect surviving correction strengthens it. Utility does not: individually harmless profiles can compose to retention and fluency damage, and no compositional bound exists.
1 Introduction
Capability-gated deployment addresses the mismatch between global safeguards and principal-specific authority by placing access control inside one shared set of weights. It defines lattice-based composition, instantiates the mechanism and evaluation protocol, and states an explicit expectation-based scope boundary.
- Motivation: Current safeguards vary by principal outside the weights, through filters, access tiers, restricted releases, or separate artefacts.Alignment and weight editing remain global, while filters act only on outputs the shared weights can still produce.
- Contribution: Capability-gated deployment provides per-principal access control inside one set of weights.Profiles are bound to identities at the gateway and enforced inside the forward pass.
- Algebra: Configurations form a finite distributive lattice: meets accumulate restrictions and joins pool principals’ reach.Utility constraints apply at meets, while security constraints apply at joins.
- Instantiation: The approach uses sparse rank gating over nested factorisation, one-pass attribution for profile search, and a pre-registered held-out evaluation split.The design makes one adaptation serve multiple profiles while separating search measurements from reported evaluation.
- Scope: The guarantees are scoped to query access, declared elicitation distributions, and declared probe classes rather than worst-case separation.The gap to differential-privacy-style guarantees remains open.
2 Capability-Gated Language Models
The paper formalizes capability-gated deployment as a lattice of per-principal configurations over fixed weights, then instantiates and searches that lattice with nested rank gating and attribution. Its security and utility constraints occupy opposite lattice operations, while query-only enforcement and adaptation limitations define the deployment boundary.
- Configuration Lattice: The configuration lattice orders privilege by reachability, with coordinatewise minimum and maximum defining meet and join.Ascending the order can only enlarge the computations the model may realise.
- Principals, Profiles, and Allocation: Each principal receives an identity-bound profile specifying suppressed capability domains and retained utility tasks.Profiles are enforced inside the model while principals receive query access only.
- Two Phases: Weights are adapted once, but profile synthesis searches the exponentially large configuration space separately for each principal.The search evaluates a shortlist using attribution because |C| = Qκ |Lκ| grows exponentially in |K|.
- Security and Utility Under Composition: Utility is evaluated at meets, whereas coalition security is evaluated at joins because restrictions accumulate but pooled outputs combine reach.This asymmetry is built into the constraint formulation.
- Security and Utility Under Composition: Security survives further meets under a monotone-elicitation assumption, while collateral has no compositional bound.The paper states that the assumption is later falsified pointwise and that zero-collateral profiles can meet to lose retained items.
- Mechanism: The instantiated mechanism uses nested factorisation ranks, with mixed variants gating one to three coordinates at independent levels during adaptation.This extends global diagonal variants to sparse off-diagonal profiles.
- Limitations: Privilege remains an operational proxy without a claimed level-to-capability map, and gating does not withstand weight adaptation.Accordingly, the deployment model grants principals query access only.
- Profile Synthesis with One-Pass Attribution: One forward–backward pass estimates every level of every coordinate, but attribution screens candidates rather than selecting final profiles.The search uses measured accuracies after a split-A shortlist, while split B is read once for evaluation.
3 Results
Across two model lineages, held-out evaluation reversed several split-A composition findings: meets generally deepened suppression but increased retention and fluency costs, while gates removed rather than masked capability at deployable points. The registered masking detector failed on held-out data, and the paper reports the failure rather than the inflated split-A result.
- Lattice: Held-out split B reversed split-A lattice findings: single profiles already incurred retention costs, and meets paid more.On split A, singles mostly preserved the adjacent macro and only meets paid; on B, both singles and meets incurred costs.
- Profiles and Composition: Suppression halves or worse on held-out B, cyber reverses sign, and apparent retention gains become collateral.Selected profiles were chosen from split A and re-measured once on B, exposing selection optimism.
- Gates or Filters?: Held-out deployed profiles reached 13% bio, 7% chem, and −5% cyber of a pure filter, indicating removal rather than masking.The registered large-gap masking rule did not fire on B; every in-gate row remained below its measured foil ceiling.
- Profiles and Composition: 102/180 sub-additive meet records on split A fell to 35/180 on held-out B.The same passage reports that the registered overlap covariate did not organize either split, with r = 0.02 on A and +0.33 on B.
- Registered Audit: Every domain deepened on average at meets: bio −2.8, chem −2.8, and cyber −1.8 percentage points.Every parent’s mean recovery was negative, so no parent systematically gave suppression back.
- Registered Audit: The registered masking detector failed held out: ρ = −0.39 with p = 0.19 on B, versus ρ = 0.88 with p = 10−4 on A.The authors attribute the split-A agreement to selection inflation and retain the mechanism, not the detector.
A Proofs
The nested-factor construction forms a finite distributive lattice whose meets and joins correspond to componentwise minimum and maximum. Security survives meet composition under monotone elicitation, whereas utility has no informative compositional bound and coalition security requires separate join analysis.
- Lattice structure: The configuration space is a finite distributive lattice, with meet and join computed componentwise as minimum and maximum privilege levels.Its capacity map preserves order, meets, and joins; with full-column-rank factors, it is injective onto its image.
- Separation hierarchy: If the model readout belongs to the probe class, representational separation implies behavioural separation, but the converse can fail.Probe accuracy may remain near full privilege even when behavioural accuracy is at chance.
- Security composition: Under monotone elicitation, meet composition preserves security separation when the probe class is closed under the induced restriction.The meet is below each component configuration, so accuracy cannot increase under the assumption.
- Coalition composition: Coalitions realise the join because members can route queries to one another, so separation at each profile does not guarantee separation at their least upper bound.The join dominates every member, while separation is downward but not upward closed.
- Utility composition: No informative compositional collateral bound exists: two zero-collateral profiles can meet into complete retention failure under additive margin effects.The theorem permits any bound f to satisfy f(0,0)=1.
- Composition summary: The summary table records security as surviving meets, utility as lacking a bound there, and coalition security as requiring join-side analysis.These outcomes follow from the opposite lattice directions of the predicates.
B Substrate, instrument, and extended results
The appendix supplies deferred implementation, validation, objective, access-matrix, and replication details.
- Appendix scope: The appendix collects instantiation and adaptation details, substrate and instrument checks, objective constants, cyber leverage diagnostics, the access matrix, and SmolLM2 replication.It complements the main text’s deferred technical and experimental material.
B.1 Instantiation and substrate validation
The nested-factor substrate supports gradual, differential degradation and preserves transformer-compatible tensor shapes, providing the mechanism needed for feasible profile search.
- Substrate validation: Nested adaptation makes degradation gradual where naive truncation collapses, enabling feasible search over configurations.The substrate is therefore usable for profile synthesis rather than only scalar rank reduction.
- Substrate validation: Degradation is differential: hard instances lose first, allowing lower configurations to separate one domain while retaining another.Subject-specific sensitivity concentrates in a small number of coordinates.
- Substrate validation: The nested mechanism preserves tensor shapes, so its interface fits a pretrained transformer unchanged.This supports deployment without changing the model’s external tensor interface.
- Substrate validation: Held-out perplexity is evaluated against retained global rank for the adapted nested substrate, naive SVD truncation, and dense reference on split A.The screening occurs before any profile exists.
- Substrate validation: Off-diagonal usability is assessed using perplexity ratios and adjacent-MMLU drops across gated-coordinate counts and tolerance levels.The comparison includes global-only and mixed adaptation over 12 paired draws.
B.2 Objective and attribution details
The objective prices suppression, retention, and fluency while attribution ranks domain-selective coordinates for shortlist search. Validation shows the instrument orders measured effects but is not effect-size calibrated, and the rescue quota does not improve the selected chem gate.
- Objective: Suppression is clamped at chance, retention penalizes drops beyond τ, and fluency contributes a separate next-token-loss price.The objective linearises held-out next-token loss rather than margin for its fluency term.
- Objective: The reported run uses λ = 2, ρ = 100, ν = 1, τ = 0.01, αD = 0.25, and a hard max_ppl_ratio = 1.10 gate.The fluency gate can make candidates ineligible regardless of objective score.
- Attribution: Gradient-times-activation attribution predicts domain-selective coordinates and supplies a fixed rescue quota for shortlist search.The criterion is applied at the factorisation bottleneck and contrasts target damage with retained-task damage.
- Instrument validation: Spearman ρ = 0.61 and sign agreement 0.92 show that first-order predictions order measured drops, while underestimating larger interventions.The instrument is explicitly an ordering signal, not an effect-size calibration.
- Shortlist ablation: Measured-only and combined search select the identical three-coordinate chem gate, so attribution’s rescue quota adds no selection benefit.The four-arm comparison matches candidate pool, fluency gate, and finalist count.
- Localisation: Localisation maps show corrected selectivity cells over the block-by-projection grid, with search steering kept separate from held-out split B.The correction threshold is q = 0.05 over 252 cells.
B.3 Why is cyber harder to suppress?
The apparent resistance of cyber to suppression is largely explained by lower baseline accuracy, while chemistry remains unusually susceptible. The evidence supports lower leverage of the present MLP-prefix interface, not an intrinsic inseparability claim.
- Control surface: 756 singleton interventions measured the control surface across 28 MLP coordinates, three WMDP domains, and nine non-full ranks.All interventions used the same split-A WMDP items and 256 MiniPile blocks without target-specific configuration selection.
- Raw comparison: At the 1.10× fluency cap, the 90th-percentile normalised margin drop was 0.197 for bio, 0.242 for chem, and 0.079 for cyber.Cyber leverage remained about 35–40% of the bio–chem average across cumulative caps from 1.02× through 4.00×.
- Raw comparison: Cyber’s registered contrast against the bio–chem average was −0.141, with a 95% interval of [−0.163, −0.107].Across identical eligible interventions, the mean contrast was −0.054, with 95% CI [−0.068, −0.039].
- Measurement concern: Baseline correctness was 43.2% for cyber, versus 67.6% for bio and 53.4% for chem, motivating matched baseline-known comparisons.The matched panel retained 87 items per domain with balanced answer letters and matched positions in baseline-margin ordering.
- Matched result: On matched questions, cyber and bio were statistically indistinguishable, while cyber remained below chem on both margin loss and known-answer flips.Cyber was −0.332 below chem on margin loss and −0.098 below chem on flips, both with intervals excluding zero.
- Narrower claim: The supported conclusion is lower MLP-prefix interface leverage over cyber, while proposed mechanisms remain untested and the broad WMDP–MMLU account lacks support.Band, attention, accumulation, and code-specific retain interventions are identified as direct follow-up tests.
B.4 The access matrix
The access matrix presents each lattice node as a principal with measured suppression, collateral, fluency, and cost across both evaluation splits. Rows increase in privilege, while omitted joins equal the full-privilege configuration.
- Access matrix: Table 1 maps each lattice node to per-domain suppression, collateral on both retain macros, fluency, and cost.Cost is measured as |supp(c)| with total rank withdrawn.
- Access matrix: Measured cells report split A / split B values in points against each split’s own full privilege.The table gives headroom values of 43.4/40.1 bio, 27.8/22.8 chem, and 19.2/16.6 cyber.
- Lattice structure: Rows ascend in privilege, and the three omitted joins equal c⊤ exactly.This makes the matrix directly usable as a deployment access matrix over lattice nodes.
B.5 The SmolLM2 generalisation
The SmolLM2 appendix reproduces the lattice design and evaluates composition across four runs. After correction, the triple strengthens bio, while chem-plus-cyber weakening of chem remains consistent but unresolved.
- Replication: Table 2 reports cross-family replication in both lineages and on both split halves, with suppression also expressed as removable headroom above chance.Split A reproduces every previously registered value exactly, licensing comparison with split B.
- Design: Four SmolLM2 lattice runs cover all twelve distinct parent pairs through a 23−1 fractional factorial design.Each search arm contributes its pre-registered pick and a strongest finalist preserving both retention macros within 2 pp.
- Profiles: The all-selected SmolLM2 run contains three atoms, while frontier parents were selected on raw suppression and are less robust by construction.The all-selected run has no post-hoc frontier-pick marker, and profile reproduction was exact across all four runs.
- Sublattice: The SmolLM2 measured sublattice shows chem accuracy rising under its gate, triple strengthening bio, and weak joins within the 1.03–1.10× in-gate range.The faded join equals c⊤ exactly, with parents gating disjoint supports.
- Profiles: The 120 gate-verified SmolLM2 finalists comprise 40 candidates per search arm, with selected markers read from the all-selected lattice run’s identical gated supports.The figure reports that every arrow points down and to the right, indicating less suppression and more collateral.
- Corrected verdict: After correction across 36 composition tests, BH retains one effect: the triple strengthens bio by −6.92 pp at p = 10−4.The chem+cyber weakening of chem appears at +4.29, +4.29, +5.52, and +9.20 pp across the four runs, but remains unresolved.