LMSM: LLM Security Framework Inspired by Linux Security Modules
XiuYu Zhang, Bonan Ruan, Junfeng Fang, An Zhang, Tat-Seng Chua, Zhenkai Liang
cs.CR
2026-08-26
NUS ports LSM-style mediation to LLM serving. On Qwen3-4B, Checkpoint cuts HarmBench ASR from 39.20% to 3.32% and keeps 98.14% of unmonitored throughput.
Deployed LLM safety already stacks alignment in the weights, prompt-side controls, and text guards at the I/O boundary. Interpretability adds a fourth signal: SAE features, transcoder coordinates, and linear probes can inspect activations while tokens are still buffered. The usual way to use that signal is to glue one artifact to its own calibration, policy logic, and intervention code. A better paper then becomes another guard stack, not an upgrade to the one already in production.
Linux hit the same split decades ago. The kernel refused to hard-code SELinux, and Linux Security Modules kept mediation in the kernel while letting policy modules change. LMSM copies that split into LLM serving. It does not claim any detector is best. It claims you can swap backends, rules, and when they fire without rebuilding request handling or output release.
The path has three pieces.
Two schedules share the same pipe. Checkpoint evaluates 15 rules once, after generated token 64. Anytime evaluates after every decode step and acts on the first crossing. State is keyed by request identity, not by the packed row index, so continuous batching can move, finish, and reuse slots without mixing decisions.
The prototype hooks Hugging Face Transformers and eager vLLM. Base weights stay frozen.
The main run is Qwen3-4B with thinking on, one H100, up to 32 active sequences. Matched Disabled keeps the same sensing path but suppresses state-changing actions.
| Setup | HarmBench ASR | WildJailbreak ASR | XSTest false refusal |
| Matched Disabled | 39.20% | 41.90% | 2.40% |
| LMSM-Checkpoint | 3.32% | 7.35% | 4.40% |
| LMSM-Anytime | 6.81% | 6.00% | 5.60% |
Relative harmful-output cuts land between 82.5% and 91.5%. ThinkSafe reports 9.63% / 7.45% for the same model under training-time defenses; the paper flags that those numbers were not rerun on this serving path.
Against a matched empty extension with no monitoring work, Checkpoint keeps 98.14% throughput at width 32 and 96.89% with all 15 rules on. Anytime, which scores every step, keeps 83.91% at width 32. Under scheduler churn, all 32 duplicate pairs preserve action, category, intervention step, and the full per-rule crossing vector.
On 264 HarmBench prompts, a Gemma SAE six-rule bundle cuts unsafe replies from 122 to 11; a Qwen transcoder bundle cuts 127 to 13. Those two runs show the interface is portable. They were not calibrated as matched safety policies.
This is a swappable shell for serving-time safety. Alignment still sets default behavior. Runtime rules cover residual failures and operator-specific obligations without a retrain. A better SAE later means a new binding and updated rule conditions, not a new stack. The trade-off is explicit: Checkpoint is cheap and late; Anytime is early, costlier, and refuses more benign prompts.
The eval is in-process eager vLLM on one H100. The current Python hook forces eager execution; compiled vLLM is 2.38× faster, so the 1.86% Checkpoint overhead is an eager-path number. One policy binds one backend and one activation site. The threat model trusts the whole serving process, so a compromised model, probe, or rule set is out of scope. Protection quality follows calibration; adaptive attacks are not tested on their own. The action set is still allow / terminate / refuse. Redaction, regeneration, and human review are listed as future work.
ASR and false-refusal rates are judge labels on released text (Llama-Guard-3, WildGuard), not intervention rates.