LMSM：受Linux安全模块启发的LLM安全框架

摘要

大型語言模型（LLM）的部署日益仰賴分層防禦，然而惡意提示詞仍可繞過這些防禦。可解釋性方法能夠揭露生成路徑上可為執行強制提供依據的模型內部訊號，但這些訊號本身並非安全控制機制。將這些訊號改編用於安全目的的部署，通常會將每個訊號與其各自的校準、策略邏輯與介入程式碼耦合，因此每新增一個工件只會增加整合工作量，而非強化共享防禦。我們提出語言模型安全模組（LMSM），這是一個借鑒 Linux 安全模組（LSM）分離架構的安全框架，用於 LLM 服務。在 LMSM 中，所選定的安全後端揭露已校準的證據，版本化策略在受信任的逐請求上下文上評估啟用規則，而獨立的閘門則授權緩衝輸出的釋放。此設計將中介正確性與策略有效性分離，使後端、規則或排程的變更毋須重建請求處理或執行強制邏輯。我們的原型展示了此分離在實務中的運作：在 Hugging Face Transformers 與持續批次處理的 vLLM 環境下，同一基礎架構可同時承載以工件為後盾的稀疏自編碼器（SAE）與轉碼器部署、以及任務適配的密集探針，在排程器變動下仍能保留逐請求的決策，並能針對每個請求選擇性地執行與組合多條規則。在 Qwen3-4B 上，LMSM-Checkpoint 將 HarmBench 攻擊成功率從 39.20% 降至 3.32%，XSTest 誤拒率從 2.40% 上升至 4.40%，同時在 32 條活動序列下保留了與不執行監控工作的對照服務路徑 98.14% 的吞吐量。LMSM 為可解釋性與模型內部分析方面的進展提供了通往執行期強制執行的共同路徑。

English

Large language models (LLMs) are increasingly deployed with layered defenses, yet malicious prompts can still bypass them. Interpretability methods can expose model-internal signals along the generation path that could inform enforcement, but these signals are not security controls by themselves. Deployments that adapt them for safety typically couple each signal to its own calibration, policy logic, and intervention code, so each new artifact creates integration work instead of strengthening a shared defense. We present Language Model Security Modules (LMSM), a security framework that adapts the separation behind Linux Security Modules (LSM) to LLM serving. In LMSM, a selected security backend exposes calibrated evidence, a versioned policy evaluates active rules over trusted per-request context, and a separate gate authorizes buffered output release. This design separates mediation correctness from policy effectiveness, and it allows backend, rule, or schedule changes without rebuilding request handling or enforcement. Our prototype shows the separation working in practice: with Hugging Face Transformers and continuously batched vLLM, the same substrate hosts artifact-backed sparse autoencoder (SAE) and transcoder deployments and task-fitted dense probes, preserves request-specific decisions under scheduler churn, and selectively enforces and composes multiple rules per request. On Qwen3-4B, LMSM-Checkpoint reduces HarmBench attack success rate from 39.20% to 3.32%, with XSTest false refusals rising from 2.40% to 4.40%, while retaining 98.14% of the throughput of a matched serving path that performs no monitoring work at 32 active sequences. LMSM gives advances in interpretability and model-internal analysis a common path to runtime enforcement.