LMSM：受Linux安全模块启发的大语言模型安全框架

摘要

大语言模型（LLM）正越来越多地采用分层防御进行部署，但恶意提示仍然可以绕过这些防御。可解释性方法能够揭示生成路径中模型内部的信号，这些信号可为防御执行提供依据，但这些信号本身并非安全控制措施。将其适配用于安全性的部署通常会将每个信号与各自的校准机制、策略逻辑和干预代码耦合在一起，因此每新增一个工件就会带来集成工作，而非强化共享防御。我们提出了语言模型安全模块（LMSM），这是一个借鉴Linux安全模块（LSM）的隔离理念并将其应用于LLM服务的安全框架。在LMSM中，选定的安全后端提供经校准的证据，版本化策略基于可信的逐请求上下文评估活动规则，而独立的门控模块则授权缓冲输出的发布。这种设计将仲裁正确性与策略有效性相分离，使得后端、规则或调度计划的变更无需重建请求处理或执行逻辑。我们的原型展示了这种隔离在实际中的运作：在Hugging Face Transformers和连续批处理的vLLM上，同一基础平台可承载基于工件的稀疏自编码器（SAE）和转码器部署以及任务适配的稠密探针，在调度器动态变化下保持逐请求决策的稳定性，并支持对每个请求选择性地执行和组合多条规则。在Qwen3-4B上，LMSM-Checkpoint将HarmBench攻击成功率从39.20%降至3.32%，XSTest误拒绝率从2.40%上升至4.40%，同时在32条活动序列下保留了匹配的无监控服务路径98.14%的吞吐量。LMSM为可解释性和模型内部分析的进展提供了通向运行时防御执行的共同路径。

English

Large language models (LLMs) are increasingly deployed with layered defenses, yet malicious prompts can still bypass them. Interpretability methods can expose model-internal signals along the generation path that could inform enforcement, but these signals are not security controls by themselves. Deployments that adapt them for safety typically couple each signal to its own calibration, policy logic, and intervention code, so each new artifact creates integration work instead of strengthening a shared defense. We present Language Model Security Modules (LMSM), a security framework that adapts the separation behind Linux Security Modules (LSM) to LLM serving. In LMSM, a selected security backend exposes calibrated evidence, a versioned policy evaluates active rules over trusted per-request context, and a separate gate authorizes buffered output release. This design separates mediation correctness from policy effectiveness, and it allows backend, rule, or schedule changes without rebuilding request handling or enforcement. Our prototype shows the separation working in practice: with Hugging Face Transformers and continuously batched vLLM, the same substrate hosts artifact-backed sparse autoencoder (SAE) and transcoder deployments and task-fitted dense probes, preserves request-specific decisions under scheduler churn, and selectively enforces and composes multiple rules per request. On Qwen3-4B, LMSM-Checkpoint reduces HarmBench attack success rate from 39.20% to 3.32%, with XSTest false refusals rising from 2.40% to 4.40%, while retaining 98.14% of the throughput of a matched serving path that performs no monitoring work at 32 active sequences. LMSM gives advances in interpretability and model-internal analysis a common path to runtime enforcement.