Capability-Gated Language Models: Security Composes, Utility Does Not

arXiv:2609.00445 · cs.CR, cs.AI, cs.LG · Submitted 2026-08-31 · Read on arXiv

cs.CR, cs.AI, cs.LG

Submitted: 2026-08-31

Updated: 2026-10-16

Comments: Accepted to NeurIPS 2026 Workshop on Foundations of Language Model Security

License: http://creativecommons.org/licenses/by/4.0/

The gist: Deployed language model safeguards (safety fine-tuning, filtering, unlearning) vary by principal only outside the model weights: filters are reconfigured, tiers are multiplied, and artefacts are

Terminology

Abstract

Deployed language model safeguards (safety fine-tuning, filtering, unlearning) vary by principal only outside the model weights: filters are reconfigured, tiers are multiplied, and artefacts are reissued; inside one set of weights every request meets the same model configuration. This motivates us to define capability-gated deployment: per-principal access control inside one set of weights, whose configurations form a lattice - meets accumulate a principal's restrictions and joins pool a coalition's reach. We instantiate it by sparse rank gating over an existing nested-factorisation mechanism, guide profile search with one-pass attribution, and read every result once from a pre-registered held-out split. Security approximately composes: provably exactly at meets under a monotone-elicitation assumption we falsify pointwise. In two lineages the median held-out meet deepens suppression; the one effect surviving correction strengthens it. Utility does not: individually harmless profiles can compose to retention and fluency damage, and no compositional bound exists.

Sources

Related papers