LMSM Brings the Linux Security Module Model to LLM Serving

Introduction

Runtime safety for large language models is often limited less by the absence of useful signals than by the difficulty of integrating them into a serving system. Interpretability techniques can reveal internal model states along the generation path, but those states are not security controls on their own. In practice, each new probe, autoencoder, or other interpretability artifact may require its own calibration procedure, policy logic, and intervention code. That makes safety deployments harder to maintain and makes replacing one artifact with another an expensive integration project.

A research team from the National University of Singapore proposes Language Model Security Modules (LMSM), a framework inspired by the separation used by Linux Security Modules, or LSM.

What the framework changes

• Evidence is separated from enforcement. A selected security backend exposes calibrated evidence from the model. A policy layer evaluates versioned rules against trusted, request-specific context. A separate gate decides whether buffered output can be released.
• Backends are interchangeable. The same substrate can host artifact-backed sparse autoencoders, transcoders, and task-fitted dense probes. Changing the evidence backend, active rules, or scheduling policy does not require rebuilding request handling or the enforcement path.
• Request identity is preserved during batching. The prototype covers Hugging Face Transformers and continuously batched vLLM. LMSM is designed to keep decisions associated with the correct request even when the scheduler changes how sequences are arranged.
• Rules can be selective and composable. Policies may activate only selected checks for a request and combine multiple rules, rather than applying one fixed intervention to every generation.

Reported results and limitations

On Qwen3-4B, the LMSM-Checkpoint configuration reduced HarmBench attack success from 39.20% to 3.32%. The XSTest false-refusal rate increased from 2.40% to 4.40%, showing the familiar trade-off between stronger blocking and preserving benign behavior. At 32 active sequences, the system retained 98.14% of the throughput of a matched serving path that performed no monitoring work.

These measurements suggest that runtime monitoring can be integrated without an overwhelming serving penalty in the tested setup. They also show why policy calibration remains important: a lower attack success rate is not enough if harmless requests are rejected more often.

Why it matters

LMSM’s main contribution is architectural rather than the introduction of one new detector. It defines a shared path from internal evidence to policy decisions and finally to output enforcement. New interpretability artifacts can therefore be adopted as evidence providers, while policy and mediation logic remain separate. This could reduce the engineering friction between experimental interpretability work and production safety systems.

The framework does not automatically solve the quality of internal evidence, threshold selection, or coverage of attack behaviors. The reported results come from a particular model, benchmark suite, and prototype implementation, so broader models and workloads still need evaluation. Even so, LMSM offers a practical interface for evolving model-internal safety methods without repeatedly redesigning the serving stack.

Source: Hugging Face Daily Papers