通过激活空间锚点实现大模型多权限精准控制，防止越权泄露。
Activation-Space Anchored Access Control for Multi-Class Permission Reasoning in Large Language Models
- 利用中间激活的几何特性，构建权限锚点库实现无训练控制。
- 在3个LLM族上降低86.5%权限违规率，90.7%攻击成功率。
- 无需微调，推理开销小，适合高安全要求的知识问答场景。
大语言模型（LLMs）日益用于知识库以实现高效知识检索与问答。然而，模型可能无意中回答超出用户权限范围的内容，导致敏感信息泄露，难以满足细粒度访问控制需求。本文发现：对同一查询，不同权限范围下的中间激活呈现明显聚类特征，且可被轻易分离。基于此可分性，我们提出无需训练的多类权限控制框架——激活空间锚定访问控制（AAAC）。AAAC从少量离线样本中构建每个权限类别的一个锚点，形成锚点库，并在推理时通过多锚点引导机制，将查询激活引导至当前用户对应的授权区域，从而设计性地抑制越权生成。在三个主流LLM家族上的大量实验表明，AAAC将权限违规率降低最高达86.5%，提示攻击成功率下降90.7%，同时保持响应可用性，仅带来轻微推理开销。
原文摘要 · Abstract (English)
Large language models (LLMs) are increasingly deployed over knowledge bases for efficient knowledge retrieval and question answering. However, LLMs can inadvertently answer beyond a user's permission scope, leaking sensitive content, thus making it difficult to deploy knowledge-base QA under fine-grained access control requirements. In this work, we identify a geometric regularity in intermediate activations: for the same query, representations induced by different permission scopes cluster distinctly and are readily separable. Building on this separability, we propose Activation-space Anchored Access Control (AAAC), a training-free framework for multi-class permission control. AAAC constructs an anchor bank, with one permission anchor per class, from a small offline sample set and requires no fine-tuning. At inference time, a multi-anchor steering mechanism redirects each query's activations toward the anchor-defined authorized region associated with the current user, thereby suppressing over-privileged generations by design. Finally, extensive experiments across three LLM families demonstrate that AAAC reduces permission violation rates by up to 86.5% and prompt-based attack success rates by 90.7%, while improving response usability with minor inference overhead compared to baselines.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。