让操作系统内核直接读取大模型预测的下一个词概率，实现零成本安全检测。
ProbeLogits: Kernel-Level LLM Inference Primitives for AI-Native Operating Systems
- 在内核层通过单次前向传播读取特定词元概率，判断行为是否安全
- 在HarmBench上阻断率达97%-99%，在ToxicChat上性能超越或媲美Llama Guard 3
- 无需额外训练模型，检测速度提升2.4-3.4倍，且难以绕过沙箱限制
一个运行大模型推理的系统内核可在生成任何文本前读取模型自身的下一个词概率分布，并将其作为治理原语。本文提出ProbeLogits，一种内核级操作，在不引入任何可学习参数的情况下，仅需一次前向传播并读取特定词元概率，即可将代理行为分类为安全或危险。由于探测读取的是代理已运行的基础模型的相同输出，它省去了微调防护模型所需的第二个模型，使安全检查的边际成本仅为一次词元概率读取。我在三个基础模型（Qwen2.5-7B、Llama-3-8B、Mistral-7B）上评估了ProbeLogits，并在三个外部基准（HarmBench、XSTest、ToxicChat）上进行了测试。在HarmBench非版权部分，三者阻断率均达97%-99%。在ToxicChat（n=1,000）中，ProbeLogits达到或超过Llama Guard 3的F1分数：Qwen2.5-7B的安全/危险分类达到F1=0.812（优于+13.7个百分点，置信区间不重叠），Llama-3在置信区间内持平（+0.4个百分点），Mistral则超出+4.4个百分点。分类速度比Llama Guard 3快2.4-3.4倍（332-556毫秒对比851-1,142毫秒），因仅读取单一词元位置而非生成文本。校准强度alpha作为部署时的策略旋钮，而非训练超参数，可按操作类别权衡召回率与精确率。我已在Anima OS（一个用约28.5万行Rust编写的裸金属x86-64内核）中实现ProbeLogits。由于代理行为必须经过内核管理的主机函数，该机制运行在WASM沙箱边界之下，使得绕过难度远高于应用层分类器。
原文摘要 · Abstract (English)
An OS kernel that runs LLM inference internally can read the model's own next-token logit distribution before any text is generated, and act on it as a governance primitive. I present ProbeLogits, a kernel-level operation that performs a single forward pass and reads specific token logits to classify an agent's action as safe or dangerous, with zero learned parameters. Because the probe reads a logit from the same base model the agent already runs, it removes the second model a fine-tuned guard requires: the marginal cost of a safety check becomes a single logit read. I evaluate ProbeLogits on three base models (Qwen2.5-7B, Llama-3-8B, Mistral-7B) across three external benchmarks (HarmBench, XSTest, ToxicChat). On HarmBench non-copyright, all three reach a 97-99% block rate. On ToxicChat (n=1,000), ProbeLogits attains F1 parity-or-better against Llama Guard 3: Qwen2.5-7B Safe/Dangerous reaches F1=0.812 (+13.7 pp, bootstrap 95% CIs disjoint), Llama-3 matches within CI (+0.4 pp), and Mistral exceeds by +4.4 pp. Classification is a measured 2.4-3.4x faster than Llama Guard 3 (332-556 ms vs. 851-1,142 ms), because it reads a single logit position instead of generating tokens. A calibration strength alpha acts as a deployment-time policy knob rather than a learned hyperparameter, trading recall for precision per operation class. I implement ProbeLogits within Anima OS, a bare-metal x86-64 kernel written in ~285,000 lines of Rust. Because agent actions must pass through kernel-mediated host functions, enforcement operates below the WASM sandbox boundary, making it substantially harder to circumvent than application-layer classifiers.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。