让大模型的特定能力可审计、可撤销，仅授权者才能调用新训练的专家模块。
Policy-Masked Private Experts: Auditable and Reversible Capability Access Control in Sparse MoE Models
- 通过隔离训练新专家分支，路由前按策略选择公开或私有路径。
- 在64种攻击场景下，未授权请求完全无法触发私有专家，零误执行。
- 适合需要精确控制模型能力访问的高安全场景，如合规生成与可信推理。
现有语言模型访问控制通常只限制行为，却允许所有请求使用相同计算资源。本文提出一种新系统：能否由可信授权机制决定哪些新训练的参数可被前向传播访问？提出Policy-Masked Private Experts方法，在冻结预训练稀疏MoE模型的基础上，独立训练一个专家分支，并在top-k路由前选择公共或私有专家池。核心主张是：在声明的可信计算基（TCB）下，未经授权请求将不执行任何私有专家。这并不意味着公共模型不具备相同语义能力。在Qwen3-30B-A3B和DeepSeek-V2-Lite上测试：三个BF16种子更新全部32个私有专家，而公共指纹保持不变；在64个对抗场景和96次拒绝/失败闭合事件中，未授权私有执行为零；独立钩子精确匹配11,616条路由私有行，且允许-拒绝-允许恢复准确无误。在两个前瞻性冻结的Qwen基准上，私有分支使精确工具使用提升5.0 pp（五次而非零次冲突；单侧Holm p=0.03125，双侧精确p=0.0625）和21.3 pp（百分位自助95%置信区间[13.3, 29.3]，Holm p=0.000031）。三位盲测评估者仍观察到18.7 pp正外部效应（95% CI [9.3, 28.0]）。参数匹配的LoRA具备类似外部效用，但事后请求门控仍有1,225次适配器调用被拒绝；而分离专家分支则实现零残留。DeepSeek复现了路由不变性并提升27.0 pp。有效密封评估结果接近中性。结果表明：对已训练参数路径可实现可审计、可逆的控制，同时显示有用迁移仍依赖分布特性。
原文摘要 · Abstract (English)
Most language-model access controls regulate behavior while leaving the same computation available to every request. We study a different systems question: can trusted authorization determine which newly trained parameters are reachable by the forward pass? Policy-Masked Private Experts freezes a pretrained sparse Mixture-of-Experts (MoE) model, trains a disjoint expert branch, and selects the public or private pool before top-k routing. The resulting claim is narrow but testable: under the declared trusted computing base (TCB), an unauthorized request executes no private expert. It does not imply that the public model lacks the same semantic capability. We test this separation between execution control and task utility in Qwen3-30B-A3B and DeepSeek-V2-Lite. Three Qwen BF16 seeds update all 32 private experts while the public fingerprint remains unchanged. Across 64 adversarial scenarios and 96 deny/fail-closed events, unauthorized private execution is zero; independent hooks exactly match 11,616 routed private rows and allow-deny-allow recovery is exact. On two prospectively frozen Qwen benchmarks, the private branch improves exact tool use by 5.0 percentage points (pp) (five versus zero discordances; one-sided Holm p = 0.03125, corresponding two-sided exact p = 0.0625) and 21.3 pp (percentile-bootstrap 95% CI [13.3, 29.3], Holm p = 0.000031). Three arm-blinded model evaluators retain a positive external effect of 18.7 pp (95% CI [9.3, 28.0]). A parameter-matched Lora has similar external utility, but a post-hoc request gate leaves 1,225 adapter calls under deny; the disjoint expert branch leaves none. DeepSeek reproduces the route invariant and gains 27.0 pp. A valid sealed evaluation is near-neutral. These results support auditable, reversible control over a trained parameter path, while showing that useful transfer remains distribution dependent.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。