LMSM: Linux-Security-Modules-Style Mediation for LLM Enforcement

LMSM introduces a security framework that applies the Linux Security Modules separation to LLM serving, decoupling calibrated evidence, versioned policy, and output gating. On Qwen3-4B, the prototype reduces HarmBench attack success rate from 39.20% to 3.32% with a 2.0pp rise in XSTest false refusals and about 98% throughput retention at 32 active sequences, but the evidence is a single abstract-level preprint without code or comparative baselines.

Hugging Face Daily Papers — LMSM: LLM Security Framework Inspired by Linux Security Modules

September 1, 20261 source62% confidence

72Strategic

Strategic score

Evidence strength42

Technical novelty78

Commercial potential58

The event is a proposal, not a product: an arXiv listing for LMSM, a framework that grafts the mediation/policy separation of Linux Security Modules onto LLM inference. The actual novelty is formalizing a boundary between three functions that current defenses usually entangle: calibrated evidence from model internals, versioned rules, and an output gate. That boundary, if it holds, would make interpretability artifacts interchangeable security backends rather than bespoke integrations.¹

Context

The framing starts from a supply-side problem: interpretability signals are not security controls, and adapting one into a control requires signal-specific calibration, policy logic, and intervention code. Each new artifact increases integration work. LMSM shifts that work into a shared substrate, in the same way LSM removed per-module kernel mediation hooks from Linux policy modules.¹

Assessment

The supporting evidence is a prototype on Qwen3-4B with continuously batched vLLM. The headline trade—HarmBench attack success falling from 39.20% to 3.32% while XSTest false refusals rise from 2.40% to 4.40% at 32 active sequences—shows the separation does not obviously collapse, and throughput is 98.14% of a non-monitoring path. This is one operating point, not a production cost estimate.¹

Caveats

AI hypothesisWhat would change my mind: public code and reproducible benchmark runs; ablations showing each layer (backend, policy, gate) contributes; stress at higher concurrency and with multiple composed rules; and comparisons against established defenses such as guard models, perplexity filters, or RLHF hardening. Without those, LMSM remains an architecture proposal with one favorable data point.¹

Source text

Hugging Face Daily Papers — LMSM: LLM Security Framework Inspired by Linux Security Modules · August 26, 2026

Computer Science > Cryptography and Security

Title:LMSM: LLM Security Framework Inspired by Linux Security Modules

Abstract:Large language models (LLMs) are increasingly deployed with layered defenses, yet malicious prompts can still bypass them. Interpretability methods can expose model-internal signals along the generation path that could inform enforcement, but these signals are not security controls by themselves. Deployments that adapt them for safety typically couple each signal to its own calibration, policy logic, and intervention code, so each new artifact creates integration work instead of strengthening a shared defense. We present Language Model Security Modules (LMSM), a security framework that adapts the separation behind Linux Security Modules (LSM) to LLM serving. In LMSM, a selected security backend exposes calibrated evidence, a versioned policy evaluates active rules over trusted per-request context, and a separate gate authorizes buffered output release. This design separates mediation correctness from policy effectiveness, and it allows backend, rule, or schedule changes without rebuilding request handling or enforcement. Our prototype shows the separation working in practice: with Hugging Face Transformers and continuously batched vLLM, the same substrate hosts artifact-backed sparse autoencoder (SAE) and transcoder deployments and task-fitted dense probes, preserves request-specific decisions under scheduler churn, and selectively enforces and composes multiple rules per request. On Qwen3-4B, LMSM-Checkpoint reduces HarmBench attack success rate from 39.20% to 3.32%, with XSTest false refusals rising from 2.40% to 4.40%, while retaining 98.14% of the throughput of a matched serving path that performs no monitoring work at 32 active sequences. LMSM gives advances in interpretability and model-internal analysis a common path to runtime enforcement.

Access Paper:

Bookmark

Bibliographic and Citation Tools

Code, Data and Media Associated with this Article

Demos

Recommenders and Search Tools

arXivLabs: experimental projects with community collaborators

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.

Linux Security Modules is the kernel interface that lets modules such as AppArmor and SELinux enforce policy without modifying each syscall; the paper's claim is that an output gate during LLM generation is an analogous hook. The unstated wager is that generation-time buffering is an acceptable mediation point, meaning users accept deferred or conditional output release.

Sparse autoencoders and transcoders are sparse feature decompositions of model activations; task-fitted dense probes are classifiers trained on hidden states. 'Artifact-backed' means each is a backend exposing calibrated evidence, not a standalone safety model. This is what makes the framework a substrate rather than another detector.

HarmBench ASR is the fraction of adversarial prompts that elicit harmful behavior on a standardized set; XSTest measures false refusals on benign prompts. The abstract reports absolute deltas without confidence intervals or per-category breakdown, so the refusal cost may vary by domain.

The 98.14% throughput figure is relative to a matched serving path that does no monitoring, and it is reported only at 32 active sequences. This is a single concurrency point; overhead at higher batch sizes or with multiple rules per request is not disclosed, so the architectural benefits are clearer than the runtime cost.

The source text above remains the property of its publisher and is reproduced for commentary.

Hugging Face Daily Papers — LMSM: LLM Security Framework Inspired by Linux Security Modules

August 26, 2026endistinct angle

LMSM: LLM Security Framework Inspired by Linux Security Modules

↑ Back to top