LMSM Ports the Linux Security Modules Split to LLM Serving, Cutting HarmBench ASR 39.20% to 3.32% at 98.14% Throughput

arXiv 2608.25697·medium signalXBlueskyLinkedInCopy link

Zhang et al. argue that interpretability signals become integration debt when each one ships its own calibration, policy logic, and intervention code, and adapt the LSM separation instead: a pluggable backend supplies calibrated evidence, a versioned policy evaluates rules over trusted per-request context, and a separate gate authorizes buffered output release. The prototype runs on Hugging Face Transformers and continuously batched vLLM, hosting sparse autoencoder, transcoder, and dense-probe backends on one substrate while preserving per-request decisions under scheduler churn. On Qwen3-4B it drops HarmBench attack success from 39.20% to 3.32% with XSTest false refusals rising 2.40% to 4.40%, retaining 98.14% of unmonitored throughput at 32 active sequences.