基于激活空间锚定的多类权限推理访问控制
Activation-Space Anchored Access Control for Multi-Class Permission Reasoning in Large Language Models
AI总结：
本文提出AAAC框架，通过激活空间锚点实现多类权限控制，有效降低权限违规和攻击成功率。
摘要：
大型语言模型（LLMs）越来越多地被部署在知识库上，以实现高效的知识检索和问答。然而，LLMs可能会无意中超出用户的权限范围进行回答，泄露敏感内容，从而使得在细粒度访问控制要求下部署知识库问答变得困难。在本工作中，我们识别出中间激活中的几何规律：对于相同的查询，由不同权限范围诱导的表示会明显聚类并易于分离。基于这种可分离性，我们提出了激活空间锚定访问控制（AAAC），一种无需训练的多类权限控制框架。AAAC从一个小的离线样本集中构建一个锚库，每个类别一个权限锚点，并且不需要微调。在推理时，多锚点引导机制会将每个查询的激活向量引导至与当前用户相关的锚定义授权区域，从而通过设计抑制过度授权的生成。最后，跨三个LLM家族的广泛实验表明，AAAC将权限违规率降低了高达86.5%，并将基于提示的攻击成功率降低了90.7%，同时在与基线相比的情况下，通过轻微的推理开销提高了响应的可用性。
英文摘要：
Large language models (LLMs) are increasingly deployed over knowledge bases for efficient knowledge retrieval and question answering. However, LLMs can inadvertently answer beyond a user's permission scope, leaking sensitive content, thus making it difficult to deploy knowledge-base QA under fine-grained access control requirements. In this work, we identify a geometric regularity in intermediate activations: for the same query, representations induced by different permission scopes cluster distinctly and are readily separable. Building on this separability, we propose Activation-space Anchored Access Control (AAAC), a training-free framework for multi-class permission control. AAAC constructs an anchor bank, with one permission anchor per class, from a small offline sample set and requires no fine-tuning. At inference time, a multi-anchor steering mechanism redirects each query's activations toward the anchor-defined authorized region associated with the current user, thereby suppressing over-privileged generations by design. Finally, extensive experiments across three LLM families demonstrate that AAAC reduces permission violation rates by up to 86.5% and prompt-based attack success rates by 90.7%, while improving response usability with minor inference overhead compared to baselines.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
