Permissioned LLMs: Enforcing Access Control in Large Language Models
Authors: Bargav Jayaraman
Virendra Marathe
Hamid Mozaffari
William F. Shen
Krishnaram Kenthapadi
Venue: NeurIPS 2025 poster ()
Keywords: LLM
PEFT
access control
Primary area: deep_learning
TL;DR: We propose a new class of fine-tuned LLMs, Permissioned LLMs, that enforce access control on responses to queries, thus protecting sensitive training/tuning data from unauthorized queries.

Abstract: In enterprise settings, organizational data is segregated, siloed and carefully protected by elaborate access control frameworks. These access control structures can completely break down if an LLM fine-tuned on the siloed data serves requests, for downstream tasks, from individuals with disparate access privileges. We propose Permissioned LLMs (PermLLM), a new class of LLMs that superimpose the organizational data access control structures on query responses they generate. We formalize abstractions underpinning the means to determine whether access control enforcement happens correctly over LLM query responses. Our formalism introduces the notion of a relevant response that can be used to prove whether a PermLLM mechanism has been implemented correctly. We also introduce a novel
metric, called access advantage, to empirically evaluate the efficacy of a PermLLM mechanism. We introduce three novel PermLLM mechanisms that build on Parameter Efficient Fine-Tuning to achieve the desired access control. We furthermore present two instantiations of access advantage–(i) Domain Distinguishability Index (DDI) based on Membership Inference Attacks, and (ii) Utility Gap Index (UGI)
based on LLM utility evaluation. We demonstrate the efficacy of our PermLLM mechanisms through extensive experiments on five public datasets (GPQA, RCV1, SimpleQA, WMDP, and PubMedQA), in addition to evaluating the validity of DDI and UGI metrics themselves for quantifying access control in LLMs.

Permissioned LLMs: Enforcing Access Control in Large Language Models
Bargav Jayaraman
Virendra J. Marathe
Oracle Labs
Oracle Labs
bargav. www..ayaaaaaaaaaee....om
virendra sxrenddaa.maatteeeaacle..oo
Hamid Mozaffari
William F. Shen University of Cambridge fa604 @cam. ac.ut uk
Oracle Labs
hamid. samidc..ozaaffaiioorace..co
Krishnaram Kenthapadi
Oracle Health
krishnaram, Btw.rrraw.nnntaaaaaaaaaaaeeeoo woracle.accoooooooo
Abstract
In enterprise settings, organizational data is segregated, siloed and carefully pro- tected by elaborate access control frameworks. These access control structures can completely break down if an LLM fine-tuned on the siloed data serves requests, for downstream tasks, from individuals with disparate access privileges. We pro- pose Permissioned LLMs (PermLLM) new class LLMs that superimpose the organizational data access control structures query responses they generate. We formalize abstractions underpinning the means to determine whether access control enforcement happens correctly over LLM query responses. Our formalism introduces the notion of a relevant response that can be used to prove whether a PermLLM mechanism has been implemented correctly. We also introduce novel metric, called access advantage, to empirically evaluate the efficacy of a PermLLM mechanism. We introduce three novel PermLLM mechanisms that build Param- eter Efficient Fine- Tine-Tunee Tuning to achieve the desired access control. We furthermore present instantiations of access advantage-(i) Domain Distinguishability Index (DDI) based on Membership Inference Attacks, and (ii) Utility Gap Index (UGI) based on L.LM utility evaluation. We demonstrate the efficacy of our PermLLM mechanisms through extensive experiments on five public datasets (GPQA, RCV1, SimpleQA. WMDP, and PubMedQA), addition to evaluating the validity of DDI and UGI metrics themselves for quantifying access control in LLMs.
Introduction
Large Language Models (LLMs), due to their unprecedented natural language processing capabilities, being adopted in vast range of applications across the entire computing industry [2] 48). The day may not be too far off when L.MS become the primary interface to a large swath of computing and information extraction tasks. In this paper, focus enterprise settings where LLMs used to perform wide variety of computing tasks using organization- wide data. Using L.LSs that have a wide purview over organizational data brings massive troves of information and utility, including the ability to combine learnings from disparate information silos of the organization, to the finger tips of individuals in the organization. However, making all the learnings from organizational data available to any individual who can query the LLM becomes critical security challenge: Organizations have
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Output
Pre-trained LLM (Frozen)
PerLLLM
Output
Adapter Merging
Outout
Pre traiieed (Frozen)
B
B
Pro: trriinddd LLM (Frozen)
A
PormLLM
Quert Ney
W
Weyss
W.
PermLLM Union Adepters
Quer Quasss
B
B
B
B A
B
W
W
W.
Way
Fine-Tune
Fine: Tune
Secunty Domain Datasets
Security Domain Datasets
Security Datasets
(4) Activate
(b) Merge
(c) Union
Figure 1:
We propose three types of Permissioned LLM (PermLLM) mechanisms. (a) Activate: that has one-to-one mapping between the security domains and PEFT adapters. When user queries the model, the mechanism activates the relevant adapter(s). (b) Merge: merges subsets of relevant PEFT adapters serve the users that have access to multiple security domains. (c) Union: trains adapters on the unions of various security domains, and at the inference phase the relevant PEFT adapter is activated to user query that requires access multiple security domains.
access control structures and hierarchies that tightly control information flow to and from individuals within them. Information access via LLMs, if not carefully controlled, risks undermining the existing access control structures and hierarchies.
As example, consider government agencies using LLMS for multitude of tasks. The data in government agencies typically segregated in multiple "clearance levels" and users can access just the data they have access privileges for 30 Any other agency data is inaccessible to the users. An LLM trained on this agency-wide data can leak privileged information to unauthorized users, thus breaking the agency's access control framework that works on the raw data. Another example is that of role- based access control [10 11: Consider a health clinic setting, where individuals performing different "roles" (doctors, nurses, technicians, administrative staff, patients, etc.) interact with LLM to perform many tasks. The roles of the users determine what part of the clinic-wide data they should have access to. An LLM trained the clinic-wide data can be easily tricked into leaking information to unauthorized users.
Research proposals to build system prompts that instruct LLM to control what information is generated in the output can help curb some leakage of sensitive information to unauthorized users [8 25). However, they do not achieve absolute security, and clever jailbreaking prompts [40 34 26 27 can be used to overrule these system prompts. A recent work proposes tagging LLM queries with encrypted access credentials authenticate users and block unauthorized queries 77] This is good start, but it lacks the flexibility needed to enable access to disparate learnings from the LLM for different users based their access credentials. We discuss access control problems and solutions for agentic systems and Retrieval Augmented Generation (RAG) systems [23 in
This paper focuses the access control problem for LLMs when they are tuned on data coming from a multitude of data silos. The challenge here guarantee that users who do not have access to specific data silos cannot retrieve information from those silos by sending carefully crafted queries to the LLMs tuned on data from those silos. A recent work [12] took an initial step in this direction, but lacks the formal framework to evaluate the access control. Moreover they only explore one type of mechanism. As a security problem, access control absolute- you either achieve access control not, hence probabilistic solutions (e.g. Differential Privacy 9 not satisfactory.
Contributions. this paper, we comprehensively study the problem of access control in LLM fine-tuning. More specifically: (i) We formalize the notion of access control mechanism in LLMs in terms of the relevance of responses generated by an LLM to the raw data the users have access to. We use the notion of security domains in our formalism. Our formalism of response relevance can be used prove correctness access control mechanisms. We also propose a novel metric called access advantage that helps empirically quantify the effectiveness of an access control mechanism

---

(ii We present three new PermLLM fin-ttuning mechanisms (see Figure 1.. based on Parameter Efficient Eme-Tuning (PEFT) our access advantage metric, Domain Distinguishubility Index (DDI) and Utility Gap Index (UGI), as
on LLMs 2).
(iii) We introduce two novel instances of
tools to audit access control enforcement via an adversarial gaming setting ( 4). (iv) We empirically evaluate our access control mechanisms on two LLMs Mistral-0.1-78 and Llama-3.1-80) using
five different data sets: GPQA [33], RCVI I [22]. SimpleQA [41), WMDP [24), and PubMedQA [20]
(s 5). Our evaluation shows the effectiveness of our access advantage metrics in assessing whether proposed access control mechanism for LLMs is enforcing data protection correctly.
Formalizing Access Control in LLMs
2.1 Basic Setup and Notation
We define a security domain (henceforth called "domain" for brevity) as a collection of data records that require identical credentials for access (e.g. files with the same group in their access control lists). We consider settings where pretrained LLMs (such as Llama and Mistral models) are fine-tuned over data from different domains with added constraint responses to inference time queries will be generated from learnings on data coming from just the domains the user has access to. This added constraint is enforced via access control mechanisms that govern how the LLM uses data from different domains.
Consider universe of n different domains S = 1 {se}, and a training data set consisting of data from these domains D Ui_1 D., ~ D., (here D., is a data set sampled from data distribution Da,, of domain s₃). Let fn be the LLM tuned using data set D. Let W be the of fn parameters. Model fine-tuning changes values of a subset of W. We say that domain s; affects a subset of parameters W., S W if data from Ds; used change parameters W., during model fine-tuning (unless stated otherwise, the terms "affect" and "affected" mean this relation between 8; and Ws, in the rest of the paper). We define M as an access control mechanism that dictates the mapping of domain s; parameters Wa, via the affects relation. We say that LLM fine-tuned using data set is permissioned (PermLLM), denoted as fy it uses the access control mechanism M to map its parameters W to multitude of domains from S, where each domain s; affects parameters W., S W. Operationally, during fine-tuning, M specifies which set of model parameters Wa, are tuned for given domain 8; (see for more details). By the same token, during inference, M can specify which set of model parameters should be used to answer a query based on the user's access credentials.
We assume setting where the PermLLM fi resides in an enclosing system S that authenticates users who send queries to M. S determines the user u's access credentials cred, and calls authentin i cate (credy) ) that takes user credentials cred, and maps them to subset of domains S, that u can access. S,, is maintained by and is never exposed to user u. This process ensures cannot arbitrarily change S,, Each of user w's subsequent query q to IDM is annotated with S, by S. M determines the model parameters Ws,, used to generate a response ris, to q, where Ws. = U.es, W.
2.2 Definitions
Definition 2.1 (Relevant Response). Given a PermLLM fMM query q f.rom user u, and the set Su of domains u has access to, let MM) be the response of f& to query q. Response r is said to be relevant to S. (i.e., r = rs.) ) if fb uses parameters Ws., (in addition to any domain-agnone model parameters) to generate r.
We say that an access control mechanism M is correctly enforced on PermLLM fM iff every response r generated for every user u's query is relevant to S..
The above definition of relevant response helps us formally determine if a proposed access control mechanism M is algorithmically correct. We however require an empirically quantifiable metric to determine if the implementation (and the algorithm by extension) of M is correct. This is particularly important for auditing. To that end, we propose new metric called response relevance score, relu(fM (g), Sw), which quantifies the information gained on data in the domain set S, by observing
3

---

responses to queries generated using model parameters s,,, affected by domains of Su. relu is expected be higher when q ~ Ds.. (i.e., q is related to domain set S.). compared to when q o Ds..
We restrict the domain of relu to the real number interval [0, 1]. where is the best expected score for relevance. rele itself can be represented by another empirical metric such as prediction accuracy, or logits for the expected response. However, given that LLMs (and ML models in general) are generalization engines, practice we expect relu be less than 1. This restriction can be effectively addressed by measuring relv for domains that the user has access to and comparing it to relv for domains that the user does not have access to. We call this the access advantage.
Definition 2.2 (Access Advantage). Given PermLLM fo trained over data set D consisting of data from domains S = [8 with access control mechanism M, a subset of domains Su C S. l achieves a-access advantage w.r.. Su if:
EqwDs.. SB.S. / (relu((b(g)) S.) O relv (2), z
where relu() is the response relevance score on the corresponding domain subset (Sn, or S.). O is a "difference" operator specific to the access control assessment method (e.g., subtraction), and is advantage threshold that lies in the range [0.1].
The access advantage metric relies on the assumption that fD performs significantly better on domains user u has access to compared to domains u does not have access to. In other words, f should have explicit segregation between the different domains, approaches to model fine-tuning fail to achieve this goal as the model is traditionally trained on all the domains without any built-in domain segregation mechanism. To the best of our knowledge, no prior work on LLM and privacy formally tackles this problem of access control through explicit domain segregation. We next propose novel mechanisms to achieve domain segregation in 3 and propose empirical metrics to evaluate the access control protocols in $ 4
dictated by M.. The existing
We believe access advantage is critical metric for auditors to determine if an access control mechanism truly achieving the segregation of domains as intended. Hence it is in the auditor's s best interest to ensure that S,, S.S. Φ. Access advantage can diminish significantly when S, n.S. o o leading to incorrect conclusions about the efficacy of the access control mechanism.
To the best of our knowledge, prior works on retrieval augmented generation (RAG) based LLM deployments do not explicitly tackle the problem of measuring effectiveness of access control mechanisms formally or empirically. Our formalism of relevant response and access advantage extends RAG systems as well, closing that gap in formalism and empirical evaluation of access control protocols. While a thorough evaluation of access control for RAG based systems is outside the scope of this paper, a more detailed analysis of conditions for formal correctness of access control in RAG systems appears in Appendix A
2.3 Auditing Access Control
To evaluate the access control mechanisms, consider classic adversarial game between the system S enclosing the model f and the auditor A. We give A the ability to choose domain access by emulating an end user, send arbitrary queries to the model via S and observe the responses. A can replay the game multiple times as different users to conclude if the access control is correctly implemented.
Audit Game The formal game between auditor A and system S is as follows:
1. Auditor A chooses domain set S,, and emulates user u. A sends user credentials cred, and query q ~ Ds_, to system S.
2. S verifies the user credential cred,, and sends back the model response (T)(2) to A.
3. A chooses domain set S, such that S. n S. & and emulates user A sends user credentials cred, and the same query q ~ Ds., to S.
4. S verifies the user credential cred, and sends back the model response fb (q) to A.
5. A concludes the access control mechanism is correctly implemented if the access advantage relu(s (q), S.) O relv(fM (q), S.)I 2 a.
Note that the auditor A has superuser privileges to choose arbitrary domain access unlike an ordinary user. This is by design to allow the auditor to evaluate the correctness of the claimed access control

---

while still following the protocol of querying the model as benign user. Detailed instantiations of this adversarial game for different suites of access advantage metries are discussed in Appendix C
3 Permissioned LLM Mechanisms
We rely on Parameter Efficient Fine- Tin--Tnnng (PEFT) 17 to obtain model parameter segregation for domains. We focus on the LoRA PEFT adapter 17. however our mechanisms seamlessly apply to other types of adapters [6 42). The three mechanisms we describe ensure that domain data is steered to train select LoRA adapters. Each domain has unique identifier (domain Id), Our access control mechanism builds a map between domains and LoRA adapters within the PermLLM's metadata. The map is used to steer all examples from a domain to the corresponding adapter/s for training. This map is also used to steer queries to the correct LoRA adapters at inference time.
One LoRA per Security Domain For our base mechanism called Activate, we assume that users have access to at most one domain. Figure aa) depicts our base mechanism that performs simple 1-1 mapping between domains and LoRA adapters. We assume that the number of domains is known beforehand, and use that knowledge to instantiate corresponding number of LoRA adapters. During training, each minibatch is sampled from one domain, and the domain's 's Id is used to select the LoRA adapter to train. At inference time, user's query is annotated with the domain Id the user has access to. This domain Id is used to activate the LoRA adapter for the corresponding domain.
Merging LoRA Adapters for Security Domain Groups In many application settings, users have access to data from multiple domains. For queries coming from such users, our Activate enables all corresponding LoRA adapters. whose activations are averaged at inference time. We however found that activations from different LoRA adapters tend to disruptively interfere with each other resulting in catastrophic performance degradation beyond two domains. We leave further refinement of activation space steering [35] 45]
future work. In our second mechanism, Merge (Figure I Ib)),,
adopt
the LoRA adapter merging strategy for users with access to multiple domains [38] [43 46 50 We experimented with several LoRA merging algorithms including TIES
43 and DARE (46), but
eventually favored the SVD approach (38) because of its better performance and stability in the context of LoRA merging. We assume that the combination of domains that users may have access to are known beforehand. Thus, after training LoRA adapters for individual domains, we can merge them for those exact domain combinations. Correspondingly, our domain-LoRA adapter map is updated with the domain IDs and the merged LoRA adapters. These new mappings are used at inference time activate the correct merged LoRA adapters. We found that adapter merging is more robust to rross-adapter interference than activation merging.
Training LoRA per Combination of Security Domains Although Merge is better than activation space merging of multiple LoRA adapters, we observed that it also leads to model performance degradation with increasing number of merged adapters. As a result, we explored another simple alternative, Union, which trains a LoRA adapter on data from each unique combination of domains users have access to. Union indeed delivers the best performance in all our mechanisms. However, it comes at the cost of significantly greater tuning time compute a domain can occur in numerous combinations of domains (e.g. in Figure T(c), data D., gets used in the training set of all three LoRA adapters). Furthermore, data sets containing large number of domains presents the added challenge of an exponential blow up in domain combinations (at most )"). However, we believe the number of combinations present in a real-world setting will be much smaller than that upper bound.
The careful mapping of domains (or groups of domains) to the correct LoRA adapters, and steering of training examples from domains to the corresponding LoRA adapters ensures precise parameter segregation for domains. Our assumption that users cannot tamper with their access credentials at inference time further aids the PermLLM's enclosing system to determine the correct set of domains corresponding to query. The query steering that happens through the PermLLM using domain IDs guarantees that all responses generated by the PermLLM are relevant to the user's domains. Furthermore, the responses are not generated using LoRA adapters that were trained using data from domains that the user does not have access to. Response relevance for all responses implies correctness of our PermLLM access control mechanisms. Our proof appears in Appendix B
5

---

4 Auditing Access Control in Permissioned LLM Mechanisms
We now introduce two novel instantiations of our access advantage metric (Definition 2.2) Domain Distinguishability Index (DDI) and Utility Gap Index (UGI) that quantity access control efficacy independently any particular system design. We show how these metrics fit into the framework for empirically assessing access control mechanisms in PermLLMs through adversarial audit games in Appendix C
These metrics are [0.1] range with higher values denoting better access control.
4.1
Metric I: Domain Distinguishability Index (DDI)
In traditional privacy evaluations, membership inference attacks (MIAs) leverage a sampled member data set (from the target model's training set) and a sampled non-member data set to assess privacy leakage [18 37|: the more accurately adversary separates and classifies samples members or non-members, the higher the privacy risk. Analogously, we adopt this MIA framework for access control assessment distinguish security domains. Specifically, for any security domain set S,, the auditor holds samples from S, training data (member set) and samples from Sj 's training data (non-member set), where S, n S; Φ. The auditor then evaluates how successfully it can distinguish the member set from the non-member set when the PermLLM is activated for S: This evaluation occurs for all security domains, giving us an aggregate access advantage, which we call Domain Distinguishability Index (DDI).
Definition 4.1 (Domain Distinguishability Index (DDI). For a domain universe consisting of n security domains, let f denote the PermLLM trained data D from all security domains with access control mechanism M. For each ordered pair of domain sets (S; _ S, S 8) with no overlap (i.e,,; n Sj = Φ), let O(S,,S,) = ( membership inference oracle O. For a given membership inference metric m(-). the DDI is defined as: DDI(m) csscs.s,cs (O((,, (
(q)15,); Vq ~ Ds, be the output of a
where the expectation over all domain sets.
We also report the standard deviation of m ((((.,);)) across all domain set pairs to capture variability. By2.2 DDI can be viewed for S; on query relu( M (q). S:), is a binary value on whether the membership inference oracle O's output is above a membership threshold. The difference operator composition of response relevance for all the samples in the member and non non-member sets.
access advantage metric, where the response relevance
rele
the MIA method specific
We use AUC-ROC and TPR @ (low) as instantiations of DDI, where higher scores indicate stronger enforcement, as S,-specific responses become more distinguishable. See Appendices F. and for details on MIA evaluation metrics and an overview of existing MIAs against LLMs.
higher DDI indicates more robust separation between security domains. our evaluations, we employ state-of-the-art MIAs for LLMs, including Loss [4], Zlib (5) Mink (36), Mink++ 47
Reference 5 attacks.
4.2 Metric 2: Utility Gap Index (UGI)
The UGI metric measures the drop in model utility on the target domain's data when different domain's adapter activated in PermLLM instead of the target domain.
Definition 4.2 (Utility Gap Index (UGD). Let U-) be chosen utility metric and for domain set
pair (S, C S, Sy C S) with no overlap (iee,S; nS, = Φ). (alityGapS..))) ( (UM (.))
U(M (q)SS) vq ~ Ds.- The UGI aggregates utility gaps across all ordered domain set pairs: Au = Es,ca,s, [UtilityGap (S...))()) where E is the expectation over all domain sets.
By 2.2 UGI is also an instantiation of the access advantage metric in which the relevance score for security domain set S; query q is the utility value itself, relu (g), S.) U(f (s)) and the operator O computes the absolute difference those relevance scores across the sampled queries.
(s),
A larger UGI indicates that enforced access controls yield more pronounced and thus more easily crreivaabe-differeene in response quality between security domains. As with DDI, we also report the standard deviation across pairs to characterize variability. We evaluate the utility gaps w.r.t. Bleurt Score (Auurrt), Bert F1-Score (Abert), Sacrebleu Score (Aste)) and Verbatim Accuracy (Ance) for our UGI metrics in 5 More details on these metrics can be found in Appendix S D.3

---

Table 1: Data Set Details.
WMDP
GPQA
SimpleQA
RCVI
PubMedQA
Data Set Size (Train / Test)
2936 / 732 360 / 88
4089 / 1018
45622 / 22811
200000/ / 11269
Number of Security Domains
3
10
4
10
Experimental Evaluation
For our experiments, we fine-tune Llama-3,1-88 and Mistral-0.1-7B pretrained models on five datasets covering multiple distinct security domains (henceforth called domains), where we fine- tune a separate LoRA adapter for each domain. Details about the model byperparameters can be found in Appendix IS D. The data we use in our experiments
WMDP (24), GPQA [33] SimpleQA [41], RCVI [22]. and PubMedQA [20]. TTbll shows the brief data set details. More details the data sets and generalization gaps can be found in Appendix
D.2
Appendix D3.3
discusses the utility evaluation of all our models.
5.1 Evaluating Access Control
Our approach achieves comparable model utility to existing approaches of fine-tuning fin-tuning (see discussion in D.3), in addition to providing access control. Here we will empirically evaluate the effectiveness of our access control using a suite of metrics. We will first consider the case where the user has access to only one domain and report the access control results in 5.1.1] Next in S 5.1.2] we will consider the case where the user has access to multiple domains. For comparison, we also include an evaluation of prompt-based access control baseline in Appendix Eut find it to be ineffective.
5.1.1 Single Active Domain
In Section 4 we proposed an adversarial audit framework for empirically assessing access control in PermLLMs. We introduced two concrete instantiations of the general access advantage metric: the Domain Distinguishability Index (DDI) and the Utility Gap Index (UGI) Av. Although $ gives formal guarantees- each response computed solely from domains the user authorized to access-we we measure access control enforcement strength with DDI and UGI ( (Au) to confirm that the guarantees hold practice, which is necessary verify correctness of implementations.
Theoretically, Ay may reach 1.0, but empirically we observe much smaller-yet substantial-acco advantage gaps for four of the data sets (Figure 2). These gaps are significantly impacted by domain distributions and the strictness of the scoring metric. For example, SimpleQA exhibits the largest UGIs (up to Abiue 0.50 and Auce = 0.50) because has the highest number of distinct domains (10 in total). Morcover, we observe that Abteu and Dace have the largest values as these metrics look for verbatim pattern matches, thus requiring the model memorize the nuances in the target domain. On the other hand, Asteurt and Abert look for approximate similarities, and hence are impacted by the similarities across the domains. This suggests that the verbatim matching metries, Astev and Dace- are better model utility metrics for measuring access advantage compared to the similarity based metrics Apteart and Abert- For large data sets like RCVI, all the metrics achieve similar values as the model begins to generalize more. While these values are not close to 1, they still provide credence to the fact that the domains are different and our access control protocol works as expected due to the utility gaps. The access advantage threshold a is dependent on the type of utility metric: verbatim matching metrics AMeu and Ance have higher threshold than similarity based metrics Asteurs and Abert- For Avee metric, > 0.2 is sufficient
infer that access control is happening correctly. PubMedQA is an exception where Ay values are close to zero; this is because the security domains artificially obtained via k-means and hence have the same underlying data distribution.
Table shows DDI values obtained from a suite of state of-te-of-the-ar MIAs. Across domain pairs, the access advantage (distinguishabilitt) scores approach = 1.0, indicating that an external auditor can almost perfectly identify the active domain (even when the domain distributions are similar as in the case of PubMedQA). Hence, even when UGI values fall significantly below 1.0 because of model generalization, the high DDI values show that access control in Activate still functions as intended. This clearly suggests that DDI is the better method for PermLLM access control efficacy evaluation.
7

---

1.0
Metric Gap (Ametri)
Apleu
Asvurt
Apert
Aare
Llama-3.1-8B
Mistral-0.1-77
WMDP
GPQA
SimpleQA
RCV1
PubMedQA
Figure Utility Gap Index, Do (mean + std) when user has access one security domain.
Table 2: DDI values with m (ACC-ROC, TPR @ 1&FPR. TPR @5%FPR) for the different MIAs.
Mink++ is run with k 10%. Entries are reported as mean + std across domains.
MIA
Llama-3.1 tpr@1 1pr@1%fpr
Mistral-0.1-77 tpr@1%fpr
auc-roc
tpr@5%fpr
auc-roc
tpr@5%fpr
Loss
0.99 0.01
0.93 0.10
0.96 0.06
1.00 0.00
0.95 - 0.06
0.99 - 0.01
WMDP
ZLIB
0.98 + 0.08
0.77 + 0.31
0.85 = 0.21
0.99 0.02
0.85 3:5=00 0.25
0.92 0.14
Mink++
1.00 0.00
0.99 + 0.01
1.00 = 0.00
1.00 0.00
1.00
1.00 0.00
Ref
0.99 0.01
0.93 0.10
0.96 0.06
1.00 0.00
0.95 0.08
0.98 + 0.03
Loss
0.97 0.05
0.81 + 0.26
0.94 0.08
0.98 0.03
0.93 0.10
0.95 = 0.07
GPQA
ZLIB
0.95 0.04
0,45 0.22
0.77 0.15
0.97 -.970000
0.57 -.
0.83 0.13
Mink++
1.00 0.00
1.00 0.01
1.00 0.00
1.00
1.99
1.00 = 0.00
Ref
1.00 0.00
0.97 + 0.04
0.99 + 0.01
1.00 + 0.00
0.97 + 0.05
0.99 + 0.02
SimpleQA
Loss
0.98 + 0.03
0.81 + 0.34
0.90 + 0.25
0.99 + 0.03
0.81 + 0.32
0.92 + 0.20
ZLIB
0.03
0.80 + 0.33
0.90 = 0.23
0.99 0.03
0.80 = 0.33
0.91 = 0.20
Mink++
0.98 4.98
0.81 + 0.32
0.91 0.21
0.99
0.82 = 0.31
0.92 0.21
Ref
0.98 0.04
- 0.36
0.90 0.25
0.98 0.03
0.79 0.36
0.90 0.24
Loss
0.99 0.01
0.86 0.21
0.97 0.06
0.99
0.02
0.85 0.24
0.96 + 0.09
RCVI
ZLIB
0.93 0.07
0.71 0.26
0.81 0.18
0.94 0.08
0.73 0.28
0.83 0.19
Mink++
1.0
0.97 1 0.05
0.99 1 0.01
1.00
0.96 1 0.06
0.99 1 0.02
Ref
0.99 1.99:00.00 0.01
0.77 1 0.28
0.99 1 0.03
0.99 1 0.01
0.80 1 0.28
0.98 1 0.05
PabMasQQA
Loss
0.81 + 0.07
0.16 + 0.11
0.36 0.15
0.95 + 0.03
0.51 0.21
0.75 0.14
ZLIB
0.77
0.10 0.05
0.30 0.13
0.88
0.32 0.17
0.57 0.15
Mink++
0.90 + 0.02
0.31 0.08
0.57 0.08
0.99 1.99
0.93 0.07
0.98 + 0.02
Ref
1.00 0.00
0.98 0.02
1.00 0.00
1.00
1.00 0.00
1.00 + 0.00
5.1.2 Multiple Active Domains
As discussed earlier in $ we explore three methods of combining knowledge from multiple domains the user has access to: (a) activating all the domain-speciff LoRA modules (Activate), (b) merging the LoRA modules (Merge), and (c) training separate LoRA modules on the union domains and using those for inference (Union). Table 3 reports the UGI (Av) ) for these approaches when the has access to two domains for all the data sets. We note that WMDP and GPQA have only three security domains, and hence activating any two domains always lead to overlap when calculating Ay as per 4.2 For these data sets, we calculate A on the non-overlapping data. Activate is computationally inexpensive but suffers from considerable utility loss when compared to the previous domain. This due to the high interference across the multiple domains in the activation space, which is known issue in the multi-task learning literature 49 39 31 The utility loss suppresses the absolute A in our experiments. As can be seen in Figure 3, Merge reduces the cross-domain interference, but still suffers from utility loss. Interestingly Merge achieves even lower Av than Activate when combining two domains, as shown in Table 3 Although it quickly outperforms Activate when the user has access to more than domains, the utility loss due model merging interference 38 43
of single
46 50 also results in progressive degradation of Au (see Figure 3). Union retains A even beyond four domains, and hence is the best choice when combining knowledge from several domains. But this comes at the cost of more training-time computation since new domain-specinn modules have to be trained for the union of domains, there could potential combinatorial blow-up of the number of such combinations. As with the single active domain

---

Table Utility Gap Index (Av) for models with different approaches of combining domains when user has access to two domains. All reported values are mean + std across domains.
Metric
Llama-3.1-8B Merge
Mistral-0.1-1 Merge
Activate
Union
Activate
Union
WMDP
Ableurt
0.09 + 0.01
0.07 = 0.02
0.11 + 0.02
0.10 + 0.02
0.08 + 0.03
0.14 + 0.03
Abert
0.05 + 0,01
0.03 = 0.01
0.06 + 0.01
0.05 = 0.01
0,04 = 0.02
0.07 + 0,02
Aace
0.27 + 0.07
0.21 + 0.09
0.31 0.11
0.32 + 0.04
0.25 + 0.07
0.49 + 0.09
Ablew
0.15 0.06
0.11 = 0.06
0.24 0.10
0.17 0.10
0.62 + 0.02
GPQA
Antewrt
0.10 0.02
0.06 = 0.02
0.14 0.03
0.10 0.04
0.32 + 0.02
Abert
0.07 + 0.02
0.04 = 0.03
0.18
0.01
0.08 0.08:0000 0.03
0,21 + 0.02
Aace
0.09 + 0.04
0.05 = 0.02
0.31 0.08
0.16
0.08 0.07
0.51 + 0.04
SimpleQA
Ablew
0.26 + 0.09
0.23 - 0.09
0.61 + 0.03
0.30 + 0.13
0.25 0.04
0.61 0.08
Ablenrt
0.16 + 0.05
0.12 0.04
0.32 0.04
0.19 1 0.05
0.02
0.33 1 0.05
Atert
0.07 + 0.03
0.05 1 0.02
0.14
0.08 1 0.03
0.06 0.01
0,14 1 0.03
Aace
0.20 + 0.07
0.18 1 0.07
0.59 1 0.05
0.27 1 0.09
0.21 0.03
0.62 1 0.09
Abtew
0.05 + 0.03
0.04 0.02
0.16
0.04
0.01 = 0.03
0.19 + 0.10
RCV1
Ableurt
0.11 + 0.01
0.07 1 0.03
0.22 0.08
0.08 0.01
0.03 0.04
0.22 + 0.08
bert
0.08 + 0.01
0.06 - 0.02
0.16
0.06 + 0.01
0.03 + 0.05
0.18 + 0.06
Aace
0.03 + 0.01
0.04 = 0.04
0.21 0.14
0.02 + 0.02
0.01 + 0.03
0.26 + 0.15
PulMaiQQ
Ablew
0.01 + 0.00
0.00 = 0.00
0.01 0.00
0.01 = 0.00
0.00 - 0.00
0.01 + 0.01
Ableurt
0.01 + 0,00
0.00 = 0.00
0.01 = 0.00
0.01 = 0.00
0.00 = 0.00
0.01 + 0.01
A bert
0.01 + 0.00
0.00 - 0.00
0.01 + 0.00
0.01 + 0.00
0.00 + 0.00
0.01 0.00
Aace
1,00
1.00
1.00
1,00
0.75
0.75
0.75
0.75
Aotort
Duser
0.50
0.50
0.50
0.25
0.25
0.25
0.00
0.00
0.00
0.00
# Active Domains
# Active Domains
Active Domains
# Active Domains
Activate
Merge
Union
Figure 3: Utility Gap Index, Aur (mean + std) for Llama-3.1-80 models fine-tuned on SimpleQA when user has access to multiple security domains.
we observe close to zero utility gap on PubMedQA as the domains share the same data distribution. We observe similar results for Mistral-O. 1-7-B model (see Figure in the appendix).
The DDI results for two-domain setting appear Table 4 (See Table 9 and Table 10 the appendix for complete results). As we can see, we achieve high DDI values (e.g., close to a = 1.0 for auc-roc). In other words, an auditor can almost perfectly identify which domain is in effect, even when the corresponding utility gap (Ay) is far below 1.0 (Figure 3). Union consistently attains the highest DDI, followed by Activate and then Merge mirroring the trend observed with Av. Union's superiority however comes at the cost of greater tuning-time computation. Union's 's near-perfect distinguishability mirrors the effect of model performance (with increasing domains) on Ay (see Sieuue 3). Crucially, the high DDI values confirm that even when Ay drops due to model generalization or degradation due activation space or parameter interference, access control remains uncompromised; DDI therefore provides the more sensitive indicator of enforcement efficacy.
6 Conclusion and Discussion
We presented a comprehensive treatment of the access control problem on fine-tuned LLMs that includes novel formalism, empirical evaluation metrics, access control enforcement mechanisms, and evaluation of the mechanisms well as the proposed metrics. We formalized new class of I.LMs called Permissioned I.LMS (PermLLM) whose access control enforcement can be verified both thcoretically and empirically using the formal tools provided in our work.

---

Table 4: DDI values (auc-roc) for models with different approaches of combining domains when user has access to two domains. All reported values are mean = std across domains
Metric
Llama-3.1-90 Merge
Mistral-0.1-7B Merge
Activate
Union
Activate
Union
Loss
0.98 + 0.02
0.93 0.05
0.99 = 0.02
0.99 + 0.02
0.95 - 0.04
0.99 = 0.01
WMDP
ZLIB
0.92 + 0.08
0.86 + 0.09
0.97 = 0.05
0.93 + 0.09
0.87 = 0.09
0.98 = 0.03
Mink++
0.90 + 0.05
0.94 + 0.04
1.00 + 0.00
0.96 + 0.02
0.94 0.03
1.00 + 0.00
Ref
1.00 + 0.00
0.99 0.00
1.00 0.00
1.00 0.00
0.99 0.00
1.00 + 0.00
Loss
0.99 + 0.01
0.93 - 0.02
1.00 0.00
0.99 0.01
0.96 = 0.04
1.00 = 0.00
GPQA
ZLIB
0,90 1.90::.00 0.06
0.82 0.07
0.99 0.01
0.93 0.08
0.86 = 0.09
0.99 = 0.01
Mink++
0.95 0.06
0.97 + 0.03
1.00 0.00
0.98 0.02
0.01
1.00 + 0.00
Ref
1.00 0.00
0.99 + 0.01
1.00 = 0.00
1.00 0.00
0.99 + 0.02
1.00 = 0.00
SimpleQA
Loss
0.96 1 0.03
0.95 1 0.03
0.97 0.04
1
0.96 1 0.02
0.97 T 0.04
ZLIB
0,94 1941000 0.04
0.93 1 0.04
0.97 1
0.003
0.95 0.03
0.97 T 0.04
Mink++
0.85 0.10
0.92 1 0.03
0.97 0.03
0.92
0.93 0.05
0.97 0.04
Ref
0.96 + 0.03
0.96 0.04
0.97 0.04
0.98 0.03
0.98 = 0.03
0.96 0.96 0.04
Loss
0.96 0.02
0.90 0.01
0.98 0.00
0.85 + 0.01
0.98 E 0.01
RCVI
ZLIB
0.82 + 0.02
0.72 0.02
0.90 0.05
0.82
0.69 + 0.03
0.90 0.05
Mink++
0.80 0.13
0.84 + 0.07
0.99 0.00
0.69 0.25
0.16
0.99 + 0.00
Ref
0.97 0.01
0.95 + 0.00
0.98 = 0.01
0.00
0.94 +
0.98 = 0.00
PubMedQA
Loss
0.84 0.05
0.66 + 0.02
0.79 = 0.04
0.11
0.65 0.01
0.81 : 0.05
71.IB
0.78 0.05
0.61 0.01
0.72 + 0.04
0.10
0.61 0.01
0.74 + 0.05
Mink++
0.85 + 0.10
0.79 0.05
0.94 0.02
0.72
0.74
0.95 + 0.02
Ref
0.99 + 0.02
0.99 + 0.01
1.00 0.00
0.93 + 0.10
0.98 + 0.00
1.00 + 0.00
Limitations. Our approach does not support deep hierarchy of domains with arbitrary overlaps. Another issue we observe is with the scalability beyond handful of domains. This either leads to severe degradation of utility (as in the case of Activate) or it becomes compute-intensive (for Union). We leave this exploration for future work. We also note some limitations in the experiments that we do not expect to change our key claims. First, we only run one model fine-tuning per parameter setting due to the computation overhead. Second, we use the default value for LoRA rank as our preliminary experiments with different ranks suggested limited impact on model utility. For our formalism in 2, assume that adversaries do not tamper with their credentials or domain access, otherwise they can gain arbitrary domain information. This is enforced by the enclosing system via authentication. Finally, we note that our DDI metries only as good as the best possible MIA.
Related Work. Access control problems in agentic systems can manifest in interesting ways, such as context hijacking (2), and may require further constraining the purview of individual agent contexts. Retrieval Augmented Generation (RAG) systems 23 32 51 are also susceptible to the access control problem. However, the access control needs to be enforced in the information retrieval engine of the system 4 and beyond our work's s scope (although we do provide a formalism for access control in RAG-based systems in Appendix Aj. One may draw some parallels between our formalism of response relevance and access advantage metric with prior works on indistinguishabbiiit [3 9 in security and privacy. The mechanisms in this lineage of works singularly focused on eliminating distinguishability between the effects of diffcrent data on computations. In contrast, PermLLM's objective is to maximize domain separation, which implics maximization of distinguishability.
Broader Impacts. Our work aims to bolster the security and privacy of individual's 's data by enforeing strict access control, such that only people with prior authorization can get access to the information. Our work applicable to healthcare, finance, and more broadly, enterprise governance applications that deal with sensitive data of individuals.
7 Acknowledgements
We would like to thank Pallika Kanani and Dan Roth for fruitful discussions that motivated the problem setup of access control in large language model based applications. We would also like to thank David Evans and the anonymous reviewers for providing helpful feedback on the paper.
10

---

References
[1] Afonso Arriaga, Manuel Barbosa, and Pooya Farshim. Private functional encryption: Indistinguishabiltt--hane baase definitions and constructions from obfuscation. Cryptology ePrint Archive, Paper 2016/018, 2016. URL htt.tt:t/t/spiintttt.t iaw.iiittniiti.oommmm wtt..........///..////
[2] Eugene Bagdasarian, Ren Yi, Sahra Ghalebikesabi, Peter Kairouz, Marco Gruteser, Sewoong Oh, Borja Balle, and Daniel Ramage. Airgapagent Protecting privacy privacy-conscious conversational agents, 2024. httppp:///aaaii..rr/aaa/////////
05175
[3] Jens-Matthia Bohli and Andreas Pashalidis. Relations among privacy notions. ACM Trans. Inf. Syst. Secur, 14(1), 2011.
1952986
[4] Stefan Büttcher and Charles L. A. Clarke. A security model for full-text file system search in multi-user environments. In Proceedings of the 4th Conference on USENIX Conference on File and Storage Techmologies Volume 4, page 13, USA, 2005. USENIX Association.
[5] Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert- Herbert-Vosss, Kather- ine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, al. Extracting training data from large language models. In 30th USENIX Security Symposium (USENIX Security 21), pages 0633-2650. 2021.
[6] Nicholas Carlini, Steve Chien, Milad Nasr, Shuang Song, Andreas Terzis, and Florian Tramer. Membership inference attacks from first principles. In 2022 IEEE symposium on security and privacy (SP), pages 1897-1914. IEEE, 2022.
[7] Shih-Han Chan. Encrypted prompt: Securing 1Im applications against unauthorized actions, 2025. /tRL//ttss//aaxxx.orr///////////
23250
[8] Yang Chen, Ethan Mendes, Sauvik Das, Wei Xu, and Alan Ritter. Can language models be instructed to protect personal information?, 2023.
02224
[9] Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Proceedings of the Third Conference Theory of Cryptography, TCC'06, pages 265-284, 2006.
[10] David F. Ferraiolo, John F. Barkley, and D. Richard Kuhn. A role-based access control model and reference implementation within corporate intranet. ACM Trans. Inf. Syst. Secur, 2(1): 34-64, 1999. ISSN 1094-9224. htLpstps:: htt////0o.orgg/...o//o 0ttp:///..111/33003000 3005/330333000003300 300834
[11) David F. Ferraiolo, D. Richard Kuhn, and Ramaswamy Chandramouli. Role-based access control. Information Security and Privacy Series, 2007.
[12] William Fleshman, Aleem Khan, Mare Marone, and Benjamin Van Durme. Adapterswap: Continuous training of Iims with data removal and access-control guarantees, 2025. URL
https://arxiv.ort wttp/axiiv.o../aaaaaoooooo abs////s///44 08417
[13] Shafi Goldwasser, Silvio Micali, and Ronald L. Rivest. A digital signature scheme secure against adaptive chosen message attacks. SIAM Journal on Computing. 17(2):281-333 1988.
chosen-message
[14] Pawam Goyal. Private information retrieval with access control, 2023.
[15] Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, et al. The llama
3 herd of models, 2024. URL URL/httss://axxii wwg. 2207. 21783
[16] Neil Houlsby, Andrei Giurgiu, Stanislaw Jastrzebski, Bruna Morrone, Quentin de Laroussilhe, Andrea Gesmundo, Mona Attariyan, and Sylvain Gelly, Parameter-efficient transfer learning for nlp, 2019, URL http:t::: httttps//aaxiv...o htr/aaxiiv..... www.xii.vrrr.o..oooooo org. abs 1902.90000 00751
[17] Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language models, 2021. URL.
https: pttps://arxxr //w.vvvaivvvvv//////////ea./.wia org/ abs/2106 09685

---

[18] Bargav Jayaraman, Lingxiao Wang, Katherine Knipmeyer, Quanquan Gu, and David Evans. Re- visiting membership inference under realistic assumptions. Proceedings on Privacy Enhancing Technologies, 2021.
[19] Albert Q. Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, Lélio Renard Lavaud, Marie-Anne Lachaux, Pierre Stock, Teven Le Scao, Thibaut Lavril, Thomas Wang, Timothée Lacroix, and William El Sayed. Mistral 7b, 2023. URL
httts://arriis wttp://wwwrr/bb//////e/// 0
[20] Qiao Jin, Bhuwan Dhingra, Zhengping Liu, William Cohen, and Xinghua Lu. PubMedQA: A dataset for biomedical research question answering. In Proceedings of the 2019 Con- ference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), pages 2567-2577. Association for Computational Linguistics, 2019. doi: 10.18653/v1/D11-.o 1259. URL
https://aclanthooe
org/ D19- 1259/
[21] Jean Kaddour, Joshua Harris, Maximilian Mozes, Herbie Bradley, Roberta Raileanu, and Robert McHardy, Challenges and applications of large language models, 2023. URL https
7/arxiv. owg/abs////oo...oooo.......o.... httpg//bb/2300...0 221.
[22] David D Lewis, Yiming Yang. Tony G Rose, and Fan Li. Rev1: A new benchmark collection for text categorization research. Journal of machine learning research, 5:361-397, 2004.
[23] Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, Sebastian Riedel, and Douwe Kiela. betrieval-augmented generation for moowledge-intensive nlp tasks. In Proceed- ings of the 34th International Conference on Neural Information Processing Systems, NIPS '20, Red Hook, NY, USA, 2020. Curran Associates Inc. ISBN
[24] Nathaniel Li, Alexander Pan, Anjali Gopal, Summer Yue, Daniel Berrios, Alice Gatti, Justin D Li, Ann- aan-Kathrin Dombrowski, Shashwat Goel, Long Phan, al. The WMDP benchmark: Measuring and reducing malicious use with unlearning. In Proceedings of the 41st International Conference on Machine Learning, volume 235 of Proceedings of Machine Learning Research, pages 28525-28550. PMLR, 2024. URL /tttts::/proceet
mlr.mrr...... mlr.press/v235/
1i24bc. html
[25] Qin Liu, Fei Wang, Chaowei Xiao, and Muhao Chen. Sudolm: Learning access control of parametric knowledge with authorization alignment, 2025. URL /tttps://arxiv.or
abs/2410.14677
[26] Yi Liu, Gelei Deng, Zhengzi Xu, Yuekang Li, Yaowen Zheng, Ying Zhang, Lida Zhao, Tianwei Zhang. Kailong Wang, and Yang Liu. Jailbreaking chatgpt via prompt engineering: An empirical study, 2024. URL https::: / arxiv. org/ abs/ / 2305 13860
[27] Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Ander- son, Yaron Singer, and Amin Karbasi. Tree of attacks: Jailbreaking black-box Iims automatically.
In A. Globerson, L. Mackey, D. Belgrave, A. Fan, U. Pa- quet, J. Tomezak, and C. Zhang, editors, Advances in Neural Information Pro- cessing Systems, volume 37. pages 61065-61 Curran Associates, Inc., 2024.
URL www.:httss///prceeeeeeo ngs neurips cc ct/ wwtpsc/pppprreeeeee les htppa/aap//r/////// peaper/2000 /t..///224//// 2024/filee 70702e8cbbb489964444460
Conerr-ooofeeeceec pdd
[28] Fatemehsadat Mireshghallah, Kartik Goyal, Archit Uniyal, Taylor Kerg-Kirkpatrick, and Reza Shokri. Quantifying privacy risks of masked language models using membership inference attacks. In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, pages 3332-8347, 2022.
[29] Hamid Mozaffari and Virendra J Marathe. Semantic membership inference attack against large language models. arXiv preprint arXiv:2406.10218. 2024.
[30] NIST SP Joint Task Force. Security and privacy controls for information systems and organi- zations, nist sp 800-53 rew. 5, 2020. URL http://sss//scc.nitiitt http:///wwr..itss.ooo/////////// /00/
53/ r5/ final
12

---

[31] Oleksiy Ostapenko, Zhan Su, Edoardo Maria Ponti, Laurent Charlin, Nicolas Le Roux, Matheus Pereira, Lucas Caccia, and Alessandro Sordoni. Towards modular llms by building and reusing a library of loras, 2024. URL rttp::://arxii..orr/ab/////
[32] OWASP GenAI Security
Project URL
Llm08:2025 vector and embedding
weaknesses, 2025.
https:/ www.epaar..a....gg/1.1.....
ng weaknesses/ stxtt=1
ss 200eemmmssssos22200m2222css222
[33] David Rein, Betty Li Hou, Asa Cooper Stickland, Jackson Petty, Richard Yuanzhe Pang, Julien Dirani, Julian Michael, and Samuel R. Bowman, Gpqa: A graduate-level google-proof q&a benchmark, 2023. URL hwtp:httts//aaattee http://wwv.rga////////oa//
12022
[34] Shang Shang, Zhongjiang Yao, Yepeng Yao, Liya Su, Zijing Fan, Xiaodan Zhang, and Zhengwei Jiang. Intentobfuscator: jailbreaking method via confusing Ilm with prompts. In ESORICS. pages 146-165, 2024. URL
org/ 1007/978 3- 031 70903 6_8
[35] William F. Shen, Xinchi Qiu, Meghdad Kurmanji. Alex Iacob, Lorenzo Sani, Yihong Chen, Nicola Cancedda, and Nicholas D. Lane. Lunar: Llm unlearning via neural activation redirection, 2025.
aas//aa///// 220222522.00 07218
[36] Weijia Shi, Anirudh Ajith, Mengzhou Xia, Yangsibo Huang, Daogao Liu, Terra Blevins, Danqi Chen, and Luke Zet.lmoyer. Detecting pretraining data from large language models. arXiv preprint arXiv:2310. 1677,699,,,,,8, 2023.
[37] Reza Shokri, Marco Stronati, Congzheng Song, and Vitaly Shmatikov. Membership inference attacks against machine learning models. In 2017 IEEE symposium on security and privacy (SP), pages 3-18. IEEE, 2017.
[38] George Stoica, Pratik Ramesh, Boglarka Ecsedi, Leshem Choshen, and Judy Hoffman. Model merging with SVD to tie the Knots, 2024. URL https::/arxxv..rgg////// 19735
[39] Tu Vu, Brian Lester, Noah Constant, Rami AI-Rfou, and Daniel Cer. Spot: Better frozen model adaptation through soft prompt transfer, 2022. URL 07904
[40] Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. Jailbroken: How does Ilm safety training fail? In A. Oh, T. Naumann, A. Globerson, K. Saenko, M. Hardt, and S. Levine, editors, Advances in Neural Information Processing Systems, volume 36, pages 80079-80110 Curran Associates, Inc., 2023. URL
[41] Jason Wei, Nguyen Karina, Hyung Won Chung, Yunxin Joy Jiao, Spencer Papay, Amelia Glaese, John Schulman, and William Fedus. Mcasuring short-form factuality in large language models, 2024. URL htt.llhtps::/ http:::s///axxvoooo
003pb///11111134336111 04368
[42] Lingling Xu, Haoran Xie, Si-Zhao Joe Qin, Xiaohui Tao, and Fu Lee Wang. Parameter-cfficient fine-tuning methods for pretrained language models: A critical review and assessment, 2023.
/ org/ wtwpr///////////.e///.e./eeeeeee 2312.311222 12148
URL httph::tt//// ptttpp://arxiv....
[43] Prateck Yadav, Derek Tam, Leshem Choshen, Colin Raffel, and Mohit Bansal. Ties Ties- merging: Resolving interference when merging models, 2023, URL 2306. 01708
orbbbs//
[44] Samuel Yeom, Irene Giacomelli, Matt Fredrikson, and Somesh Jha. Privacy risk in machine learning: Analyzing the connection to overfitting, 2018.
[45] Fangcong Yin, Xi Ye, and Greg Durrett. Lofit: Localized fine-tuning on LLM representations. In Advances in Neural Information Processing Systems 38: Annual Conference on Neural Information Processing Systems, 2024.
13

---

[46] Le Yu, Bowen Yu, Haiyang Yu, Fei Huang, and Yongbin Li. Language models are super mario: Absorbing abilities from homologous models free lunch, 2024. URL https
//arxiv.org/abs//22
03099
[47] Jingyang Zhang, Jingwei Sun, Eric Yeats, Yang Ouyang, Martin Kuo, Jianyi Zhang, Hao Yang, and Hai Li. Min-K%++: Improved baseline for detecting pre- teeerraiinng data from large language models. arXiv preprint arXiv:2404.00 02936, 2024.
[48] Wayne Xin Zhao, Kun Zhou, Junyi Li, Tianyi Tang. Xiaolei Wang, Yupeng Hou, Yingqian Min, Beichen Zhang, Junjie Zhang, Zican Dong, Yifan Du, Chen Yang, Yushuo Chen, Zhipeng Chen, Jinhao Jiang, Ruiyang Ren, Yifan Li, Xinyu Tang. Zikang Liu, Peiyu Liu, Jian- Yun Nie, and Ji-Rong Wen. A survey of large language models, 2025. URL
2303. 8223
[49] Xiangyun Zhao, Haoxiang Li, Xiaohui Shen, Xiaodan Liang, and Ying Wu. A modulation module for multi-task learning with applications in image retrieval. In Proceedings of the European Conference on Computer Vision (ECCV), 2018.
[50] Ziyu Zhao, Tao Shen, Didi Zhu, Zexi Li, Jing Su, Xuwu Wang, Kun Kuang, and Fei Wu. Merging loras like playing lego: Pushing the modularity of lora to extremes through rank-wise clustering, 2024. URL
[51] Hongbin Zhong, Matthew Lentz, Nina Narodytska, Adriana Szekeres, and Kexin Rong. Hon- eybee: Efficient role-based access control for vector databases via dynamic partitioning, 2025.
URL https: wwwp:/iwwor//ab///000000 01538
14

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The key claims of the paper mentioned in the abstract and the introduction accurately reflected in the rest of the paper.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: We discuss the key limitations of our work in $ 6 We also clearly mention the underlying assumptions for our formalism of access control in S 2 Finally, in the experiments with multiple active domains in $ 5.1.2, we find overlap when activating any two domains for WMDP and GPQA data sets to calculate the access advantage, these data sets have only three security domains. For these experiments, we calculated the access advantage metrics on the non-overlapping data.
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model vell-specifiiattio, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested few datasets with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
15

---

3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
Justification: We provide the proof of correctness of our access control mechanisms and the underlying assumptions in Appendix
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: We provide detailed description of our data sets and model fine-tuning hyperparameters in Apppendix D.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution a specific model and empirical evaluation, may be necessary either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
also be provided via detailed
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make clear how to reproduce that algorithm.
(b) the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may tricky in some cases, in which case authors welcome describe the particular way they provide for reproducibility.
16

---

In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [No]
Justification: Due to our organizational policies regarding intellectual property, we can not currently open-source the code and the fine-tuned models. However, we provide complete citations for the public data sets we use and also describe the model fine-tuning hyperparameter settings in detail AApeeddx D We use the publicly available pretrained models for our fine-tuning, which are also properly cited in the paper.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips) cc/
public gui SoddeeeSu// ss assonPolicyy for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
//nips wtpps.cccppblicc///ccccccpcp //ippps.c//pbbbii//qiiiie///////
for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: We describe the training and test data set splits, and the model fine-tuning hyperparameters Appendix
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
17

---

Justification: We provide mean + standard deviations for all our results reported in the experiments. These are calculated across the different domains for each data set. Only the training and validation set losses are not reported with mean + sld as we only fine-tune single model per setting due the computational overhead.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain the text how they were calculated and reference the corresponding figures tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification:
We discuss compute resources used for our experiments in Appendix D
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't make into the paper).
9. Code ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics httpii/wtgpppees.........//ooo/a
Answer: [Yes]
Justification: We strictly adhere to the code of ethics. We made sure to preserve complete anonymity in the submission.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
18

---

10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: While we see no negative societal impacts of our work, we discuss the broader
impacts of work in $
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
there are negative socictal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper deseribe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: We do not intend to release any of our fine-tuned models. We do not show any of the data set records in the paper, even though the data sets we use are publicly available under permissible licenses.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
19

---

Justification: We mention the licenses for the data sets and the pretrained models we used in our experiments in Appendix
Guidelines:
The answer NA means that the paper does use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset. For scraped data from a particular source (e.g.. website). the copyright and terms of service of that source should be provided.
license, copyright information, and terms of use package should be provided. For popular datasets, paper saaperswiie swithcode com. dat asatases has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
assets are released,
For existing datasets that are re- ee-pacaaedd, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's 's creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: We do not release any models new data sets part of this submission. The core contributions are the set of mechanisms ensure access control LLMs, and the evaluation metrics to audit the effectiveness of access control.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification:
The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included the main paper.
According to the NeurIPS Code of Ethies, workers involved data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
Institutional review board (IRB) approvals or equivalent for research with human subjects
20

---

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsoureing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with
human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent)
may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Answer: [NA]
Justification: We only pretrained LLMs for our experimental evaluation of fine-tuning with access control over various data sets. LLMs were not used for writing the paper, nor do they replace any human intellectual efforts, and such do contribute the novelty of the paper.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non standard components.
Please refer to our LLM policy (ht htt.arrpppp.cc/ooofeeeneeeee///e
LLM) for what should or should not described.
21

---

Cs, from a selected security domain S;. Intuitively, A Formalizing Access Control for Retrieval Augmented Generation
For Retrieval Augmented Generation (RAG), we assume a pre-trained LLM f that is used in applications without additional fine-tuning. Instead, we augment f with retriever engine R to give us a retrieval augmented LLM fR-
Each query 4e: to SR is accompanied by context c, retrieved by R. that enhances Sn response to the query. Let retrieve contexts from the context database C, i.e. e E C. Furthermore, we have C' C'=Ui=1
Cs: ~ C... where each Cs; is collection of contexts belonging to security domain s;-
For this discussion, we define M as an access control mechanism that dictates the mapping of every C., CC to the security domain We say that a RAG system that uses contexts from the context database C' permissioned (PermRAG), if it uses retriever RC which turn uses the access control mechanism M to retrieve context
given a security domain 8;, R uses M to retrieve context e C... One can trivially generalize this definition of PermRAG to work with subsets of security domains instead of singleton security domain 8,.
For PermRAG, we assume an identical enclosing system setting as in PermLLM (see S 2p: Given a user u the enclosing system determines u's access credentials credy and calls authenticate cate (credy) that takes user credentials cred, and maps them to a subset of secu- rity domains S, that can access. User u cannot arbitrarily change S., Each of user w's subsequent query to fn is annotated with S., The retriever RC of fi uses access control mechanism M to retrieve a context c E Cs...
Definition A.1 (Relevant Response for PermRAG). Given a PermRAG fR, with retriever R a query q from user u, and S. the security domains u has access to, r= = fa(9) is the response by f to query q. Response r said to be relevant S, (i.e. Ts.) if retriever R uses context E Cs., to augment the query for
To empirically quantify response relevance, we can use the same response relevance score, relu(fn(g): S.) that quantifies the information gained on data in the security domains g's user u has access to (this is the same set of security domains that mapping M gives for u for the retriever R i.c. S.).. Here R& retrieves the query context c C using mapping M, c is then augmented to the query q. We restrict the domain of relv to the real number interval [0, 1]. where I is the best expected score for relevance. Similar to PermLLM, we define access advantage for PermRAG as follows:
Definition A.2 (Access Advantage for PermRAG). Given PermRAG fa that uses retriever R which in turn uses the context database containing data from domains S Ui= {si), with access control mechanism M, subset of security domains S,, S S, context E C that is augmented to query q. In achieves a-access advantage w.r.l. Sn if:
Eqy sel.
S.) O relu(fu(g)) S.) 2a
where relu() is the respouse relevance score the corresponding security domain subset (Su or Se). O is a "difference" operator specific to the access control assessment method (e.g. subtraction). and a is advantage threshold that lies in the range [0.1].
B Formal Access Control Enforcement in PermLLM Mechanisms
We now present formal proofs for correct access control enforcement in our PermLLM mechanisms presented in S 3 Activate, Merge, and Union.
we consider a universe of n different security domains S (s:)- and a training data set consisting of data from these domains D = U D., ~ DD, (here DR, a data set sampled from data distribution D., of domain s;). Let fo be the LLM tuned using data set D. Let W be the set of fo 's parameters. Model tuning changes values of a subset of W. Let security domain 8; affect, per the meaning of affect in 2 a subset parameters W., C W. Thus data from Da; is used to change parameters W., during model fine-tuning. Let M be the access control mechanism that dictates the mapping of security domain s; to parameters Wa, via the affects relation.
Refreshing the formalism from
22

---

Consider set of LoRA adapters [17 11.12 12....... Im- Each adapter 1, comprises parameters Wi,, such that Wi, n Wi, Φ, vi * j. Let be the adapter Id for adapter 4. Let fD by the PermLLM that uses mapping M of security domains to parameters during tuning and testing. Let J.M be the system enclosing f that performs the mapping from user credentials cred, to sets of security domains S. for each user u. We make two assumptions about F.M; (i) F.M can correctly determine and maintain the security domains S, a user has access to; and (ii) S. remains opaque to the user and any other adversary and result, cannot be tampered with by any
or adversary.
We assume that both fine-tuning and testing are mediated through J.M, During fine-tuning, the dataset D is passed to FM F.M extracts information about the security domains $1, Sn covered by D. For settings where users have access to multiple security domains, the list of security domain combinations that users have access to is also passed on to FMM. F.M does the mapping between security domain groups and LoRA adapters differently for each of our PermLLM mechanisms:
Activate
FM maps each security domain 8; to a unique LoRA adapter 4. For fine- tuning of fD minibatches sampled for each 8; are routed to the corresponding LoRA adapter 1, the other LoRA adapters are deactivated for the sampled mini-batch.
Merge
Security LooA adapter mappings and fine-tuning of fb proceeds identically to that in Activate. However, after the fine-tuning is done, the security domain groups used to merged LoR adapters. These new LoRA adapters are added to the set of LoRA adapters in fD The mapping M is also updated with the new mappings between security domain groups and LoRA adapters.
Union Datasets corresponding to the security domain groups are used to fine-tuning unique LoRA adapters. M is also updated with these new security domain group-LoRA adapter mappings.
At the end of fine-tuning, .M will have mapping between each security domain group S, (for each respective user u) and each LoRA adapter in mechanisms Merge and Union. More formally,
Lemma B.1. In Merge and Union, after fine-tuning, for every user that has access to Su. S, Uls.. where Is. is a LoRA adapter, S, affects parameters Wis..' and Wis,, is not affected by any other security domains S.
In case of Activate, S. is used at inference time to activate the LoRA adapters le., where 8, Sw- More formally,
Lemma B.2. In Activate after fine-tuning, for every user u that has access to Su, S S. Vs; E S., 8; affects parameters Wing and Wi., is not affected by any other security domain 83 E S., i + or
8k S| S...
At inference time, u sends query q J.M. J.M first determines u's security domains Su,, and then passes q and Su to f'M which then activates the LoRA adapter/s corresponding to S.: Is. in case of Merge and Union, and la.. where s, S., in case of Activate. Our assumptions about accessibility of S,, to the user or adversary ensure that the adversary cannot tamper with S, within the scope of J.M
Theorem B.3, Given any query q. from any user u, the response = (D (g) is relevant to for M in Activate, Merge, Union.
through the fine-tuning process S, affects parameters Wis, in Merge and Union, and parameters Wt, Vs, E Su in Activate. At inference time, these same parameters (along with the pretrained model's ''s parameters) are used to generate response fM (g). By implication, the parameters affected by S,, are used to generated Hence is relevant to S., i.c. r = Ts..
Proof. From Lemmas Theorem B. and Theorem B.2
Since the above response relevance condition applies for all responses = all users u, we say that Activate, Merge, and Union correctly enforce parameter separation and hence correctly enforce access control for all users
=IM (4) on all queries & by
23

---

C Audit Games
We formalize black-box games that capture: (i) the distinguishability of security domain-specific responses for DDI, and (ii) the utility disparity induced by access restrictions for UGI. Intuitively, in these auditing games, we measure how effectively an external auditor can conclude the access control mechanism is correctly implemented by verifying if the correct domain adapter is activated for a query. This effectiveness is directly correlated with the access advantage score for the target security dsmain(s). Higher access advantage score denotes stronger access control enforcement. A perfectly separated system provides the auditor with an access advantage score of 1.0.
We consider the same threat setting and auditor privileges for our adversarial games between auditor A and system S enclosing the PermLLM fD as described in S 2.3
Game 1: Domain Distinguishability. This game assesses whether the auditor can effectively conclude if the correct security domains were used based on the generated responses. The primary motivation of this game measure the distinguishability of different security domains' distributions.
1. Auditor A chooses security domain set S,, and emulates user u. A sends user credentials credy and query q P~D, Ds.. to system S. S verifies the user credential credy and sends back the model response fb (q) to A.
2. A chooses security domain set S, such that S, nss & and emulates user v. A sends user credentials cred, and the same query q ~ Ds, to S. S verifies the user credential cred, and sends back the model response f (g) to A.
3. A sends the models responses and domain information to membership inference oracle O obtain domain distinguishability score mf [q)]S.,, fD (S)). where m(-) is membership inference metric (e.g., AUC-ROC or TPR @ &FPR) in the [0,1] range.
4. A concludes the access control mechanism is correctly implemented if the domain distin- guishability score m(O(I) (q)]S.. JD (.)) 2 a.
Note that we can change the above game to distinguish members (q ~ Ds..) and non-members (q DD.)) for the target domain set Sw, similar to prior MIA setups, which is what we do in our experiments in
Game 2: Utility Gap Evaluation. The second game evaluates how distinctly the responses from two different security domains impact the utility perceived by users. The rationale behind this game confirm that enforced access controls result in meaningful variations in response quality.
1. Auditor A chooses security domain set S, and emulates user u. A sends user credentials cred, and query q ~ DDs., to system S. S verifies the user credential credy and sends back the model response f (g) to A.
2. chooses security domain set S, such that S.S. credentials cred,, and the same query q ~ 'Ds., to S. S verifies the user credential cred, and sends back the model response I (g) to A.
and emulates user v. A sends user
3. Given a utility function U(- (e.g.. BLEURT or task accuracy) that outputs values in [0.1] range, AA concludes the access control mechanism is correctly implemented if the utility gap score (UM (1) - U(S (n)] (().) 2 a.
We aggregate the utility gaps from this game across all domain set pairs to obtain our UGI metric.
D Detailed Experiment Setup
D.I Models
For our instantiation of PermLLM, we fine-tune Llama-3.1-8BB15 and Mistral-O.1-7B 19 pretrained models on four datasets covering multiple distinct security domains (henceforth called domains), where we fine-tune separate LoRA adapter for each domain. To compare our PermLLM, we train two additional models with full fine-tuning and LoRA fine-tuning respectively on entire training data. Note that these models are only used for utility baselines as they do not provide access control. For all the LoRA adapters, use 64 rank and 0.1 dropout. We use Adam optimizer with 0.1 weight decay
24

---

Table 5: Data Set Details. Generalization Loss Gap (i.e., gap between model's loss on training and test sets) for all models are reported after fine-tuning for 5 epochs on each data set.
Data Set (# Domains)
Data Set Size
Llama-3.1-30 Loss Gap
Mistral-0.1 Loss Gap
Train
Test
Full FT
LoRA
PermLLM
Full
LoRA
PermLLM
WMDP (3)
2936
732
1.96
0.52
1.15
1.36
0.65
1.07
GPQA (3)
360
88
2.51
1.06
1.04
1.58
0.61
1.09
SimpleQA (10)
4089
1018
2.91
0.96
1.49
1.87
0.90
1.25
RCVI (4)
45622
22811
4.07
0.35
0.83
2.48
0.37
0.74
PubMedQA (10)
200000
11269
3.53
0.07
0.36
2.56
0.07
0.35
to fine-tuned all the models for 5 epochs with 300 warmup steps, 2 batch size and 5 x 10- learning rate (except for Mistral-O. 1-7B full fine-tuning that uses learning rate of 5 x 10-5). We performed grid search over multiple learning rates and warmup steps and found these values to give the best results. For all our experiments, we use H100 GPUs (with 80GB VRAM per GPU), workers per GPU, and 384 GB RAM. One epoch of fine-tuning took from few minutes (for our smallest data set: GPQA) to a couple of hours (for our largest data set: I) Mistral-O. 1-7BB is released under Apache 2.0 license, and Llama-3. 1-BBB is released under Llama 3.1 Community License.
D.2
Data Sets
For our experiments, we require data sets that consist of multiple distinct domains and are possibly not seen by the pretrained models. We use five different data sets, namely. WMDP (24), GPQA [3
SimpleQA [1], RCVI [22], and PubMedQA (0). While the first three data sets were collected after the pretraining cutoff dates for Llama-3. 1-8B and 1istraa--01-7BB RCVI is older data set and hence we do not know if it was used in pretraining. However, we observe a high initial training loss on this data set, thereby indicating that it was either not used in pretraining or was catastrophically forgotten by the models, allowing for a gradual reduction in training loss during our fine-tuning (see Figure 7). Table 5 shows the data set details, along with the generalization gap (test loss train loss) for different approaches of fine-tuning the models on these data sets. See Figure 4 Figure 5 Figure 6 Figure 7| and Figure for complete training and test loss trajectories across different data sets.
WMDP. Weapons of Mass Destruction Proxy (WMDP) 24 is a data set consisting of multi-choice question-answer pairs spanning three domains: biological weapons (bio), chemical weapons (chem) and warer- weapons (cyber). We do 4:1 split of the data set to obtain training and test sets. The training consists of 2936 question-answer pairs where 1019 are from bio, 327 are from chem and the remaining 1590 are from cyber. The test set size is 732 records, consisting of 254 bio, 81 chem and 397 cyber records. The largest record from this data set consists of 1934 tokens (tokenized using Llama3 tokenizer). This data set is released under MIT License.
GPQA. Graduate-Level Google-Prov Q&A Benchmark (GPQA) 33 data set consists of general question-answer pairs from three domains: biology, chemistry and physics. We do 4:1 split of the data set to obtain training and test sets. The training set consists of 360 question-answer pairs where 63 are from biology, 147 are from chemistry and the remaining 150 are from physics. The test set size is 88 records, consisting of 15 biology, 36 chemistry and 37 physics records. The largest record from this data set consists of 911 tokens (tokenized using Llama3 tokenizer). This data set is released under MIT License.
QAmpleQA. SimpleQA 41] is factuality benchmark that measures the ability for language models answer short, fact-secking questions. It consists of general question-ansen answer pairs from ten domains: art, geography, history, music, other, politics, science and technology, sports, tv shows, and video games. We do 4:1 split of the data set obtain training and test sets. The training set consists of 4089 question-ansve answer pairs divided across all ten domains. The test set size is 1018 records spanning across all ten domains. The largest record from this data set consists of 156 tokens (tokenized using Llama3 tokenizer). This data set is released under MIT License.
RCV1. RCV1 22 is benchmark dataset on text categorization. It is a collection of newswire articles produced by Reuters between 1996 and 1997. It contains 804,414 manually labeled newswire
25

---

(a) Full Fine-Tuning
(b) LoRA Fine-Tuning
(c) Prompt-Bassd
(d) PermLLM
1
Loss
3-
2
Epochs
Epochs
Epochs
Epochs
Llama-3.1-88 (Train)
Llama-3.1 3.1.-B..BBBBBBB-. (Eval)
Mistral-0.1 (Train)
Mistral-0.1-77 (Eval)
Figure 4: Comparing model loss on WMDP data set.
(a) Full Fine-Tuning Tuning
(b) LoRA Fine-Tuning
(c) Phompt-Basee
(d) PermLLM
1
Loss
3-
2
Epochs
Epochs
Epochs
Epochs
Llama-3.1-88 (Train)
Llama-3.1-88 (Eval)
Mistral-0.1-P5 (Train)
Mistral-0.1-7B (Eval)
Figure 5: Comparing model loss GPQA data set.
documents, broadly categorized with respect to three categories: industries, topics and regions. We took subset of this data set and created four non-overlapping domains using topics: commercial (CCAT), economic (ECA7), governance (GCAT), and mechanical (MCA7)). We then did 2:1 split of the subset obtain training and test sets. The training consists of 45622 question-answe pairs where 23822 are from CCAT, 7460 are from GCAT, 3370 are from ECAT and the remaining 10970 are from MCAT' The test size is 22811 records, consisting of 1 1911 CCAT, 3730 GCAT, 1685 ECAT, and 5485 MCAT records. The largest record from this data set consists of 1199 tokens (tokenized using Llama3 tokenizer). This data is released under CC BY 4.0 License.
PubMedQA. PubMedQA 20 contains approximately 200K medical articles formatted as (Context
Question Answer). We encoded these articles using the GTE sentence encoder and applied k- means clustering to the resulting embeddings to derive 10 non-overlapping security domains. While clustering enforces semantic similarity within each domain and dissimilarity across domains. the underlying data distribution remains the same, since all samples originate from the same dataset. The largest record from this data set consists of 1614 tokens (tokenized using Llama3 tokenizer). This data set is released under MIT License.
D.3 Model Utility Evaluation
We four metrics evaluate the utility of the model generations: Bleurt Score (bluert), Bert F1-Score (bert), Sacrebleu Score (bleu) and Verbatim Accuracy (acc). These metrics measure how
(a) Full Fine-Tuning
(b) LoRA Fine-Tuning
(c) Prompt-Bass Based
(d) PermLLM
1
Loss
2
3
2
2
Epochs
Epochs
Epachs
Epochs
1.1ma-3.1-8B (Train)
Llama-3.1-88 (Eval)
Mistral-0.1179 1-7- (Train)
Mistral-O.1-7B (Eval)
Figure 6: Comparing model loss on SimpleQA data set.
26

---

(a) Full Fine-Tuning
(b) LoRA Fine-Tuning
(c) Prompt-Based
(d) PermLLM
1
Loss
3-
2-
3
2
Epochs
Epochs
Epochs
Epochs
Llama-3.1-88 (Train)
Llama-3.1-4 (Eval)
Mistral-0.1 (Train)
Mistral-0.1-777 (Eval)
Figure 7: Comparing model loss on RCVI data set.
(a) Full Fine-Tuning
(b) LoRA Fine-Tuning
(c) Prompt-Based
(d) PermLLM
5
4
Loss
3-
3-
3
2-
2
1
Epochs
Epochs
Epochs
Epochs
Llama-3.1-88 (Train)
Llama-3.1-88 (Eval)
Mistral-0.1-7B (Train)
Mistral-0.1-7B (Eval)
Figure 8: Comparing model loss PubMedQA data set.
similar the generated text is to the ground truth. bleurl and berl measure the semantic similarity, bleu measures the fraction of common n-grams, and ace gives a binary decision of whether the generated text verbatim matches the ground truth. All the metrics lic in a [0,1] range, where values close to I indicate high model utility.
We check the utility of Activate to determine if tuning different LoRA adapters for each security domain leads to acceptable model utility. To that end, we show in Table the utility of Llama-3.1 models fine-tuned on different data sets with the three approaches: full fine-tuning, LoRA fine-tuning and our PermLLM. We do not report the bleu score for WMDP as answering task where model only has to generate a single token. bleu requires generating at least four tokens. Our approach achieves similar or better utility on the training set compared to the LoRA approach. On the test set, our approach achieves similar utility to LoRA for most of the data sets, except for SimpleQA where LoRA performs better. This because SimpleQA has more domains (10 in total), thus each of our individual domain adapter sees only fraction of data of what LoRA approach's 's adapter sees (given that SimpleQA is already a small data set). We expect the performance of our domain-specific adapters to increase the data set size increases. Full fine-tuning is highly sensitive to training achieve high utility (e.g., on SimpleQA and RCV1), or it underfits and achieves low utility (e.g., WMDP and GPQA). We observe similar results for Mistral-O.1. - models (see Table 7).
multi-choice question-
and as a result it either completely overfits on training set to
0.75
0.75
0.75
0.75
Aalort
0.50
0.50
0.50
0.50
0.25
0.25
0.25
0.25
0.00
0.00
0.00
0.00
2
Active Domains
Active Domains
Active Domains
Active Domains
Activate
Merge
Union
Figure 9: Utility Gap Index, Au (mean = std) for Mistral-0.1-7B models fine-tuned on SimpleQA when user has access to multiple security domains.
27

---

Table Utility comparison of Llama-3.1-8B models trained with different approaches. All reported values are mean = std across domains.
Metric
Full Fine-Tuning
LoRA
Tine-Tuning
PermLLM
Train
Test
Train
Test
Train
Test
WMDP
bleurt
0.74 + 0.06
0.74 = 0.06
0.90 + 0.08
0.85 + 0.08
0.92 + 0.08
0.82 + 0.06
bert
0.89 + 0.03
0.89 = 0.03
0.96 + 0.03
0.94 + 0.08
0.97 = 0.03
0.93 + 0.03
acc
0.26 + 0.07
0.27 0.07
0.76 + 0.20
0.60
0.20
0.81 + 0.22
0.49 + 0.15
bleu
0.26 + 0.02
0.05 = 0.03
0.45 + 0.12
0.10
0.39 = 0.20
0,10 1 0.04
GPQA
blertt
0.53 0.05
0.39 0.05
0.64 0.09
0.62 0.007
0,47
bert
0.67 = 0.06
0.59 =
0.77 0.08
0.67 0.00
0.75
0.67
acc
0.24 0.06
0.02 = 0.03
0.32 + 0.05
0.00
0.31 0.09
0.04 0.05
SimpleQA
bleu
0.80 + 0.06
0.34 = 0.11
0.65 0.06
0.29
0.67 0.10
0.09 + 0.04
Meurt
0.86 1 0.03
0.58 = 0.05
0.80
0.61 0.02
0.04
0.53 1 0.04
berl
0.96 1 0.01
0.84 = 0.02
0.94
0.86 0.001
0.00
0.82 1 0.03
0.68 1 0.10
0.20 0.12
0.52 0.07
0.17
0.55
0.02 1 0.02
bleu
0.75
0.14 0.08
0.100
0.16
0.27
0.100
0.16 + 0.08
RCVI
bleurt
0.88 + 0.04
0.46 0.12
0.13
0.49
0.62 0.13
0.50 +: 0.12
bert
0.94 0.03
0.67 = 0.09
0.75
0.00
0.78
0.70 0.08
acc
0.78 + 0.06
0.16 = 0.10
0.27
0.17
0
0.18 0.10
PubMedQQ
bleu
0.71 0.05
0.07 = 0.01
0.09
0.09 0.01
0.00
0.09 0.01 0.01
bleurt
0.77 + 0.03
0.38 0.01
0.40 0.01
0.40
0.42
0.00
bert
0.90 + 0.02
0.64 0.02
0.68 0.01
0.68
0.69 0.00
0.67
Metric Gap (Amssne)
Apleu
Abcurt
Apert
Aace
Llama-3.1-81
Mistral-0.1-P7
0.6
0.4
0.2
0.0
WMDP
GPQA
SimpleQA
RCVI
PubMedQA
Figure 10: Utility Gap Index, Au (mean + std) for prompt-basee based access control baseline when user has access to one security domain.
E Prompt-Based Access Control
Recent works 8 25 have proposed enforcing form of access control in system prompts, however we note that they do not provide absolute access control and are vulnerable to jailbreaking prompts. Regardless,
implement prompt-based access control tagged with a prompt prefix (e.g., "use domain /"") and the rest of the fine-tuning pipeline similar to LoRA fine-tuning. We add the relevant prompt prefixes during both model fine-tuning and inference. The models fine-tuned with prompt-based access control achieve similar training and test loss to that of LoRA fine-tuning across all the data sets, as shown in Figure 4 Figure Figure 6 Figure and Figure 8) However, this baseline fails to provide any meaningful access control, even when user has access to only one security domain as shown in Figure 10 and Table 8 As shown in the figure and table, the utility gap index is close to zero and DDI scores are close to random guessing across all the data sets for both Llama and Mistral models fine-tuned with prompt-baad bosept access control. The reason is that the prompt prefix for different domains only differ in one or two tokens and hence the model tends to ignore this difference and continues generating responses even for domains the user has no access to. Exploring different prompt structures might lead to better access control but is beyond the scope of this work. We observe a similar trend when the user access multiple security domains shown in Figure II for SimpleQA data set.
baseline where each query
28

---

Table 7: Utility comparison of Mistral-0.1-7B models trained with different approaches. All reported values are mean + std across domains.
Metric
Full Fine-Tuning
LoRA
Tine-nuning
PermLLM
Train
Test
Train
Test
Train
Test
WMDP
bleurt
0.95 + 0.01
0.82 = 0.03
0.96 + 0.02
0.87 + 0.08
0.96 = 0.01
0.86 + 0.03
bert
0.98 + 0.01
0.92 = 0.02
0.99 = 0.01
0.94 + 0.02
0.99 = 0.01
0.94 + 0.02
acc
0.88 + 0.04
0.46 0.14
0.92 + 0.07
0.60 + 0.09
0.93 - 0.04
0.58 + 0.11
bleu
0.46 + 0.03
0.06 = 0.05
0.35 = 0.08
0.11 0.00
0,55
0,13 + 0.06
GPQA
blertt
0.65 + 0.04
0.42 0.08
0.59
0.47
0.67 0.09
0,47 + 0.08
bert
0.75 + 0.05
0.62 =
0.73
0.68 0.005
0.79
0.66 1
acc
0.38 + 0.04
0.04 = 0.05
0.24
0.06
0.40
0.08 + 0.02
SimpleQA
bleu
0.94 0.02
0.36 = 0.11
0.73 + 0.06
0.34
0.70 - 0.13
0.10 + 0.04
beurt
0.94 0.01
0.60 = 0.04
0.84
0.62 0.00
0.83 1 0.06
0.52 1 0.04
berl
0.99 + 0.01
0.85 = 0.02
0.96
0.87 0.001
0.82 1 0.03
0.91 + 0.04
0.23 0.12
0.62 0.08
0.20
0.16
0.03 1 0.02
bleu
0.92
0.17 = 0.09
0.28
0.100
0.37
0.19 + 0.09
RCVI
bleurt
0.93 0.02
0.48 0.12
0.60
0.51 0.12
0.66 0.12
0.50 +: 0.12
bert
0.98 0.02
0.69 = 0.08
478
0.71 0.08
0.81
0.71 0.08
cc
0.92 0.03
0.19 = 0.11
0.31 0.15
0.20 0.111
0.38
0.19 0.10
PubMedQQ
bleu
0.75 0.04
0.08 = 0.01
0.09 0.01
0.08 0.01
0.11
0.08 0.01
bleurt
0,80 + 0.03
0.39 = 0.01
0.41 = 0.01
0.41 0.01
0.43
0.11
bert
0.92 + 0.01
0.65 0.02
0.69 0.01
0.68 0.02
0.68 0.02
1.00
1.00
1.00
1.00
0.75
0.75
0.75
0.75
Ancurt
0.50
0.50
0.50
0.50
0.25
0.25
0.25
0.25
0.00
0.00
0.00
3
4
3
# Active Domains
# Active Domains
Active Domains
Active Domains
Llama-3.1-8
Mistral-O.1-7D
Figure 11: Utility Gap Index, Ay (mean std) for prompt-based access control baseline on different models fine-tuned on SimpleQA when user has access multiple security domains.
F MIAs against LLMs
In Section we defined the Domain Distinguishability Index (DDI) as the average success rate of an adversary playing the Domain Distinguishability game over all domain pairs That game is implemented with membership inference attacks (MIAs) [44 5] 29 36 [47]: the auditor compares a member set drawn from the active domain's 's training data with non-member set drawn from some other domain, and tries to tell them apart. The better this separation, the larger the DDI. Here, in this section, expand the MIA toolbox that underpins HiDI-detailing evaluation metrics and the specific attacks we deploy against LLMs. More generally, an MIA for an LLM f assigns a membership score A(x, a candidate text æ. Thresholding this score at declares a member (if' A(z, f) e) or non-member (if A(z, f) <s).
F1 Metrics
We employ two complementary metrics to quantify the success of our membership inference attacks, as used by prior MIA works [8
28
(1) Attack ROC curves: The Receiver Operating Characteristic (ROC) curve illustrates the trade- off between the True Positive Rate (TPR) and the False Positive Rate (FPR) ) for the attacks. The FPR measures the proportion of non-member samples that are incorrectly classified members, while the TPR represents the proportion of member samples that are correctly identified members, We report
29

---

Table DDI values for prompt- based access control baseline when user has access one security domain.
MIA
Lluma-3. 1lBma-3.1-8B Ipr@: 1
Mistral-O.1 1-7B Ipr 1%ffp
auc-roc
1pr 1pr@:5
auc-roc
1pr@5%%ppr
Loss
0.53 + 0.02
0.02 + 0.01
0.06 + 0.01
0.54 + 0.02
0.02 + 0.01
0.07 + 0.02
WMDP
ZLIB
0.52 1: 0.01
0.01 1: 0.01
0.06 1 0.01
0.52 1: 0.01
0.01 1: 0.01
0.06 1: 0.01
Mink
0,53 1 0.03
0.02 + 0.02
0.08 + 0.03
0.53 4 0.01
0.02 + 0.01
0.06 + 0.01
Mink++
0.55 + 0.06
0.02 : 0.03
0.08 + 0.05
0.52
- 0.03
0.01 + 0.00
0.05 0.01
0.53 1 0.02
0.02 + 0.01
0.00
0.53
0.01
0.06
Loss
0.55 0.02
0.02 0.00
0.06 0.10
0.56 0.03
0.03 0.00
0.12 1 0.04
GPQA
ZLIB
0.54 0.02
0.02 0.00
0.07
0.54 0.02
0.03 +.000001
0.08 + 0.02
Mink
0.57 0.05
0.02 + 0.01
0.12
0.59 0.07
0.07
0.05 + 0.06
0.13 0.07 0.07
Mink++
0.54
0.05 + 0.06
0.12
0.55 A 0.12
0.06 + 0.06
0.12 + 0.09
Ref
0.57 +07700.00 0.02
0.04 + 0.02
0.13 0.05
0.56 = 0.03
0.03 + 0.02
0.13 + 0.07
SimpleQA
Loss
0.53
0.08 0.14
0.16 0.20
0.55
0.09
0.16
ZLJB
0.52 0.16
0.04 + 0.05
0.09 + 0.09
0.53 0.14
0.03 + 0.03
0.09 + 0.08
Mink
0.52 + 0.28
0.09 0.15
0.22
0.55 165+0.0 0.22
0.09 + 0.15
0.17 + 0.20
Mink++
0.50 + 0.43
0.31 + 0.40
0.36 + 0.43
0.52 0.35
0.22 + 0.33
0.28 + 0.35
Ref
0.53 + 0.22
0.03 + 0.03
0.54
0.04 0.06
0.09 + 0.09
Loss
0.50 + 0.02
0.01 1 0.00
0.05 0.01
0.50 0.01
0.01 0.00
0.05 0.00
RCVI
ZLIB
0.50 + 0.01
0.01 0.00
0.05
0.50 0.00
0.01 0.00
0.05 0.00
Mink
0.50 + 0.04
0.01 0.00
0.05 0.01
0.50 0.01
0.01 0.02
0.05 0.00
Mink++
0.50 + 0.05
0.01 0.01
0.05
0.50
0.01 101
0.05 0.01
Ref
0.50 + 0.01
0.01 0.01
0.50 1.00 0.01
0.01 + 0.00
00.5 1 0.00
PubMedQA
Loss
0.50 + 0.00
0.01
0.05
0.50 - 0.00
0.01 + 0.00
0.05 + 0.00
ZLIB
0,50 + 0.00
0.01
0.00
0.50 +.00
0.01 + 0.00
0.05 0.00
Mink
0.01
0.00
0.00
0.50
0.00
0.01
Mink++
0.50 1 0.01
0.01 0.00
0.00
0.50
0.01 0.00
0.05 0.00
Ref
0.50 + 0.03
0.01 0.00
0.01
0.50 1.000.009 0.03
0.01 - 0.00
0.05 + 0.01
the Area Under the ROC Curve (AUC-ROC) as an aggregate metric to assess the overall success of the attacks. AUC-ROC is threshold-independeer metric, and it shows the probability that a positive instance (member) has higher score than a negative instance (non-member).
(2) Attack TPR at low FPR: This metric is crucial for determining the effectiveness of an attack confidently identifying members of the training dataset without falsely classifying non-members as members. We focus on low FPR thresholds, specifically 1,, and 5%. For instance, the TPR at an FPR of 1% is calculated by setting the detection threshold that only 1% of non-member samples are predicted as members.
F22 Existing MIAs
LOSS 44]
The LOSS method utilizes the loss value of model f.) for the given text as the membership score; a lower loss suggests that the text was seen during training, so A(z, f) = E(f. (ff. x))
Calculating membership scores based solely on loss values often results in high false negative rates. To improve this, a difficulty calibration method can be employed to account for the intrinsic complexity of z. For example, repetitive or common phrases typically yield low loss values. One method of calibrating this input complexity is by using another LLM, (-) assumed to be trained on a similar data distribution. The membership score is then defined as the difference in loss values between the target and reference models, A(x, /) f(x, f) l(x, Ref). In evaluations, we used the base models (i.e., Llama-3. and Mistral-O.1-7BB before any fine-tuning the reference models.
Ref [5]:
Zlib 15:
Another method to calibrate the difficulty of sample is by using its zlib compression size, where more complex sentences have higher compression sizes. The membership score is then calculated by normalizing the loss value by the zlib compression size, A(x f) 3lb())
f(x.f)
30

---

Table 9: DDI values for models (with base model Llama-3.1-8B) with different approaches of combining domains when user has access to two domains. All reported values are mean + std across domains
MIA
Actioue 15
Untion Ipeall 1'5dpe
Sprir
0.02
0.77
0.87 =:
0.83
0.05
0.53
0:67 = 0122
0.89 0.07
0.90 0.14
0.91 :: 00000
WMDP
2ILBR
0.92
0.08
0.27
0.67 0.22
0.88
0.00
0.38
0.21
0.50 0.20
0.97 0.05
0.77
0.31
0.50 =: 0.22
Misk
0.99
0.01
0.88
0.93 0.04
0.96
0.02
0.18
0.78 0.12
1.00 0.00
0.94 0.08
0.00 =: 0.01
Miske-
0.90
0.65
0.62 0.21
0.71 0.16
0.94
0.04
0.21
0.80
0.15
1.00 0.00
0.00 0.88 0.02
1.00 2 0.00
Ref
1.00
0.00
0.588
0.02
0.99 2 0:01
0.89
0.00
0.81 2: 0.05
0.91 = 0.02
1.00 2: 0.00
1.00 2: 0.00
Loss
0.00 1: 0.01
0:81 4: 0.00
0.93 2: 0.05
0.93 2: 0.02
0.39 4: 0.14
0.72 = 0:03
1.00 2: 0.00
0.87 4: 0.04
0:50 2 0.01
OPQN
21
0.90 2: 0.06
0:38
2 0.20
0 = 0.22
0.82
2 0.07
0:28
2: 0.17
0.44
= 0.16
0.99 2: 0.01
0.79 2: 0.30
0:96 : 0.05
Mink
0.90 1: 0.01
0.92 0.11
0.97 2: 0.04
0.96
0.03
0.69
1: 9.07
0.50 2: 0.07
1,00 2: 0.00
1,00 1: 0.00
1.00 1: 0.00
Mink+
0.05 1: 0.06
0.82 0.10
0.85 2: 0:13
0.97
0.03
0.75
4: 0.13
0.88 2 0.10
1,00 2: 0.00
1.00 1: 0.00
1.00 1: 0.00
Keet
1.00 à: 0.00
0.01 0.59
0.99 2: 0.01
0.09 à: 0.01
0.87
0.12
0,503 = 0.00
1.00 2: 0.00
1.00 1: 0.00
1.000 d: 0.00
0.003
0.73 26
0.96
0.08
0.47
0.74 0.21
0.04
0.62
0.83 0.29
SimpleQA
ZLIB
4
0.06
0.67
0.17
0.97 0.04
0.38
0.82 0.29
Mink
0.06
0.41 0.30
0.68
0.03
0.22
0.71 0.18
0.98 0.03
0.38
0.84 0.25
Minke-
0.25 0.19
0.57 0.16
0.03
0.16
0.02 0.13
0.03
0.37
0.85 1: 0.24
0.00
0.73
0.60
0.79
0.90
0.02
0-40 0.09
0.76 = 0.15
0.90
0:01
0.26 +: 0.06
0.52 = 0.07
0.98
0.00
0.55 0.28
0.94 = 0.01
RCVI
ZLIB
0.27 0.07
0.46 0.06
0.72
0.02
0.11 0.08
0:26 0.03
0.50 0.05
0.52
0.67 # 0.13
Mink
0:87
0.022
0.60 0.18
0.87 2: 0:08
0.92
0.02
0.29 0.04
0.63 0:08
0.99 0.00
0.80 0.08
0:97 2 0.01
Minke-
0:13 0..00-2
0:52 0-18
0.19 = 0:21
0.84 0:07
0:28 0.22
0.52
0.19
0.89 0.00
0.80 0.05
0:98 2: 0.00
Ref
0.01
0.50 0.08
0.86 = 0.00
0:00 0.85
0.26 9: 0.07
0.63 = 0.05
0.01 0.88
0.50 0.31
0.95 : 0.02
Loss
0.54 1: 0.05
0:21 1 0.11
0.44 2 0.12
0.66 1: 0.02
0.04 1: 9.01
0.14 2: 0.01
0.79 1 0.04
0.14 à: 0.05
0.32 :: 0.09
ZLIB
0.7H
1: 0.05
0.13 1 0.07
0.33 2 0.09
0.61 1 0.01
0.03 1: 0.01
0.12 2 0.01
0.72 1 0.04
0,00 1 0.04
0.25 1: 0.07
Mink
0.01
1 0.05
0:39 1 0.17
0.63 2 0.17
0.73
1 0.02
0.07 1: 0.02
0:22 0:03
0.87
1 0.05
0.25 à 0.11
0.49 0.11
M
0.55
4: 0.10
0.36
d: 0.22
0.55
= 0.23
0.79 0.05
0.12
2 0.06
0.33 = 0.08
0.94 0.02
0.44 0.17
0.72
+ 0.12
Ref
0.90
3 0.02
0.84 0.16
0.93 2: 0.08
0.99
0.01
0.75 2 0.18
0.96 = 0.04
1.00 0.00
0.97 0.07
1.00 d: 0.00
Table 10: DDI values for models (with base model Mistral-0.1-75 with different approaches of combining domains when user has access to two domains. All reported values are mean + std across domains.
Acthoue sprio
Uniom 1peor
1pe97 19eppe
0.02
0.85 0.21
0.92 = 0.11
0.95 0.04
0:21
0:75 = 0.19
0.59 0.01
0.96 +: 0.06
WMDP
ZLJIB
0.09
0.30
0.74 0.30
0:87:t:00 0.00
0.58 0.20
0.98 0.08
0.28
0.38 :: 0.16
Misk
0.01
0.89
0.14
0.96 0.07
0.08
0.11
0.83 0.12
1.00 0.00
1.00 :: 0.00
Minke-
0.86
0.02
0.77 0.04
0.86 0.04
0.84 0.03
0.58
0.03
0.50 0:05
1.00 0.00
1.00 0.00
1.00 :: 0.00
Ref
1.00
0.00
1.00 0.00
1.00 2 0.00
0.89
0.00
0.88
0.08
0.96 = 0.02
1.00 0.00
2: 0.00
1.00 :: 0.00
Lows
0.90 4: 0.01
0.83 2 0.18
0.95 = 0.06
0.96 2: 0.04
0.55 2: 0.24
0.87 = 0.08
1.00 2: 0.00
0.97 2 0.04
0.98 = 0.02
OPDA
ZLIB
0.90 1: 0.08
0,50
1 0.35
0.74 2: 0.32
0.86
1 0.09
0.33
à: 0.23
0.36 2: 0.21
0.99 1 0.01
0.88 1 0.17
0.37 1: 0.04
Mink
1.00 1: 0.00
0.94 0.07
0.98 2: 0.02
0.08 1 0.02
0.74
9.14
0.8T 0.12
1.00 1 0.00
1.00 1: 0.00
1.00 1: 0.00
Minke-
2..05:2
2: 0.07
0.80 2 0.14
0.92
2: 0:06
0.08
2 0.01
0:75
0.13
0.59 0:07
1.00 22 0.00
1.00 1: 0.00
1.000 2: 0.00
Ree
1.00
1: 0.00
1 1.00 2: 0.00
1,00 2 0.00
0.99 2: 0.02
0.84 2: 0.23
0.97 = 0.01
1.00 0:002:00 0.00
0.97 1: 0.04
1.00 2: 0.00
0.00
0.58
0.82
0.02
0.79 0.17
0.04
0.76 0.31
SimpleQA
ZLIB
0.75
0.03
0.20
0.72
0.19
0.04
0.42
0.75 0.31
Mink
0.03
0.51 0.34
0.83
0.96 0.02
0:49 0.24
0.77
0.18
0.04
0.41
0.79 1: 0.27
Minke-
0.21 0.65
0.68 0.21
0.05
0.73
0.19
0.04
0.41
0.76 0.29
0.86 0.27
0.85
0.25
0.04
0.75 0.34
Loss
0.04
0.39 0.28
0.62 = 0.23
0.86 0.01
:: 0.08
0.35 0.02
0.98 0.01
0.53
0.02 + 0.01
RCVI
21 IR
0.82
0.05
0-50 0.10
0.50 =: 0.08
0.89
0.03
0.10 0.04
0:26 = 0.06
0.50 0.05
0.48
0.93
0-67 2 0.14
Mink
0.83
0.05
0-14 0.21
0.68 = 0:25
0.85
0.02
0:18 0.08
0-40
0.04
0.59 0.00
0.73 0.12
0-97 2 0.01
Mink--
0.69
0.25
0.27 0.20
0.45 0.35
0.16 0.94
0.70
0.18 + 0.18
0.35
= 0.21
0.59 0.00
0.89 0.08
0.98 + 0.00
Kef
0.96
1: 0.002
0:35 0.14
0.7L 1: 0.18
0.01
0.15 1: 9.05
0.52 - 0.08
0.98 1 0.00
0.25 0.45
0:97 1: 0.00
Loss
0.7H 1 0.11
0.19 1: 0.15
0.38 1: 0.19
0.65 1: 0.01
0.04 1: 9.01
0.133 2: 0.02
(1.1 1: 0.05
0.16 1: 0.00
0.36 1 0.12
ZLIB
0.73
0.10
0:13 0.11
0.28 2: 0.14
0.61 1 0.01
0:03 1: 0.01
0.11 = 0.01
0.74 2: 0.05
0.11 1 0.04
0:27 2: 0.18
Mink
0.53:2-0.14
0.30
2 0.26
0.49 = 0.27
0.70
à 0.02
0.05 2: 0.02
0.15 = 0.02
0.89 2: 0.04
0,26 2: 0.11
0.53 : 0.12
Misk+
0.72
1222200:4 0.24
0.29 0.31
0.44 2 0.33
0.74 0.06
0.08
0.04
0.23 = 0.07
0.95 0.02
0,53 0.19
0.76 :: 0.13
Ref
0.90
0.10
0.09 0.30
0.80 2 0.20
0.98 0.00
0.39 1: 0.08
0.93 2: 0.04
1.00 2 0.00
0.97 0.05
1.00 1 0.00
Min-K (36]:
This attack hypothesizes that non-member samples often have more tokens assigned
lower likelihoods. It first calculates the likelihood of each token as M (Ix.) = log p( (ree)) for each token Te given the prefix Tzz-- The membership score is then calculated by averaging over the lowest K% of tokens with lower likelihood, A(x, f)
miin-K5 Σ zz, Eminn 4%
Min- linKK% Ko (2;).
This method improves on Min-K by utilizing the insight that maximum likelihood training optimizes the Hessian trace of likelihood over the training data. It calculates a normalized score for each token 2, given the prefix V<t as Min-K%++uoknn (z:) log (xce)
Min-K++ 471:
where
Jeet
Mage is the mean log probability of the next token across the vocabulary, and Ozee is the standard deviation. The membership score is then aggregated by averaging the scores of the lowest K% tokens,
A(x, f)= = [min-X*++]] Ex;Emin -% Min-K % +hoken (.:).
31


Reviews:
[{"review_id": "odjvTv4x7J", "reviewer": "Reviewer_L9eS", "summary": "This paper introduces Permissioned LLMs , a novel class of large language models designed to enforce organizational data access control structures directly on their query responses in enterprise settings. The core problem addressed is the breakdown of traditional access control when LLMs, fine-tuned on siloed and protected data, serve requests from individuals with varying access privileges.", "questions": "1. How do the proposed PermLLM mechanisms scale to very large numbers of users, permission groups, or highly granular access control policies, which are common in real-world enterprise environments? Could the authors discuss the computational or architectural implications\n\n2. While the UGI metric evaluates utility, could the authors provide a more detailed analysis or discussion on the inherent trade-offs between strict access control enforcement and the LLM's overall utility or helpfulness for authorized users, especially for complex query types?", "limitations": "see questions and weaknesses", "rating": 4, "confidence": 2, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths: The paper provides a strong formalization of the problem and the proposed solution, which is crucial for a security-related domain. The development of the \"access advantage\" metric and its instantiations (DDI, UGI) appears theoretically sound and practical for evaluating the efficacy of PermLLM mechanisms. The mechanisms built on PEFT leverage existing robust techniques. The extensive experiments on diverse datasets provide solid empirical validation of both the mechanisms and the metrics.\n\nWeaknesses : the paper primarily focuses on domain-level segregation, It would be beneficial to discuss how PermLLMs scale to extremely fine-grained access control policies and complex hierarchical or attribute-based access control structures common in enterprises. Additionally, the paper does not explicitly detail the performance overhead (e.g., inference latency, training time, memory footprint) introduced by the PermLLM mechanisms compared to standard fine-tuning or other LLM deployment strategies. While PEFT is efficient, quantifying the added cost for access control enforcement would be valuable for practical deployment.", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their detailed feedback and for acknowledging the merits of our access control formalism and evaluation framework. We would like to clarify the concerns and questions raised in the review:\n\n## Scalability and applicability to complex settings\n\nThe reviewer raised some valid concerns about the scalability of the approach in the comments _\"It would be beneficial to discuss how PermLLMs scale...\"_ and _\" How do the proposed PermLLM mechanisms scale to very large numbers of users...\"_. \n\nA big part of the goals of our work was to formalize access control enforcement in LLMs and introduce empirical metrics to evaluate its effectiveness. In our paper, we focus on domain-level segregation as a foundation step. Our access control algorithms (Activate, Merge, and Union), though simple, are concrete mechanisms that achieve the domain-level segregation of LLM responses based on user access privileges.  More complex scenarios such as scalability, fine-grained access and hierarchical domains would require additional research and is left for future work. That said, we believe that finer-grained or attribute-based access control policies can, in principle, be reduced to controlled filtering or masking of training inputs within the PermLLM framework. For example, filtering specific attribute values before adapter training enables extension toward such policies without fundamental changes to the framework.\n\nAs we stated in our limitations section, we believe the scalability of our approach to large number of domains (order of thousands) is not feasible at the moment. For large number of users or permission groups, we can cluster similar permission groups into hierarchical clusters and train the PEFT modules on the clusters. We leave this extension for future work.\n\n\n## Performance overhead of Permissioned LLMs\n\nRegarding the comment _\"...the paper does not explicitly detail the performance overhead...\"_: We can add the additional memory footprint data for our permissioned LLMs in terms of additional PEFT model parameters in the revision. We do not observe any increase in training cost for *Active*, for *Merge* the cost is nominal and independent of training data size or training time. For *Union*, we require training the models on the union of domains which scales the training time with the number of domain sets and their sizes.  Although this scaling can inflate to 2^n sets of domains in principle, in practice, we expect the sets of domains to be much lower in many important application settings.\n\n\n## Clarification on utility–access control trade-offs\n\nRegarding the comment _\"...discussion on the inherent trade-offs between strict access control enforcement and the LLM's overall utility...\"_: The UGI metric measures the gap in model utility between a domain a user has access to and a domain the user doesn't have access to. It thus impacts the utility for unauthorized users by design. It does not, however, trade-off the utility for users with legitimate access to security domains even for complex queries as long as they have access to the domains required to answer the query. The UGI could however be upper-bounded by the model generalizability across different security domains in cases where the domains have correlations and/or when learnings from one security domain help answer queries for another security domain. In such scenarios, a user with no access to a target domain could still get relevant answers from a model that has generalized the learnings from other domains the user has access to, and the access controls are not violated as long as the model does not glean over the data from target domain to answer the user's query. We do not consider any cross-domain correlations in our experiment setup to keep the analysis straightforward."}, {"review_id": "GNCB1wQEGN", "reviewer": "Reviewer_1HWR", "summary": "This paper proposed Permissioned LLMs (PermLLMs), a new design for enforcing access control in outputs of LLMs through efficient fine-tuning. To assess the performance of access control in LLMs, the authors also propose a formal framework for quantifying the relevance and utility of access control of LLMs and two metrics, Domain Distinguishability Index (DDI) and Utility Gap Index (UGI), to benchmark the LLM utility. The paper presents experiments on four public datasets to demonstrate the efficacy of PermLLMs", "questions": "Can you clarify why the relevance score function $relv()$ is the utility value itself (Sec. 4.2)? It seems to be a central component to the entire framework, and it would certainly be beneficial to see discussions on it. Continuing the discussion on UGI, relevance to a specific domain and utility do not seem to be simply equivalent.", "limitations": "The authors discussed some limitations of the proposed method.", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\n* The work is well-motivated and well-written, with a research question of clear real-world application potential. The problem of tailoring LLM outputs based on user access is an interesting and important one.\n\n* The paper includes a formal method to the LLM access control problem, which quantifies the strictness of the model following access control of domains and a game-based threat (audit) model (Sec. 2.3) for evaluation of the system.\n\nWeaknesses:\n\n* One particular weakness in the framework is the design of DDI, which utilizes membership inference attacks for distinguishing model outputs. A downside inherent in this design would be, naturally, that the index is only as good as the strongest attack, which still remains an open problem for MIAs against LLMs, and especially in black-box scenarios. A more recent critique of the MIA methods toward LLMs is given by Meeus et al. in [1], in short, post-hoc collected shadow sets for MIAs are not good classifiers of training sample memberships.\n\n* The notion of Access Advantage (Def. 2.2) and UGI (Def. 4.2) needs more clarification. From a user perspective, one would certainly expect that an LLM should not suffer utility loss on *any* query. Suppose the model can generalize on a particular domain $D_{S_u}$ based on other pre-trained data alone; should the model be penalized for its output even though it has not observed this domain?\n\nReferences\n[1] Matthieu Meeus, Igor Shilov, Shubham Jain, Manuel Faysse, Marek Rei, Yves-Alexandre de Montjoye. SoK: Membership Inference Attacks on LLMs are Rushing Nowhere (and How to Fix It). In SatML, 2025.", "was_revised": true, "final_justification": "My main concerns have been addressed, and the authors will include results and discussion mentioned in the rebuttal.", "rebuttal": "We thank the reviewer for their detailed feedback and for acknowledging the practical significance of the problem and our evaluation framework. Below we would like to clarify the concerns and questions raised:\n\n## On the reliance on MIA success\n\nThe reviewer raised a valid concern that the DDI evaluation is only as good as the best MIA in their comment _\"One particular weakness in the framework is the design of DDI, which utilizes membership inference attacks...\"_. \n\nWe agree with the reviewer that the empirical success of DDI is dependent on the strongest membership inference attacks, which could get trickier for LLMs as the training set sizes increase in the general LLM training setting. However, in our scenario the security domains are distinct from each other in the data distribution sense, and as such even with larger domains the MIAs would be successful in distinguishing the domains.\n\nMoreover, DDI is designed to be modular with respect to the choice of MIA. In our experiments, we already evaluate DDI using five different MIA techniques, demonstrating its flexibility and robustness across a range of attack strategies. As the field progresses and stronger and more refined MIAs are developed, they can be directly incorporated into the DDI calculation without modification to the framework. This design ensures that DDI remains adaptable and relevant in assessing access control effectiveness.\n\n\n## On the clarification of UGI metric\n\nRegarding the comment _\"The notion of Access Advantage (Def. 2.2) and UGI (Def. 4.2) needs more clarification. From a user perspective, one would certainly expect that an LLM should not suffer utility loss on any query. Suppose the model can generalize on a particular domain based on other pre-trained data alone; should the model be penalized for its output even though it has not observed this domain?\"_: We note that there is no penalization on model output/utility with Permissioned LLMs. If the model generalizes well with just its pre-training data, then it will perform well on queries related to domains the user does not have access to. However, this does not imply the access control does not work as intended. The access advantage definition only bounds the gap in model utility between the case where the user has access to a domain and the case where the user has no access to that domain, which includes any model utility obtained from learnings without the model gleaning the data from the domain the user doesn't have access to. We will clarify this in the revision.\n\nRegarding the comment _\"Can you clarify why the relevance score function is the utility value itself (Sec. 4.2)?...\"_: For UGI, we are using the gap in *utility*, which is why the relevance score defined in Def 2.2 is the utility for the target domain for the UGI instantiation. Other access advantage instantiations could use different relevance score metrics, for instance DDI uses AUC and TPR@(low)FPR as relevance score metrics."}, {"review_id": "Ik8tfDVWBt", "reviewer": "Reviewer_mrTF", "summary": "This work studies the problem of using datasets in enterprises where parts of it have different access control permissions. The paper proposes a new framework called PermLLM to utilize these datasets for finetuning LLMs while respecting the access control permissions. The core idea is to ensure that an LLM fine-tuned on data from multiple \"security domains\" only generates responses based on the domains a specific user is authorized to access. The paper formalizes this problem, proposes a generalized metric called access advantage along with an auditor process to measure this empirically, proposes 3 methods to achieve PermLLMs and experimentally evaluates them on 4 different datasets (WMDP, GPQA, SimpleQA and RCV1).\n\nThe 3 proposed methods are variations of training and combining PEFT adapters that are trained on the relevant \"security domains\". The 3 methods are:\n- Activate: Each adapter is trained on a single \"security domain\" and activations are combined during inference.\n- Merge: Each adapter is trained on a single \"security domain\" and adapters are combined for inference.\n- Union: Each adapter is trained for existing combinations of \"security domains\"\n\nThe paper also proposes 2 metrics to measure how effective these methods are called Domain Distinguishability Index (DDI) based on Membership Inference Attacks and Utility Gap Index (UGI) based on LLM utility evaluation. They find that these techniques work well in the simplified access control model presented in the paper with few domains.", "questions": "1) Given that the construction is private by construction as each user can only use an adapter from security domains it has access to, its not clear how much value all the empirical metrics are adding to understanding the privacy of the mechanisms? If the question is about auditing, would it be easier and more effective to audit that the adapters themselves are trained on the correct data instead?\n\n2) Can you elaborate on how UGI makes sense as a metric? From what I can tell, it doesn't tell us much about utility and can only tell us about privacy leakage in a very roundabout way.", "limitations": "yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 4, "significance": 2, "originality": 2, "strengths_and_weaknesses": "Strengths:\n- Paper is clearly written and easy to understand and follow.\n- The work is thorough as it provides a framework for theoretically understanding this problem as well as metrics to empirically evaluate the implementations.\n\nWeaknesses:\n- The provided methods for PermLLMs seem fairly simple and combine already existing methods.\n- The methods provided do not scale well with increasing number of domains. Activate and Merge both suffer from low utility when number of domains increase. Union requires exponential space and training resources. Furthermore, the access control model is very simple without any hierarchies and it seems like it is expected that it does not change over time.", "was_revised": true, "final_justification": "The authors clarified most of the questions I had in their response but as the other reviewers also mentioned, the current set of results have a few weaknesses:\n- The empirical auditing metrics rely on either assumptions that utility loss is expected if query does not have access to the correct domain or rely on MIA attacks that might not work well in practice.\n- The methods provided to achieve Permissioned LLMs do not seem to scale well to complex access controls that systems like this will usually use such as a larger number of domains. \n\nBased on this, I will choose to keep my initial rating.", "rebuttal": "We thank the reviewer for their detailed feedback and for acknowledging the merits of our access control formalism and evaluation framework. We would like to take the opportunity to respond to the questions and concerns raised in the review:\n\n## Regarding the auditing process\n\nIn response to the question _\"Given that the construction is private by construction as each user can only use an adapter from security domains it has access to, its not clear how much value all the empirical metrics are adding to understanding the privacy of the mechanisms? If the question is about auditing, would it be easier and more effective to audit that the adapters themselves are trained on the correct data instead?\"_:\n\nOur access control evaluation is with respect to an auditor having access to all the domain adapters and domain datasets who wants to verify if the access control mechanism is implemented correctly. Hence the auditor chooses a query from a target domain and evaluates the access advantage when querying the target domain adapter (i.e., \"in\" adapter) instead of any other adapter (i.e., \"out\" adapter). This also answers how much information a user can gain for a target domain query when they have access to the target domain versus when they do not, thereby bounding the leakage about an individual query/record. \n\nThe above problem can also be reformulated by fixing an adapter and querying it with \"in\" and \"out\" domain data, and our experiments already capture this. The UGI metrics reported in Figure 2 and 3, and Table 3, show the *average* gaps across all domain adapters and domain datasets, which implicitly captures this scenario. For example, given two adapters, A1 and A2, and two security domains, D1 and D2, the UGI metric finds the average utility gap between \"in\" and \"out\" adapters for both domains: ((U(A1, D1) - U(A2, D1)) + (U(A2, D2) - U(A1, D2))) / 2. The alternate problem formulation is also equivalent to this: ((U(A1, D1) - U(A1, D2)) + (U(A2, D2) - U(A2, D1))) / 2.\n\nFinally, both DDI and UGI are agnostic to the underlying *implementation* of access control. Whether the system is built using PEFT or other future techniques, our metrics remain applicable. This makes them broadly useful for auditing the effectiveness of any access control enforcement mechanism, not just the specific construction used in this work.\n\n\n## Regarding the UGI metric\n\nIn response to the question _\"Can you elaborate on how UGI makes sense as a metric? From what I can tell, it doesn't tell us much about utility and can only tell us about privacy leakage in a very roundabout way.\"_: We note that the UGI metric quantifies the difference in utility between the cases when a user has access to a security domain and when they do not have access to that domain. This pertains to how much information a user can gain for a target domain query when they have access to the target domain versus when they do not. UGI does not quantify the model utility itself.\n\n\n## Regarding the scalability and simplicity of the approach\n\nRegarding the comment _\"The provided methods for PermLLMs seem fairly simple and combine already existing methods.\"_: While the access control mechanisms are simple and straightforward, we would like to highlight the effectiveness of these approaches in enforcing access control as shown in our experiments. Additionally, we also implemented a naive prompt-based access control baseline which fails to achieve any meaningful access control, while also being susceptible to potential jailbreaking attacks. We will include these new results and a thorough discussion in the paper's revision.\n\nRegarding the comment _\"The methods provided do not scale well with increasing number of domains...\"_: Since the problem of access control in LLMs has not been formalized before and ours is the first work in this effort, the major goals of our work are to formalize access control enforcement in LLMs and introduce empirical metrics to evaluate the effectiveness. As we stated in our limitations section, the scalability of our approach to large number of domains (order of thousands) is not feasible at the moment. For large number of domains or permission groups, we can cluster similar permission groups into hierarchical clusters and train the PEFT modules on the clusters. We leave this extension for future work."}, {"review_id": "NvW1uZxqSj", "reviewer": "Reviewer_z3PK", "summary": "This paper addresses a critical and underexplored challenge in deploying LLMs within enterprise or multi-tenant environments: how to enforce fine-grained access control when LLMs are fine-tuned on data from multiple security domains. The authors propose Permissioned LLMs (PermLLMs), a class of models that associate subsets of LoRA adapters with specific data domains. They present three mechanisms—Activate, Merge, and Union—to enforce domain-specific access control during both fine-tuning and inference. To evaluate the enforcement strength, they introduce two novel empirical metrics: Domain Distinguishability Index (DDI) and Utility Gap Index (UGI). The paper is well-motivated, formally grounded, and supported by empirical results on multiple datasets.", "questions": "- How does the system handle noisy domain boundaries or cross-domain data leakage (e.g., data records shared across silos)?\n\n- Hyperparameter Sensitivity: Given that only default LoRA rank (64) was tested with limited ablation studies, how sensitive are the results to key hyperparameters like adapter rank, learning rate schedules, and the choice of layers for adapter placement?", "limitations": "Yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\n- The paper tackles a real-world security problem that is likely to become increasingly important as LLMs are deployed across enterprise and governmental settings. It introduces a formal framework for modeling access control in LLMs and provides a rigorous definition of access advantage.\n\n\n- The experimental evaluation is comprehensive in scope, covering multiple datasets with varying characteristics and two different base models. The use of membership inference attacks to construct the DDI metric is innovative and provides a principled way to assess domain separability. The inclusion of multiple utility metrics for UGI offers different perspectives on access control effectiveness.\n\n\nWeakness: \n\n- The most significant limitation of this work is its scalability constraints. The Union mechanism, which provides the best performance, requires up to 2^n adapters for n domains, creating a combinatorial explosion that quickly becomes impractical. While the authors acknowledge this limitation, they provide insufficient analysis of when scalability becomes prohibitive or guidance on the maximum practical number of domains.", "was_revised": true, "final_justification": "This paper addresses a critical and underexplored challenge in deploying LLMs within enterprise or multi-tenant environments: how to enforce fine-grained access control when models are fine-tuned on data from multiple security domains. The authors present a simple yet conceptually meaningful solution to this problem. While the proposed approach has certain limitations in terms of scalability and generality, the initial solution provides a useful starting point for future work in this space. Overall, I believe the paper makes a valuable contribution to the community. My current score reflects both my appreciation of the paper’s central insight and the clarifications provided during the rebuttal. I will maintain my original score.", "rebuttal": "We thank the reviewer for their detailed feedback and for recognizing the merits of our access control formalism and evaluation framework and their relevance to the enterprise settings. Below we would like to respond to the questions and concerns raised in the review:\n\n## Guidance on usability and scalability\n\nRegarding the comment _\"...insufficient analysis of when scalability becomes prohibitive or guidance on the maximum practical number of domains.\"_: The usability is subjective and depends on the dataset sizes, size of the models and the compute resources available. We expect the mechanisms to scale well to few dozen domains for the models of sizes similar to Llama-8B and Mistral-7B models. We have experimented with 3 to 10 security domains in our experiments across different datasets. In practice, the combinations are few and sparse in enterprise settings and thus we don't need all possible permutations for *Union*. For instance, in enterprises there would be hierarchy in organization and not all employees would get all possible access combinations: employees typically only have access to lower levels than their designation. In such settings, the combinations could be in the order of *nlog(n)* for a tree-type hierarchical organization structure. All these interesting scalability issues are a part of our future work.\n\n\n## Handling domain segregation\n\nIn response to the question _\"How does the system handle noisy domain boundaries or cross-domain data leakage (e.g., data records shared across silos)?\"_: We assume the separation of data across security domains has happened before our access control mechanisms come into play. Most enterprise settings already have strict separation/segregation of data across different silos or organizations. Any individual that is part of any two organizations would naturally get access to data from both domains. The actual handling of separation of noisy cross-domain boundaries is beyond the scope of this work.\n\n\n## Hyperparameter sensitivity\n\nIn response to the question _\"Given that only default LoRA rank (64) was tested with limited ablation studies, how sensitive are the results to key hyperparameters like adapter rank, learning rate schedules, and the choice of layers for adapter placement?\"_: We tried adapters with different LoRA ranks ranging from 2 to 64, and found it to have limited impact on the metrics, and hence set the default value to 64. We also tried different learning rates between 1e-5 and 5e-4 using grid search in our initial experiments and set the best values for all our experiments. We have not experimented with choosing specific layers for adapter placement and went with the standard LoRA implementation of using adapters for all layers. We will add this discussion in the *Detailed Experiment Setup* section in the appendix."}]

Author rebuttal:

Meta-review: The paper introduces Permissioned LLMs, a new framework to enforce access control on the outputs of fine-tuned language models. The authors propose mechanisms based on Parameter-Efficient Fine-Tuning to segregate data access. They also introduce two novel metrics, the Domain Distinguishability Index and the Utility Gap Index, to gauge the effectiveness of the access control systems.

Strength: Tackles an important security problem for enterprise LLMs. Formalises the problem and introduces an auditable evaluation framework. Empirical validation is thorough across multiple datasets and models.

Weakness: Scalability of the proposed mechanisms (L9eS, mrTF, z3PK). DDI metric's reliance on membership inference attacks. The Union method is computationally impractical for a large number of access domains. 1HWR correctly noted that the DDI metric is only as effective as the best available MIA (where current MIAs have clear limitations).

The decision to accept is based on the paper's novelty and importance. It provides the first formal treatment of access control for fine-tuned LLMs. This is a crucial step for building trustworthy AI systems. The authors were highly responsive during the rebuttal. They convincingly addressed the most serious criticism about the DDI metric. They conducted new experiments on the PubMedQA dataset. The extra work significantly strengthened the paper and convinced 1HWR to support acceptance. Scalability remains a valid concern - however, it is an acceptable limitation for a foundational paper that opens up a new field of inquiry.
Decision: Accept (poster)