Research map / Large language models / Reasoning and chain of thought

No More, No Less: Least-Privilege Language Models

ICML 2026 · Large language models › Reasoning and chain of thought · approach: Routing, pruning and distillation for reasoning · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes least-privilege language models that control a deployed LM's reachable internal computation at inference via Nested Least-Privilege Networks (rank-indexed nested factorization of linear layers), giving a privilege-utility knob for per-request capability suppression.

Problem

Deployed language models expose the same full internal capability to every user and request through one endpoint; output-level filters and steering do not remove underlying capability, so there is no reversible, per-request way to restrict what the model can compute.

Approach

Define privilege as reachable internal computation and enforce it inside the forward pass by re-parameterizing linear layers as nested low-rank factors (W(g)=B_g A_g, prefix of rank-g factors), post-hoc fine-tuned with an uncertainty-weighted loss over an anchor full-rank and a sampled lower rank; a monitor-allocator-enforcer stack chooses rank per request.

Key results

• On Qwen2.5-0.5B, Contains Substring accuracy falls from 99.7% at rank index 0 to 77.6% at the lowest rank, while Llama-3.2-1B keeps above 97% on all tasks even at its lowest rank.
• Progressive escalation reaches accuracy targets with lower average rank than static full privilege on Pythia-1B balanced brackets, at the cost of extra inference passes.
• Sparse block-level interventions in NLPN-Qwen2.5-0.5B can selectively suppress chemistry (or chemistry and biology) MMLU subjects with limited collateral degradation.

Surprising findings

• Llama-3.2-1B stays above 97% on all algorithmic tasks even at its lowest rank, suggesting architecture strongly affects robustness to rank reduction.
• Most block/projection interventions have negligible effect; only a small subset yields subject-specific degradation.

Limitations

• Privilege interface is not a safety guarantee; capabilities may be recoverable via adaptation or prompting.
• Average rank is only a proxy for reachable computation and does not map to semantic capability classes.
• Evaluation is on small models and algorithmic tasks, with limited MMLU suppression experiments.

Experimental setup

Datasets: MiniPile Balanced Brackets Length Comparison Contains Substring MMLU

Benchmarks: Balanced Brackets Length Comparison Contains Substring MMLU perplexity

Metrics: accuracy average rank (privilege) perplexity overhead (number of passes)

Baselines: SVD truncation Full-privilege Min Rank Static LP Progressive escalation

Builds on: SVD low-rank truncation slimmable networks once-for-all networks uncertainty-weighted multi-task loss

Closest papers by meaning

• Permissioned LLMs: Enforcing Access Control in Large Language Models (NeurIPS 2025 · similarity 0.85)
• CoreGuard: Safeguarding Foundational Capabilities of LLMs Against Model Stealing in Edge Deployment (NeurIPS 2025 · similarity 0.84)
• Jailbreak Antidote: Runtime Safety-Utility Balance via Sparse Representation Adjustment in Large Language Models (ICLR 2025 · similarity 0.84)
• On Prompt-Driven Safeguarding for Large Language Models (ICML 2024 · similarity 0.84)
• On Evaluating the Durability of Safeguards for Open-Weight LLMs (ICLR 2025 · similarity 0.84)
• Representation Noising: A Defence Mechanism Against Harmful Finetuning (NeurIPS 2024 · similarity 0.83)