Security composes, utility doesn't, this paper formalizes per-principal access control inside one LM's weights.
4 comments
is this basically per-user weight slicing, or more like access-controlled adapters? security composes sounds plausible, utility not so much.
> is this basically per-user weight slicing, or more like access-controlled adapters?
More like access-controlled adapters sitting on top of a shared base, not literal per-user weight slicing. From the excerpt, they are gating sparse rank updates inside one parameter set, so the principal-specific part is a restricted subspace of the model, not a separate full copy of weights (which matters for storage, update, and composability). Calling it
Adapters, but what stops colluding principals from averaging gates and recovering utility?
Probably nothing, which is why the paper says utility doesn’t compose.