Paper deep dive
Capability-Gated Language Models: Security Composes, Utility Does Not
Patrikas Vanagas, Augustas Mačijauskas, Laurynas Lopata
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 91%
Last extracted: 9/2/2026, 4:47:36 AM
Summary
The paper introduces 'Capability-Gated Language Models,' a framework for per-principal access control within a single set of model weights using a lattice structure. Security properties compose at lattice meets (restrictions accumulate), while utility properties do not compose, as individually harmless profiles can degrade retention and fluency when combined. The authors instantiate this using sparse rank gating over nested factorization and validate it on Qwen3-1.7B and SmolLM2-1.7B.
Entities (9)
Relation Signals (7)
Capability-Gated Language Models → evaluatedon → Qwen3-1.7B
confidence 95% · We study the framework and our instantiation on Qwen3-1.7B
Capability-Gated Language Models → evaluatedon → SmolLM2-1.7B
confidence 95% · repeat the pipeline verbatim on SmolLM2-1.7B
Capability-Gated Language Models → uses → Nested Factorization
confidence 90% · We instantiate it by sparse rank gating over an existing nested-factorisation mechanism
Capability-Gated Language Models → usesdatasetforretention → MMLU
confidence 90% · The retain set R¯u is seven MMLU subjects
Capability-Gated Language Models → usesdatasetforsuppression → WMDP
confidence 90% · The suppress set Su is WMDP
Security Composes → holdsat → Lattice
confidence 85% · Security composes: provably at meets... configurations form a lattice
Utility Does Not Compose → holdsat → Lattice
confidence 85% · Utility does not: individually harmless profiles can compose to retention and fluency damage
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Deployed language model safeguards (safety fine-tuning, filtering, unlearning) vary by principal only outside the model weights: filters are reconfigured, tiers are multiplied, and artefacts are reissued; inside one set of weights every request meets the same model configuration. This motivates us to define capability-gated deployment: per-principal access control inside one set of weights, whose configurations form a lattice - meets accumulate a principal's restrictions and joins pool a coalition's reach. We instantiate it by sparse rank gating over an existing nested-factorisation mechanism, guide profile search with one-pass attribution, and read every result once from a pre-registered held-out split. Security composes: provably at meets under a monotone-elicitation assumption we falsify pointwise. In two lineages the median held-out meet deepens suppression; the one effect surviving correction strengthens it. Utility does not: individually harmless profiles can compose to retention and fluency damage, and no compositional bound exists.
Tags
Links
- Source: https://arxiv.org/abs/2609.00445v1
- Canonical: https://arxiv.org/abs/2609.00445v1
Trouble viewing inline? Open PDF directly →
Full Text
75,778 characters extracted from source content.
Expand or collapse full text
Foundations of Language Model Security Capability-Gated Language Models: Security Composes, Utility Does Not Patrikas Vanagas Affiliation: BPTI Affiliation: Vilnius, Lithuania Email: pv.unwired170@passmail.net Augustas Mačijauskas Affiliation: Independent Researcher Affiliation: Vilnius, Lithuania Email: august.macijauskas@gmail.com Laurynas Lopata Affiliation: askEarth AG Affiliation: Zürich, Switzerland Email: lopatalaurynas@gmail.com Abstract Deployed language model safeguards (safety fine-tuning, filtering, unlearning) vary by principal only outside the model weights: filters are reconfigured, tiers are multiplied, and artefacts are reissued; inside one set of weights every request meets the same model configuration. This motivates us to define capability-gated deployment: per-principal access control inside one set of weights, whose configurations form a lattice — meets accumulate a principal’s restrictions and joins pool a coalition’s reach. We instantiate it by sparse rank gating over an existing nested-factorisation mechanism, guide profile search with one-pass attribution, and read every result once from a pre-registered held-out split. Security composes: provably at meets under a monotone-elicitation assumption we falsify pointwise. In two lineages the median held-out meet deepens suppression; the one effect surviving correction strengthens it. Utility does not: individually harmless profiles can compose to retention and fluency damage, and no compositional bound exists. 1 Introduction A deployed language model is one endpoint and one configuration: a capability withheld from an anonymous user is withheld from a vetted defender in the same deployment. Protection theory has held since the 1970s that authority should instead be indexed to a principal, so that a right can be granted, narrowed, or revoked for one subject without altering it for every other (Lampson, 1974; Graham and Denning, 1972). The mismatch is newly consequential for language models: frontier capability is rising on a steep, well-characterised trend (Kwa et al., 2025), dangerous-capability evaluation has become a precondition of release (Shevlane et al., 2023; Phuong et al., 2024), and the domains at issue – biology, chemistry, offensive cybersecurity (Li et al., 2024) – are exactly those in which different principals warrant different capability. The safeguards that ship are global by construction: post-training alignment shapes one output distribution for every request thereafter (Ouyang et al., 2022; Bai et al., 2022; Rafailov et al., 2023); unlearning and concept erasure edit the weights, but the edited weights are the single artefact every user receives (Li et al., 2024; Belrose et al., 2023; Meng et al., 2022); and classifiers mediate every request against a policy beside the weights – reconfigurable per tenant, but only over what the weights still emit. Per-principal variation is thus bought outside any one set of weights – reconfigured filters, tiered and identity-verified access, restricted releases, managed-access frameworks [Carter and Butchello, 2026, Bloomfield et al., 2026] – at the granularity of whole accounts and whole models: each distinct authority is a distinct filter policy over intact capability, or a distinct artefact to train, evaluate, and maintain (Roland et al., 2026). The caveat is known – filtering leaves the underlying computation reachable, and unlearning is repeatedly found to suppress rather than erase, the knowledge recoverable by fine-tuning or probing (Łucki et al., 2025; Deeb and Roger, 2025): accuracy at chance is evidence about behaviour, not about what remains reachable. pretrainedθ0 _0adaptation (once)every c a usable modelweights θ ++ interface(,Lκ,T)(K,\L_κ\,T)profile search over Cone φ(u) (u) per principalServing: identity binds profile; weights never changeinternalclearedpublicgatewayu↦φ(u)u (u)φ(u) (u): one bar per coordinate, height == levelone set of weights θ φ(u)T_ (u) in forward passπθ,c⊤ _θ,\,c πθ,cbio _θ,\,c_bioπθ,cbio∧ccyber _θ,\,c_bio\! c_cyberprofiles installed at the gateway■ model ■ privilege / enforcement ■ allocation ■ data c⊤=cbio∨ccyberc =c_bio c_cyberreached by coalition of bothcbioc_bioccyberc_cyber∧ _bioccyberc_cyberone principal, both suppressedc⊥c minimum capabilitycapability Figure 1: Capability-gated deployment. Left (a): adaptation is paid once and yields a single set of weights with the interface of Definition 2.1; a search over C then yields one profile per principal, which the gateway binds to identity and the enforcer applies inside the forward pass. Right (b): profiles are points of a lattice: composing two descends to their meet (one principal, both restrictions); pooling two principals’ outputs ascends to their join (a coalition’s reach). Utility constraints in (3) bind at meets, security constraints at joins. What is missing is thus not the will to differentiate but a per-principal mechanism inside one set of weights and an algebra for it, since authority is useful because it composes: a principal under two restrictions holds their conjunction, and principals pooling outputs command their union. The shape of that algebra is classical – Denning’s lattice model combines security requirements by greatest lower bound (Denning, 1976), and non-interference says what unavailability means (Goguen and Meseguer, 1982) – and so is the debt: such properties are notoriously not preserved under composition (McCullough, 1988), and which strengthened conditions survive, at what price, is literature of its own (McLean, 1994; Mantel, 2002). LLM capability profile lattice inherits both. We define capability-gated deployment (Fig. 1): per-principal access control inside one set of weights, varying only one privilege level per control coordinate. Configurations form a finite distributive lattice: a principal under several restrictions holds the meet, a coalition pooling outputs commands the join (Fig. 1). We instantiate it by sparse rank gating over a nested factorisation, steer profile search with a one-pass attribution, and read every result once from a pre-registered held-out split — an A/B discipline portable to any capability-control evaluation. Security composes at meets (provably under a monotone-elicitation assumption we then falsify pointwise, and empirically in two lineages) while utility does not: individually harmless profiles compose to real retention and fluency damage, and no compositional bound is possible. Scope. All claims assume query access (outputs observed at one’s own configuration, identity bound at the gateway, weights untouched) in expectation over a declared elicitation distribution and against a declared probe class; the gap from these expectation-based guarantees to worst-case, differential-privacy-style separation is the open problem we pose. 2 Capability-Gated Language Models What algebraic object serves many principals from one deployment, and what survives composition? 2.1 Formal Definition of Capability-Gated Deployment The Configuration Lattice. The weights are fixed; deployment varies only where, and how far, privilege is removed. We fix that action space abstractly, so the algebra belongs to the interface. Definition 2.1 (Capability-gating interface). A capability-gating interface for a model with parameters θ is a triple (,Lκ∈,T)(K,\L_κ\_κ ,T), where K is a finite set of control coordinates (sites whose privilege may be set independently) and each κ∈κ carries a finite, totally ordered set LκL_κ of privilege levels. A configuration assigns a level to every coordinate, i.e. is an element of :=∏κ∈LκC:= _κ L_κ; we write c⊤c for the configuration granting the greatest level everywhere and c⊥c for the least. The enforcer T carries a configuration to effective parameters θ(c):=Tc(θ)θ(c):=T_c(θ) and thus to a deployed policy πθ,c:=πθ(c) _θ,c:= _θ(c), with Tc⊤(θ)=θT_c (θ)=θ. Configurations are ordered pointwise, c⪯c′:⟺c(κ)≤c′(κ)for every κ∈,c c : c(κ)≤ c (κ)\ \ for every κ , (1) and the interface is required to be monotone in reachability: writing Reach(c)Reach(c) for the set of computations realisable under θ(c)θ(c), c⪯c′⟹Reach(c)⊆Reach(c′).c c (c) (c ). (2) Equation (2) gives the order its content: ascending it can only enlarge what the model may compute, and (1) compares two configurations only when one dominates the other at every coordinate. Under (1), (,⪯)(C, ) is a finite distributive lattice, bounded by c⊥c and c⊤c , with (c∧c′)(κ)=minc(κ),c′(κ)(c c )(κ)= \c(κ),c (κ)\ and (c∨c′)(κ)=maxc(κ),c′(κ)(c c )(κ)= \c(κ),c (κ)\ (Theorem A.1, App. A; Fig. 1). Principals, Profiles, and Allocation. Deployment is not a model but a service: one set of weights answers to several parties whose authorities differ. P is a finite set of principals — users, endpoints, or API keys. Each u∈u carries a suppress set SuS_u of capability domains that must be unavailable to u and a retain set RuR_u of tasks on which u’s utility must be preserved. Allocation is a map φ:→ :P ; φ(u) (u) is u’s profile, bound to the principal at the gateway and enforced inside by Tφ(u)T_ (u) (Fig. 1). Principals hold query access only: each sees outputs at its own profile and alters neither it nor θ. Two Phases. The weights are adapted once; the profiles are found afterwards. Adaptation is a one-time procedure returning θ together with an interface satisfying Definition 2.1, under which every configuration is a usable model. Profile synthesis then searches C, per principal, for a configuration meeting that principal’s requirements. Only the latter repeats when a principal is added, and it is the hard one: ||=∏κ|Lκ||C|= _κ|L_κ| is exponential in |||K|, so synthesis measures only a shortlist. It needs an attribution (effect of each level of each coordinate on each domain, predicted from the mechanism’s internals at cost independent of |||C|) which the interface does not provide and an instantiation must. Definition 2.2 (Capability-gated deployment). Fix an interface as in Definition 2.1 and a family ⊆2 T 2^P of coalitions the threat model admits. Let (c,D) Sep(c,D) be a predicate that domain D is separated under c, (c,R) Ret(c,R) that task set R is retained, and γR(c) _R(c) the collateral incurred on R; §2.2 gives them content. Capability-gated deployment solves minφ:→ _ \,:\,P ∑u∈γRu(φ(u)) _u _R_u ( (u) ) (3) s.t. .t. (φ(u),D)∀u∈,∀D∈Su,(φ(u),Ru)∀u∈, Sep ( (u),D )\ \ ∀ u ,\ ∀ D∈ S_u, Ret ( (u),R_u )\ \ ∀ u , (⋁u∈Tφ(u),D)∀T∈,∀D∈⋂u∈TSu. Sep ( _u∈ T (u),\ D )\ \ ∀ T∈ T,\ ∀ D∈ _u∈ TS_u. The two constraint families sit on opposite sides of the lattice (Fig. 1). A principal obliged to forgo several domains at once holds the meet of the corresponding profiles, so its utility is assessed below each of them; a coalition pooling outputs commands whatever any member commands, so its security must be assessed at the join, above them all. Utility is therefore evaluated at meets and security at joins — an asymmetry (3) is arranged to expose rather than to hide. 2.2 Security and Utility Under Composition Definition 2.3 (Channels, separation, retention). A configuration c is observed at two channels. Its behavioural channel is what it emits, summarised on a domain D with elicitation distribution DD_D and chance level αD _D as accD(c)=x∼D[accπc(x)]acc_D(c)=E_x _D\! [acc_ _c(x) ]; its representational channel is the state hc(x)h_c(x) at the decision, read by a declared class P of probes from representations to answers. With γR(c)=accR(c⊤)−accR(c) _R(c)=acc_R(c )-acc_R(c) the collateral on a retain set R and corresponding tolerances ε,δ,τ≥0 ,δ,τ≥ 0, εbeh(c,D) Sep^beh_ (c,D) :⟺accD(c)≤αD+ε : \ acc_D(c)≤ _D+ (behavioural) (behavioural) (4) δrep(c,D) Sep^rep_δ(c,D) :⟺supp∈Px∼D[accp(hc(x))]≤αD+δ : \ _p∈ P\ E_x _D\! [acc_p(h_c(x)) ]≤ _D+δ (representational) (representational) τ(c,R) Ret_τ(c,R) :⟺γR(c)≤τ. : \ _R(c)≤τ. (retentional) (retentional) Separation is one schema read at two channels that differ in who may decode. In (3), Sep is εbeh∧δrep Sep^beh_ Sep^rep_δ at a principal’s own configuration and εbeh Sep^beh_ alone at joins, where coalitions hold outputs only; Ret is τ Ret_τ. An allocation meeting these constraints for u is secure for u and preserves its utility. Separation fails by a capability’s persistence, retention by its loss. With the model’s own readout in P, δrep⇒δbeh Sep^rep_δ Sep^beh_δ and not conversely (Proposition A.2). The masking gap μ(c,D)=δ⋆−ε⋆μ(c,D)=δ - between the tightest tolerances at which each holds tells a gate, which removes the capability, from a filter, which withholds its output with the capability intact — attaining beh Sep^beh with μ maximal. Direction in the lattice decides what survives composition (proofs in Appendix A). Under a monotone-elicitation assumption (Assumption A.4) (which §3 finds violated only pointwise, by about a point) security composes: separation survives every further meet (Theorem A.5). Coalition pooling outputs realises the join of its members’ profiles, so (3) imposes separation there (Theorem A.6). Collateral admits no compositional bound: zero-collateral profiles can meet to lose every retained item under exactly additive margins, since accuracy thresholds a margin (Theorem A.7). Nothing so far has named a mechanism, and nothing needed to: any construction offering independently addressable sites with ordered, reachability-nested settings instantiates Definition 2.1, and everything above applies to it. 2.3 Instantiating the Interface One control coordinate : a gated map κ (r)=B:, 1:rA1:r,:W(r)=B_:,\,1:r\,A_1:r,\,:ImW(1)⊆⋯⊆ImW(rmax)Im\,W(1) ·s \,W(r_ )as a bar:height =r=rOne adaptation step : two forwards, anchor ++ one sampled variantanchor c⊤c ⋯·sor⋯·sglobal variant (Rauba et al., 2026):every κ at one shared level — thediagonal c(κ)≡rc(κ)≡ r of C⋯·s▼ ▼ variant (ours): k∈1,2,3k∈\1,2,3\coordinates at independent levels —sparse, off the diagonal Figure 2: Instantiated interface and mixed-rank adaptation. Left (a): a control coordinate is one map W≈BAW≈ BA; level r keeps the prefix factors (green), withdrawing the tail (dashed), so levels nest reachable computation (2). Later figures draw a coordinate as a bar of its level. Right (b): each step trains c⊤c with one sampled variant. Rauba et al. (2026) draw global variants only (the lattice diagonal); profiles are sparse off-diagonal points; our mixed variant gates one to three coordinates at independent levels (markers). Mechanism. We instantiate Definition 2.1 with the nested subspace networks of Rauba and van der Schaar (2026), as Rauba et al. (2026) deploy them for least-privilege inference: there ||=1|P|=1, Su=∅S_u= , and one scalar rank minimises privilege subject to a utility floor. We add configurations off that diagonal, and principals in the plural (App. B.1 details the correspondence). A control coordinate is one of each block’s MLP projections, reparameterised as W≈BAW≈ BA; levels are ranks, and level r keeps the prefix factors (Fig. 2), so with θ the post-adaptation parameters, Tc⊤(θ)=θT_c (θ)=θ holds exactly. On Qwen3-1.7B, ten levels on each of ||=84|K|=84 coordinates give ||=1084|C|=10^84. Composition is then exact at the level of reachable computation: nested factors carry meets to intersected write-spaces and joins to their sums (Theorem A.3), which extends Theorem A.5 from outputs to representations. The mechanism supplies every property the framework consumes — reachability monotone (2), degradation gradual and differential, sensitivity concentrated in few coordinates, tensor shapes unchanged — each itemised, with what it buys the framework, in App. B.1. Adaptation off the Diagonal.11 1 We share our code here: https://anonymous.4open.science/r/capability-gated-language-models-318D/README.md The recipe of Rauba et al. (2026) trains each step at the anchor c⊤c jointly with one sampled constant variant c(κ)≡rc(κ)≡ r (the diagonal of C) while the profiles of Definition 2.2 are sparse off-diagonal points (Fig. 1). We therefore alternate the global draw with a mixed variant gating k∈1,2,3k∈\1,2,3\ random coordinates at independent levels (Fig. 2; loss in App. B.1), so adaptation trains the states that profile synthesis selects among, not the diagonal alone. What We Do Not Claim. Two caveats of Rauba et al. (2026) apply: privilege is an operational proxy, no level-to-capability map claimed; and gating does not withstand weight adaptation, which is why §2.1 grants principals query access only. 2.4 Profile Synthesis with One-Pass Attribution Profile synthesis searches C, per principal, for a configuration maximising a scalarisation of (3), score(c)= (c)\;= acc¯R¯u(c)−λ|Su|∑D∈Sumax(accD(c),αD) acc_ R_u(c)\;-\; λ|S_u| _D∈ S_u \! (acc_D(c),\ _D ) (5) −ρ∑M∈R¯umax(0,accM(c⊤)−accM(c)−τ)−νΦ(c), -ρ _M∈ R_u \! (0,\ acc_M(c )-acc_M(c)-τ )\;-\;ν\, (c), where acc¯ acc averages accuracy over a set; each term prices a failure the others cannot see. Suppression counts only down to the chance level αD _D: scoring below chance requires identifying the correct answer, so an unclamped term would reward masking over removal (§2.2). The hinge is the collateral γRu _R_u of (3) at tolerance τ, and Φ prices fluency, which no accuracy term registers (construction in App. B.2). The search (a measured single-coordinate sweep, then beam search by coordinate descent, candidates scored by (5)) is tractable on a 108410^84-point lattice only because it scores a shortlist, never the lattice; the shortlist’s worth is priced, not assumed, in Fig. 10b. The shortlist is where the attribution of §2.1 enters, and nesting supplies it in closed form. Gating is exact in the component basis: level r discards the components j≥rj≥ r of hκ=Aκxh_κ=A_κx, changing its output by Δoκ=−Bκ[:,r:]hκ[r:] o_κ=-B_κ[:,r:]\,h_κ[r:]; linearising the correct-answer margin m in it gives Δm(κ,r)≈⟨gκ,Δoκ⟩=−∑j≥raκ(j),aκ(j)=∑t⟨gκ,t,Bκ[:,j]⟩hκ[t,j], m(κ,r)\;≈\; g_κ, o_κ \;=\;-\!\! _j≥ ra_κ(j), a_κ(j)\;=\; _t g_κ,t,\,B_κ[:,j] \,h_κ[t,j], (6) where gκ=∂m/∂oκg_κ=∂ m/∂ o_κ and t ranges over token positions. The estimator is classical — gradient-times-activation (Shrikumar et al., 2017; Molchanov et al., 2019; Nanda, 2023); what is new is where it sits. At the factorisation bottleneck the perturbation is the deployed control action rather than a chosen counterfactual, and since aκ(j)a_κ(j) is independent of r, one forward–backward pass prices every level of every coordinate: the attribution §2.1 requires, at the cost it requires. Being first-order, it screens rather than selects: the levels the sweep evaluates, plus a rescue quota of coordinates by predicted selectivity (App. B.2). Measured accuracies decide the rest, but not those we report: each benchmark is split in two before any measurement, the search reads only split A, and split B is read once, for §3. 3 Results We study the framework and our instantiation on Qwen3-1.7B (Qwen Team, 2025) and repeat the pipeline verbatim on SmolLM2-1.7B (Allal et al., 2025). Protocol. All headline numbers are read once from held-out split B, with the split-A value beside them; accuracies carry Wilson intervals throughout. The terms of (5) (and through it Sep and Ret of (3)) are measured on three datasets. The suppress set SuS_u is WMDP (Li et al., 2024), all three domains: bio (12731273 items), chem (408408), cyber (19871987). The retain set R¯u R_u is seven MMLU subjects (Hendrycks et al., 2021) pooled into two macros, each scored as total correct over total items: adjacent (college biology, chemistry, and computer science, one per hazard domain) and distant (philosophy, high-school US history, international law, and high-school macroeconomics). The fluency price Φ , the 1.10×1.10× gate, and every perplexity ratio in the paper are measured on MiniPile (Kaddour, 2023), a distillation of the Pile (Gao et al., 2020). Every benchmark is frozen into splits A and B before any measurement (§2.4). Each substrate is adapted once by the recipe of §2.3. The well-formedness check of Rauba et al. (2026) (held-out perplexity stable across the rank ladder where naive SVD truncation collapses) passes under our mixed recipe (Fig. 8, App. B.1), and so does the check that is ours, usability off the diagonal against the number of gated coordinates (Fig. 9). A domain enters for a substrate only if, on the screening half, c⊤c accuracy clears αD _D by 5 points with the Wilson lower bound clear of it, lest every configuration would vacuously separate. Instrumental Validation. We validate the §2.4 instrument first (App. B.2, Fig. 10). One forward–backward pass at c⊤c predicts the drop measured by gating that cell on split A, confirming (6): sign agreement and Spearman ρ>0.5ρ>0.5, large interventions drifting from the first-order prediction — the instrument screens rather than selects. A shortlist ablation over four matched arms (sweep, sweep++quota, random, adversarially least-selective) measures the best (5) score against evaluations: what buys the search is measuring coordinates at all; attribution buys a better configuration per evaluation; the adversarial arm still reaches sensible suppression for common directions. Compute. One run per stage reproduces the results on a single substrate in about 4545 GPU-hours: 2323 of adaptation on one H100, everything downstream on one L40S, most of it the per-domain searches. The instrument and each sublattice measurement run in minutes, and headroom, composition, and the mechanism checks re-read existing artefacts — the lattice is evaluated once and read many ways. Figure 3: Measured sublattice. Bars give a domain’s suppression, taller more removed (pale split A, solid held-out split B, each against split’s full privilege) with the adjacent-macro drop Δ (A/B) and the perplexity ratio. Three faded joins equal c⊤c exactly (parents gate disjoint supports). Lattice. Fig. 3 shows the sublattice generated by the three deployed profiles under meet and join (twelve nodes); the full access matrix is Table 1 (App. B.4), the SmolLM2-1.7B analogue App. B.5 (Fig. 15, Table 2). On split A separation appears mostly not to survive composition; on split B the same nodes reverse it. Retention tells the inverse story: on A the single profiles mostly leave the adjacent macro intact and only the meets pay; on B the singles already pay and the meets pay more. Joins sit barely below full privilege, their parents gating disjoint supports (Theorem A.6). Profiles and Composition. Fig. 4 is the search’s own record: each domain’s gate-verified finalists, suppression against adjacent-macro collateral, split A by construction — the cloud is the search. Each domain’s selected profile (the bootstrapped lower-quartile winner among in-gate finalists, not the argmax) is re-measured once on B: suppression halves or worse, cyber reverses sign, and apparent retention gains turn into real collateral; the arrows are that gap, and the gap prices the optimism of an unprotected search. Fig. 4 crosses the thirteen parents (3 bio, 4 chem, 6 cyber) over all 54 cross-domain pairs and 24 triples: 180 (meet, parent, domain) records, each meet’s suppression on a parent’s domain minus that parent’s own, against the Jaccard overlap of the gated supports. The strong sub-additivity of split A does not survive B, and the registered covariate (shared support should mean interference) organises neither half (r=0.02r=0.02 on A, +0.33+0.33 on B, the opposite sign). Nor does the sub-additivity reproduce on two shorter adaptations of the same base model (median η of 1.941.94 and 1.511.51 on their own split A, against 0.900.90 here): a property of the selection, not of composition. Fig. 4 is the empirical face of Theorem A.5 (security composes, under MEA), which puts every record at or above zero; held-out B agrees as a tendency (the SmolLM2 analogue is Fig. 16). Figure 4: Profiles and composition. (a) The 200 gate-verified finalists on split A: suppression against adjacent-macro collateral, relative to c⊤c . Bars are Wilson intervals. (b) What each meet keeps of its parent’s suppression against gated-support overlap, all 180 (meet, parent, domain) records; zero is the additive baseline (η=1η=1). Sub-additive records fall from 102/180 on A to 35/180 on B. Gates or Filters? We proceed to study whether a profile’s suppression is removal of the capability, or masking, using probe protocols from Hewitt and Liang (2019). We use the declared linear probe P on the final-layer residual at the answer position, fitted on all of split A and scored once on split B, five seeds. Random-label control is the same probe fitted to shuffled labels — the memorisation floor; readout-cancellation foil is the full-privilege model with the four answer-letter logits permuted after the forward pass — the largest masking gap. Fig. 5 compares the behavioural and representational accuracies along with the relative masking gap μrel _rel (behaviour’s drop from c⊤c minus the probe’s drop) positive when the answer fell further than the knowledge. chem’s probe fails its capacity floor at full privilege (34.3%34.3\% against a behavioural 47.8%47.8\%), so chem is read only through μrel _rel. The foil is Proposition A.2’s converse failure made physical, so a held-out μ μ near the floor supports rep Sep^rep with respect to the declared P, not merely beh Sep^beh. The registered rule (large held-out gap means masking) does not fire: on B the deployed profiles reach 13%13\% (bio), 7%7\% (chem) and −5%-5\% (cyber) of a pure filter, against 1111, 5353 and 1515 on the split they were selected on. At deployable operating points, these gates remove rather than mask. Fig. 5 draws one dumbbell per grid parent — μrel _rel, A→ . Nearly every dumbbell points left on B (split A’s apparent masking was largely fitted to the search half), and every in-gate row sits well below its measured foil ceiling. The budget cuts one way: masking survives only where fluency is spent freely, and no cyber parent clears the gate. That absence is a result, not a blemish: no admissible cyber gate exists under the registered 1.10×1.10× budget, and the deployed profile, cheapest breach at 1.12×1.12×, shows no held-out suppression at all (−1.0-1.0 p on B, Table 1); App. B.3 measures the missing leverage. Figure 5: Gate or filter. (a) Each domain’s deployed profile, with the readout-cancellation foil as the measured ceiling of μ μ; chem is hatched: read as μrel _rel. (b) μrel _rel for the thirteen grid parents against each domain’s foil ceiling (dashed). No cyber parent clears the gate; the one held-out masker spends freely (1.26×1.26×, 52%52\% of a pure filter). Mechanism Checks. We now test three load-bearing steps: monotone elicitation (Assumption A.4), the thresholding mechanism behind Theorem A.7, and the masking-plane geometry. Fig. 6 shows the 20162016 (coordinate, level, group) cells of the single-coordinate sweep. Monotonicity is false pointwise (383383 cells raise accuracy, by up to +4.3+4.3 p — about a point’s magnitude); Theorem A.5 (security composes) rests on it, so the violations bound how literally that theorem can be read: small enough that it survives as a tendency, large enough that nothing forces a meet to preserve suppression exactly. Fig. 6 studies per-item margins on the adjacent macro at cbc_b, cchc_ch and cb∧cchc_b c_ch; margins compose roughly linearly (slope 0.660.66 on B), yet 33 of the 9292 items correct under both parents are lost at the meet. This is Theorem A.7’s mechanism: accuracy thresholds the margin, so two profiles with zero collateral can lose items at their meet even when the margin effects are exactly additive. The theorem’s construction is found in the wild rather than built. Finally, Fig. 6 places the thirteen parents between a pure gate and a pure filter. On B the deployed profiles sit −-2.8 to ++5.6 p from the gate edge; on A a uniformly positive ++2.2 to ++5.9 p, all three inside the wedge. Held-out, that reading is withdrawn: only bio stays clearly inside, cyber is indistinguishable from a pure gate, and chem sits below, knowledge falling faster than its answer; chem’s probe caps its claim at a gate. Audit. Last, we ask whether composition can itself detect masking, pre-registered before any split-B unlock: suppression that survives the meet is suppression; suppression that evaporates was masking. Fig. 7 shows residuals of the meets above chance on the parent’s own domain: an open circle above its filled marker is evaporation. Individual meets scatter both ways (the 35/180 sub-additive records of Fig. 4), but every parent’s mean recovery is negative (Fig. 7) and every domain deepens on average (bio −2.8-2.8, chem −2.8-2.8, cyber −1.8-1.8 p): no parent systematically gives suppression back, and the per-parent means leave the detector nothing to predict. Fig. 7 reads the same profiles by depth (one linear probe per block; genuine removal would drop probe accuracy at the gated blocks, masking carries it through) and the knowledge is carried past every gate, legible at the final layer. Fig. 7 is the registered prediction tying the halves: parents that give suppression back should be those with large masking gaps — the meet as a masking detector under pure query access. On A, strongly confirmed (ρ=0.88ρ=0.88, permutation p=10−4p=10^-4); on B, ρ=−0.39ρ=-0.39 at p=0.19p=0.19 over thirteen parents. The split-A result was two selection-inflated quantities agreeing: masking gaps measured on the half the probes were fitted to, give-back on the half the profiles were selected on. We report the failure rather than the split-A number; what survives is the mechanism, not the detector. Conclusions. Capability-gated deployment turns one adaptation into a lattice of models: per-principal profiles found by search, enforced inside the forward pass, and audited at its meets and joins. Under the registered A/B protocol, security composes (every corrected held-out composition effect is a strengthening, in both lineages) while utility does not, collateral admitting no compositional bound; at deployable operating points the gates remove rather than mask, within the declared probe class; and the pre-registered masking detector failed held-out, reported as failed. Two split-A findings we retract are the measure of what an unprotected search protocol can manufacture. We leave open how capability gating behaves under adaptive elicitation and mechanisms beyond nested MLP factors, and how expectation-based separation hardens to a worst-case, differential-privacy-style guarantee. The cyber diagnostics suggest tests of whether the limited leverage is distributed support, rank ordering, or computation outside the gated surface. Figure 6: Mechanism checks. (a) Single-coordinate accuracy changes from the cached sweep. (b) Per-item margins at cb∧cchc_b c_ch, a 1.18×1.18× meet; marked items were correct under both parents. (c) The masking plane; dotted edge a pure gate, dashed a pure filter; filled markers the deployed profiles, hollow the remaining parents. Figure 7: Registered audit fails on held-out data. (a) Each parent’s own-domain accuracy above chance, alone (filled) and at every meet containing it (open). (b) Probe minus control by depth, five-seed means. (c) The registered prediction: masking gap against give-back at the meets. References Allal et al. (2025) L. B. Allal, A. Lozhkov, E. Bakouch, G. M. Blázquez, G. Penedo, L. Tunstall, A. Marafioti, H. Kydlíček, A. P. Lajarín, V. Srivastav, J. Lochner, C. Fahlgren, X. Nguyen, C. Fourrier, B. Burtenshaw, H. Larcher, H. Zhao, C. Zakka, M. Morlon, C. Raffel, L. von Werra, and T. Wolf SmolLM2: When Smol Goes Big – Data-Centric Training of a Small Language Model. External Links: 2502.02737, Link Cited by: §3. Bai et al. (2022) Y. Bai, S. Kadavath, S. Kundu, A. Askell, J. Kernion, A. Jones, A. Chen, A. Goldie, A. Mirhoseini, C. McKinnon, C. Chen, C. Olsson, C. Olah, D. Hernandez, D. Drain, D. Ganguli, D. Li, E. Tran-Johnson, E. Perez, J. Kerr, J. Mueller, J. Ladish, J. Landau, K. Ndousse, K. Lukosuite, L. Lovitt, M. Sellitto, N. Elhage, N. Schiefer, N. Mercado, N. DasSarma, R. Lasenby, R. Larson, S. Ringer, S. Johnston, S. Kravec, S. E. Showk, S. Fort, T. Lanham, T. Telleen-Lawton, T. Conerly, T. Henighan, T. Hume, S. R. Bowman, Z. Hatfield-Dodds, B. Mann, D. Amodei, N. Joseph, S. McCandlish, T. Brown, and J. Kaplan Constitutional AI: Harmlessness from AI Feedback. External Links: 2212.08073, Link Cited by: §1. Belrose et al. (2023) N. Belrose, D. Schneider-Joseph, S. Ravfogel, R. Cotterell, E. Raff, and S. Biderman LEACE: Perfect linear concept erasure in closed form. In Advances in Neural Information Processing Systems, Vol. 36. External Links: Link Cited by: §1. Bloomfield et al. (2026) D. Bloomfield, J. R. M. Black, O. Crook, N. Brandes, M. S. Hanke, T. V. Inglesby, A. Cicero, R. Pollack, T. Hernandez-Boussard, M. J. Imperiale, R. B. Altman, and J. Pannu Biological data governance in an age of AI. Science 391 (6785), p. 558–561. External Links: Document Cited by: §1. Carter and Butchello (2026) S. R. Carter and G. Butchello A Framework for Managed Access to Biological AI Tools. Paper Nuclear Threat Initiative (NTI), Washington, DC. Note: Accessed: 14 August 2026 External Links: Link Cited by: §1. Deeb and Roger (2025) A. Deeb and F. Roger Do Unlearning Methods Remove Information from Language Model Weights?. External Links: 2410.08827, Link Cited by: §1. Denning (1976) D. E. Denning A lattice model of secure information flow. Commun. ACM 19 (5), p. 236–243. External Links: ISSN 0001-0782, Link, Document Cited by: §1. Gao et al. (2020) L. Gao, S. Biderman, S. Black, L. Golding, T. Hoppe, C. Foster, J. Phang, H. He, A. Thite, N. Nabeshima, S. Presser, and C. Leahy The Pile: An 800GB Dataset of Diverse Text for Language Modeling. External Links: 2101.00027, Link Cited by: §3. Goguen and Meseguer (1982) J. A. Goguen and J. Meseguer Security Policies and Security Models. In 1982 IEEE Symposium on Security and Privacy, Vol. , p. 11–11. External Links: Document Cited by: §1. Graham and Denning (1972) G. S. Graham and P. J. Denning Protection: Principles and Practice. In Proceedings of the May 16–18, 1972, Spring Joint Computer Conference, AFIPS ’72 (Spring), New York, NY, USA, p. 417–429. External Links: Document Cited by: §1. Hendrycks et al. (2021) D. Hendrycks, C. Burns, S. Basart, A. Zou, M. Mazeika, D. Song, and J. Steinhardt Measuring Massive Multitask Language Understanding. In The Ninth International Conference on Learning Representations, External Links: Link Cited by: §3. Hewitt and Liang (2019) J. Hewitt and P. Liang Designing and Interpreting Probes with Control Tasks. In Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), K. Inui, J. Jiang, V. Ng, and X. Wan (Eds.), Hong Kong, China, p. 2733–2743. External Links: Link, Document Cited by: §3. Kaddour (2023) J. Kaddour The MiniPile Challenge for Data-Efficient Language Models. External Links: 2304.08442, Link Cited by: §3. Kwa et al. (2025) T. Kwa, B. West, J. Becker, A. Deng, K. Garcia, M. Hasin, S. Jawhar, M. Kinniment, N. Rush, S. V. Arx, R. Bloom, T. Broadley, H. Du, B. Goodrich, N. Jurkovic, L. H. Miles, S. Nix, T. Lin, C. Painter, N. Parikh, D. Rein, L. J. K. Sato, H. Wijk, D. M. Ziegler, E. Barnes, and L. Chan Measuring AI Ability to Complete Long Software Tasks. In Advances in Neural Information Processing Systems, Vol. 38. External Links: Link Cited by: §1. Lampson (1974) B. W. Lampson Protection. ACM SIGOPS Operating Systems Review 8 (1), p. 18–24. Note: Originally presented at the 5th Princeton Conference on Information Sciences and Systems, Princeton University, Mar. 1971, p. 437–443 External Links: Document Cited by: §1. Li et al. (2024) N. Li, A. Pan, A. Gopal, S. Yue, D. Berrios, A. Gatti, J. D. Li, A. Dombrowski, S. Goel, L. Phan, G. Mukobi, N. Helm-Burger, R. Lababidi, L. Justen, A. B. Liu, M. Chen, I. Barrass, O. Zhang, X. Zhu, R. Tamirisa, B. Bharathi, A. Khoja, Z. Zhao, A. Herbert-Voss, C. B. Breuer, S. Marks, O. Patel, A. Zou, M. Mazeika, Z. Wang, P. Oswal, W. Lin, A. A. Hunt, J. Tienken-Harder, K. Y. Shih, K. Talley, J. Guan, R. Kaplan, I. Steneker, D. Campbell, B. Jokubaitis, A. Levinson, J. Wang, W. Qian, K. K. Karmakar, S. Basart, S. Fitz, M. Levine, P. Kumaraguru, U. Tupakula, V. Varadharajan, R. Wang, Y. Shoshitaishvili, J. Ba, K. M. Esvelt, A. Wang, and D. Hendrycks The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearning. In Proceedings of the 41st International Conference on Machine Learning, Proceedings of Machine Learning Research, Vol. 235, p. 28525–28550. Cited by: §1, §1, §3. Mantel (2002) H. Mantel On the composition of secure systems. In Proceedings 2002 IEEE Symposium on Security and Privacy, Vol. , p. 88–101. External Links: Document Cited by: §1. McCullough (1988) D. McCullough Noninterference and the composability of security properties. In Proceedings. 1988 IEEE Symposium on Security and Privacy, Vol. , p. 177–186. External Links: Document Cited by: §1. McLean (1994) J. McLean A general theory of composition for trace sets closed under selective interleaving functions. In Proceedings of 1994 IEEE Computer Society Symposium on Research in Security and Privacy, Vol. , p. 79–93. External Links: Document Cited by: §1. Meng et al. (2022) K. Meng, D. Bau, A. Andonian, and Y. Belinkov Locating and Editing Factual Associations in GPT. In Advances in Neural Information Processing Systems, Vol. 35, p. 17359–17372. Cited by: §1. Molchanov et al. (2019) P. Molchanov, A. Mallya, S. Tyree, I. Frosio, and J. Kautz Importance Estimation for Neural Network Pruning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), p. 11264–11272. Cited by: §B.2, §2.4. Nanda (2023) N. Nanda Attribution Patching: Activation Patching at Industrial Scale. Note: https://w.neelnanda.io/mechanistic-interpretability/attribution-patchingAccessed 2026-08-07 Cited by: §B.2, §2.4. Ouyang et al. (2022) L. Ouyang, J. Wu, X. Jiang, D. Almeida, C. L. Wainwright, P. Mishkin, C. Zhang, S. Agarwal, K. Slama, A. Ray, J. Schulman, J. Hilton, F. Kelton, L. Miller, M. Simens, A. Askell, P. Welinder, P. Christiano, J. Leike, and R. Lowe Training language models to follow instructions with human feedback. In Advances in Neural Information Processing Systems, Vol. 35, p. 27730–27744. Cited by: §1. Phuong et al. (2024) M. Phuong, M. Aitchison, E. Catt, S. Cogan, A. Kaskasoli, V. Krakovna, D. Lindner, M. Rahtz, Y. Assael, S. Hodkinson, H. Howard, T. Lieberum, R. Kumar, M. A. Raad, A. Webson, L. Ho, S. Lin, S. Farquhar, M. Hutter, G. Deletang, A. Ruoss, S. El-Sayed, S. Brown, A. Dragan, R. Shah, A. Dafoe, and T. Shevlane Evaluating Frontier Models for Dangerous Capabilities. External Links: 2403.13793, Link Cited by: §1. Qwen Team (2025) Qwen Team Qwen3 Technical Report. External Links: 2505.09388, Link Cited by: §3. Rafailov et al. (2023) R. Rafailov, A. Sharma, E. Mitchell, S. Ermon, C. D. Manning, and C. Finn Direct Preference Optimization: Your Language Model is Secretly a Reward Model. In Advances in Neural Information Processing Systems, Vol. 36, p. 53728–53741. Cited by: §1. Rauba et al. (2026) P. Rauba, D. Seputis, P. Vanagas, and M. van der Schaar No More, No Less: Least-Privilege Language Models. In Proceedings of the 43rd International Conference on Machine Learning, Proceedings of Machine Learning Research, Vol. 306. Cited by: §B.1, §B.1, §B.1, §B.1, Figure 2, Figure 2, Figure 2, §2.3, §2.3, §2.3, §3. Rauba and van der Schaar (2026) P. Rauba and M. van der Schaar Deep Hierarchical Learning with Nested Subspace Networks for Large Language Models. In The Fourteenth International Conference on Learning Representations, External Links: Link Cited by: §B.1, §B.1, §2.3. Roland et al. (2026) E. Roland, M. Cubuktepe, E. Martinez, S. Servaes, K. Pepper, M. Vaiana, D. S. de Lucena, J. Rosenblatt, A. Foote, C. Anil, and A. Cloud Modular Pretraining Enables Access Control. External Links: 2607.08077, Link Cited by: §1. Shevlane et al. (2023) T. Shevlane, S. Farquhar, B. Garfinkel, M. Phuong, J. Whittlestone, J. Leung, D. Kokotajlo, N. Marchal, M. Anderljung, N. Kolt, L. Ho, D. Siddarth, S. Avin, W. Hawkins, B. Kim, I. Gabriel, V. Bolina, J. Clark, Y. Bengio, P. Christiano, and A. Dafoe Model evaluation for extreme risks. External Links: 2305.15324, Link Cited by: §1. Shrikumar et al. (2017) A. Shrikumar, P. Greenside, and A. Kundaje Learning Important Features Through Propagating Activation Differences. In Proceedings of the 34th International Conference on Machine Learning, Proceedings of Machine Learning Research, Vol. 70, p. 3145–3153. Cited by: §B.2, §2.4. Syed et al. (2024) A. Syed, C. Rager, and A. Conmy Attribution Patching Outperforms Automated Circuit Discovery. In Proceedings of the 7th BlackboxNLP Workshop: Analyzing and Interpreting Neural Networks for NLP, p. 407–416. External Links: Document Cited by: §B.2. Wei et al. (2024) B. Wei, K. Huang, Y. Huang, T. Xie, X. Qi, M. Xia, P. Mittal, M. Wang, and P. Henderson Assessing the Brittleness of Safety Alignment via Pruning and Low-Rank Modifications. In Proceedings of the 41st International Conference on Machine Learning, Proceedings of Machine Learning Research, Vol. 235, p. 52588–52610. Cited by: §B.2. Łucki et al. (2025) J. Łucki, B. Wei, Y. Huang, P. Henderson, F. Tramèr, and J. Rando An Adversarial Perspective on Machine Unlearning for AI Safety. Transactions on Machine Learning Research. External Links: ISSN 2835-8856, Link Cited by: §1. Appendix A Proofs The lattice structure of §2.1 and the accompanying statements for §2.2 are collected here, with their proofs. Theorem A.1 (Lattice structure). (,⪯)(C, ) is a finite distributive lattice, bounded by c⊥c and c⊤c , with (c∧c′)(κ)=minc(κ),c′(κ),(c∨c′)(κ)=maxc(κ),c′(κ).(c c )(κ)= \c(κ),c (κ)\, (c c )(κ)= \c(κ),c (κ)\. (7) Proof. Each LκL_κ is a finite chain, hence a bounded lattice with min and max as meet and join, and every chain is distributive (min(x,max(y,z))=max(min(x,y),min(x,z)) (x, (y,z))= ( (x,y), (x,z)) holds in any totally ordered set). C is the direct product of the LκL_κ, and both the lattice identities and distributivity are preserved componentwise under direct products. Bounds are c⊥c and c⊤c . ∎ Proposition A.2 (Hierarchy). If the model’s own readout (the map carrying hc(x)h_c(x) to the emitted answer) belongs to P, then δrep(c,D)⇒δbeh(c,D) Sep^rep_δ(c,D) Sep^beh_δ(c,D) for every c and D. The converse fails: behavioural separation at tolerance zero is consistent with probe accuracy near the full-privilege value. Proof. Let p0∈Pp_0∈ P be the readout. Then accπc(x)=accp0(hc(x))acc_ _c(x)=acc_p_0(h_c(x)) by definition of the readout, so accD(c)≤supp∈P[accp(hc(x))]≤αD+δacc_D(c)≤ _p∈ PE [acc_p(h_c(x)) ]≤ _D+δ. For the failure of the converse, take any configuration under which the representation still encodes the answer along some direction while the readout no longer projects onto it: probe accuracy stays near the full-privilege value while behavioural accuracy sits at chance. Such configurations exist whenever the readout is not the only functional in P separating the classes, which is the generic case. ∎ Theorem A.3 (Capacity is a lattice embedding). For the nested-factor instantiation, write κ(r)=colspanBκ[:,:r]W_κ(r)=colspanB_κ[:,:r] for the subspace coordinate κ can write into at rank r, and Cap(c)=(κ(c(κ)))κ∈Cap(c)= (W_κ(c(κ)) )_κ , ordered by componentwise inclusion, with componentwise intersection ⊓ and componentwise sum ⊔ . Then for all c,c′∈c,c : (a) c⪯c′⟹Cap(c)⊑Cap(c′)c c (c) (c ); (b) Cap(c∧c′)=Cap(c)⊓Cap(c′)Cap(c c )=Cap(c) (c ); (c) Cap(c∨c′)=Cap(c)⊔Cap(c′)Cap(c c )=Cap(c) (c ). If every BκB_κ has full column rank, CapCap is injective, hence a lattice isomorphism onto its image. Proof. Bκ[:,:r]B_κ[:,:r] is a column prefix of Bκ[:,:r′]B_κ[:,:r ] for r≤r′r≤ r , so κ(r)⊆κ(r′)W_κ(r) _κ(r ): each κ(r)r\W_κ(r)\_r is a chain, which gives (a). Two subspaces on a chain are comparable, so their intersection is the smaller of the two, κ(min(r,r′))=κ((c∧c′)(κ))W_κ( (r,r ))=W_κ ((c c )(κ) ), and their sum is the larger, κ(max(r,r′))=κ((c∨c′)(κ))W_κ( (r,r ))=W_κ ((c c )(κ) ); both identities hold at every coordinate, giving (b) and (c). For injectivity, full column rank makes dimκ(r)=r _κ(r)=r, so CapCap determines c. Had the factors not been nested (rank reduction selected an arbitrary subset of components, as SVD truncation of two separately compressed models would) the two spaces would generally be incomparable and their intersection a proper subspace of both, so exactness would fail. ∎ Assumption A.4 (Monotone elicitation (MEA)). For the task sets concerned, c⪯c′⟹accD(c)≤accD(c′).c c \ \ acc_D(c) _D(c ). Theorem A.5 (Security composes, under MEA). Under Assumption A.4 on D, accD(c∧c′)≤minaccD(c),accD(c′)acc_D(c c )≤ \acc_D(c),\,acc_D(c )\; consequently εbeh(c,D) Sep^beh_ (c,D) implies εbeh(c∧c′,D) Sep^beh_ (c c ,D) for every c′c , and likewise for δrep Sep^rep_δ when P is closed under restriction to the meet’s write-spaces. Proof. c∧c′⪯c c c and c∧c′⪯c′c c c by definition of the meet, so Assumption A.4 applied twice gives the inequality; then accD(c∧c′)≤accD(c)≤αD+εacc_D(c c ) _D(c)≤ _D+ . For the representational analogue, Theorem A.3(b) confines every write of the meet to the intersected write-spaces; if P is closed under the induced restriction of its input, the supremum over P at the meet is at most the supremum at c, and the same two lines apply. ∎ Theorem A.6 (Coalitions realise the join). Let a coalition T hold φ(v)v∈T\ (v)\_v∈ T, with each member being allowed to select another member and return its answer. Then the coalition attains accD≥maxv∈TaccD(φ(v))acc_D≥ _v∈ Tacc_D( (v)) for every domain D, and ⋁v∈Tφ(v) _v∈ T (v) is the least configuration dominating every member; a coalition guarantee therefore requires εbeh(⋁v∈Tφ(v),D) Sep^beh_ ( _v∈ T (v),\,D ), which does not follow from εbeh(φ(v),D) Sep^beh_ ( (v),D) holding for each v separately. Proof. Any query one member can answer, the coalition answers by routing it to that member and sharing the output, which gives the lower bound. That ⋁v∈Tφ(v) _v∈ T (v) is the least upper bound is Theorem A.1. Since separation is downward closed (Theorem A.5) and not upward closed, its holding at each φ(v) (v) constrains nothing at a point above them all. ∎ Theorem A.7 (No compositional bound on collateral). Under Assumption A.4 on R, joins preserve τ Ret_τ and meets obey γR(c∧c′)≥maxγR(c),γR(c′) _R(c c )≥ \ _R(c),\, _R(c )\; and no informative converse exists — any f satisfying γR(c∧c′)≤f(γR(c),γR(c′)) _R(c c )≤ f ( _R(c), _R(c ) ) across all gated models has f(0,0)=1f(0,0)=1. Proof. c⪯c∨c′c c c , so Assumption A.4 gives accR(c∨c′)≥accR(c)≥accR(c⊤)−τacc_R(c c ) _R(c) _R(c )-τ: joins preserve τ Ret_τ, and the meet inequality restates Theorem A.5’s inequality on R. For the absence of an informative converse, let R be scored by the sign of a margin m, let every item carry margin m0>0m_0>0 at c⊤c , and let c,c′c,c each gate one of two distinct coordinates whose effects on the margin are −θ-θ, with m0/2<θ<m0m_0/2<θ<m_0. Each configuration alone leaves every margin at m0−θ>0m_0-θ>0: all items correct, γR(c)=γR(c′)=0 _R(c)= _R(c )=0. Their meet gates both coordinates; with the effects exactly additive, every margin becomes m0−2θ<0m_0-2θ<0, so γR(c∧c′)=1 _R(c c )=1. Any admissible f therefore has f(0,0)≥1f(0,0)≥ 1, and since collateral never exceeds one, f(0,0)=1f(0,0)=1: the bound is vacuous precisely where it would be informative. ∎ In summary, the direction each predicate faces in the lattice decides what survives composition: Predicate Requirement Survives ∧ (accumulation) Survives ∨ (coalition) εbeh Sep^beh_ security yes no δrep Sep^rep_δ security yes, for restriction-closed P no τ Ret_τ utility no bound exists yes Appendix B Substrate, instrument, and extended results This appendix collects what the main text defers: the instantiation and adaptation detail of §2.3, the substrate and instrument checks, the objective’s constants, a diagnostic of cyber’s lower leverage, the access matrix, and the SmolLM2 replication. B.1 Instantiation and substrate validation What the mechanism supplies. Monotone reachability (2) is the nested subspace property [Rauba and van der Schaar, 2026]. After nested adaptation, degradation is gradual where naive truncation collapses (this makes searching C feasible at all) and it is differential: hard instances lose first, which is what lets a configuration below c⊤c separate one domain yet retain another [Rauba et al., 2026]. Subject-specific sensitivity concentrates in a few coordinates [Rauba et al., 2026], making the admissible set of Definition 2.2 plausibly non-empty. And tensor shapes are preserved, so the interface fits a pretrained transformer unchanged [Rauba and van der Schaar, 2026]. The adaptation recipe. Each step forwards the batch twice, once at the anchor c⊤c and once at the sampled variant, combining the two losses under learned per-level uncertainty weights [Rauba et al., 2026]. A mixed variant is weighted by the mean of its levels’ uncertainties, and global and mixed draws alternate with equal probability (Fig. 2). Relation to prior work. The nested subspace networks of Rauba and van der Schaar [2026] set one global rank and name the layer-specific case as open; in Rauba et al. [2026], per-coordinate configurations appear only as a search space. The lattice of §2.1 is that vector-valued generalisation, with its algebra — meets, joins, composition laws. Conditioning the allocation φ on request-time signals would recover the per-request allocator of Rauba et al. [2026]; the experiments here use static per-principal profiles. The substrate checks. Substrate well-formedness and off-diagonal usability parallel the diagnostics of Rauba et al. [2026]; they are confirmatory preconditions rather than contributions. Held-out perplexity is stable across the full rank ladder where naive SVD truncation collapses (Fig. 8); degradation against the number of gated coordinates (Fig. 9) is the measured form of the mixed recipe’s claim — that adaptation trains the states profile synthesis selects from. Figure 8: Substrate well-formedness. Held-out perplexity against retained global rank on Qwen3-1.7B: the adapted nested substrate, naive SVD truncation, and the dense reference. Split A (screening, before any profile exists). Figure 9: Off-diagonal usability. Degradation on Qwen3-1.7B against the number of gated coordinates k, global-only against mixed adaptation, levels sampled as during adaptation: (a) perplexity ratio against the 1.101.10 budget; (b) adjacent-MMLU drop against τ. Means over 12 paired draws, ribbons 10th–90th percentiles. Split A (precondition check). B.2 Objective and attribution details The objective’s terms. Suppression is rewarded at weight λ, clamped at αD _D, so the term’s optimum is accuracy at chance. Retention is measured on R¯u R_u, the retain set pooled into groups M large enough for the per-task tolerance to be measurable (τ=0.01τ=0.01 is half an item on a fifty-item subject); the hinge (the collateral γRu _R_u of (3) made concrete) charges drops beyond τ at a rate ρ no suppression can repay. Φ(c) (c) applies the linearisation of (6) to held-out next-token loss rather than the margin, predicting each gated coordinate’s fluency cost; it sums these predictions over supp(c)supp(c), negatives clipped, at exchange rate ν. Constants. As recorded in the configuration of the reported run: λ=2λ=2 (lambda_suppress), ρ=100ρ=100 (penalty_scale), ν=1ν=1 (fluency_price_weight), τ=0.01τ=0.01 (eps_preserve_drop), and αD=0.25 _D=0.25 for four-option items. The fluency gate, max_ppl_ratio =1.10=1.10, sits outside (5) as a hard constraint on candidates and is what makes most configurations ineligible regardless of score. Φ(c) (c) is recorded as the sum over supp(c)supp(c) of the clipped first-order singleton Δ , so ν weights a summed Δ , not a perplexity ratio. The search’s winner is the lower quartile of B=1000B=1000 bootstrap resamples of the objective, not the argmax. Attribution’s lineage and use. Equation (6) is gradient-times-activation [Shrikumar et al., 2017] at the factorisation bottleneck — equivalently the first-order Taylor criterion for structure removal [Molchanov et al., 2019], or attribution patching with a zero baseline [Nanda, 2023, Syed et al., 2024]. The prediction picks the levels the measured sweep evaluates and a fixed rescue quota of coordinates by predicted selectivity — a set-difference contrast against the retained tasks, after Wei et al. [2024]. Concretely, the search takes 2424 coordinates at four ranks each with a rescue quota of six, sweep fractions 0.75,0.5,0.375,0.25,0.125,0.06250.75,0.5,0.375,0.25,0.125,0.0625, and carries 4040 finalists into gate verification; the shortlist is not a parameter of this stage, being E2’s frozen twelve-coordinate output per strategy, which the search consumes as given. Re-run against held-out next-token loss, the same pass yields the per-coordinate prices Φ sums in (5). Instrument validation. The gating identity is exact to fp32, and first-order predictions order measured drops (Spearman ρ=0.61ρ=0.61, sign agreement 0.920.92) while increasingly underestimating them with intervention size — an ordering signal, never effect sizes (Fig. 10a). What steers the search is selectivity, σD(κ)=s~D(κ)−maxD′≠Ds~D′(κ) _D(κ)= s_D(κ)- _D ≠ D s_D (κ): the predicted margin damage to D, normalised by D’s mean decision margin, minus the worst damage to any other measured group. Raw importance ranks generically load-bearing coordinates first, whose gating is a lobotomy; σD(κ)>0 _D(κ)>0 marks κ as disproportionately D’s. The resulting maps are domain-structured (Fig. 11), though the structure is relative, not absolute: single-coordinate margin drops are strongly coupled between WMDP domains and MMLU subjects alike. The shortlist ablation. The four arms of Fig. 10b price each ingredient of the search, matched in candidate pool, fluency gate, and finalist count: combined (the default) — measured sweep plus attribution’s rescue quota; measured-only — sweep order alone; random — a random shortlist; anti — the least selective coordinates by attribution, pre-registered to fail. Attribution’s rescue quota buys nothing: measured-only and combined select the identical three-coordinate chem gate (0.528→0.3800.528→ 0.380 at 1.087×1.087×), the quota costing 15%15\% more evaluations for the same selection; a bio arm agrees. The controls calibrate the claim rather than flatter it: a random shortlist reaches 71%71\% of combined’s suppression, but only at 2.8×2.8× the budget; anti, built from the least selective coordinates and pre-registered to fail, still reaches 7.47.4 p; and random’s selection even scores higher on the objective, buying retention instead of suppression. What buys the search is measuring coordinates at all; attribution buys a better configuration per evaluation, not a reachable one; and chem’s suppressible directions are common enough that even an adversarial shortlist reaches them, given budget. Figure 10: Instrument validation and shortlist ablation. (a) First-order predicted against measured margin drop on the 24-cell validation subset: the instrument orders interventions, it is not calibrated for effect size. (b) Running-best objective against evaluations for four search arms matched in candidate pool, fluency gate, and finalist count. Combined and measured-only select the identical chem gate, the rescue quota costing 15%15\% more evaluations; random needs 2.8×2.8× the budget; anti, pre-registered to fail, still reaches 7.47.4 p. Two earlier arm designs (a starved candidate pool; a looser 1.251.25 screen) are superseded by this matched comparison. Split A throughout: search trajectories never read B. Figure 11: Localisation maps. Z-scored selectivity σD(κ) _D(κ) at active rank 256 over the (block × projection) grid; circles mark cells surviving Benjamini–Hochberg correction at q=0.05q=0.05 over all 252 cells. Split A: the instrument that steers the search never reads B. B.3 Why is cyber harder to suppress? The control surface. The selected cyber profile removes less capability than its bio and chem counterparts, but the search alone cannot say why. We therefore measure the control surface before selection: all 28×3=8428× 3=84 MLP coordinates, each gated alone at every one of the nine non-full ranks, for 756 singleton interventions. Every intervention is evaluated on the same split-A WMDP items and 256 MiniPile blocks; no target-specific configuration is selected. The response is the drop in mean answer margin divided by that domain’s mean absolute margin on correctly answered full-privilege items. Split A is diagnostic here, not a new confirmation: this question was posed after the split-B profile result was known. The registered contrast. At the registered 1.10×1.10× fluency cap, 586 interventions are eligible. The 90th-percentile normalised margin drop is 0.1970.197 for bio, 0.2420.242 for chem, and 0.0790.079 for cyber (Fig. 12a). The registered contrast, Q.90cyber−(Q.90bio+Q.90chem)/2Q_.90^cyber-(Q_.90^bio+Q_.90^chem)/2, is −0.141-0.141, with a 95% transformer-block bootstrap interval [−0.163,−0.107][-0.163,-0.107]. Thus a strong cyber singleton has only 36%36\% of the leverage of the bio–chem average. The result is not confined to the upper tail: pairing the three domain responses for each identical eligible intervention gives a mean contrast of −0.054-0.054, 95% CI [−0.068,−0.039][-0.068,-0.039]. Nor does cyber catch up when fluency is relaxed: its 90th percentile remains about 3535–40%40\% of the bio–chem average from the 1.02×1.02× through 4.00×4.00× cumulative caps; the disjoint-band comparison is negative in every well-populated band (Fig. 12b). Figure 12: Cyber has lower singleton leverage across the trained rank ladder. Each observation gates one MLP coordinate at one rank, all others at full rank; leverage is the normalised margin drop defined in the text. (a) 90th-percentile leverage under a cumulative perplexity cap — a strong, not single-best, intervention — with the 1.10×1.10× gate dashed. (b) The same interventions in disjoint perplexity bands: cyber leverage minus the bio–chem mean, negative where cyber moves less; the one positive band holds 14 destructive interventions and alters neither registered comparison. Split A diagnostic; 756 interventions, uncertainty clustered by transformer block. A measurement concern. The full-rank model answers only 43.2%43.2\% of cyber questions correctly, against 67.6%67.6\% for bio and 53.4%53.4\% for chem. An intervention cannot flip an answer that was already wrong, so cyber may appear harder to suppress simply because fewer cyber items are known at baseline. We therefore repeat the comparison using only baseline-correct questions. To keep the domains comparable, we retain 87 items from each, answer letters balanced and positions matched in each domain’s baseline-margin ordering. For every in-gate singleton, we ask how much of the matched items’ original decision margin it removes and how often it changes a known answer to a wrong one (Fig. 13). Figure 13: After matching baseline-known questions, cyber responds like bio; chemistry drives the remaining gap. Bars: 90th percentile over the 586 in-gate singletons on the matched panel. (a) Margin loss as a fraction of the matched domain’s baseline margin; (b) the fraction of baseline-correct answers flipped. Error bars: 95% intervals from a crossed bootstrap over transformer blocks and matched item triplets; insets: pairwise cyber contrasts with 95% intervals. Split A post-hoc diagnostic. The matched result. The interpretation changes. On decision-margin loss, cyber is −0.037-0.037 below bio (95% CI [−0.099,0.039][-0.099,0.039]), and on known-answer flips it is +0.023+0.023 above bio (95% CI [−0.034,0.069][-0.034,0.069]): neither difference is distinguishable from zero. Cyber remains below chem on both margin loss (−0.332-0.332, 95% CI [−0.455,−0.202][-0.455,-0.202]) and flips (−0.098-0.098, 95% CI [−0.161,−0.046][-0.161,-0.046]). Thus lower baseline cyber accuracy explains much of the original cyber–bio gap, but not the cyber–chem gap. The narrower claim. Together, the raw and matched analyses establish a narrower claim than cyber being intrinsically inseparable. The present MLP-prefix interface has less leverage over cyber than over the bio–chem average, but this is not a uniform cyber deficit: baseline-known cyber and bio questions respond similarly, while chemistry is unusually susceptible. The singleton grid still makes a pure search-failure explanation unlikely, while leaving four mechanistic possibilities, each with a separable prediction. Distributed support predicts a lower concentration of positive singleton effects and a gradual catch-up under measured top-k accumulation. Rank-order misalignment predicts cyber sensitivity in the retained low-index factor bands when non-prefix bands are ablated at matched NLL. Computation outside the MLP surface predicts disproportionate cyber leverage from attention-head or residual-stream interventions. Overlap with general capability predicts that cyber suppression lies on a worse code/technical-utility Pareto frontier. The registered WMDP–MMLU correlation test does not support the broad version of the last account: after removing each intervention’s MiniPile Δ , cyber’s mean coupling breadth differs from the bio–chem average by −0.032-0.032, 95% CI [−0.129,0.053][-0.129,0.053]. A code-specific retain panel remains the direct test. Until the band, attention, and accumulation interventions are run, the measured conclusion is lower interface leverage, not a unique claim about where cyber knowledge resides. Figure 14: Measured WMDP–MMLU coupling at rank 256. Pearson correlations of margin drops across 84 single-coordinate interventions, three WMDP domains against seven MMLU subjects, before (left) and after (middle) removing each intervention’s MiniPile Δ ; right, the mean adjusted correlation with 95% block-bootstrap intervals. Coupling is broad for all three domains; the registered cyber-breadth contrast is indistinguishable from zero. Split A diagnostic. B.4 The access matrix Table 1 is the sublattice of Fig. 3 as a deployment would consume it: each node a principal against the full metric panel, on both splits. Table 1: The deployment’s access matrix. Each lattice node as a principal against the metric panel: per-domain suppression, collateral on both macros, fluency, and cost as |supp(c)||supp(c)| with total rank withdrawn. Measured cells are split A / split B, in points, against that split’s own full privilege (headroom 43.4/40.143.4/40.1 bio, 27.8/22.827.8/22.8 chem, 19.2/16.619.2/16.6 p cyber); fluency and cost are split-independent. Rows ascend in privilege; the three omitted joins equal c⊤c exactly. The single-profile rows are the deployed profiles’ metric panel. principal bio chem cyber adj. dist. ppl dials/rank cb∧cch∧ccyc_b c_ch c_cy 8.6/6.1 6.1/9.0 2.3/0.3 6.4/4.1 5.1/3.7 1.37× 11 / 12390 cb∧cchc_b c_ch 7.7/6.8 9.2/6.9 1.7/1.5 2.9/2.9 3.1/6.0 1.18× 7 / 7782 cb∧ccyc_b c_cy 8.3/5.0 9.2/9.4 4.5/1.8 3.5/1.7 3.1/1.4 1.22× 8 / 8704 cch∧ccyc_ch c_cy 5.0/3.5 4.9/6.9 1.4/1.4 2.9/1.7 4.7/1.8 1.27× 9 / 10342 cbc_b 7.5/3.8 6.7/4.5 0.4/0.2 -2.9/1.7 0.4/2.9 1.09× 4 / 4096 cchc_ch 5.2/3.9 16.0/5.3 -0.1/0.9 -1.7/2.3 0.2/2.9 1.10× 5 / 5734 ccyc_cy 1.6/3.8 7.4/4.9 3.4/-1.0 -2.3/0.6 -0.4/-1.9 1.12× 4 / 4608 cb∨cchc_b c_ch 4.9/3.0 5.5/1.2 -1.4/0.8 -1.7/0.6 0.8/4.1 1.02× 2 / 2048 c⊤c 0.0/0.0 0.0/0.0 0.0/0.0 0.0/0.0 0.0/0.0 1.00× – B.5 The SmolLM2 generalisation Table 2: Cross-family replication. Each claim in both lineages, on both halves: x→yx→ y is split A → split B, and suppression is also given as a fraction of the domain’s headroom above chance — what the objective’s floor makes removable. Split A reproduces every previously registered value exactly, which is what licenses reading the split-B column beside it. Provenance differs by column: the Qwen3 suppression rows quote the granular search arms as previously registered, not the deployed atoms of Table 1 (bio 7.5→3.87.5→ 3.8, chem 16.0→5.316.0→ 5.3, cyber 3.4→−1.03.4→-1.0); the SmolLM2 rows are the pre-registered all-selected atoms of Fig. 15. Held-out reading costs every suppression claim roughly half its size in both lineages; chem inverts on SmolLM2; the chem++cyber weakening reverses on B and is withdrawn; utility non-composition is the only claim that grows on the held-out half, in both. ‡ : independently selected parents; a single joint search does reach in-gate meets. § @sectionsign: a property of the search, which never reads split B. ¶ @paragraphsign: at 1.20×1.20× (Qwen3) and 1.30×1.30× (SmolLM2); perplexity ratios are split-independent throughout. Claim Qwen3-1.7B SmolLM2-1.7B bio suppressible −11.79→−8.01-11.79→-8.01, 27→20%27→ 20\% −10.06→−6.12-10.06→-6.12, 39→24%39→ 24\% ✓ chem suppressible −19.02→−6.94-19.02→-6.94, 68→31%68→ 31\% −7.36→+4.08-7.36→+4.08, inverts ∼ cyber suppressible¶ −5.34→−1.21-5.34→-1.21, 28→7%28→ 7\% −7.85→−2.52-7.85→-2.52, 68→26%68→ 26\% ✓ no in-gate cyber profile cheapest 1.120×1.120× cheapest >1.10×>1.10× ✓ frontier beats selected§ 12 of 13 arms 3 of 3 arms ✓ atoms/meets suppress 223→186223→ 186 of 270 44→2144→ 21 of 66 ✓ no in-gate meet‡ 0 of 24 runs 0 of 4 runs ✓ joins cheap, weak, in-gate yes 3 of 3, 1.031.03–1.10×1.10× ✓ triple strengthens bio −13.21-13.21, 8 → −15.38-15.38, 10 runs survives, 3 runs ✓ chem++cyber destroys chem 9 of 24 → reverses 4 of 4 n.s. → none — utility non-composition +6.84→+7.00+6.84→+7.00 distant +16.99→+17.12+16.99→+17.12 distant ✓ Figure 15: The measured sublattice (SmolLM2-1.7B). The all-selected run’s twelve nodes, drawn exactly as Fig. 3 and pinned to its 1616 p scale, so heights are directly comparable across lineages. chem’s atom bar runs below baseline on B: the gate raises chem accuracy in this lineage. The triple strengthens bio; joins are cheap, weak, and the only in-gate nodes (1.031.03–1.10×1.10×), the faded one equal to c⊤c exactly, its parents gating disjoint supports. The distant macro, not drawn, is Theorem A.7’s demonstration in this lineage: no atom moves it by more than 1.61.6 p, the triple loses 17.117.1 — individually harmless, jointly destructive. Figure 16: Profiles and composition (SmolLM2-1.7B). Figs. 4 and 4 redrawn on SmolLM2 from this appendix’s three search arms and four lattice runs. (a) The 120120 gate-verified finalists, 4040 per arm. SmolLM2 has no probe run, so the selected markers are read off the all-selected lattice run’s atoms, whose gated supports are identical to the arms’ pre-registered picks — the values of Table 2’s first three rows. Every arrow points down and to the right (less suppression, more collateral), only bio’s held-out interval clears zero, and collateral changes sign for bio and chem: gating helped the adjacent macros on the half that chose it. (b) All 3636 (meet, parent, domain) records from the four runs. The reversal reproduces at a quarter of Qwen3’s family size: sub-additive records fall from 25/3625/36 on A to 17/3617/36 on B, and the medians move −1.49→+2.82-1.49→+2.82 p (η 0.84→1.140.84→ 1.14). Design. Table 2’s lattice rows pool four SmolLM2 lattice runs. Because each search arm re-measured 4040 finalists on the reporting set, two parents per domain are available without any further search: the arm’s own pre-registered pick, and the strongest finalist that leaves both retention macros within 22 p. Crossing two levels of three factors in a 23−12^3-1 fractional factorial (bio ⊕ chem ⊕ cyber =0=0) covers all twelve distinct parent pairs in four runs, of which the all-selected run is one, so three additional runs suffice. Each run emits twelve nodes (three atoms, three pairwise meets, the triple, three joins, and the triple join) in about seven minutes. Parents. The all-selected run’s three atoms are the nodes cbc_b, cchc_ch and ccyc_cy of Fig. 15. The frontier parents, which no figure draws, are bio −12.42-12.42 p at 1.3831×1.3831×, chem −9.82-9.82 at 1.22251.2225 and cyber −8.96-8.96 at 1.27721.2772. A frontier parent is selected on raw suppression rather than on the pre-registered bootstrapped lower quartile, so it is less robust by construction (stable scores −2.996/−1.942/−1.407-2.996/-1.942/-1.407 against −1.686/−0.166/−0.104-1.686/-0.166/-0.104); each result records this per domain in profile_provenance.post_hoc_frontier_pick, and the all-selected run carries no such asterisk and is the one quoted in the main text. The profile-reproduction guard was exact on all four runs (worst deviation 0.00000.0000 p of a 0.050.05 tolerance, over 3636 checks), so every parent transferred into the lattice without drift. Corrected verdict over the pooled family: composition, 3636 tests, BH keeps one — the triple strengthening bio (−6.92-6.92 p, p=10−4p=10^-4); suppression, 8484 tests deduplicated to 6666, BH keeps 4444. The chem++cyber weakening of chem appears at +4.29+4.29, +4.29+4.29, +5.52+5.52 and +9.20+9.20 p across the four runs. Four-of-four agreement in sign is not itself a test at this family size (a sign test alone gives p=0.125p=0.125), which is why the main text reports the row as consistent and unresolved.