Capability-Gated Language Models: Security Composes, Utility Does Not

arXiv:2609.00445v1 [cs.CR] 31 Aug 2026

Capability-Gated Language Models: Security Composes, Utility Does Not

Patrikas Vanagas BPTI Vilnius, Lithuania

Augustas Mačijauskas Independent Researcher Vilnius, Lithuania

Laurynas Lopata askEarth AG Zürich, Switzerland

pv.unwired170@passmail.net

august.macijauskas@gmail.com

lopatalaurynas@gmail.com

Abstract Deployed language model safeguards (safety fine-tuning, filtering, unlearning) vary by principal only outside the model weights: filters are reconfigured, tiers are multiplied, and artefacts are reissued; inside one set of weights every request meets the same model configuration. This motivates us to define capability-gated deployment: per-principal access control inside one set of weights, whose configurations form a lattice — meets accumulate a principal’s restrictions and joins pool a coalition’s reach. We instantiate it by sparse rank gating over an existing nested-factorisation mechanism, guide profile search with one-pass attribution, and read every result once from a pre-registered held-out split. Security composes: provably at meets under a monotone-elicitation assumption we falsify pointwise. In two lineages the median held-out meet deepens suppression; the one effect surviving correction strengthens it. Utility does not: individually harmless profiles can compose to retention and fluency damage, and no compositional bound exists.

1

Introduction

A deployed language model is one endpoint and one configuration: a capability withheld from an anonymous user is withheld from a vetted defender in the same deployment. Protection theory has held since the 1970s that authority should instead be indexed to a principal, so that a right can be granted, narrowed, or revoked for one subject without altering it for every other [Lampson, 1974, Graham and Denning, 1972]. The mismatch is newly consequential for language models: frontier capability is rising on a steep, well-characterised trend [Kwa et al., 2025], dangerous-capability evaluation has become a precondition of release [Shevlane et al., 2023, Phuong et al., 2024], and the domains at issue – biology, chemistry, offensive cybersecurity [Li et al., 2024] – are exactly those in which different principals warrant different capability. The safeguards that ship are global by construction: post-training alignment shapes one output distribution for every request thereafter [Ouyang et al., 2022, Bai et al., 2022, Rafailov et al., 2023]; unlearning and concept erasure edit the weights, but the edited weights are the single artefact every user receives [Li et al., 2024, Belrose et al., 2023, Meng et al., 2022]; and classifiers mediate every request against a policy beside the weights – reconfigurable per tenant, but only over what the weights still emit. Per-principal variation is thus bought outside any one set of weights – reconfigured filters, tiered and identity-verified access, restricted releases, managed-access frameworks [Carter and Butchello, 2026, Bloomfield et al., 2026] – at the granularity of whole accounts and whole models: each distinct authority is a distinct filter policy over intact capability, or a distinct artefact to train, evaluate, and maintain [Roland et al., 2026]. The caveat is known – filtering leaves the underlying computation reachable, and unlearning is repeatedly found to suppress rather than erase, the knowledge recoverable by fine-tuning or probing [Łucki et al., 2025, Deeb and Roger, 2025]: accuracy at chance is evidence about behaviour, not about what remains reachable. Preprint.

θ0

weights θ + interface

adaptation (once)

every c a usable model

(K, {Lκ }, T )

c⊤ = cbio ∨ ccyber

profile search over C

reached by coalition of both

one φ(u) per principal

ccyber

profiles installed at the gateway

internal cleared

Serving: identity binds profile; weights never change πθ, c⊤ one set of weights θ

gateway u 7→ φ(u)

Tφ(u) in forward pass

public

πθ, cbio

■ privilege / enforcement

■ allocation

cbio ∧ ccyber

one principal, both suppressed

πθ, cbio∧ccyber c⊥ minimum capability

φ(u): one bar per coordinate, height = level ■ model

cbio capability

pretrained

■ data

Figure 1: Capability-gated deployment. Left (a): adaptation is paid once and yields a single set of weights with the interface of Definition 2.1; a search over C then yields one profile per principal, which the gateway binds to identity and the enforcer applies inside the forward pass. Right (b): profiles are points of a lattice: composing two descends to their meet (one principal, both restrictions); pooling two principals’ outputs ascends to their join (a coalition’s reach). Utility constraints in (3) bind at meets, security constraints at joins. What is missing is thus not the will to differentiate but a per-principal mechanism inside one set of weights and an algebra for it, since authority is useful because it composes: a principal under two restrictions holds their conjunction, and principals pooling outputs command their union. The shape of that algebra is classical – Denning’s lattice model combines security requirements by greatest lower bound [Denning, 1976], and non-interference says what unavailability means [Goguen and Meseguer, 1982] – and so is the debt: such properties are notoriously not preserved under composition [McCullough, 1988], and which strengthened conditions survive, at what price, is literature of its own [McLean, 1994, Mantel, 2002]. LLM capability profile lattice inherits both. We define capability-gated deployment (Fig. 1a): per-principal access control inside one set of weights, varying only one privilege level per control coordinate. Configurations form a finite distributive lattice: a principal under several restrictions holds the meet, a coalition pooling outputs commands the join (Fig. 1b). We instantiate it by sparse rank gating over a nested factorisation, steer profile search with a one-pass attribution, and read every result once from a pre-registered held-out split — an A/B discipline portable to any capability-control evaluation. Security composes at meets (provably under a monotone-elicitation assumption we then falsify pointwise, and empirically in two lineages) while utility does not: individually harmless profiles compose to real retention and fluency damage, and no compositional bound is possible. Scope. All claims assume query access (outputs observed at one’s own configuration, identity bound at the gateway, weights untouched) in expectation over a declared elicitation distribution and against a declared probe class; the gap from these expectation-based guarantees to worst-case, differential-privacy-style separation is the open problem we pose.

2

Capability-Gated Language Models

What algebraic object serves many principals from one deployment, and what survives composition? 2.1

Formal Definition of Capability-Gated Deployment

The Configuration Lattice. The weights are fixed; deployment varies only where, and how far, privilege is removed. We fix that action space abstractly, so the algebra belongs to the interface. Definition 2.1 (Capability-gating interface). A capability-gating interface for a model with parameters θ is a triple (K, {Lκ }κ∈K , T ), where K is a finite set of control coordinates (sites whose privilege may be set independently) and each κ ∈ K carries a finite, totally ordered set QLκ of privilege levels. A configuration assigns a level to every coordinate, i.e. is an element of C := κ∈K Lκ ; we write c⊤ for the configuration granting the greatest level everywhere and c⊥ for the least. The enforcer T carries a configuration to effective parameters θ(c) := Tc (θ) and thus to a deployed policy πθ,c := πθ(c) , with Tc⊤ (θ) = θ. Configurations are ordered pointwise, c ⪯ c′

:⇐⇒

c(κ) ≤ c′ (κ) for every κ ∈ K, 2

(1)

and the interface is required to be monotone in reachability: writing Reach(c) for the set of computations realisable under θ(c), c ⪯ c′

=⇒

Reach(c) ⊆ Reach(c′ ).

(2)

Equation (2) gives the order its content: ascending it can only enlarge what the model may compute, and (1) compares two configurations only when one dominates the other at every coordinate. Under (1), (C, ⪯) is a finite distributive lattice, bounded by c⊥ and c⊤ , with (c ∧ c′ )(κ) = min{c(κ), c′ (κ)} and (c ∨ c′ )(κ) = max{c(κ), c′ (κ)} (Theorem A.1, App. A; Fig. 1b). Principals, Profiles, and Allocation. Deployment is not a model but a service: one set of weights answers to several parties whose authorities differ. P is a finite set of principals — users, endpoints, or API keys. Each u ∈ P carries a suppress set Su of capability domains that must be unavailable to u and a retain set Ru of tasks on which u’s utility must be preserved. Allocation is a map φ : P → C; φ(u) is u’s profile, bound to the principal at the gateway and enforced inside by Tφ(u) (Fig. 1a). Principals hold query access only: each sees outputs at its own profile and alters neither it nor θ. Two Phases. The weights are adapted once; the profiles are found afterwards. Adaptation is a one-time procedure returning θ together with an interface satisfying Definition 2.1, under which every configuration is a usable model. Profile synthesis then searches C, per principal, for a configuration meeting that principal’s requirements. Only the latter repeats when a principal is added, and it is the Q hard one: |C| = κ |Lκ | is exponential in |K|, so synthesis measures only a shortlist. It needs an attribution (effect of each level of each coordinate on each domain, predicted from the mechanism’s internals at cost independent of |C|) which the interface does not provide and an instantiation must. Definition 2.2 (Capability-gated deployment). Fix an interface as in Definition 2.1 and a family T ⊆ 2P of coalitions the threat model admits. Let Sep(c, D) be a predicate that domain D is separated under c, Ret(c, R) that task set R is retained, and γR (c) the collateral incurred on R; §2.2 gives them content. Capability-gated deployment solves X
min γRu φ(u) φ : P→C

u∈P

s.t. Sep φ(u), D ∀u ∈ P, ∀D ∈ Su , Ret φ(u), Ru ∀u ∈ P, W  T Sep ∀T ∈ T, ∀D ∈ u∈T Su . u∈T φ(u), D

(3)

The two constraint families sit on opposite sides of the lattice (Fig. 1b). A principal obliged to forgo several domains at once holds the meet of the corresponding profiles, so its utility is assessed below each of them; a coalition pooling outputs commands whatever any member commands, so its security must be assessed at the join, above them all. Utility is therefore evaluated at meets and security at joins — an asymmetry (3) is arranged to expose rather than to hide. 2.2

Security and Utility Under Composition

Definition 2.3 (Channels, separation, retention). A configuration c is observed at two channels. Its behavioural channel is what it emits, summarised ona domain D with elicitation distribution  DD and chance level αD as accD (c) = Ex∼DD accπc (x) ; its representational channel is the state hc (x) at the decision, read by a declared class P of probes from representations to answers. With γR (c) = accR (c⊤ )−accR (c) the collateral on a retain set R and corresponding tolerances ε, δ, τ ≥ 0, Sepbeh ε (c, D) :⇐⇒ accD (c) ≤ αD + ε   Seprep δ (c, D) :⇐⇒ sup Ex∼DD accp (hc (x)) ≤ αD + δ

(behavioural) (representational)

p∈P

(4)

(retentional)

Retτ (c, R) :⇐⇒ γR (c) ≤ τ.

Separation is one schema read at two channels that differ in who may decode. In (3), Sep is beh Sepbeh ∧ Seprep alone at joins, where coalitions hold ε δ at a principal’s own configuration and Sepε outputs only; Ret is Retτ . An allocation meeting these constraints for u is secure for u and preserves its utility. Separation fails by a capability’s persistence, retention by its loss. With the model’s own readout in P , Seprep ⇒ Sepbeh and not conversely (Proposition A.2). δ δ 3

One control coordinate : a gated map κ One adaptation step : two forwards, anchor + one sampled variant A

anchor c⊤

···

B

or r as a bar: W (r) = B:, 1:r A1:r, : height = r Im W (1) ⊆ · · · ⊆ Im W (rmax )

▼

▼

···

···

global variant [Rauba et al., 2026]: every κ at one shared level — the diagonal c(κ) ≡ r of C

mixed variant (ours): k ∈ {1, 2, 3} coordinates at independent levels — sparse, off the diagonal

Figure 2: Instantiated interface and mixed-rank adaptation. Left (a): a control coordinate is one map W ≈ BA; level r keeps the prefix factors (green), withdrawing the tail (dashed), so levels nest reachable computation (2). Later figures draw a coordinate as a bar of its level. Right (b): each step trains c⊤ with one sampled variant. Rauba et al. [2026] draw global variants only (the lattice diagonal); profiles are sparse off-diagonal points; our mixed variant gates one to three coordinates at independent levels (markers).

The masking gap µ(c, D) = δ ⋆ − ε⋆ between the tightest tolerances at which each holds tells a gate, which removes the capability, from a filter, which withholds its output with the capability intact — attaining Sepbeh with µ maximal. Direction in the lattice decides what survives composition (proofs in Appendix A). Under a monotoneelicitation assumption (Assumption A.4) (which §3 finds violated only pointwise, by about a point) security composes: separation survives every further meet (Theorem A.5). Coalition pooling outputs realises the join of its members’ profiles, so (3) imposes separation there (Theorem A.6). Collateral admits no compositional bound: zero-collateral profiles can meet to lose every retained item under exactly additive margins, since accuracy thresholds a margin (Theorem A.7). Nothing so far has named a mechanism, and nothing needed to: any construction offering independently addressable sites with ordered, reachability-nested settings instantiates Definition 2.1, and everything above applies to it. 2.3

Instantiating the Interface

Mechanism. We instantiate Definition 2.1 with the nested subspace networks of Rauba and van der Schaar [2026], as Rauba et al. [2026] deploy them for least-privilege inference: there |P| = 1, Su = ∅, and one scalar rank minimises privilege subject to a utility floor. We add configurations off that diagonal, and principals in the plural (App. B.1 details the correspondence). A control coordinate is one of each block’s MLP projections, reparameterised as W ≈ BA; levels are ranks, and level r keeps the prefix factors (Fig. 2a), so with θ the post-adaptation parameters, Tc⊤ (θ) = θ holds exactly. On Qwen3-1.7B, ten levels on each of |K| = 84 coordinates give |C| = 1084 . Composition is then exact at the level of reachable computation: nested factors carry meets to intersected write-spaces and joins to their sums (Theorem A.3), which extends Theorem A.5 from outputs to representations. The mechanism supplies every property the framework consumes — reachability monotone (2), degradation gradual and differential, sensitivity concentrated in few coordinates, tensor shapes unchanged — each itemised, with what it buys the framework, in App. B.1. Adaptation off the Diagonal.1 The recipe of Rauba et al. [2026] trains each step at the anchor c⊤ jointly with one sampled constant variant c(κ) ≡ r (the diagonal of C) while the profiles of Definition 2.2 are sparse off-diagonal points (Fig. 1a). We therefore alternate the global draw with a mixed variant gating k ∈ {1, 2, 3} random coordinates at independent levels (Fig. 2b; loss in App. B.1), so adaptation trains the states that profile synthesis selects among, not the diagonal alone. What We Do Not Claim. Two caveats of Rauba et al. [2026] apply: privilege is an operational proxy, no level-to-capability map claimed; and gating does not withstand weight adaptation, which is why §2.1 grants principals query access only. 1We share our code here: https://anonymous.4open.science/r/capability-gated-language-models-318D/README.md

4

2.4

Profile Synthesis with One-Pass Attribution

Profile synthesis searches C, per principal, for a configuration maximising a scalarisation of (3),
λ X max accD (c), αD score(c) = accR̄u (c) − |Su | D∈Su (5) X
max 0, accM (c⊤ ) − accM (c) − τ − ν Φ(c), −ρ M ∈R̄u

where acc averages accuracy over a set; each term prices a failure the others cannot see. Suppression counts only down to the chance level αD : scoring below chance requires identifying the correct answer, so an unclamped term would reward masking over removal (§2.2). The hinge is the collateral γRu of (3) at tolerance τ , and Φ prices fluency, which no accuracy term registers (construction in App. B.2). The search (a measured single-coordinate sweep, then beam search by coordinate descent, candidates scored by (5)) is tractable on a 1084 -point lattice only because it scores a shortlist, never the lattice; the shortlist’s worth is priced, not assumed, in Fig. 10b. The shortlist is where the attribution of §2.1 enters, and nesting supplies it in closed form. Gating is exact in the component basis: level r discards the components j ≥ r of hκ = Aκ x, changing its output by ∆oκ = −Bκ [:, r:] hκ [r:]; linearising the correct-answer margin m in it gives X X ∆m(κ, r) ≈ ⟨gκ , ∆oκ ⟩ = − aκ (j), aκ (j) = gκ,t , Bκ [:, j] hκ [t, j], (6) t

j≥r

where gκ = ∂m/∂oκ and t ranges over token positions. The estimator is classical — gradient-timesactivation [Shrikumar et al., 2017, Molchanov et al., 2019, Nanda, 2023]; what is new is where it sits. At the factorisation bottleneck the perturbation is the deployed control action rather than a chosen counterfactual, and since aκ (j) is independent of r, one forward–backward pass prices every level of every coordinate: the attribution §2.1 requires, at the cost it requires. Being first-order, it screens rather than selects: the levels the sweep evaluates, plus a rescue quota of coordinates by predicted selectivity (App. B.2). Measured accuracies decide the rest, but not those we report: each benchmark is split in two before any measurement, the search reads only split A, and split B is read once, for §3.

3

Results

We study the framework and our instantiation on Qwen3-1.7B [Qwen Team, 2025] and repeat the pipeline verbatim on SmolLM2-1.7B [Allal et al., 2025]. Protocol. All headline numbers are read once from held-out split B, with the split-A value beside them; accuracies carry Wilson intervals throughout. The terms of (5) (and through it Sep and Ret of (3)) are measured on three datasets. The suppress set Su is WMDP [Li et al., 2024], all three domains: bio (1273 items), chem (408), cyber (1987). The retain set R̄u is seven MMLU subjects [Hendrycks et al., 2021] pooled into two macros, each scored as total correct over total items: adjacent (college biology, chemistry, and computer science, one per hazard domain) and distant (philosophy, high-school US history, international law, and high-school macroeconomics). The fluency price Φ, the 1.10× gate, and every perplexity ratio in the paper are measured on MiniPile [Kaddour, 2023], a distillation of the Pile [Gao et al., 2020]. Every benchmark is frozen into splits A and B before any measurement (§2.4). Each substrate is adapted once by the recipe of §2.3. The well-formedness check of Rauba et al. [2026] (held-out perplexity stable across the rank ladder where naive SVD truncation collapses) passes under our mixed recipe (Fig. 8, App. B.1), and so does the check that is ours, usability off the diagonal against the number of gated coordinates (Fig. 9). A domain enters for a substrate only if, on the screening half, c⊤ accuracy clears αD by 5 points with the Wilson lower bound clear of it, lest every configuration would vacuously separate. Instrumental Validation. We validate the §2.4 instrument first (App. B.2, Fig. 10). One forward– backward pass at c⊤ predicts the drop measured by gating that cell on split A, confirming (6): sign agreement and Spearman ρ > 0.5, large interventions drifting from the first-order prediction — the instrument screens rather than selects. A shortlist ablation over four matched arms (sweep, sweep+quota, random, adversarially least-selective) measures the best (5) score against evaluations: what buys the search is measuring coordinates at all; attribution buys a better configuration per evaluation; the adversarial arm still reaches sensible suppression for common directions. 5

wmdp-bio

wmdp-chem cch ^ ccy

wmdp-cyber ccy

cch _ ccy

¢+2.9/+1.7 1.27x

¢-2.3/+0.6 1.12x

cb ^ cch ^ ccy

cb ^ ccy

cch

¢+0.0/+0.0> 1.00x ´c

¢+6.4/+4.1 1.37x

¢+3.5/+1.7 1.22x

¢-1.7/+2.3 1.10x

cb ^ cch

cb

¢+2.9/+2.9 1.18x

¢-2.9/+1.7 1.09x

Minimum privilege (meets)

cb _ ccy

cb _ cch _ ccy

c>

¢+0.0/+0.0> 1.00x ´c

¢+0.0/+0.0> 1.00x ´c

¢+0.0/+0.0 1.00x Zero by definition

cb _ cch

¢-1.7/+0.6 1.02x

Full privilege (joins)

Figure 3: Measured sublattice. Bars give a domain’s suppression, taller more removed (pale split A, solid

held-out split B, each against split’s full privilege) with the adjacent-macro drop ∆ (A/B) and the perplexity ratio. Three faded joins equal c⊤ exactly (parents gate disjoint supports).

Compute. One run per stage reproduces the results on a single substrate in about 45 GPU-hours: 23 of adaptation on one H100, everything downstream on one L40S, most of it the per-domain searches. The instrument and each sublattice measurement run in minutes, and headroom, composition, and the mechanism checks re-read existing artefacts — the lattice is evaluated once and read many ways. Lattice. Fig. 3 shows the sublattice generated by the three deployed profiles under meet and join (twelve nodes); the full access matrix is Table 1 (App. B.4), the SmolLM2-1.7B analogue App. B.5 (Fig. 15, Table 2). On split A separation appears mostly not to survive composition; on split B the same nodes reverse it. Retention tells the inverse story: on A the single profiles mostly leave the adjacent macro intact and only the meets pay; on B the singles already pay and the meets pay more. Joins sit barely below full privilege, their parents gating disjoint supports (Theorem A.6). Profiles and Composition. Fig. 4a is the search’s own record: each domain’s gate-verified finalists, suppression against adjacent-macro collateral, split A by construction — the cloud is the search. Each domain’s selected profile (the bootstrapped lower-quartile winner among in-gate finalists, not the argmax) is re-measured once on B: suppression halves or worse, cyber reverses sign, and apparent retention gains turn into real collateral; the arrows are that gap, and the gap prices the optimism of an unprotected search. Fig. 4b crosses the thirteen parents (3 bio, 4 chem, 6 cyber) over all 54 cross-domain pairs and 24 triples: 180 (meet, parent, domain) records, each meet’s suppression on a parent’s domain minus that parent’s own, against the Jaccard overlap of the gated supports. The strong sub-additivity of split A does not survive B, and the registered covariate (shared support should mean interference) organises neither half (r = 0.02 on A, +0.33 on B, the opposite sign). Nor does the sub-additivity reproduce on two shorter adaptations of the same base model (median η of 1.94 and 1.51 on their own split A, against 0.90 here): a property of the selection, not of composition. Fig. 4b is the empirical face of Theorem A.5 (security composes, under MEA), which puts every record at or above zero; held-out B agrees as a tendency (the SmolLM2 analogue is Fig. 16). Gates or Filters? We proceed to study whether a profile’s suppression is removal of the capability, or masking, using probe protocols from Hewitt and Liang [2019]. We use the declared linear probe P on the final-layer residual at the answer position, fitted on all of split A and scored once on split B, five seeds. Random-label control is the same probe fitted to shuffled labels — the memorisation floor; readout-cancellation foil is the full-privilege model with the four answer-letter logits permuted after the forward pass — the largest masking gap. Fig. 5a compares the behavioural and representational accuracies along with the relative masking gap µrel (behaviour’s drop from c⊤ minus the probe’s drop) positive when the answer fell further than the knowledge. chem’s probe fails its capacity floor at full privilege (34.3% against a behavioural 47.8%), so chem is read only through µrel . The foil is Proposition A.2’s converse failure made physical, so a held-out µ̂ near the floor supports Seprep with respect to the declared P , not merely Sepbeh . The registered rule (large held-out gap means masking) does not fire: on B the deployed profiles reach 13% (bio), 7% (chem) and −5% (cyber) of a pure filter, against 11, 53 and 15 on the split they were selected on. At deployable operating points, these gates remove rather than mask. Fig. 5b draws one dumbbell per grid parent — µrel , A→B. Nearly every dumbbell points left on B (split A’s apparent masking was largely fitted to the search half), and every in-gate row sits well below its measured foil ceiling. The budget cuts one way: masking survives only where fluency is spent freely, and no cyber parent clears the gate. That 6

chem

10

bio

5

cyber

0 −5

−6

5 0 A: -0.7 pp

−10

−4

−2

B: +2.0 pp

−5

wmdp-bio wmdp-cyber wmdp-chem

−8

Split A Split B Triple

10

Selected, split A Same, split B (held out)

15

Meet ¡ parent suppression (pp)

Suppression (pp, higher = better)

15

20

0

2

Adjacent-macro collateral (pp, higher = worse)

Below 0: meet suppresses less than the parent

0.0

0.1

0.2

0.3

Support overlap (Jaccard)

0.4

Figure 4: Profiles and composition. (a) The 200 gate-verified finalists on split A: suppression against adjacentmacro collateral, relative to c⊤ . Bars are Wilson intervals. (b) What each meet keeps of its parent’s suppression against gated-support overlap, all 180 (meet, parent, domain) records; zero is the additive baseline (η = 1). Sub-additive records fall from 102/180 on A to 35/180 on B.

absence is a result, not a blemish: no admissible cyber gate exists under the registered 1.10× budget, and the deployed profile, cheapest breach at 1.12×, shows no held-out suppression at all (−1.0 pp on B, Table 1); App. B.3 measures the missing leverage. Mechanism Checks. We now test three load-bearing steps: monotone elicitation (Assumption A.4), the thresholding mechanism behind Theorem A.7, and the masking-plane geometry. Fig. 6a shows the 2016 (coordinate, level, group) cells of the single-coordinate sweep. Monotonicity is false pointwise (383 cells raise accuracy, by up to +4.3 pp — about a point’s magnitude); Theorem A.5 (security composes) rests on it, so the violations bound how literally that theorem can be read: small enough that it survives as a tendency, large enough that nothing forces a meet to preserve suppression exactly. Fig. 6b studies per-item margins on the adjacent macro at cb , cch and cb ∧cch ; margins compose roughly linearly (slope 0.66 on B), yet 3 of the 92 items correct under both parents are lost at the meet. This is Theorem A.7’s mechanism: accuracy thresholds the margin, so two profiles with zero collateral can lose items at their meet even when the margin effects are exactly additive. The theorem’s construction is found in the wild rather than built. Finally, Fig. 6c places the thirteen parents between a pure gate and a pure filter. On B the deployed profiles sit −2.8 to +5.6 pp from the gate edge; on A a uniformly positive +2.2 to +5.9 pp, all three inside the wedge. Held-out, that reading is withdrawn: only bio stays clearly inside, cyber is indistinguishable from a pure gate, and chem sits below, knowledge falling faster than its answer; chem’s probe caps its claim at a gate. Audit. Last, we ask whether composition can itself detect masking, pre-registered before any split-B unlock: suppression that survives the meet is suppression; suppression that evaporates was masking. Fig. 7a shows residuals of the meets above chance on the parent’s own domain: an open circle above

¹^+2.8

60

¹^ n/a

40 20 0

¹^+37.7 ¹^-0.8

®D

B1-bio 1.09x

C1-chem 1.10x

Y1-cyber 1.12x †

Readout foil (bio)

foil

B1-bio 1.09x B2-bio 1.24x B3-bio 1.30x C1-chem 1.10x C2-chem 1.09x C3-chem 1.24x C4-chem 1.26x Y1-cyber 1.12x Y2-cyber 1.20x Y3-cyber 1.43x Y4-cyber 1.52x Y5-cyber 1.52x Y6-cyber 2.19x

foil

Accuracy (%)

80

Random-label control Split A (pale)

foil

Behavioural Linear probe

0

20 ¹rel (pp)

In gate Breaches Deployed Split A

40

Figure 5: Gate or filter. (a) Each domain’s deployed profile, with the readout-cancellation foil as the measured

ceiling of µ̂; chem is hatched: read as µrel . (b) µrel for the thirteen grid parents against each domain’s foil ceiling (dashed). No cyber parent clears the gate; the one held-out masker spends freely (1.26×, 52% of a pure filter).

7

cyber chem MMLU-adj Violations: 383/2016 cells, max +4.3 pp

−40

−20

40 2

Probe residual (pp)

Margin drop at the meet

bio

Additive

0 −2 3/92 items lost at the meet

0

−2.5

¢acc, one coordinate (pp)

0.0

30 20

cyber chem

10 0

2.5

bio

Summed single-profile drop

⋆ full privilege readout foil deployed other parent

0

20

40

Behavioural residual (pp)

Figure 6: Mechanism checks. (a) Single-coordinate accuracy changes from the cached sweep. (b) Per-item

margins at cb ∧cch , a 1.18× meet; marked items were correct under both parents. (c) The masking plane; dotted edge a pure gate, dashed a pure filter; filled markers the deployed profiles, hollow the remaining parents.

its filled marker is evaporation. Individual meets scatter both ways (the 35/180 sub-additive records of Fig. 4b), but every parent’s mean recovery is negative (Fig. 7c) and every domain deepens on average (bio −2.8, chem −2.8, cyber −1.8 pp): no parent systematically gives suppression back, and the per-parent means leave the detector nothing to predict. Fig. 7b reads the same profiles by depth (one linear probe per block; genuine removal would drop probe accuracy at the gated blocks, masking carries it through) and the knowledge is carried past every gate, legible at the final layer. Fig. 7c is the registered prediction tying the halves: parents that give suppression back should be those with large masking gaps — the meet as a masking detector under pure query access. On A, strongly confirmed (ρ = 0.88, permutation p = 10−4 ); on B, ρ = −0.39 at p = 0.19 over thirteen parents. The split-A result was two selection-inflated quantities agreeing: masking gaps measured on the half the probes were fitted to, give-back on the half the profiles were selected on. We report the failure rather than the split-A number; what survives is the mechanism, not the detector.

40

0

B1-bio C1-chem Y1-cyber Full privilege

30

Recovery at the meet (pp)

30

Open above filled = evaporated

Probe ¡ control (pp)

Residual above chance (pp)

Conclusions. Capability-gated deployment turns one adaptation into a lattice of models: per-principal profiles found by search, enforced inside the forward pass, and audited at its meets and joins. Under the registered A/B protocol, security composes (every corrected held-out composition effect is a strengthening, in both lineages) while utility does not, collateral admitting no compositional bound; at deployable operating points the gates remove rather than mask, within the declared probe class; and the pre-registered masking detector failed held-out, reported as failed. Two split-A findings we retract are the measure of what an unprotected search protocol can manufacture. We leave open how capability gating behaves under adaptive elicitation and mechanisms beyond nested MLP factors, and how expectation-based separation hardens to a worst-case, differential-privacy-style guarantee. The cyber diagnostics suggest tests of whether the limited leverage is distributed support, rank ordering, or computation outside the gated surface.

20

20

10

10

0

−10 B1-bio B2-bio B3-bio C1-chem C2-chem C3-chem C4-chem Y1-cyber Y2-cyber Y3-cyber Y4-cyber Y5-cyber Y6-cyber

0

Shaded = blocks that profile gates

0

20

Residual depth (block)

bio chem cyber

−1 −2

½ = -0.39

p = 0.19 (n.s.)

−3 −4

0

25

50

Masking gap (% of ceiling)

Figure 7: Registered audit fails on held-out data. (a) Each parent’s own-domain accuracy above chance, alone (filled) and at every meet containing it (open). (b) Probe minus control by depth, five-seed means. (c) The registered prediction: masking gap against give-back at the meets.

8

References Loubna Ben Allal, Anton Lozhkov, Elie Bakouch, Gabriel Martín Blázquez, Guilherme Penedo, Lewis Tunstall, Andrés Marafioti, Hynek Kydlíček, Agustín Piqueres Lajarín, Vaibhav Srivastav, Joshua Lochner, Caleb Fahlgren, Xuan-Son Nguyen, Clémentine Fourrier, Ben Burtenshaw, Hugo Larcher, Haojun Zhao, Cyril Zakka, Mathieu Morlon, Colin Raffel, Leandro von Werra, and Thomas Wolf. SmolLM2: When Smol Goes Big – Data-Centric Training of a Small Language Model, 2025. URL https://arxiv.org/abs/2502.02737. Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, Jackson Kernion, Andy Jones, Anna Chen, Anna Goldie, Azalia Mirhoseini, Cameron McKinnon, Carol Chen, Catherine Olsson, Christopher Olah, Danny Hernandez, Dawn Drain, Deep Ganguli, Dustin Li, Eli Tran-Johnson, Ethan Perez, Jamie Kerr, Jared Mueller, Jeffrey Ladish, Joshua Landau, Kamal Ndousse, Kamile Lukosuite, Liane Lovitt, Michael Sellitto, Nelson Elhage, Nicholas Schiefer, Noemi Mercado, Nova DasSarma, Robert Lasenby, Robin Larson, Sam Ringer, Scott Johnston, Shauna Kravec, Sheer El Showk, Stanislav Fort, Tamera Lanham, Timothy Telleen-Lawton, Tom Conerly, Tom Henighan, Tristan Hume, Samuel R. Bowman, Zac Hatfield-Dodds, Ben Mann, Dario Amodei, Nicholas Joseph, Sam McCandlish, Tom Brown, and Jared Kaplan. Constitutional AI: Harmlessness from AI Feedback, 2022. URL https://arxiv.org/abs/2212.08073. Nora Belrose, David Schneider-Joseph, Shauli Ravfogel, Ryan Cotterell, Edward Raff, and Stella Biderman. LEACE: Perfect linear concept erasure in closed form. In Advances in Neural Information Processing Systems, volume 36. Curran Associates, Inc., 2023. URL https://proceedings.neurips.cc/paper_files/paper/2023/hash/ d066d21c619d0a78c5b557fa3291a8f4-Abstract-Conference.html. Doni Bloomfield, James R. M. Black, Oliver Crook, Nadav Brandes, Moritz S. Hanke, Thomas V. Inglesby, Anita Cicero, Robert Pollack, Tina Hernandez-Boussard, Michael J. Imperiale, Russ B. Altman, and Jaspreet Pannu. Biological data governance in an age of AI. Science, 391(6785): 558–561, February 2026. doi: 10.1126/science.aeb2689. Sarah R. Carter and Greg Butchello. A Framework for Managed Access to Biological AI Tools. Paper, Nuclear Threat Initiative (NTI), Washington, DC, January 2026. URL https://www.nti.org/wp-content/uploads/2026/01/NTIBio_Paper_ A-Framework-for-Managed-Access-to-Biological-AI-Tools_FINAL.pdf. Accessed: 14 August 2026. Aghyad Deeb and Fabien Roger. Do Unlearning Methods Remove Information from Language Model Weights?, 2025. URL https://arxiv.org/abs/2410.08827. Dorothy E. Denning. A lattice model of secure information flow. Commun. ACM, 19(5):236–243, May 1976. ISSN 0001-0782. doi: 10.1145/360051.360056. URL https://doi.org/10.1145/ 360051.360056. Leo Gao, Stella Biderman, Sid Black, Laurence Golding, Travis Hoppe, Charles Foster, Jason Phang, Horace He, Anish Thite, Noa Nabeshima, Shawn Presser, and Connor Leahy. The Pile: An 800GB Dataset of Diverse Text for Language Modeling, 2020. URL https://arxiv.org/abs/2101. 00027. J. A. Goguen and J. Meseguer. Security Policies and Security Models. In 1982 IEEE Symposium on Security and Privacy, pages 11–11, 1982. doi: 10.1109/SP.1982.10014. G. Scott Graham and Peter J. Denning. Protection: Principles and Practice. In Proceedings of the May 16–18, 1972, Spring Joint Computer Conference, AFIPS ’72 (Spring), pages 417–429, New York, NY, USA, 1972. ACM. doi: 10.1145/1478873.1478928. Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. Measuring Massive Multitask Language Understanding. In The Ninth International Conference on Learning Representations, 2021. URL https://openreview.net/forum?id= d7KBjmI3GmQ.

9

John Hewitt and Percy Liang. Designing and Interpreting Probes with Control Tasks. In Kentaro Inui, Jing Jiang, Vincent Ng, and Xiaojun Wan, editors, Proceedings of the 2019 Conference on Empirical Methods in Natural Language Processing and the 9th International Joint Conference on Natural Language Processing (EMNLP-IJCNLP), pages 2733–2743, Hong Kong, China, November 2019. Association for Computational Linguistics. doi: 10.18653/v1/D19-1275. URL https://aclanthology.org/D19-1275/. Jean Kaddour. The MiniPile Challenge for Data-Efficient Language Models, 2023. URL https: //arxiv.org/abs/2304.08442. Thomas Kwa, Ben West, Joel Becker, Amy Deng, Katharyn Garcia, Max Hasin, Sami Jawhar, Megan Kinniment, Nate Rush, Sydney Von Arx, Ryan Bloom, Thomas Broadley, Haoxing Du, Brian Goodrich, Nikola Jurkovic, Luke Harold Miles, Seraphina Nix, Tao Lin, Chris Painter, Neev Parikh, David Rein, Lucas Jun Koba Sato, Hjalmar Wijk, Daniel M. Ziegler, Elizabeth Barnes, and Lawrence Chan. Measuring AI Ability to Complete Long Software Tasks. In Advances in Neural Information Processing Systems, volume 38. Curran Associates, Inc., 2025. URL https://proceedings.neurips.cc/paper_files/paper/2025/hash/ 85069585133c4c168c865e65d72e9775-Abstract-Conference.html. Butler W. Lampson. Protection. ACM SIGOPS Operating Systems Review, 8(1):18–24, January 1974. doi: 10.1145/775265.775268. Originally presented at the 5th Princeton Conference on Information Sciences and Systems, Princeton University, Mar. 1971, pp. 437–443. Nathaniel Li, Alexander Pan, Anjali Gopal, Summer Yue, Daniel Berrios, Alice Gatti, Justin D. Li, Ann-Kathrin Dombrowski, Shashwat Goel, Long Phan, Gabriel Mukobi, Nathan Helm-Burger, Rassin Lababidi, Lennart Justen, Andrew B. Liu, Michael Chen, Isabelle Barrass, Oliver Zhang, Xiaoyuan Zhu, Rishub Tamirisa, Bhrugu Bharathi, Adam Khoja, Zhenqi Zhao, Ariel Herbert-Voss, Cort B. Breuer, Samuel Marks, Oam Patel, Andy Zou, Mantas Mazeika, Zifan Wang, Palash Oswal, Weiran Lin, Adam A. Hunt, Justin Tienken-Harder, Kevin Y. Shih, Kemper Talley, John Guan, Russell Kaplan, Ian Steneker, David Campbell, Brad Jokubaitis, Alex Levinson, Jean Wang, William Qian, Kallol Krishna Karmakar, Steven Basart, Stephen Fitz, Mindy Levine, Ponnurangam Kumaraguru, Uday Tupakula, Vijay Varadharajan, Ruoyu Wang, Yan Shoshitaishvili, Jimmy Ba, Kevin M. Esvelt, Alexandr Wang, and Dan Hendrycks. The WMDP Benchmark: Measuring and Reducing Malicious Use With Unlearning. In Proceedings of the 41st International Conference on Machine Learning, volume 235 of Proceedings of Machine Learning Research, pages 28525–28550. PMLR, 2024. Jakub Łucki, Boyi Wei, Yangsibo Huang, Peter Henderson, Florian Tramèr, and Javier Rando. An Adversarial Perspective on Machine Unlearning for AI Safety. Transactions on Machine Learning Research, 2025. ISSN 2835-8856. URL https://openreview.net/forum?id=J5IRyTKZ9s. H. Mantel. On the composition of secure systems. In Proceedings 2002 IEEE Symposium on Security and Privacy, pages 88–101, 2002. doi: 10.1109/SECPRI.2002.1004364. D. McCullough. Noninterference and the composability of security properties. In Proceedings. 1988 IEEE Symposium on Security and Privacy, pages 177–186, 1988. doi: 10.1109/SECPRI.1988.8110. J. McLean. A general theory of composition for trace sets closed under selective interleaving functions. In Proceedings of 1994 IEEE Computer Society Symposium on Research in Security and Privacy, pages 79–93, 1994. doi: 10.1109/RISP.1994.296590. Kevin Meng, David Bau, Alex Andonian, and Yonatan Belinkov. Locating and Editing Factual Associations in GPT. In Advances in Neural Information Processing Systems, volume 35, pages 17359–17372. Curran Associates, Inc., 2022. Pavlo Molchanov, Arun Mallya, Stephen Tyree, Iuri Frosio, and Jan Kautz. Importance Estimation for Neural Network Pruning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 11264–11272, 2019. Neel Nanda. Attribution Patching: Activation Patching at Industrial Scale. https://www. neelnanda.io/mechanistic-interpretability/attribution-patching, 2023. Accessed 2026-08-07. 10

Long Ouyang, Jeff Wu, Xu Jiang, Diogo Almeida, Carroll L. Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kelton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul Christiano, Jan Leike, and Ryan Lowe. Training language models to follow instructions with human feedback. In Advances in Neural Information Processing Systems, volume 35, pages 27730–27744. Curran Associates, Inc., 2022. Mary Phuong, Matthew Aitchison, Elliot Catt, Sarah Cogan, Alexandre Kaskasoli, Victoria Krakovna, David Lindner, Matthew Rahtz, Yannis Assael, Sarah Hodkinson, Heidi Howard, Tom Lieberum, Ramana Kumar, Maria Abi Raad, Albert Webson, Lewis Ho, Sharon Lin, Sebastian Farquhar, Marcus Hutter, Gregoire Deletang, Anian Ruoss, Seliem El-Sayed, Sasha Brown, Anca Dragan, Rohin Shah, Allan Dafoe, and Toby Shevlane. Evaluating Frontier Models for Dangerous Capabilities, 2024. URL https://arxiv.org/abs/2403.13793. Qwen Team. Qwen3 Technical Report, 2025. URL https://arxiv.org/abs/2505.09388. Rafael Rafailov, Archit Sharma, Eric Mitchell, Stefano Ermon, Christopher D. Manning, and Chelsea Finn. Direct Preference Optimization: Your Language Model is Secretly a Reward Model. In Advances in Neural Information Processing Systems, volume 36, pages 53728–53741. Curran Associates, Inc., 2023. Paulius Rauba and Mihaela van der Schaar. Deep Hierarchical Learning with Nested Subspace Networks for Large Language Models. In The Fourteenth International Conference on Learning Representations, 2026. URL https://openreview.net/forum?id=ymUOPsbxLi. Paulius Rauba, Dominykas Seputis, Patrikas Vanagas, and Mihaela van der Schaar. No More, No Less: Least-Privilege Language Models. In Proceedings of the 43rd International Conference on Machine Learning, volume 306 of Proceedings of Machine Learning Research. PMLR, 2026. Ethan Roland, Murat Cubuktepe, Erick Martinez, Stijn Servaes, Keenan Pepper, Mike Vaiana, Diogo Schwerz de Lucena, Judd Rosenblatt, Addie Foote, Cem Anil, and Alex Cloud. Modular Pretraining Enables Access Control, 2026. URL https://arxiv.org/abs/2607.08077. Toby Shevlane, Sebastian Farquhar, Ben Garfinkel, Mary Phuong, Jess Whittlestone, Jade Leung, Daniel Kokotajlo, Nahema Marchal, Markus Anderljung, Noam Kolt, Lewis Ho, Divya Siddarth, Shahar Avin, Will Hawkins, Been Kim, Iason Gabriel, Vijay Bolina, Jack Clark, Yoshua Bengio, Paul Christiano, and Allan Dafoe. Model evaluation for extreme risks, 2023. URL https: //arxiv.org/abs/2305.15324. Avanti Shrikumar, Peyton Greenside, and Anshul Kundaje. Learning Important Features Through Propagating Activation Differences. In Proceedings of the 34th International Conference on Machine Learning, volume 70 of Proceedings of Machine Learning Research, pages 3145–3153. PMLR, 2017. Aaquib Syed, Can Rager, and Arthur Conmy. Attribution Patching Outperforms Automated Circuit Discovery. In Proceedings of the 7th BlackboxNLP Workshop: Analyzing and Interpreting Neural Networks for NLP, pages 407–416. Association for Computational Linguistics, 2024. doi: 10.18653/v1/2024.blackboxnlp-1.25. Boyi Wei, Kaixuan Huang, Yangsibo Huang, Tinghao Xie, Xiangyu Qi, Mengzhou Xia, Prateek Mittal, Mengdi Wang, and Peter Henderson. Assessing the Brittleness of Safety Alignment via Pruning and Low-Rank Modifications. In Proceedings of the 41st International Conference on Machine Learning, volume 235 of Proceedings of Machine Learning Research, pages 52588–52610. PMLR, 2024.

11

A

Proofs

The lattice structure of §2.1 and the accompanying statements for §2.2 are collected here, with their proofs. Theorem A.1 (Lattice structure). (C, ⪯) is a finite distributive lattice, bounded by c⊥ and c⊤ , with (c ∧ c′ )(κ) = min{c(κ), c′ (κ)},

(c ∨ c′ )(κ) = max{c(κ), c′ (κ)}.

(7)

Proof. Each Lκ is a finite chain, hence a bounded lattice with min and max as meet and join, and every chain is distributive (min(x, max(y, z)) = max(min(x, y), min(x, z)) holds in any totally ordered set). C is the direct product of the Lκ , and both the lattice identities and distributivity are preserved componentwise under direct products. Bounds are c⊥ and c⊤ . Proposition A.2 (Hierarchy). If the model’s own readout (the map carrying hc (x) to the emitted beh answer) belongs to P , then Seprep δ (c, D) ⇒ Sepδ (c, D) for every c and D. The converse fails: behavioural separation at tolerance zero is consistent with probe accuracy near the full-privilege value. Proof. Let p0 ∈ P be the readout. Then accπc (x) = accp0 (hc (x)) by definition of the readout, so accD (c) ≤ supp∈P E accp (hc (x)) ≤ αD +δ. For the failure of the converse, take any configuration under which the representation still encodes the answer along some direction while the readout no longer projects onto it: probe accuracy stays near the full-privilege value while behavioural accuracy sits at chance. Such configurations exist whenever the readout is not the only functional in P separating the classes, which is the generic case. Theorem A.3 (Capacity is a lattice embedding). For the nested-factor instantiation, write Wκ (r) = colspan B
κ [:, :r] for the subspace coordinate κ can write into at rank r, and Cap(c) = Wκ (c(κ)) κ∈K , ordered by componentwise inclusion, with componentwise intersection ⊓ and componentwise sum ⊔. Then for all c, c′ ∈ C: (a) c ⪯ c′ =⇒ Cap(c) ⊑ Cap(c′ ); (b) Cap(c ∧ c′ ) = Cap(c) ⊓ Cap(c′ ); (c) Cap(c ∨ c′ ) = Cap(c) ⊔ Cap(c′ ). If every Bκ has full column rank, Cap is injective, hence a lattice isomorphism onto its image. Proof. Bκ [:, :r] is a column prefix of Bκ [:, :r′ ] for r ≤ r′ , so Wκ (r) ⊆ Wκ (r′ ): each {Wκ (r)}r is a chain, which gives (a). Two subspaces on a chain are comparable, so their intersection
′ ′ is the smaller of the two, Wκ (min(r, r )) = W (c ∧ c )(κ) , and their sum is the larger, κ
Wκ (max(r, r′ )) = Wκ (c ∨ c′ )(κ) ; both identities hold at every coordinate, giving (b) and (c). For injectivity, full column rank makes dim Wκ (r) = r, so Cap determines c. Had the factors not been nested (rank reduction selected an arbitrary subset of components, as SVD truncation of two separately compressed models would) the two spaces would generally be incomparable and their intersection a proper subspace of both, so exactness would fail. Assumption A.4 (Monotone elicitation (MEA)). For the task sets concerned, c ⪯ c′ =⇒ accD (c) ≤ accD (c′ ). Theorem A.5 (Security composes, under MEA). Under Assumption A.4 on D, beh ′′ accD (c ∧ c′ ) ≤ min{accD (c), accD (c′ )}; consequently Sepbeh ε (c, D) implies Sepε (c ∧ c , D) rep ′′ for every c , and likewise for Sepδ when P is closed under restriction to the meet’s write-spaces. Proof. c ∧ c′ ⪯ c and c ∧ c′ ⪯ c′ by definition of the meet, so Assumption A.4 applied twice gives the inequality; then accD (c ∧ c′′ ) ≤ accD (c) ≤ αD + ε. For the representational analogue, Theorem A.3(b) confines every write of the meet to the intersected write-spaces; if P is closed under the induced restriction of its input, the supremum over P at the meet is at most the supremum at c, and the same two lines apply. Theorem A.6 (Coalitions realise the join). Let a coalition T hold {φ(v)}v∈T , with each member being allowed to select another member and return W its answer. Then the coalition attains accD ≥ maxv∈T accD (φ(v)) for every domain D, and v∈T φ(v) is the least configuration domi
W nating every member; a coalition guarantee therefore requires Sepbeh ε v∈T φ(v), D , which does not follow from Sepbeh ε (φ(v), D) holding for each v separately. 12

Proof. Any query one member can answer, the coalition answers by routing it to that member W and sharing the output, which gives the lower bound. That v∈T φ(v) is the least upper bound is Theorem A.1. Since separation is downward closed (Theorem A.5) and not upward closed, its holding at each φ(v) constrains nothing at a point above them all. Theorem A.7 (No compositional bound on collateral). Under Assumption A.4 on R, joins preserve ′ Retτ and meets obey γR (c ∧ c′ ) ≥ max{γR
(c), γR (c )}; and no informative converse exists — any ′ ′ f satisfying γR (c ∧ c ) ≤ f γR (c), γR (c ) across all gated models has f (0, 0) = 1. Proof. c ⪯ c ∨ c′′ , so Assumption A.4 gives accR (c ∨ c′′ ) ≥ accR (c) ≥ accR (c⊤ ) − τ : joins preserve Retτ , and the meet inequality restates Theorem A.5’s inequality on R. For the absence of an informative converse, let R be scored by the sign of a margin m, let every item carry margin m0 > 0 at c⊤ , and let c, c′ each gate one of two distinct coordinates whose effects on the margin are −θ, with m0 /2 < θ < m0 . Each configuration alone leaves every margin at m0 − θ > 0: all items correct, γR (c) = γR (c′ ) = 0. Their meet gates both coordinates; with the effects exactly additive, every margin becomes m0 − 2θ < 0, so γR (c ∧ c′ ) = 1. Any admissible f therefore has f (0, 0) ≥ 1, and since collateral never exceeds one, f (0, 0) = 1: the bound is vacuous precisely where it would be informative. In summary, the direction each predicate faces in the lattice decides what survives composition: Predicate

Requirement

Survives ∧ (accumulation)

Survives ∨ (coalition)

Sepbeh ε Seprep δ Retτ

security security utility

yes yes, for restriction-closed P no bound exists

no no yes

13

B

Substrate, instrument, and extended results

This appendix collects what the main text defers: the instantiation and adaptation detail of §2.3, the substrate and instrument checks, the objective’s constants, a diagnostic of cyber’s lower leverage, the access matrix, and the SmolLM2 replication. B.1

Instantiation and substrate validation

What the mechanism supplies. Monotone reachability (2) is the nested subspace property [Rauba and van der Schaar, 2026]. After nested adaptation, degradation is gradual where naive truncation collapses (this makes searching C feasible at all) and it is differential: hard instances lose first, which is what lets a configuration below c⊤ separate one domain yet retain another [Rauba et al., 2026]. Subject-specific sensitivity concentrates in a few coordinates [Rauba et al., 2026], making the admissible set of Definition 2.2 plausibly non-empty. And tensor shapes are preserved, so the interface fits a pretrained transformer unchanged [Rauba and van der Schaar, 2026]. The adaptation recipe. Each step forwards the batch twice, once at the anchor c⊤ and once at the sampled variant, combining the two losses under learned per-level uncertainty weights [Rauba et al., 2026]. A mixed variant is weighted by the mean of its levels’ uncertainties, and global and mixed draws alternate with equal probability (Fig. 2b). Relation to prior work. The nested subspace networks of Rauba and van der Schaar [2026] set one global rank and name the layer-specific case as open; in Rauba et al. [2026], per-coordinate configurations appear only as a search space. The lattice of §2.1 is that vector-valued generalisation, with its algebra — meets, joins, composition laws. Conditioning the allocation φ on request-time signals would recover the per-request allocator of Rauba et al. [2026]; the experiments here use static per-principal profiles. The substrate checks. Substrate well-formedness and off-diagonal usability parallel the diagnostics of Rauba et al. [2026]; they are confirmatory preconditions rather than contributions. Held-out perplexity is stable across the full rank ladder where naive SVD truncation collapses (Fig. 8); degradation against the number of gated coordinates (Fig. 9) is the measured form of the mixed recipe’s claim — that adaptation trains the states profile synthesis selects from. 10 8

Held-out perplexity

10 7 10 6 10 5

Adapted nested substrate Naive SVD truncation

10 4 10 3 10 2 10 1

Dense reference (13.5) 0.05

0.39

3.1

25

100

Retained global rank (%)

Figure 8: Substrate well-formedness. Held-out perplexity against retained global rank on Qwen3-1.7B: the adapted nested substrate, naive SVD truncation, and the dense reference. Split A (screening, before any profile exists).

14

(a)

(b) Mixed-state

2.0 1.8 1.6 1.4 1.2

fluency budget

Adjacent-MMLU drop (pp)

Held-out perplexity ratio

30

Global-only

2.2

1.0 1

2

3

4

6

8

12

25 20 15 10 5 retention tolerance ¿

0 1

Number of gated coordinates, k

2

3

4

6

8

12

Number of gated coordinates, k

Figure 9: Off-diagonal usability. Degradation on Qwen3-1.7B against the number of gated coordinates k,

global-only against mixed adaptation, levels sampled as during adaptation: (a) perplexity ratio against the 1.10 budget; (b) adjacent-MMLU drop against τ . Means over 12 paired draws, ribbons 10th–90th percentiles. Split A (precondition check).

B.2

Objective and attribution details

The objective’s terms. Suppression is rewarded at weight λ, clamped at αD , so the term’s optimum is accuracy at chance. Retention is measured on R̄u , the retain set pooled into groups M large enough for the per-task tolerance to be measurable (τ = 0.01 is half an item on a fifty-item subject); the hinge (the collateral γRu of (3) made concrete) charges drops beyond τ at a rate ρ no suppression can repay. Φ(c) applies the linearisation of (6) to held-out next-token loss rather than the margin, predicting each gated coordinate’s fluency cost; it sums these predictions over supp(c), negatives clipped, at exchange rate ν. Constants. As recorded in the configuration of the reported run: λ = 2 (lambda_suppress), ρ = 100 (penalty_scale), ν = 1 (fluency_price_weight), τ = 0.01 (eps_preserve_drop), and αD = 0.25 for four-option items. The fluency gate, max_ppl_ratio = 1.10, sits outside (5) as a hard constraint on candidates and is what makes most configurations ineligible regardless of score. Φ(c) is recorded as the sum over supp(c) of the clipped first-order singleton ∆NLL, so ν weights a summed ∆NLL, not a perplexity ratio. The search’s winner is the lower quartile of B = 1000 bootstrap resamples of the objective, not the argmax. Attribution’s lineage and use. Equation (6) is gradient-times-activation [Shrikumar et al., 2017] at the factorisation bottleneck — equivalently the first-order Taylor criterion for structure removal [Molchanov et al., 2019], or attribution patching with a zero baseline [Nanda, 2023, Syed et al., 2024]. The prediction picks the levels the measured sweep evaluates and a fixed rescue quota of coordinates by predicted selectivity — a set-difference contrast against the retained tasks, after Wei et al. [2024]. Concretely, the search takes 24 coordinates at four ranks each with a rescue quota of six, sweep fractions 0.75, 0.5, 0.375, 0.25, 0.125, 0.0625, and carries 40 finalists into gate verification; the shortlist is not a parameter of this stage, being E2’s frozen twelve-coordinate output per strategy, which the search consumes as given. Re-run against held-out next-token loss, the same pass yields the per-coordinate prices Φ sums in (5). Instrument validation. The gating identity is exact to fp32, and first-order predictions order measured drops (Spearman ρ = 0.61, sign agreement 0.92) while increasingly underestimating them with intervention size — an ordering signal, never effect sizes (Fig. 10a). What steers the search is selectivity, σD (κ) = s̃D (κ) − maxD′ ̸=D s̃D′ (κ): the predicted margin damage to D, normalised by D’s mean decision margin, minus the worst damage to any other measured group. Raw importance ranks generically load-bearing coordinates first, whose gating is a lobotomy; σD (κ) > 0 marks κ as disproportionately D’s. The resulting maps are domain-structured (Fig. 11), though the structure is relative, not absolute: single-coordinate margin drops are strongly coupled between WMDP domains and MMLU subjects alike. 15

The shortlist ablation. The four arms of Fig. 10b price each ingredient of the search, matched in candidate pool, fluency gate, and finalist count: combined (the default) — measured sweep plus attribution’s rescue quota; measured-only — sweep order alone; random — a random shortlist; anti — the least selective coordinates by attribution, pre-registered to fail. Attribution’s rescue quota buys nothing: measured-only and combined select the identical three-coordinate chem gate (0.528 → 0.380 at 1.087×), the quota costing 15% more evaluations for the same selection; a bio arm agrees. The controls calibrate the claim rather than flatter it: a random shortlist reaches 71% of combined’s suppression, but only at 2.8× the budget; anti, built from the least selective coordinates and pre-registered to fail, still reaches 7.4 pp; and random’s selection even scores higher on the objective, buying retention instead of suppression. What buys the search is measuring coordinates at all; attribution buys a better configuration per evaluation, not a reachable one; and chem’s suppressible directions are common enough that even an adversarial shortlist reaches them, given budget. (a) Attribution orders sparse interventions

(b) Is the shortlist worth its cost? −0.10 −0.15

Spearman ρ = 0.61 sign agreement = 0.92 (n=24)

Best objective s(c)

Measured margin drop

2

1

0

same gate: 694 measured-only 753 combined evals

−0.20 −0.25 −0.30 combined (ours) measured-only random anti (should fail)

−0.35

−1

−1

bio gate

chem up

0

1

cyber

−0.40

down

2

10 0

10 1

First-order predicted margin drop

10 2

10 3

Measured evaluations (budget)

Figure 10: Instrument validation and shortlist ablation. (a) First-order predicted against measured margin

(a) Bio (± 65/84 BH)

(b) Chem (± 37/84 BH)

(c) Cyber (± 58/84 BH)

gate

up

0.0 −0.5 −1.0

down

−1.5 0

6

12

18

Transformer block

24

0

6

12

18

Transformer block

24

0

6

12

18

24

Selectivity σ (z-score normalisation)

drop on the 24-cell validation subset: the instrument orders interventions, it is not calibrated for effect size. (b) Running-best objective against evaluations for four search arms matched in candidate pool, fluency gate, and finalist count. Combined and measured-only select the identical chem gate, the rescue quota costing 15% more evaluations; random needs 2.8× the budget; anti, pre-registered to fail, still reaches 7.4 pp. Two earlier arm designs (a starved candidate pool; a looser 1.25 screen) are superseded by this matched comparison. Split A throughout: search trajectories never read B.

Transformer block

Figure 11: Localisation maps. Z-scored selectivity σD (κ) at active rank 256 over the (block × projection) grid; circles mark cells surviving Benjamini–Hochberg correction at q = 0.05 over all 252 cells. Split A: the instrument that steers the search never reads B.

16

B.3

Why is cyber harder to suppress?

The control surface. The selected cyber profile removes less capability than its bio and chem counterparts, but the search alone cannot say why. We therefore measure the control surface before selection: all 28 × 3 = 84 MLP coordinates, each gated alone at every one of the nine non-full ranks, for 756 singleton interventions. Every intervention is evaluated on the same split-A WMDP items and 256 MiniPile blocks; no target-specific configuration is selected. The response is the drop in mean answer margin divided by that domain’s mean absolute margin on correctly answered full-privilege items. Split A is diagnostic here, not a new confirmation: this question was posed after the split-B profile result was known.

(a) Singleton leverage at matched cost 0.3

0.2 paper cap (+10% PPL)

0.1 Bio

Chem

Cyber

0.0 1.02

1.05

1.10

1.25

1.50

2.00

(b) Cyber gap within cost bands Cyber leverage gap

Strong-effect leverage (90th pct.)

The registered contrast. At the registered 1.10× fluency cap, 586 interventions are eligible. The 90th-percentile normalised margin drop is 0.197 for bio, 0.242 for chem, and 0.079 for cyber chem (Fig. 12a). The registered contrast, Qcyber − (Qbio .90 + Q.90 )/2, is −0.141, with a 95% transformer.90 block bootstrap interval [−0.163, −0.107]. Thus a strong cyber singleton has only 36% of the leverage of the bio–chem average. The result is not confined to the upper tail: pairing the three domain responses for each identical eligible intervention gives a mean contrast of −0.054, 95% CI [−0.068, −0.039]. Nor does cyber catch up when fluency is relaxed: its 90th percentile remains about 35–40% of the bio–chem average from the 1.02× through 4.00× cumulative caps; the disjoint-band comparison is negative in every well-populated band (Fig. 12b).

4.00

0.0

−0.2

−0.4

≤

Maximum MiniPile perplexity / baseline

5 0 5 0 0 0 0 02 .0 .1 .2 .5 .0 .0 .0 1. --1 --1 --1 --1 --2 --4 >$4 02 05 10 25 50 00 . . . . . . 1 1 1 1 1 2

Non-overlapping perplexity / baseline band

Figure 12: Cyber has lower singleton leverage across the trained rank ladder. Each observation gates

one MLP coordinate at one rank, all others at full rank; leverage is the normalised margin drop defined in the text. (a) 90th-percentile leverage under a cumulative perplexity cap — a strong, not single-best, intervention — with the 1.10× gate dashed. (b) The same interventions in disjoint perplexity bands: cyber leverage minus the bio–chem mean, negative where cyber moves less; the one positive band holds 14 destructive interventions and alters neither registered comparison. Split A diagnostic; 756 interventions, uncertainty clustered by transformer block.

A measurement concern. The full-rank model answers only 43.2% of cyber questions correctly, against 67.6% for bio and 53.4% for chem. An intervention cannot flip an answer that was already wrong, so cyber may appear harder to suppress simply because fewer cyber items are known at baseline. We therefore repeat the comparison using only baseline-correct questions. To keep the domains comparable, we retain 87 items from each, answer letters balanced and positions matched in each domain’s baseline-margin ordering. For every in-gate singleton, we ask how much of the matched items’ original decision margin it removes and how often it changes a known answer to a wrong one (Fig. 13). The matched result. The interpretation changes. On decision-margin loss, cyber is −0.037 below bio (95% CI [−0.099, 0.039]), and on known-answer flips it is +0.023 above bio (95% CI [−0.034, 0.069]): neither difference is distinguishable from zero. Cyber remains below chem on both margin loss (−0.332, 95% CI [−0.455, −0.202]) and flips (−0.098, 95% CI [−0.161, −0.046]). Thus lower baseline cyber accuracy explains much of the original cyber–bio gap, but not the cyber–chem gap.

17

0.7 0.6 0.5 0.4 0.3 0.2 0.1 0.0

Bio

Chem

Cyber

Baseline-correct items flipped to wrong

Fraction of baseline margin removed

(a) Decision-margin loss Cyber - bio: -0.037 [-0.099, +0.039] Cyber - chem: -0.332 [-0.455, -0.202]

0.35 0.30

(b) Known answers flipped Cyber - bio: +0.023 [-0.034, +0.069] Cyber - chem: -0.098 [-0.161, -0.046]

0.25 0.20 0.15 0.10 0.05 0.00

Bio

Chem

Cyber

Figure 13: After matching baseline-known questions, cyber responds like bio; chemistry drives the

remaining gap. Bars: 90th percentile over the 586 in-gate singletons on the matched panel. (a) Margin loss as a fraction of the matched domain’s baseline margin; (b) the fraction of baseline-correct answers flipped. Error bars: 95% intervals from a crossed bootstrap over transformer blocks and matched item triplets; insets: pairwise cyber contrasts with 95% intervals. Split A post-hoc diagnostic.

The narrower claim. Together, the raw and matched analyses establish a narrower claim than cyber being intrinsically inseparable. The present MLP-prefix interface has less leverage over cyber than over the bio–chem average, but this is not a uniform cyber deficit: baseline-known cyber and bio questions respond similarly, while chemistry is unusually susceptible. The singleton grid still makes a pure search-failure explanation unlikely, while leaving four mechanistic possibilities, each with a separable prediction. Distributed support predicts a lower concentration of positive singleton effects and a gradual catch-up under measured top-k accumulation. Rank-order misalignment predicts cyber sensitivity in the retained low-index factor bands when non-prefix bands are ablated at matched NLL. Computation outside the MLP surface predicts disproportionate cyber leverage from attention-head or residual-stream interventions. Overlap with general capability predicts that cyber suppression lies on a worse code/technical-utility Pareto frontier. The registered WMDP–MMLU correlation test does not support the broad version of the last account: after removing each intervention’s MiniPile ∆NLL, cyber’s mean coupling breadth differs from the bio–chem average by −0.032, 95% CI [−0.129, 0.053]. A code-specific retain panel remains the direct test. Until the band, attention, and accumulation interventions are run, the measured conclusion is lower interface leverage, not a unique claim about where cyber knowledge resides.

After removing ΔNLL 1.0

0.96 0.85 0.94 0.97 0.96 0.93 0.94

Bio

0.96 0.86 0.94 0.97 0.97 0.95 0.94

0.5 Chem

0.87 0.89 0.88 0.90 0.84 0.77 0.89

Chem

0.91 0.87 0.89 0.90 0.89 0.85 0.90

0.0 −0.5

Cyber

0.88 0.88 0.92 0.95 0.89 0.86 0.90

Cyber

0.91 0.86 0.92 0.95 0.94 0.93 0.90

CS Ph H il. is to ry La w M ac ro

Bi o

em

Ch

CS Ph H il. is to ry La w M ac ro

em

Ch

Bi o

−1.0

Pearson r

Bio

Mean correlation with 7 MMLU tasks

Measured WMDP-MMLU coupling across 84 rank-256 interventions Raw margin correlation

NLL-adjusted breadth 1.00 0.75 0.50 0.25 0.00 −0.25 −0.50 −0.75 −1.00 Bio

Chem

Cyber

Figure 14: Measured WMDP–MMLU coupling at rank 256. Pearson correlations of margin drops across

84 single-coordinate interventions, three WMDP domains against seven MMLU subjects, before (left) and after (middle) removing each intervention’s MiniPile ∆NLL; right, the mean adjusted correlation with 95% block-bootstrap intervals. Coupling is broad for all three domains; the registered cyber-breadth contrast is indistinguishable from zero. Split A diagnostic.

18

B.4

The access matrix

Table 1 is the sublattice of Fig. 3 as a deployment would consume it: each node a principal against the full metric panel, on both splits. Table 1: The deployment’s access matrix. Each lattice node as a principal against the metric panel: per-domain

suppression, collateral on both macros, fluency, and cost as |supp(c)| with total rank withdrawn. Measured cells are split A / split B, in points, against that split’s own full privilege (headroom 43.4/40.1 bio, 27.8/22.8 chem, 19.2/16.6 pp cyber); fluency and cost are split-independent. Rows ascend in privilege; the three omitted joins equal c⊤ exactly. The single-profile rows are the deployed profiles’ metric panel. principal

B.5

bio

chem

cyber

adj.

dist.

ppl

dials/rank

cb ∧ cch ∧ ccy cb ∧ cch cb ∧ ccy cch ∧ ccy

8.6/6.1 7.7/6.8 8.3/5.0 5.0/3.5

6.1/9.0 9.2/6.9 9.2/9.4 4.9/6.9

2.3/0.3 1.7/1.5 4.5/1.8 1.4/1.4

6.4/4.1 2.9/2.9 3.5/1.7 2.9/1.7

5.1/3.7 3.1/6.0 3.1/1.4 4.7/1.8

1.37× 1.18× 1.22× 1.27×

11 / 12390 7 / 7782 8 / 8704 9 / 10342

cb cch ccy

7.5/3.8 5.2/3.9 1.6/3.8

6.7/4.5 16.0/5.3 7.4/4.9

0.4/0.2 -0.1/0.9 3.4/-1.0

-2.9/1.7 -1.7/2.3 -2.3/0.6

0.4/2.9 0.2/2.9 -0.4/-1.9

1.09× 1.10× 1.12×

4 / 4096 5 / 5734 4 / 4608

cb ∨ cch c⊤

4.9/3.0 0.0/0.0

5.5/1.2 0.0/0.0

-1.4/0.8 0.0/0.0

-1.7/0.6 0.0/0.0

0.8/4.1 0.0/0.0

1.02× 1.00×

2 / 2048 –

The SmolLM2 generalisation

Table 2: Cross-family replication. Each claim in both lineages, on both halves: x → y is split A → split B,

and suppression is also given as a fraction of the domain’s headroom above chance — what the objective’s floor makes removable. Split A reproduces every previously registered value exactly, which is what licenses reading the split-B column beside it. Provenance differs by column: the Qwen3 suppression rows quote the granular search arms as previously registered, not the deployed atoms of Table 1 (bio 7.5 → 3.8, chem 16.0 → 5.3, cyber 3.4 → −1.0); the SmolLM2 rows are the pre-registered all-selected atoms of Fig. 15. Held-out reading costs every suppression claim roughly half its size in both lineages; chem inverts on SmolLM2; the chem+cyber weakening reverses on B and is withdrawn; utility non-composition is the only claim that grows on the held-out half, in both. ‡: independently selected parents; a single joint search does reach in-gate meets. §: a property of the search, which never reads split B. ¶: at 1.20× (Qwen3) and 1.30× (SmolLM2); perplexity ratios are split-independent throughout. Claim

Qwen3-1.7B

SmolLM2-1.7B

bio suppressible chem suppressible cyber suppressible¶ no in-gate cyber profile frontier beats selected§ atoms/meets suppress no in-gate meet‡ joins cheap, weak, in-gate triple strengthens bio chem+cyber destroys chem utility non-composition

−11.79 → −8.01, 27 → 20% −19.02 → −6.94, 68 → 31% −5.34 → −1.21, 28 → 7% cheapest 1.120× 12 of 13 arms 223 → 186 of 270 0 of 24 runs yes −13.21, 8 → −15.38, 10 runs 9 of 24 → reverses +6.84 → +7.00 distant

−10.06 → −6.12, 39 → 24% −7.36 → +4.08, inverts −7.85 → −2.52, 68 → 26% cheapest > 1.10× 3 of 3 arms 44 → 21 of 66 0 of 4 runs 3 of 3, 1.03–1.10× survives, 3 runs 4 of 4 n.s. → none +16.99 → +17.12 distant

✓ ∼ ✓ ✓ ✓ ✓ ✓ ✓ ✓ — ✓✓

Design. Table 2’s lattice rows pool four SmolLM2 lattice runs. Because each search arm re-measured 40 finalists on the reporting set, two parents per domain are available without any further search: the arm’s own pre-registered pick, and the strongest finalist that leaves both retention macros within 2 pp. Crossing two levels of three factors in a 23−1 fractional factorial (bio ⊕ chem ⊕ cyber = 0) covers all twelve distinct parent pairs in four runs, of which the all-selected run is one, so three additional runs suffice. Each run emits twelve nodes (three atoms, three pairwise meets, the triple, three joins, and the triple join) in about seven minutes. Parents. The all-selected run’s three atoms are the nodes cb , cch and ccy of Fig. 15. The frontier parents, which no figure draws, are bio −12.42 pp at 1.3831×, chem −9.82 at 1.2225 19

wmdp-bio

wmdp-chem cch ^ ccy

wmdp-cyber ccy

cch _ ccy

¢+6.4/-0.6 1.53x

¢-4.1/-1.2 1.30x

¢-4.7/-3.5 1.10x

cb ^ cch ^ ccy

cb ^ ccy

cch

cb _ ccy

cb _ cch _ ccy

c>

¢+8.7/+9.9 1.97x

¢+0.6/+4.1 1.50x

¢-4.1/+0.6 1.20x

¢-3.5/-1.7 1.08x

¢+0.0/+0.0 1.00x Zero by definition

cb ^ cch

cb

cb _ cch

¢+0.0/+0.0> 1.00x ´c

¢+0.0/+4.1 1.38x

¢-3.5/+3.5 1.24x

¢-4.1/+0.0 1.03x

Minimum privilege (meets)

Full privilege (joins)

Figure 15: The measured sublattice (SmolLM2-1.7B). The all-selected run’s twelve nodes, drawn exactly as

bio

10 cyber

5

chem

0

Selected, split A Same, split B (held out)

−5

−6

−4

5

B: +2.8 pp

0

−10

−2

Split A Split B Triple

−5

wmdp-bio wmdp-cyber wmdp-chem

−10

Meet ¡ parent suppression (pp)

Suppression (pp, higher = better)

Fig. 3 and pinned to its 16 pp scale, so heights are directly comparable across lineages. chem’s atom bar runs below baseline on B: the gate raises chem accuracy in this lineage. The triple strengthens bio; joins are cheap, weak, and the only in-gate nodes (1.03–1.10×), the faded one equal to c⊤ exactly, its parents gating disjoint supports. The distant macro, not drawn, is Theorem A.7’s demonstration in this lineage: no atom moves it by more than 1.6 pp, the triple loses 17.1 — individually harmless, jointly destructive.

0

2

Adjacent-macro collateral (pp, higher = worse)

A: -1.5 pp Below 0: meet suppresses less than the parent

0.10

0.15

0.20

Support overlap (Jaccard)

0.25

Figure 16: Profiles and composition (SmolLM2-1.7B). Figs. 4a and 4b redrawn on SmolLM2 from this

appendix’s three search arms and four lattice runs. (a) The 120 gate-verified finalists, 40 per arm. SmolLM2 has no probe run, so the selected markers are read off the all-selected lattice run’s atoms, whose gated supports are identical to the arms’ pre-registered picks — the values of Table 2’s first three rows. Every arrow points down and to the right (less suppression, more collateral), only bio’s held-out interval clears zero, and collateral changes sign for bio and chem: gating helped the adjacent macros on the half that chose it. (b) All 36 (meet, parent, domain) records from the four runs. The reversal reproduces at a quarter of Qwen3’s family size: sub-additive records fall from 25/36 on A to 17/36 on B, and the medians move −1.49 → +2.82 pp (η 0.84 → 1.14).

and cyber −8.96 at 1.2772. A frontier parent is selected on raw suppression rather than on the pre-registered bootstrapped lower quartile, so it is less robust by construction (stable scores −2.996/ − 1.942/ − 1.407 against −1.686/ − 0.166/ − 0.104); each result records this per domain in profile_provenance.post_hoc_frontier_pick, and the all-selected run carries no such asterisk and is the one quoted in the main text. The profile-reproduction guard was exact on all four runs (worst deviation 0.0000 pp of a 0.05 tolerance, over 36 checks), so every parent transferred into the lattice without drift. Corrected verdict over the pooled family: composition, 36 tests, BH keeps one — the triple strengthening bio (−6.92 pp, p = 10−4 ); suppression, 84 tests deduplicated to 66, BH keeps 44. The chem+cyber weakening of chem appears at +4.29, +4.29, +5.52 and +9.20 pp across the four runs. Four-of-four agreement in sign is not itself a test at this family size (a sign test alone gives p = 0.125), which is why the main text reports the row as consistent and unresolved.

20

Related documents

• Capability-Gated Language Models: Security Composes, Utility Does Not#819893
• Capability-Gated Language Models: Security Composes, Utility Does Not#809897
• From Capability to Assurance in Autonomous Penetration-Testing Harnesses: A Framework and Reference Implementation#1037347
• 120 Domain-Specific Languages for Security#141652
• Why Jailbreaks Succeed in Diffusion Language Models: An Energy Landscape Analysis#1105400