Permit: Permission-Aware Representation Intervention for Controlled Generation in Large Language Models

TL;DR

Permit introduces a permission-aware framework that enforces fine-grained control over large language models' outputs by intervening in hidden states, significantly reducing information leakage.

Contribution

It proposes a novel method to control LLM outputs by manipulating hidden states based on permission conditions, with minimal additional parameters.

Findings

Permit outperforms state-of-the-art methods in permission control accuracy.

It reduces information leakage to near zero.

Achieves over 18% F1-score improvement with >98% fewer trainable parameters.

Abstract

Large language models (LLMs) are increasingly deployed in enterprise settings where they handle sensitive documents and user context, raising acute concerns over security and controllability. Conventional access control regulates whether information is accessible to the model, yet leaves how the model uses that information at generation time largely unconstrained: once sensitive content enters the context, outputs may still drift beyond a user's authorized scope. We present Permit, a novel permission-aware representation intervention framework that closes this gap by enforcing fine-grained control directly on the model's hidden states. Through exploratory analysis, we find that permission conditions induce hidden-state shifts that are (i) separable across permissions and (ii) concentrated in a small set of dominant directions. Permit exploits this geometry in two stages: it first identifies a permission-sensitive subspace from activation differences across permission conditions, and then performs lightweight interventions within this subspace to steer generation, with two concrete instantiations (offset-based and gated). Both operate atop a frozen backbone with only a handful of permission-specific parameters, achieving precise control with minimal overhead. Experimental results demonstrate that Permit performs better than the state-of-the-art method across multiple permission settings while driving information leakage to near zero, achieving over 18% F1-score improvement with >98% fewer trainable parameters.