迈向无风险的开放权重模型：在LLM中区分公共与私有能力
Toward Open Weight Models Without Risks: Separating Public and Private Capabilities in LLMs
摘要
开放权重的大型语言模型能够推动科学进步并实现广泛的应用。然而，这种模型使得对敏感功能的控制变得困难。目前的做法要么是提前限制那些危险功能的使用，要么通过使用特定模型变体、输入/输出监控器以及API权限的封闭服务来限制访问。前者容易引发破解问题，同时却让所有用户都无法使用这些功能，从而增加了少数用户带来的风险；后者则与开放权重发布方式根本不兼容。在本文中，我们提出了分层语言模型——即一组开放的权重可以支持多种功能级别。在默认的公共配置下，分层语言模型表现得就像普通语言模型一样。一个紧凑的秘密密钥可以指定对一小部分参数的排列方式，从而生成另一种计算图，进而实现额外的功能。我们开发了一种训练方案，该方案从零开始同时训练两种配置，然后利用正则化技术对带有秘密密钥的配置进行微调，以保留公共模型的特性。我们训练了拥有1.8亿和6.5亿参数的分层语言模型，并发现带有秘密密钥的配置能够学习新语言、理解指令并记住私人知识，而公共配置则不具备这些能力。此外，我们的方法还可以自然地应用于多个层级结构。由于授权机制基于模型的权重结构而非输入数据，因此这种机制能够抵抗基于微调的提取和部分密钥泄露行为。总体而言，分层语言模型为实现开放权重发布与选择性功能控制之间的平衡提供了可能。
English Abstract
Open-weight Large Language Models (LLMs) enable scientific progress and broad deployment. However, they make it difficult to control access to sensitive capabilities. Current practice either suppresses dangerous capabilities before release or mediates access through closed services that use specialized model variants, input/output monitors, and API permissions. The former is susceptible to jailbreaks while sacrificing capability for all users to mitigate the risks posed by a few, and the latter is fundamentally incompatible with open-weight release. In this paper, we propose Tiered Language Models (TLMs), where a single set of released weights supports multiple capability levels. In its default public configuration, a TLM behaves as a conventional LLM. A compact secret key specifies a permutation over a small parameter subset, inducing an alternative computation graph over the same weights that exposes additional capabilities. We develop a training protocol that jointly pretrains both configurations from scratch, then fine-tunes the keyed configuration on private data with regularization to preserve the public model's behavior. We pretrain 180M- and 650M-parameter TLMs and demonstrate that the keyed configuration can acquire a new language, gain instruction-following ability, and memorize private factual knowledge, whereas the public configuration exhibits none of these capabilities. Moreover, we show that our approach extends naturally to multiple hierarchical tiers. Because authorization operates on the model's weight structure rather than in the input space, the mechanism resists fine-tuning-based extraction and partial key compromise. In general, TLMs take a step toward reconciling open-weight release with selective capability control.