Search papers, labs, and topics across Lattice.
This paper introduces a composable trust model for language models that separates the authority to act from the model's internal generation, allowing for a deterministic input ranking based on source integrity. By implementing a fixed non-model monitor that evaluates inputs according to their trustworthiness, the authors achieve a significant increase in the model's resistance to untrusted input manipulation, raising the genuine-leak defended rate from 27% to 94% with only a 4% cost in clean output quality. Additionally, the model enhances attribution capabilities, improving the identification of lower-trust sources from 0% to 92%, thereby maintaining the integrity of higher-trust information in conflicting scenarios.
A novel trust model for language models dramatically boosts resistance to untrusted input manipulation while maintaining high-quality output.
In a language model, instructions and data share one token stream, so nothing inside the model's generation can keep untrusted text from steering it. We develop a trust model that places the authority to act outside the model, in code: a source's standing, not its content, decides which operation runs and whether it acts. A lower-trust source may inform an answer but not override a higher one. An unmodified model runs inside a deterministic pipeline that ranks inputs by source integrity, and a fixed non-model monitor provably chooses the operation and any outside action from trusted inputs alone. We can measure but not prove the pipeline's resistance to injection; we prompt-tune it and report the rate. On a one-shot held-out set with an unmodified Gemma~4 26B model, passivation and a wrapper (the cascade) raise the genuine-leak defended rate from $27\%$ to $94\%$ at roughly a $4\%$ clean-quality cost ($Q_{\mathrm{rel}}{=}0.96$). Under adaptive red-teaming the proved boundary holds unconditionally, and the measured defense stays at $87\%$. The cascade also attributes a lower-trust source's fact rather than dropping it, raising attribution from $0\%$ to $92\%$, and follows the higher-trust source on a conflict.
