Chain-of-Authorization: Embedding authorization into large language models

Yang Li; Yule Liu; Xinlei He; Youjian Zhao; Qi Li; Ke Xu

cs.AIMar 24, 2026

Chain-of-Authorization: Embedding authorization into large language models

Authors: Yang Li, Yule Liu, Xinlei He, Youjian Zhao, Qi Li, Ke Xu

Organizations: Department of Computer Science and Technology, Tsinghua University . · Data Science and Analytic Thrust, Information Hub, The Hong Kong University of Science and Technology (Guangzhou) . · Institude for Math and AI, Wuhan University .

Abstract

Although Large Language Models (LLMs) have evolved from text generators into the cognitive core of modern AI systems, their inherent lack of authorization awareness exposes these systems to catastrophic risks, ranging from unintentional data leakage to unauthorized command execution. Existing defense mechanisms are fundamentally decoupled from internal reasoning, rendering them insufficient for the complex security demands of dynamic AI systems. Here, we propose the Chain-of-Authorization (CoA) framework, a paradigm that internalizes access control as a foundational cognitive capability. By systematically redesigning the input-output format and fine-tuning the model on synthesized data with complex permission topologies, CoA forces the model to generate a structured authorization trajectory as a causal prerequisite for any substantive response or action, thereby enabling LLMs to internalize access boundaries within dynamic reasoning environments. CoA maintains high utility in authorized scenarios while achieving high rejection rates of unauthorized prompts and robust defense against diverse adversarial attacks. By embedding authorization directly into the reasoning process, CoA provides a principled architectural blueprint for deploying secure LLMs as the cognitive cores of modern AI systems.

Figures & tables

Figure 1: Overview of the Chain-of-Authorization (CoA) framework. The upper half illustrates the mechanistic design, and the lower half illustrates the learning paradigm.

		WMDP	MMLU	SQuAD	CovidQA	Mobile Actions
Qwen3 1.7B	Base	$28.00{\color[rgb]{0.5,0.5,0.5}(\blacktriangledown 33.77)}$	$50.00{\color[rgb]{0.5,0.5,0.5}(\blacktriangledown 9.45)}$	$31.95{\color[rgb]{0.5,0.5,0.5}(\blacktriangledown 54.69)}$	$48.40{\color[rgb]{0.5,0.5,0.5}(\blacktriangledown 14.75)}$	$62.03{\color[rgb]{0.5,0.5,0.5}(\blacktriangledown 33.13)}$
	SFT	61.77	59.45	86.64	63.15	95.16
	Extra	$\mathbf{61.22{\color[rgb]{0,0,1}(\blacktriangledown 0.55)}}$	$46.27{\color[rgb]{0.5,0.5,0.5}(\blacktriangledown 13.18)}$	/	/	$\mathbf{94.84{\color[rgb]{0,0,1}(\blacktriangledown 0.32)}}$
	PermLM	$51.84{\color[rgb]{0.5,0.5,0.5}(\blacktriangledown 9.93)}$	$56.00{\color[rgb]{0.5,0.5,0.5}(\blacktriangledown 3.45)}$	$31.95{\color[rgb]{0.5,0.5,0.5}(\blacktriangledown 54.69)}$	$27.50{\color[rgb]{0.5,0.5,0.5}(\blacktriangledown 35.65)}$	$55.00{\color[rgb]{0.5,0.5,0.5}(\blacktriangledown 40.16)}$
	sudoLM	$29.39{\color[rgb]{0.5,0.5,0.5}(\blacktriangledown 32.38)}$	$38.91{\color[rgb]{0.5,0.5,0.5}(\blacktriangledown 20.54)}$	$68.48{\color[rgb]{0.5,0.5,0.5}(\blacktriangledown 18.16)}$	$56.41{\color[rgb]{0.5,0.5,0.5}(\blacktriangledown 6.74)}$	$69.06{\color[rgb]{0.5,0.5,0.5}(\blacktriangledown 26.10)}$
	CoA	$59.59{\color[rgb]{0.5,0.5,0.5}(\blacktriangledown 2.18)}$	$\mathbf{56.35{\color[rgb]{0,0,1}(\blacktriangledown 3.10)}}$	$\mathbf{84.68{\color[rgb]{0,0,1}(\blacktriangledown 1.96)}}$	$\mathbf{60.87{\color[rgb]{0,0,1}(\blacktriangledown 2.28)}}$	$94.53{\color[rgb]{0.5,0.5,0.5}(\blacktriangledown 0.63)}$

Table 1: Accuracy (%) of various methods on different backbone models and datasets. “/” denotes training failure or infeasible method. Subscripts show absolute difference from SFT (

\blacktriangle

up,

\blacktriangledown

down), with blue highlighting results closest to SFT.

Figure 2: Accuracy and rejection rate across five datasets under mismatch and public authorization states, where each circle represents the average accuracy of a method on a group of specific datasets across three backbone models, with the line mapping to its variance.

ASR( $\downarrow$ )	Qwen3-1.7B		Llama3-8B-Instruct		Mistral-7B-v0.3
ASR( $\downarrow$ )	SudoLM	CoA	SudoLM	CoA	SudoLM	CoA
None	100.00/3.67	0.14/6.54	78.64/9.25	0.14 / 0.00	98.50/17.82	0.00 / 0.00
Prefix Injection	100.00/3.27	0.14 /6.80	79.18/0.00	0.14 / 0.00	0.95/0.00	0.27 /0.00
Style Injection	100.00/99.86	0.14 / 9.12	51.43/7.89	0.14 / 0.14	98.10/66.12	0.14 / 0.00
Misrepresentation	99.86/0.00	0.14/5.58	57.28/4.90	0.00 / 0.00	97.28/1.77	0.14 / 0.00
Logical Appeal	100.00/0.00	0.00 /5.44	72.38/3.68	0.14 / 0.00	98.24/0.69	0.00 / 0.00

Table 2: Attack Success Rate (%) under the mismatch and public authorization state on WMDP. Bold values indicate the best results. Results are shown in the mismatch/public format.

Figure 3: Visualization of hidden states across different authorization scenarios.

Figure 4: Step-wise causal intervention on CoA trajectories.

Figure 5: Impact of learning rate on accuracy and rejection rates under different authorization states.

Figure 7: Illustrations of experimental Chain-of-Authorization templates designed for various authorization scenarios. Different colors indicate distinct authorization phases: resource review ( ), identity verification ( ), and decision making ( ).

	WMDP	MMLU	SQuAD	Covid-QA	Mobile-Actions
Dataset Size (Train/Test)	2936/732	11233/2809	2262/2036	1252/155	5794/640
#Permission Labels	3	57	100	1234	5

Table 3: Dataset Details.

LLM Security

Large language model (LLM) security studies attacks, privacy risks, and defenses across model training, inference, and deployment.

See all 322 papers

SFCoT: Safer Chain-of-Thought via Active Safety Evaluation and Calibration
Mar 16, 2026Yu Pan, Wenlong Yu, Tiejun Wu +4LLM Safety Alignment Jailbreak Defense
Department College of Intelligence and Computing, Tianjin University · NSFOCUS Technologies Group Co., Ltd. · College of Management and Economics, Tianjin University +1
Metis: Learning to Jailbreak LLMs via Self-Evolving Metacognitive Policy Optimization
May 11, 2026Huilin Zhou, Jian Zhao, Yilu Zhong +7Inference-Time Optimization Adversarial Attacks on LLMs
University of Science and Technology of China · Institute of Artificial Intelligence (TeleAI), China Telecom
Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems
Aug 31, 2026Panduranga Sai Varma Dantuluri, Jyotirmoy SundiMulti-Agent LLM Systems LLM Agent Security
VotalAI

Mar 16, 2026J/K move · Enter open · S save

SFCoT: Safer Chain-of-Thought via Active Safety Evaluation and Calibration

Yu Pan, Wenlong Yu, Tiejun Wu, Xiaohu Ye+3

Department College of Intelligence and Computing, Tianjin University · NSFOCUS Technologies Group Co., Ltd. · College of Management and Economics, Tianjin University+1

LLM Safety Alignment Jailbreak Defense Language Model Safety Evaluation Adversarial Attacks on LLMs

Open paper AskPDF arXiv

Large language models (LLMs) have demonstrated remarkable capabilities in complex reasoning tasks. However, they remain highly susceptible to jailbreak attacks that undermine their safety alignment. Existing defense mechanisms typically rely on post hoc filtering applied only to the final output, leaving intermediate reasoning steps unmonitored and vulnerable to adversarial manipulation. To address this gap, this paper proposes a SaFer Chain-of-Thought (SFCoT) framework, which proactively evaluates and calibrates potentially unsafe reasoning steps in real time. SFCoT incorporates a three-tier safety scoring system alongside a multi-perspective consistency verification mechanism, designed to detect potential risks throughout the reasoning process. A dynamic intervention module subsequently performs targeted calibration to redirect reasoning trajectories toward safe outcomes. Experimental results demonstrate that SFCoT reduces the attack success rate from

58.97\%

12.31\%

, demonstrating it as an effective and efficient LLM safety enhancement method without a significant decline in general performance.

Abstract

LLM Security

Explore similar work

SFCoT: Safer Chain-of-Thought via Active Safety Evaluation and Calibration

Metis: Learning to Jailbreak LLMs via Self-Evolving Metacognitive Policy Optimization

Delegation Without Trust: An Empirical Gap Analysis of Identity, Authorization, and Runtime Governance in Multi-Agent LLM Systems