The Kernel Blindness Hypothesis: Investigating OS-Level Detectability of LLM Safety Mechanisms

The Kernel Blindness Hypothesis: Investigating OS-Level Detectability of LLM Safety Mechanisms | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Research Article The Kernel Blindness Hypothesis: Investigating OS-Level Detectability of LLM Safety Mechanisms Ata Kilic, Baris Celiktas This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-9190463/v1 This work is licensed under a CC BY 4.0 License Status: Posted Version 1 posted You are reading this latest preprint version Abstract As Large Language Models (LLMs) are integrated into critical infrastructure, externally auditing their safety mechanism activation without internal access becomes essential. This paper investigates whether LLM safety refusals produce a detectable computational footprint at the operating system level across multi- modal side channels. We frame this as a Safety Mechanism Activation Detection problem, employing high-resolution eBPF kernel tracing and GPU telemetry to classify model outputs as Refusal or Compliance. Initial experiments on Meta Llama 3.1 8B yielded high predictive accuracy (AUC ≥ 0.93). However, a rigorous seven-phase analysis revealed this performance was driven entirely by a confounding variable: response length. To isolate genuine safety-mechanism- activation signatures, we applied Length-Controlled Matching, retaining only response pairs with identical token counts. When response length was strictly controlled, the predictive power of kernel and GPU features collapsed to ran- dom chance (AUC ≈ 0.50), despite concurrent white-box analysis proving that the model’s internal representations clearly distinguish safety contexts (AUC 0.84-0.89). We therefore propose the Kernel Blindness hypothesis: under strictly bounded compute environments (single-GPU, 4-bit quantized, non-batched dense transformer inference), the semantic intent of neural operations is indistinguish- able at the kernel level. This phenomenon is rigorously confirmed across three major 7-8B model architectures (Llama 3.1, Gemma, and Mistral), demonstrat- ing that reinforcement learning from human feedback (RLHF) safety alignment produces no externally detectable computational signatures under these specific constraints. This overarching negative result highlights a fundamental limita- tion in black-box monitoring for edge deployments and emphasizes the need for grey-box auditing approaches. Computer Architecture and Engineering Large language models AI safety auditing side-channel analysis kernel tracing eBPF GPU telemetry Full Text Additional Declarations The authors declare no competing interests. Cite Share Download PDF Status: Posted Version 1 posted You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-9190463","acceptedTermsAndConditions":true,"allowDirectSubmit":true,"archivedVersions":[],"articleType":"Research Article","associatedPublications":[],"authors":[{"id":610098280,"identity":"5616ff7f-8e5e-4163-8809-5eefcc4f797c","order_by":0,"name":"Ata Kilic","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAABAElEQVRIiWNgGAWjYBACfvbmh495/0jwyMsfPnCAwSABKJaAX4tkzzFj47ltFnKGM9gSEFoO4NFicCNHTPpvW4Uxww0eA6gNBLQwHMhhk85tk0hsnN3z8eCPgjSgU3MMmD/uwa2DseEMUMsficR2mbMbDvMY5ACd+saA4cAz3FqYGXuAWhqAtjTkbjjMYFABcipQCx6XsTHzsEnzArU0HMh5cPAHUIs9IS08bDxiIC1A7+cwHAA5zECCgBYJHjZjY6AWOcOeYwZAv6TxSJx5VnDgDB4t9vcfA6OyoY5Hnr358ccff5Ll+NuTNz6owKMF06UgghQNo2AUjIJRMAqwAABodliBgZnI4wAAAABJRU5ErkJggg==","orcid":"","institution":"Işık University","correspondingAuthor":true,"prefix":"","firstName":"Ata","middleName":"","lastName":"Kilic","suffix":""},{"id":610098281,"identity":"b90a40f7-5ca3-4de2-b31b-ff37ebab6876","order_by":1,"name":"Baris Celiktas","email":"","orcid":"","institution":"Işık University","correspondingAuthor":false,"prefix":"","firstName":"Baris","middleName":"","lastName":"Celiktas","suffix":""}],"badges":[],"createdAt":"2026-03-22 10:13:07","currentVersionCode":1,"declarations":{"humanSubjects":false,"vertebrateSubjects":false,"conflictsOfInterestStatement":false,"humanSubjectEthicalGuidelines":false,"humanSubjectConsent":false,"humanSubjectClinicalTrial":false,"humanSubjectCaseReport":false,"vertebrateSubjectEthicalGuidelines":false},"doi":"10.21203/rs.3.rs-9190463/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-9190463/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":105564353,"identity":"9506c1b8-c164-471c-bade-3594a709d2a0","added_by":"auto","created_at":"2026-03-27 12:49:21","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":1374768,"visible":true,"origin":"","legend":"","description":"","filename":"snllmsec.pdf","url":"https://assets-eu.researchsquare.com/files/rs-9190463/v1_covered_194c07c5-b318-42bb-ae5a-af9087df0db6.pdf"}],"financialInterests":"The authors declare no competing interests.","formattedTitle":"\u003cp\u003eThe Kernel Blindness Hypothesis: Investigating OS-Level Detectability of LLM Safety Mechanisms\u003c/p\u003e","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":true,"hideJournal":true,"highlight":"","institution":"Işık University","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true},"keywords":"Large language models, AI safety auditing, side-channel analysis, kernel tracing, eBPF, GPU telemetry","lastPublishedDoi":"10.21203/rs.3.rs-9190463/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-9190463/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"\u003cp\u003eAs Large Language Models (LLMs) are integrated into critical infrastructure, externally auditing their safety mechanism activation without internal access becomes essential. This paper investigates whether LLM safety refusals produce a detectable computational footprint at the operating system level across multi- modal side channels. We frame this as a Safety Mechanism Activation Detection problem, employing high-resolution eBPF kernel tracing and GPU telemetry to classify model outputs as Refusal or Compliance. Initial experiments on Meta Llama 3.1 8B yielded high predictive accuracy (AUC ≥ 0.93). However, a rigorous seven-phase analysis revealed this performance was driven entirely by a confounding variable: response length. To isolate genuine safety-mechanism- activation signatures, we applied Length-Controlled Matching, retaining only response pairs with identical token counts. When response length was strictly controlled, the predictive power of kernel and GPU features collapsed to ran- dom chance (AUC ≈ 0.50), despite concurrent white-box analysis proving that the model’s internal representations clearly distinguish safety contexts (AUC 0.84-0.89). We therefore propose the Kernel Blindness hypothesis: under strictly bounded compute environments (single-GPU, 4-bit quantized, non-batched dense transformer inference), the semantic intent of neural operations is indistinguish- able at the kernel level. This phenomenon is rigorously confirmed across three major 7-8B model architectures (Llama 3.1, Gemma, and Mistral), demonstrat- ing that reinforcement learning from human feedback (RLHF) safety alignment produces no externally detectable computational signatures under these specific constraints. This overarching negative result highlights a fundamental limita- tion in black-box monitoring for edge deployments and emphasizes the need for grey-box auditing approaches.\u003c/p\u003e","manuscriptTitle":"The Kernel Blindness Hypothesis: Investigating OS-Level Detectability of LLM Safety Mechanisms","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2026-03-24 06:31:25","doi":"10.21203/rs.3.rs-9190463/v1","editorialEvents":[{"type":"communityComments","content":0}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"researchsquare","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":true,"externalIdentity":"","sideBox":"","snPcode":"","submissionUrl":"/submission","title":"Research Square","twitterHandle":"researchsquare","acdcEnabled":true,"dfaEnabled":false,"editorialSystem":"","reportingPortfolio":"","inReviewEnabled":false,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"eb04feb3-f8c1-4670-81bf-6238fe9190d8","owner":[],"postedDate":"March 24th, 2026","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"posted","subjectAreas":[{"id":64916800,"name":"Computer Architecture and Engineering"}],"tags":[],"updatedAt":"2026-03-24T06:31:25+00:00","versionOfRecord":[],"versionCreatedAt":"2026-03-24 06:31:25","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-9190463","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-9190463","identity":"rs-9190463","version":["v1"]},"buildId":"XKTyCvWXoU3ODBz1xrDgd","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}