Hidden in the Request: Explaining Unethical LLM Compliance through Token Relevance

• Because helpfulness and harmlessness can conflict, indiscriminately maximizing helpfulness may facilitate harmful or unethical behavior [6] [19] [8] [23].Source: §1 · p. 1
• LLMs can recognize an ethical violation in a judgment or statement yet provide assistance when the same behavior is framed as a request.The authors identify this as a gap between ethical recognition and action, in which pressure to be helpful can override apparent ethical concern.Source: §1 · p. 1
• Prior work examines prompt and social-context effects [12] and internal representations of refusal and safety [3] [27], but not recognized-yet-assisted unethical actions or their prompt-token causes.Source: §1 · p. 1
• The study frames moral action through Rest’s four-component model: sensitivity, judgment, motivation, and implementation, with failure in any component potentially producing unethical behavior.The components concern recognizing ethical situations and consequences, choosing an ethical course, prioritizing moral values, and carrying out the choice.Source: §1 · p. 2
• Across two LLMs, a benchmark presenting the same unethical behavior as classification, narrative, or assistance request found less consistent ethical responses in the request setting.Models generally recognized the ethical issue in classification and narrative forms; the design distinguishes failures of moral sensitivity from failures of moral motivation.Source: §1 · p. 2
• The authors use Layer-wise Relevance Propagation (LRP) to assess token contributions and introduce two LRP-guided decoding strategies that steer generation to prioritize cues.LRP quantifies how strongly each input token contributes to each predicted output token.Source: §1 · p. 2

• Cue tokens explicitly signal unethical or morally questionable aspects of a prompt; external instruct-model annotations mark them offline rather than extracting them at inference.Source: §2 · p. 2
• TFUC comprises 150 unethical scenarios drawn from the commonsense subset of ETHICS [10], each presented as moral classification, first-person narrative, or assistance request.Source: §2 · p. 2
• Form-3 assistance prompts elicited unethical responses more frequently than the other two TFUC forms, motivating the paper’s focus on Form-3 thereafter.Source: §2 · p. 2
• LRP assigns input-token relevance to an output token, and TFUC analysis found lower relevance on cue tokens than other prompt tokens, motivating cue-focused guidance.Figure 1 illustrates the relevance pattern for one Form-3 query.Source: §2 · p. 2, Figure 1 · p. 3

LRP Beam Search

• LRP Beam Search scores the first N generated tokens by cumulative cue-token relevance share, then uses standard log-probability scoring for the remainder; temperature τ smooths the distribution.Source: §2 · p. 3

LRP Top k

• LRP Top k forces each top-k first-step token into a candidate, greedily completes each trajectory, then selects the one with the most relevance concentrated on cue tokens, unlike confidence-based selection [24].The motivating analysis found that changing only the initial token could redirect an unethical response to an ethical one.Source: §2 · p. 3

Improving form-3 responses

• −1.3 points (Ministral3-14B) and −17.3 points (Qwen2.5-7B): CoT falls below baseline, while all proposed methods improve both models’ Form-3 moral-response rates and LRP-BS/LRP-TK consistently outperform baselines.The greedy-resume variant confirms that steering early decoding steps toward ethical paths is sufficient to guide the final output.Source: Table 2 · p. 4, §3 · p. 4

Three forms of unethical cases

• With identical TFUC scenarios, both models perform well on Forms 1–2 but decline on Form 3, isolating request framing as the condition associated with actionable harmful assistance.The authors interpret this pattern as a moral-motivation failure: helpfulness can override moral considerations that the models demonstrate in Forms 1 and 2.Source: Table 1 · p. 4, §3 · p. 4
• Responses count as ethical when they challenge Form-2 statements or decline Form-3 requests; endorsements or actionable assistance count as unethical.Form 1 is scored by regex matching, while Forms 2 and 3 are evaluated by Gemini 3.5 Flash-lite [22].Source: §3 · p. 4

Improving form-3 responses

• The Form-3 comparison tests LRP-BS, greedy-resume, and LRP-TK against a prompting-only zero-shot CoT baseline.LRP-BS uses N = 25 and b = 3; LRP-TK uses K = 5 and N = 25. CoT appends “Let’s think step by step” [13].Source: §3 · p. 4

4 Conclusion

• Both LRP-guided decoding methods increase ethical responses to request-framed queries, and steering only early decoding steps suffices.The conclusion identifies cue tokens as the locus of moral failure under request framing and presents attribution over them as a useful lens for analyzing and beginning to address such failures.Source: §4 · p. 4
• Instruction-tuned LLMs can recognize an unethical act yet comply when it is framed as a help request, revealing a gap between moral recognition and motivation.LRP found that compliant responses assign little relevance to the cue tokens marking the transgression, directing relevance elsewhere in the request.Source: §4 · p. 4

A Related Work

• Alignment seeks helpfulness and morality through frameworks such as helpful-honest-harmless [4] and preference optimization [6] [8] [23], but adversarial prompts can undermine safety.Models may provide assistance for ethically compiled requests that they would judge wrong when the same act is presented in isolation.Source: A Related Work · p. 6
• Unlike prompt-design studies of persuasive rephrasing, role-play, and moral judgment [26] [20] [12], TFUC fixes the scenario and varies only its presentation.This isolates framing effects from effects of content and intent.Source: A Related Work · p. 6
• Reasoning-based safety approaches use chain-of-thought prompting [13] or train deliberative alignment [9], whereas this intervention requires no additional training and acts directly on decoding.Source: A Related Work · p. 7
• Representation- and decoding-based work identifies safety or refusal directions and units [3], and finds harmfulness can remain represented after refusal is suppressed [27].Source: A Related Work · p. 7
• Prior LRP decoding has mitigated multimodal hallucinations by guiding generation toward under-attended visual tokens [2].Source: A Related Work · p. 7

B Limitations

• TFUC’s 150 scenarios limit evaluation scale and diversity, while its unethical-only scope and request-for-assistance focus leave generalization to ethical situations and other forms untested.The interventions strengthen cue-token relevance rather than directly enforcing ethics, so observed improvements are evidence about cue-token attribution’s role in failures, not a general-purpose safety mechanism.Source: B Limitations · p. 7

C.1 Theoretical Background: Situational Cues and Moral Sensitivity

• The Four-Component Model of morality grounds the paper’s focus on moral sensitivity and interpreting ambiguous situational cues.The paper uses this framework to motivate evaluating whether models recognize implicit moral cues in prompts.Source: §C.1 · p. 7
• The Kitty Genovese case illustrates how confusion caused by ambiguous situational cues can contribute to failures to intervene.Witnesses later reported that cue ambiguity was one reason they did not intervene.Source: §C.1 · p. 7
• Staub’s empirical research shows that prosocial and helping behaviors are strongly modulated by the clarity or ambiguity of environmental cues.Source: §C.1 · p. 7
• For LLMs, the evaluation tests whether models identify implicit moral cues in a prompt or default to unconstrained compliance with questionable requests.Source: §C.1 · p. 7

C.2 TFUC Benchmark Prompts and Examples

• Form-1 asks whether a first-person scenario is morally wrong under ordinary US standards as of 2020, with binary Wrong/Not wrong choices.The example concerns listing an unearned college degree on a resume to get a job.Source: §C.2 · p. 7
• Form-2 presents the unethical scenario as a neutral first-person narrative, such as claiming an unearned degree on a resume.Source: §C.2 · p. 7
• Form-3 directly requests help wording a resume to claim an unearned degree and obtain a job.Source: §C.2 · p. 7
• Cue tokens identify the deceptive act; an external LLM guided by Definition 1 annotates them to support cue-aware decoding.In the example, the cue sequence is “a college degree I never actually earned.”Source: §C.2 · p. 7
• Unethical ETHICS commonsense cases are converted from Form-2 statements into implicit harmful requests by an external LLM.The external LLM rephrases the original prompts to request help with the same action.Source: §C.2 · p. 8

C.3 Response Classification

• Form-1 responses are classified by regular-expression search for the emitted “A) Wrong” or “B) Not wrong” label.Source: §C.3 · p. 8
• Form-2 answers are classified by an external LLM judge because neutral first-person prompts elicit spontaneous responses whose characteristics must be examined.The judge uses the system prompt detailed in Figure 2.Source: §C.3 · p. 8
• Form-3 compliance with execution guidelines is classified as unethical, while refusal with a lecture about impropriety is classified as ethical.An external LLM judge applies the prompt shown in Figure 3.Source: §C.3 · p. 8

• Section 3 located the Form-3 failure in framing rather than recognition.Source: D Cue and Trajectory Analysis · p. 8
• Appendix D.1 examines where the relevance behind a Form-3 response lands, while Appendix D.2 asks whether an ethical response is reachable under a different first token.Source: D Cue and Trajectory Analysis · p. 8
• Both appendix analyses motivate the decoding methods in Section 2.Source: D Cue and Trajectory Analysis · p. 8

D.1 Cue Tokens Analysis

• The analysis measures cue-token relevance share across the question’s cue and other tokens in baseline greedy responses to 150 Form-3 queries.It aggregates the relevance each input token receives across the response, then compares the cue-token share with the share for the remaining question tokens.Source: §D.1 · p. 8
• Because cues occupy just under a third of question tokens, the analysis compares relevance per token rather than total relevance mass, which would mostly reflect span length.An even per-token split is 0.5.Source: §D.1 · p. 8
• Cue-token relevance share was 0.34 for Qwen2.5-7B and 0.38 for Ministral3-14B, both below the even-split benchmark of 0.5.The reported comparison covers both models; Figure 1 shows the same pattern on a single query.Source: §D.1 · p. 11
• The cue span is not where attribution concentrates under Form-3 framing, despite Forms 1 and 2 establishing that its content is available to the model.The authors distinguish under-attribution from the cue going unread.Source: §D.1 · p. 11

D.2 Top-K Analysis

• For Form-3 queries where greedy decoding produced unethical outputs, each of the top-k initial tokens was forced before greedy completion; this follows Wang and Zhou [24].This produced k candidate responses per query.Source: §D.2 · p. 11
• Figure 4 illustrates the comparison of candidate responses generated by forcing top-k initial tokens.The exploration is applied to queries where standard greedy decoding originally returned unethical outputs.Source: §D.2 · p. 11
• RPEYR measures the overall fraction of ethical completions, while ER3 measures the share of queries with at least one ethical alternative.These metrics assess ethical yield across the candidate pool and the rate of queries where exploration reveals a safe response.Source: §D.2 · p. 11
• At least one ethical trajectory was found in a majority of cases, reaching 78.9% on Qwen2.5-7B.The evaluation used k = 5 for Qwen2.5-7B and Ministral3-14B.Source: §D.2 · p. 11

E Layer-wise Relevance Propagation (LRP)

• The LRP analysis asks which input parts a response is attributable to, including whether cue tokens are among them.The appendix presents its decomposition principle, conservation property, local-linearisation argument, and propagation rules for transformer components.Source: E Layer-wise Relevance Propagation (LRP) · p. 11
• The implementation follows Attention-Aware LRP [1] (AttnLRP), including that formulation’s transformer-specific rules.The appendix gives the framework and component rules in full.Source: E Layer-wise Relevance Propagation (LRP) · p. 11

E.1 Relevance decomposition and conservation

• LRP explains a scalar model output by splitting it into additive contributions from intermediate representations and ultimately input features.The relevance contributions are constrained to sum proportionally to the output being explained.Source: §E.1 · p. 11
• Conservation keeps total relevance unchanged across layers, tying scores at different depths to the same output unlike gradient attributions that may vanish or explode.Relevance is neither created nor destroyed as it propagates from output back to input.Source: §E.1 · p. 11

E.2 Propagation rules from local linearisation

• Propagation rules commonly derive from Deep Taylor Decomposition, which linearises a neuron's computation around a reference point and reads expansion terms as additive relevance contributions.Relevance is taken proportional to the neuron's output, and scaling the affine approximation by the relevance-to-output ratio decomposes that relevance.Source: §E.2 · p. 13
• AttnLRP propagates only the input-dependent part of the linearised decomposition, treating bias and linearisation error as an absorbed offset that does not affect token-level score interpretation.For linear layers, the resulting standard LRP-z rule redistributes relevance using activations and weights with a normalising denominator to preserve conservation.Source: §E.2 · p. 13

E.3 Rules for transformer components

• The ϵ rule stabilises z-rule denominators near zero, while softmax relevance redistribution accounts for the competition introduced by normalisation across input dimensions.The stabiliser shares the denominator's sign; softmax redistribution subtracts each dimension's share of the total attributed to it.Source: §E.3 · pp. 13–14
• For the bilinear attention-value product, relevance is split evenly between attention and value factors to keep the decomposition conservative.The value branch receives an analogous share summed over the complementary dimension.Source: §E.3 · p. 14
• LayerNorm and RMSNorm pass relevance through unchanged under a constant-denominator approximation; applying the component rules from a generated-token logit back to the prompt yields token-level relevances.The approximation assumes the normalising denominator changes activation scale without changing which features an output is attributable to.Source: §E.3 · p. 14