PaperlayerView exact revision on arXiv

Source-linked AI summary

Labels Override Definitions in Jev-Style Typed Decision Models

Seyedarmin Azizi, Erfan Baghaei Potraghloo, Massoud Pedram

arXiv:2610.02586v1cs.AI

TL;DR

Typed decision models are expected to base probabilities on option definitions, but the paper tests whether labels instead drive decisions. Across open systems and language-model readouts, labels often dominate; interventions identify prompt rendering as the distinguishing factor, and the authors provide a test and measure mitigations.

  • Problem

    Option definitions state the intended rule, but whether typed decision models follow definitions or option labels has not been established across systems.

    Source: §1 · p. 2, §2.2 · p. 4

  • Method

    The paper independently varies labels and definitions across classification tasks and PolicyBench, then patches prompt rendering in both directions in open systems.

    Source: §4.3 · p. 6, §8 · p. 16

  • Results

    Across tested systems, three LAYA checkpoints and language-model readouts are mainly label-driven while VON is label-invariant; on PolicyBench, A/B labels raise LAYA-TD accuracy by +0.1511 [+0.1377, +0.1646].

    Source: §1 · p. 2, §5.2 · p. 8

  • Takeaways & Limitations

    Changing whether labels enter the model input removes the effect in LAYA and creates it in VON, and a two-call test lets practitioners identify which regime applies.

    Source: §1 · p. 2, §8 · p. 16

    The study does not measure hosted Jev, so its mechanism claims concern open-weight implementations and language-model readouts.

    Source: §7 · p. 15

Abstract

from arXiv · show

A typed decision model answers a fixed question about an input by returning a probability for each of several caller-defined options. Each option carries a short label and a written definition, which is where a developer states the rule the model should apply. Jev introduced this interface for routing, moderation and triage, open implementations followed, and the same operation occurs whenever a language model is used as a classifier by scoring label strings. We study the open implementations, whose weights we can inspect and patch, and ask whether the probability follows the definitions or the labels. A preference for the label we call option-label bias. Across four open-weight typed decision models, three ways of reading an answer from a Qwen2.5 backbone, eleven classification tasks and PolicyBench, a synthetic routing suite we introduce in which the rule appears only in the definitions, the answer is mostly the labels. Deleting every definition leaves accuracy unchanged (laya-td: 0.8559 against 0.8487), although those definitions support 0.7971 on their own, and renaming the options to A and B raises accuracy by +0.1511 [+0.1377, +0.1646]. One system, von, is unaffected, and the two code bases differ in one expression: laya writes each option as "{label}: {definition}", while von writes only the definition. Changing that expression in both directions, with no weight changed, makes all three laya checkpoints exactly invariant (+0.0000 [+0.0000, +0.0000]) and creates the effect in von, whose accuracy falls from 0.8511 to 0.2281 when a label contradicts its definition. Earlier work attributed this failure to the constrained decision head these models use in place of a text decoder; our results locate it in the prompt rendering. We give a two-call test that tells a practitioner which case applies to their model, and measure what four mitigations are worth.

1 INTRODUCTION

Typed decision models return probabilities over caller-defined options, whose definitions state the intended rule. The paper finds that labels often dominate those definitions, and traces the difference across systems to how options are rendered in the model input.

1 INTRODUCTION

  • Across three LAYA checkpoints and language-model readouts, decisions are mainly determined by labels; VON returns the same probabilities whatever the labels are.Deleting definitions leaves accuracy unchanged, even though the definitions support classification when labels are replaced by A and B.Source: §1 · p. 2
  • Changing only how options are rendered removes label effects from all three LAYA checkpoints and creates them in VON.The intervention changes whether the label appears alongside the definition in the model input, without changing weights, decision head, or calibration.Source: §1 · pp. 2–3
  • Only 5 of 26 applicable evaluations included an ordinary-language-model label-probability baseline, and only 1 of 27 tested invariance to option names.The audit notes that without an invariance test the effect is not visible, and without a baseline it cannot be attributed.Source: §1 · pp. 2–3
  • A two-call test checks whether changing only option labels changes the returned distributions; when labels affect decisions, renaming options A, B raises routing-suite accuracy by +0.1511 [+0.1377, +0.1646].The paper also reports that confidence ranks errors in the wrong direction when a label and its definition disagree.Source: §1 · p. 3
  • The study covers open-weight implementations and language-model readouts, not Jev itself, whose internals remain closed.The authors therefore scope their mechanism claims to open systems.Source: §1 · p. 3

2 BACKGROUND

Typed decision models answer fixed questions with structured outputs, while their option labels and definitions provide distinct information channels. The paper compares readouts and open systems to study how those channels enter a decision.

2.1 WHAT A TYPED DECISION MODEL DOES

  • A choice request supplies a state and question, and returns a selected option, probabilities for the options, and a confidence score; other common types are ordered-scale score and boolean.The criteria field carries option definitions, and the interface produces no text.Source: §2.1 · p. 3, Figure 2 · p. 4

2.2 THE TWO CHANNELS OF A REQUEST

  • Labels and definitions are separate channels: labels can name familiar classes, while definitions state the rule the interface is designed to apply.Experiments vary the channels independently because both can indicate the correct option.Source: §2.2 · p. 4, §2.1 · p. 4

2.3 HOW AN ANSWER IS OBTAINED WITHOUT GENERATING TEXT

  • The paper compares option strings through scoring readouts and also describes generative readouts that sample text and map replies back to options.Typed heads normalize scalar scores across option markers in one pass; language-model scoring normalizes option-string log-probabilities, with length normalization for the label log-probability readout.Source: §2.3 · p. 4

2.4 SYSTEMS STUDIED

  • The systems studied are open-weight LAYA and VON implementations plus language-model readouts over Qwen2.5, Llama-3.1, and Mistral backbones.LAYA constructs a separate input sequence per question, so questions in one request cannot influence one another.Source: §2.4 · p. 5

3 RELATED WORK

Prior work documents changes under option renaming and several other vulnerabilities in typed decision models. This paper distinguishes label preference from input-independent label priors and challenges the proposed decision-head explanation.

Evaluations of typed decision models

  • Earlier evaluations report accuracy across classification and reading-comprehension tasks, probability-axiom violations for linked questions, and answer changes after added context, opinions, or prompt injection.Ling et al. (2026) survey public projects, while Tang & Zheng (2026) review the literature and report evaluation gaps.Source: §3 · p. 5

The effect we study

  • Sun et al. (2026) reported that renaming option sets changes hosted Jev’s answers and attributed the effect to its constrained decision head; this paper instead locates it in prompt rendering.The paper tests the effect on open weights, against language-model baselines, and by changing rendering in both directions.Source: §3 · p. 5

Input-independent label priors

  • Input-independent label priors favor an option regardless of state, whereas option-label bias favors an option’s name over its definition when those channels disagree.Contextual calibration removes the former by dividing out predictions on a content-free input; this paper measures conditions where it helps or does not.Source: §3 · p. 5

4 METHOD

The method varies option labels and definitions independently, tests both ordinary classification and a controlled synthetic routing suite, and evaluates multiple models and readouts. It reports accuracy and additional statistics for decisions and input sensitivity.

4.1 VARYING THE TWO CHANNELS

  • Option variants preserve what options mean while changing how they are presented; aligned, arbitrary, exchanged, misleading, label-only, and neither conditions separate label and definition information.The state is also varied across real, null, and mismatch conditions to assess whether the model uses the input.Source: §4.1 · pp. 5–6, Table 1 · p. 6

4.2 CLASSIFICATION TASKS

  • Eleven public tasks cover fixed-label choice, yes/no polarity, and ordinal classification settings.SST-2, RTE, and CB are fixed-label choice tasks; seven yes/no tasks support polarity measurement, and SST-5 is used where an ordered scale is relevant.Source: §4.2 · p. 6

4.3 POLICYBENCH

  • PolicyBench generates balanced support-ticket examples from six controlled attributes, with seven boolean policies stated only in the true-branch definitions.Ground truth comes from the generating attributes, avoiding label noise, annotator disagreement, and contamination; the primary suite uses an explicit false-branch negation to make definitions comparably substantive.Source: §4.3 · pp. 6–7

4.4 MODELS

  • The model set includes four typed decision heads and three Qwen2.5 sizes, evaluated with length-normalized label scoring, constrained first-token, and generate-then-parse readouts.The three readouts separate the typed head from task-format choices.Source: §4.4 · p. 7

4.5 METRICS

  • Accuracy is reported throughout, with AUROC for evaluating confidence as a ranking of correctness; flip rate measures changed decisions and state-blindness measures agreement with empty-state decisions.A state-blindness value near 1 means decisions remain nearly the same regardless of input; intervals use item-level percentile bootstrap with 4000 resamples.Source: §4.5 · p. 7

5 RESULTS

Across the tested systems, labels can override definitions, and changing how labels enter the input removes this behavior in LAYA and induces it in VON. Further tests find that label sensitivity is distinct from responses to negated questions and can make confidence-based gating misleading.

5.1 WHAT EACH CHANNEL CONTRIBUTES

  • 0.8559 against 0.8487 accuracy shows that deleting definitions does not reduce laya-typed-decisions accuracy, although definitions alone support 0.7971.When labels contradict definitions, accuracy falls to 0.1357; VON instead reaches 0.8511 across labelings and falls to 0.5102 without definitions.Source: §5.1 · p. 7, Figure 3 · p. 8

5.2 RESULTS ON POLICYBENCH

  • +0.1511 [+0.1377, +0.1646] is LAYA-TD’s accuracy gain with arbitrary letters rather than meaningful labels on controlled PolicyBench-XF.The direction of misleading-label effects varies by checkpoint; the initial catch-all false-branch design produced an apparent option-position preference that disappeared with comparable definitions.Source: Table 3 · p. 8, §5.2 · pp. 8–9, §5.2.1 · p. 9

5.3 LANGUAGE-MODEL READOUTS SHOW THE SAME EFFECT

  • +0.1203 [+0.1019, +0.1395] is the Qwen2.5-7B readout’s gain from replacing meaningful labels with A and B on PolicyBench-XF.Mistral-7B shows a comparable +0.1531 [+0.1343, +0.1724] gain; the scoring readouts agree within intervals, while generative-readout comparisons differ across suites.Source: §5.3 · pp. 9–10

5.4 A MODEL THAT IS UNAFFECTED, AND WHY

  • VON is label-invariant because its encoder receives definitions, while labels serve as keys for retrieving definitions and naming answers.Its probabilities remain identical across labelings, and its label-only and neither conditions are exactly 0.5000.Source: §5.4 · p. 10, Figure 4 · p. 11

5.5 ADDING AND REMOVING THE LABEL

  • +0.0000 [+0.0000, +0.0000] is the arbitrary-versus-aligned label contrast after removing labels from all three LAYA checkpoints; adding labels to VON makes its accuracy fall from 0.8511 to 0.2281 under contradictory labels.The patches change one rendering expression while leaving weights, decision head, and calibration unchanged; Table 5 compares the two directions on both suites.Source: Table 5 · p. 11, §5.5 · p. 12

5.6 A TWO-CALL TEST

  • A two-call test compares returned distributions for the same question after changing only labels, identifying whether labels affect the decision.It requires no gold labels, held-out data, or access to model weights.Source: §5.6 · p. 12

5.8 BEHAVIOR OF THE CONFIDENCE SCORES

  • 0.8123 AUROC under ordinary labels drops to 0.2433 when labels contradict definitions, reversing confidence’s ranking of correct and incorrect answers.Under corrupted rendering, confidence-based escalation routes wrong items and accepts correct ones; the proposed alternative is a rendering-disagreement check.Source: Table 6 · p. 13, §5.8 · pp. 13–14

5.7 NEGATED QUESTIONS

  • 0.6419 to 0.3576 is LAYA-TD’s accuracy change after negating questions, while its returned probability remains essentially unchanged.VON also changes decisions on 0.9711 [0.964, 0.979] of negated items despite being label-invariant; the two failures are independent.Source: §5.7 · p. 13

6 MITIGATIONS

The section compares four mitigations and recommends choosing among them based on whether labels affect the model and whether they must retain their meaning.

Choosing a mitigation

  • Run the two-call test first, use arbitrary labels if the task permits, and otherwise consider null-state correction and review of disagreements.A zero flag rate indicates that the procedure is unnecessary for VON; near-constant outputs can also agree while both are wrong, and the neither control distinguishes that case from definition use.Source: §6 · pp. 14–15

M1: arbitrary labels

  • +0.1511 on PolicyBench-XF is the gain from arbitrary labels, but this choice costs accuracy when class names predict the class.The two-call test is the stated way to determine which case applies.Source: §6 · p. 14

M2: null-state prior correction

  • +0.0391 for LAYA-TD under aligned labels and +0.0748 for the Qwen2.5-7B readout are gains from null-state correction.The correction hurts when labels are arbitrary and reduces VON accuracy to exactly 0.5000 in all three conditions; its empty-state call retains definitions, which are VON’s whole input.Source: §6 · pp. 14–15

M3: an instruction to ignore the labels

  • +0.0138 [+0.0077, +0.0200] for LAYA-TD on PolicyBench-XF is the gain from instructing the model to ignore labels, versus +0.1511 for relabeling.The instruction is not a substitute for arbitrary labels.Source: §6 · p. 15

M4: two-rendering disagreement

  • 0.8921 accuracy on retained items, at 0.8100 coverage and 0.8977 precision, is the result of flagging LAYA-TD’s rendering disagreements.This requires one extra call and no training; arbitrary labels instead reach 0.8931 at full coverage, so disagreement review is for cases where labels must keep their meaning.Source: §6 · p. 15

7 LIMITATIONS

The paper’s evidence is limited to open-weight implementations and language-model readouts, with synthetic PolicyBench and natural tasks covering different evaluation properties. Some numerical results depend on the authors’ definition wording, and no conclusion is drawn from laya-multilingual’s near-chance PolicyBench performance.

Scope of evaluated systems

  • The authors did not measure Jev, so claims cover open-weight implementations and language-model readouts, not the hosted commercial model itself.They cannot inspect a closed model’s code to establish the mechanism there.Source: §7 · p. 15

Evaluation data

  • PolicyBench is synthetic and templated, providing exact ground truth, exact class balance, and immunity to contamination at the cost of naturalness.The natural-task suite covers the other side of that trade.Source: §7 · p. 15

Interpretation and wording

  • The argument relies on arbitrary versus arbitrary-exchanged labels and arbitrary versus aligned labels, not the potentially under-specified misleading condition.The definitions are the authors’ wording, and different phrasing would move the absolute numbers.Source: §7 · pp. 15–16

Evaluation boundary

  • The authors draw no conclusion from laya-multilingual’s near-chance performance throughout PolicyBench.Source: §7 · p. 16

8 CONCLUSION

The conclusion locates option-label bias in prompt rendering: writing labels alongside definitions distinguishes affected systems from the unaffected one. It also argues that checking invariance to option names and using a language-model baseline helps identify that behavior’s source.

8 CONCLUSION

  • One of four open-weight implementations satisfies the criteria-field contract, while three do not; whether labels are included alongside definitions distinguishes the groups.Removing labels from the affected systems eliminates the effect, and adding them to the unaffected system creates it, with no weight changes.Source: §8 · p. 16
  • Practitioners can determine which regime their model is in with two calls, and the rendering change costs nothing in latency.Source: §8 · p. 16
  • Two evaluation gaps identified by Tang & Zheng (2026)—an invariance test and a language-model baseline—are related; reporting both located the behavior in prompt rendering rather than the decision head.Source: §8 · p. 16

ETHICS STATEMENT

The work uses public model weights, public datasets, and generated synthetic data, without human subjects, personal data, or new data collection.

Ethics statement

  • The evaluation involves no human subjects, personal data, or new data collection.PolicyBench tickets are template-generated and describe fictional customers.Source: ETHICS STATEMENT · p. 16
  • The authors judge publication risk low relative to disclosure’s benefit because the reported failure modes are already present in deployed systems and the paper provides detection and mitigation procedures.Source: ETHICS STATEMENT · p. 16
  • Third-party models were evaluated under their licenses, and checkpoints are named for reproducibility rather than vendor ranking.Source: ETHICS STATEMENT · p. 16

REPRODUCIBILITY STATEMENT

The paper’s measurements are reproducible from public models and datasets, cached predictions, and released code and outputs.

REPRODUCIBILITY STATEMENT

  • All models and datasets are public, and the released code, generator, and raw predictions support reproducing the reported measurements without a vendor API key.Measurements are generated from cached per-item predictions and inserted through a macro, so rerunning the grid updates the manuscript.Source: REPRODUCIBILITY STATEMENT · p. 16

A SUPPLEMENTARY TABLES

The supplementary tables and figure document PolicyBench readout comparisons, channel contributions, decision flips, and task-specific contrasts. Their captions specify the scope and conditions of each comparison.

A SUPPLEMENTARY TABLES

  • Figure 6 shows accuracy for three readouts by label condition on the uncontrolled PolicyBench suite, with bootstrap 95% intervals over items.The caption notes that the scoring-versus-generative readout gap is largest on this suite and refers to §5.3 for the controlled-suite result.Source: Figure 6 · p. 17
  • Table 9 reports channel contributions for fixed-label choice tasks SST-2, RTE, and CB (n = 833); it excludes the ordinal task because score questions lack a separate label channel.Source: Table 9 · p. 17
  • Table 10 gives exact values for Figure 5, including the decision flip rate of Equation (4) in its final column.Source: Table 10 · p. 18
  • The two scoring readouts agree on both PolicyBench suites, while their comparison with the generative readout does not hold across suites.Table 11 covers one backbone and three readouts on both suites.Source: Table 11 · p. 18
  • Table 12 contrasts the uncontrolled PolicyBench suite, where the false branch uses the catch-all definition “none of the above applies”.The caption identifies its third-column artifact as the one discussed in §5.2.1 and directs comparison with Table 3.Source: Table 12 · p. 18

B TASKS

Table 13 describes the tasks and their class prevalence, including rebalancing applied to UNFAIR-ToS clause types.

B TASKS

  • UNFAIR-ToS clause types are class-balanced because raw splits are about 97% negative, allowing an always-“no” model to reach 0.97 accuracy without carrying information.Source: B TASKS · p. 18
  • Table 13 lists each task’s question type, number of evaluated items, and class prevalence after any rebalancing.Source: Table 13 · p. 18

Related papers

Loading 2610.02586v1…