PaperlayerView exact revision on arXiv

Source-linked AI summary

Verdict Without the Rule: Diagnosing and Auditing Regulatory Rule Sensitivity in LLM Compliance Systems

Saisab Sadhu, Aadit Sengupta, Vinay kumar Sankarapu, Pratinav Seth

arXiv:2610.12313v1cs.AIcs.CLcs.CY

TL;DR

The paper asks whether compliance verdicts actually depend on the supplied regulatory rule, rather than merely matching benchmark labels. It tests rule perturbations behaviorally and representationally across models and domains, finding substantial verdict invariance overall but greater sensitivity on deletion-critical cases.

  • Problem

    Accuracy-based evaluation cannot establish whether a correct compliance verdict depended on the supplied rule.

    Source: §1 · p. 1

  • Method

    The paper perturbs rules while holding cases fixed and measures both verdict changes and shifts in compliance-predictive representations.

    Source: §1 · p. 2, §3.2 · p. 4

  • Results

    OCS is uniformly low overall, but on cases where deleting the rule disrupts a correct verdict, OCS-swap rises to 0.73–1.00.

    Source: §8 · p. 9

  • Takeaways & Limitations

    High benchmark accuracy can coexist with substantial invariance to supplied-rule changes, so accuracy alone is insufficient evidence of rule-grounded compliance.

    Source: §9 · p. 9

    Results characterize sensitivity under prompts that truncate rule text at 300 characters, so an operative clause beyond that window may be unavailable to the model.

    Source: Limitations · p. 10

Abstract

from arXiv · show

Large language model compliance systems are deployed on the assumption that a verdict depends on the regulatory rule it is given. We test this directly across five models and 20 regulatory and platform-policy domains: delete, swap, or negate the governing rule while holding the case fixed, and check whether the verdict changes (OCS) or the model's internal representation of compliance shifts at all (ICS-delta). Neither moves much: models' verdicts are often invariant to substantial perturbations of the supplied rule, and the guard model, evaluated here under a custom-rule adaptation of its native taxonomy, is the least rule-sensitive and least accurate of the five, barely above chance (51%, versus 90-92% for general-purpose models). This reflects easy cases more than blanket neglect: on cases where deleting the rule changes a previously correct model prediction, models do track it closely. Neither better prompting nor direct intervention on the model's internal representations closes this gap. Accuracy alone does not establish that a compliance verdict is grounded in the supplied rule.

1 Introduction

The paper asks whether compliance verdicts depend on the supplied rule, testing both verdict changes and shifts in compliance-predictive representations. It introduces behavioral and representational audits, targeted interventions, and an analysis of textual properties associated with rule sensitivity.

1 Introduction

  • Accuracy alone cannot show whether a correct verdict depended on the supplied rule, since the same verdict may be reached without consulting it.A verdict that survives deleting the rule may reflect case features or patterns learned during training.Source: §1 · p. 1
  • The paper introduces OCS, a per-sample behavioral metric for counterfactual rule dependence, and ICS-delta, a probe of rule-related shifts in compliance-predictive representations.The tests delete, swap, or negate the rule while holding the case fixed.Source: §1 · pp. 1–2
  • The paper also tests whether prompting or representation-level interventions recover accuracy on low-rule-sensitivity cases and examines five textual properties of regulatory rules.Source: §1 · p. 2

2 Related Work

Prior compliance systems are generally evaluated for classification, generation, or retrieval accuracy, rather than whether verdicts are grounded in supplied rules. This paper relates counterfactual rule-sensitivity tests to work on faithfulness, internal representations, and policy conditioning.

2 Related Work

  • Existing compliance systems are evaluated on classification, generation, or retrieval accuracy, not whether their verdicts are grounded in the supplied rule.The cited systems include FinGuard [Dou et al., 2026], ComplianceNLP [Guo et al., 2026], GraphCompliance [Chung et al., 2025], LegiLM [Zhu et al., 2024], and others.Source: §2 · p. 2
  • OCS tests behavioral rule dependence without requiring explanations, while ICS-delta applies counterfactual rule perturbations to internal representations.The paper distinguishes its per-sample representational shift measure from prior aggregate classifier-AUROC comparisons [Sadhu et al., 2026b].Source: §2 · p. 3
  • Related work on dynamic policy conditioning offers a different architectural response to the problem OCS diagnoses behaviorally.The passage identifies DynaGuard [Hoover et al., 2026] and CourtGuard [Suleymanov et al., 2026] as examples.Source: §2 · p. 3

3 Methodology

The methodology pairs a behavioral test of verdict change with a representational test of shifts in a compliance-predictive direction. Both perturb the rule while holding the case fixed, but measure different outcomes.

3 Methodology

  • OCS measures whether a system's verdict changes under rule perturbation, and ICS-delta measures whether its compliance-predictive representation shifts under the same perturbations.Source: §3 · p. 3

3.1 OCS: Behavioral Rule Sensitivity

  • A low OCS is diagnostic of verdict invariance, not proof that the model ignored the rule or that its verdict is legally incorrect.The metric does not determine whether a changed verdict would be legally required under the perturbed rule.Source: §3.1 · p. 3

3.1.1 Perturbation Conditions

  • The rule perturbations delete the rule, replace it with a canonical rule from another domain, or negate mandatory obligations while leaving the case fixed.Samples without mandatory modals are excluded from OCS-neg rather than counted as unchanged.Source: §3.1.1 · pp. 3–4

3.2 ICS-delta: Representational Grounding

  • ICS-delta uses a training-free, per-model and per-domain compliance probe, then tests whether its activation projection changes under the rule perturbations.The probe direction is selected using held-out validation data disjoint from the direction-fitting split.Source: §3.2 · p. 4, §3.2.1 · p. 4

3.2.1 ICS and ICS-delta

  • ICS projects the last-token residual-stream activation onto a fixed direction; ICS-delta measures the absolute projection difference between original and perturbed rules.The case text remains fixed, and the delta is reported as a fraction of each model's mean baseline |ICS| magnitude.Source: §3.2.1 · p. 4

3.2.2 Interpreting Small ICS-delta

  • Rule perturbations shift the measured projection by 12.8–22.9% of mean baseline |ICS| across the four Tier-1 models, but this does not establish that rule information is absent elsewhere.OCS and ICS-delta rankings show no significant convergence; the two interventions do not reliably improve accuracy on LOW-OCS cases.Source: §3.2.2 · p. 4

4 Experimental Setup

Experiments use a fixed 20-domain subset of OmniCompliance-100K and compare five locally run models on the same sampled cases. The setup includes a custom-rule adaptation for Llama-Guard-3-8B and excludes models unsuitable for the representational analysis.

4.1 Dataset and Domains

  • The experiments use a fixed 20-domain subset of OmniCompliance-100K, with labels derived from regulatory enforcement text rather than model self-labeling.The domains span data protection, AI safety, finance, cybersecurity, education, platform policy, and fundamental rights.Source: §4.1 · p. 4

4.2 Sampling

  • Each model receives the same stratified, seeded cases, with 200 cases per domain per model where the domain supports balanced labels.The sampling yields 12,897 case-condition generations per model and 64,485 total; parseable-verdict rates exceed 99.5% for every model.Source: §4.2 · p. 5

4.3 Models

  • Five models are run locally; Llama-Guard-3-8B is prompted with a custom compliance-policy category substituted for its fixed taxonomy.The four general-purpose models are used for fitted ICS probe directions, while the guard model is excluded from representational analyses because its architecture and task format differ.Source: §4.3 · p. 5

5 Results: Rule Sensitivity Audit

Across the five results subsections, verdicts are generally insensitive to rule perturbations, although sensitivity rises on deletion-critical cases. Rule-text syntax is associated with sensitivity, while the guard-model result is qualified by its custom-rule task mismatch.

5.1 OCS Is Uniformly Low

  • OCS-agg ranged from 0.013 (Llama-Guard-3-8B) to 0.094 (Qwen2.5-7B-Instruct), averaging 0.069 across 100 cells, far below ≈0.5.Figure 2 is cold across nearly every domain–model cell; its warmest cell is Mistral-7B-v0.3 × cybersecurity_mitre_attack (0.265).Source: §5.1 · p. 5, Figure 2 · p. 6

5.2 Linguistic Regression

  • MDD alone survived BH correction (ρ = 0.570, pBH = 0.044); ECD and CRC did not, and the joint OLS was suggestive rather than decisive.Higher dependency-tree depth tracked higher OCS, meaning more rule sensitivity; the joint model explained under half the variance and did not reach conventional significance.Source: §5.2 · p. 6

5.3 OCS vs. an Empirical Null

  • All four general-purpose models’ observed OCS-agg values were below their 0.48–0.50 bias-corrected nulls (p < 0.0001); guard OCS-agg 0.013 was below its 0.019 null (p < 0.0001).The guard’s response bias was extreme (p = 0.985, q = 0.996), but its observed rule sensitivity was still lower than its model-specific null predicted.Source: §5.3 · pp. 6–7

5.4 Rule-Necessity Control

  • On deletion-critical cases, OCS-swap rose to 0.73–1.00 versus 0.08–0.12 pooled, significantly exceeding the bias-corrected null only for Llama-3.1-8B-Instruct.“Rule-necessary” means the model’s correct baseline verdict became incorrect under deletion; the subset ranged from 94 to 187 cases among general-purpose models, with only six shared by all four.Source: §5.4 · p. 7

5.5 Guard-Model Results

  • Under the custom-rule adaptation, Llama-Guard-3-8B had the lowest OCS-agg (0.013) and 51.1% baseline accuracy, versus 90.3–91.9% for each general-purpose model.The authors attribute this distinct result as consistent with a mismatch: regulatory rules were placed in a slot outside the guard’s trained 14-category taxonomy.Source: §5.5 · p. 7

6 Cross-Dataset Generalization

An OCS sweep on two external benchmarks found rule sensitivity higher than on OmniCompliance-100K, though it remained below the independence reference. The magnitude varied with dataset and task format, so the authors recommend evaluation on deployment-like data.

6 Cross-Dataset Generalization

  • LegalBench accuracy was 49.7%, indistinguishable from chance, whereas ContractNLI accuracy was 78.6%; its higher OCS is therefore a cleaner case of greater rule sensitivity.The authors suggest ContractNLI’s hypothesis-as-rule and contract-excerpt-as-document format gives cases a tighter logical link than OmniCompliance-100K’s narrative pairs.Source: §6 · pp. 7–8
  • For Llama-3.3-70B-Instruct, OCS-agg was 0.255 on LegalBench (3.1×) and 0.318 on ContractNLI (3.9×), higher than on OmniCompliance-100K.Table 2 reports OCS below the 0.5 independence reference across datasets, but not as a fixed, dataset-independent model property.Source: §6 · p. 7, Table 2 · p. 8
  • The authors recommend computing OCS on data resembling the deployment distribution rather than relying on a single portable number.Low rule sensitivity also held on both external benchmarks, but its magnitude varied across datasets.Source: §6 · p. 8

7 Interventions

Neither rule-grounded prompting nor targeted activation steering reliably recovers accuracy on LOW-OCS cases. The steering results include exploratory harms, but no setting significantly beats baseline.

7 Interventions

  • The tests compare standard and rule-grounded prompts, then steer fitted compliance directions at two scales across LOW-OCS and HIGH-OCS partitions.Rule-grounded prompting asks models to quote a relevant rule clause before giving a verdict; steering uses positive and negative residual-stream interventions.Source: §7 · p. 8, §7.1 · p. 8, §7.2 · p. 8
  • Neither intervention significantly recovers LOW-OCS accuracy; rule-grounded prompting significantly harms Qwen2.5-7B-Instruct there (∆=−0.028, p < 0.0001).No model improves significantly under prompting, and no steering setting significantly beats baseline.Source: §7.1 · p. 8, §7.2 · p. 9

7.2 Targeted Activation Steering

  • For Llama-3.1-8B-Instruct, the unsteered baseline is the best LOW-OCS setting; Llama-3.3-70B-Instruct shows only non-significant positive-steering improvement there.Negative-steering harms are exploratory because per-setting comparisons are uncorrected for 16 comparisons.Source: §7.2 · pp. 8–9

8 Discussion

The discussion distinguishes rule-sensitive, outcome-determinative cases from the majority where verdicts track scenario content. It cautions that accuracy and the tested interventions do not establish rule-grounded compliance.

Audit result and interpretation

  • On cases where deleting the rule disrupts a correct verdict, OCS-swap rises to 0.73–1.00; on most cases, verdicts remain largely invariant to rule changes.Standard accuracy cannot distinguish which regime produced a correct answer.Source: §8 · p. 9

The guard model and the two instruments

  • The guard model is least rule-sensitive and least accurate, while behavioral and representational instruments do not converge and interventions offer no clean fix.The guard model’s result does not support safety-training as a source of rule sensitivity in this evaluation.Source: §8 · p. 9

Scope of the evidence

  • OCS-del is lower than OCS-swap or OCS-neg, indicating that a wrong rule can clash with document-based priors rather than being simply ignored.The intervention results provide no evidence that these particular inference-time methods recover the missing sensitivity.Source: §8 · p. 9

Practical implication

  • Accuracy on labeled benchmarks does not license an inference that verdicts are grounded in the supplied rule.OCS is cheap and needs no gold labels, but flags whether verdicts change under perturbation—not whether that change is legally correct—so low scores motivate scrutiny rather than settle it.Source: §8 · p. 9

9 Conclusion

Across five models and 20 domains, verdicts often remain invariant to substantial rule perturbations, while sensitivity rises on cases where the rule is outcome-determinative. The conclusion is that benchmark accuracy alone is insufficient evidence of rule-grounded compliance reasoning.

9 Conclusion

  • Across five models and 20 domains, many correct verdicts are largely invariant to rule deletion, substitution, or negation, but OCS-swap reaches 0.73–1.00 on deletion-critical cases.The guard model under custom-rule adaptation is least rule-sensitive and least accurate, and the two instruments do not converge.Source: §9 · p. 9
  • Two targeted interventions fail to reliably recover LOW-OCS accuracy, and one measurably worsens it; rule syntactic complexity is the strongest predictor of domain-level sensitivity.The finding also holds on LegalBench and ContractNLI, where sensitivity is 3–4× higher than on OmniCompliance-100K.Source: §9 · p. 9
  • The evidence does not show that the pattern is permanent or unfixable, or that models never encode or use regulatory rules.It supports the narrower conclusion that high benchmark accuracy can coexist with substantial invariance to changes in the supplied rule.Source: §9 · p. 9

Limitations

These analyses report the audit’s domain and prompt scope, test OCS and ICS-delta against additional comparisons, and identify limits on interpreting rule sensitivity.

Limitations

  • Rule-text truncation at 300 characters limits results to the evaluated prompt format; an omitted operative clause can make low OCS reflect unavailable information.Rule-grounded prompting also changes reasoning instructions while adding the full rule, so rule completeness is not isolated.Source: Limitations · p. 10

A Llama-Guard Prompt Adaptation

  • The Llama-Guard adaptation replaces its 14 fixed safety categories with one custom rule category in a raw-text scaffold.Its packaged chat template has no field for an arbitrary policy; safe and unsafe are mapped to compliant and non-compliant, respectively.Source: A Llama-Guard Prompt Adaptation · p. 13

B Domains and OCS Audit Statistics

  • OCS-neg applies only to samples containing mandatory modals; three domains have zero coverage, and one domain has only 146 examples rather than the target 200.Sampling reaches N = 200 per domain except edu_discrimination_us_edu_dept; the zero-coverage domains are excluded from OCS-neg.Source: B Domains and OCS Audit Statistics · p. 13, Table 4 · p. 14

C Prompt Templates

  • The standard prompt uses the first 300 rule characters and a one-word verdict; the rule-grounded prompt asks for the applicable clause before the verdict.Unparseable verdicts are returned as null and excluded from that condition’s OCS.Source: C Prompt Templates · p. 15

D ICS-delta and Convergent Validity

  • Every ICS-delta bar is a small fraction of baseline ICS magnitude, and no model’s OCS-agg/ICS-delta-agg rank correlation reaches conventional significance.OCS-neg is consistently the smallest ICS-delta condition in Figure 4.Source: Figure 4 · p. 16, Table 7 · p. 16

E Empirical Null and Rule-Necessity

  • Every model’s OCS was significantly below its own bias-corrected independence null; Llama-3.3-70B-Instruct’s nominal OCS-neg reduction on rule-necessary cases did not survive correction.The null used each model’s empirical baseline and altered-verdict marginals, with a within-domain permutation test.Source: Table 8 · p. 16, Table 9 · p. 17

F OCS as a Predictor of Accuracy

  • ρ = 0.190 (p = 0.058, n = 100) for OCS-agg versus baseline accuracy, a weak positive correlation that narrowly misses conventional significance.At this sample size, OCS-agg alone would not reliably substitute for gold-label accuracy measurement.Source: F OCS as a Predictor of Accuracy · p. 17, Figure 5 · p. 17

G Linguistic Regression: Full Statistics

  • Only MDD survives Benjamini-Hochberg correction among per-feature correlations, while no standardized OLS coefficient is individually significant in the joint model.MDD is closest to the p < 0.05 threshold in the joint model.Source: Table 10 · p. 18, Figure 6 · p. 18

H Interventions: Full Statistics

The intervention analyses compare rule-grounded prompting and activation steering with standard or unsteered baselines. Neither intervention shows a significant accuracy benefit in the reported comparisons.

H Interventions: Full Statistics

Loading 2610.12313v1…