PaperlayerView exact revision on arXiv

Source-linked AI summary

Where Do Legal Factors Live in LLMs?

Li Zhang, Kevin Ashley

arXiv:2610.28799v1cs.CL

TL;DR

The paper asks whether internal representations of LLMs encode expert-defined CATO legal factors, an important question because model outputs alone leave the organization of legal knowledge difficult to trace. It tests factor readouts from activations and selected SAE features across three models, finding all 26 factors readable and much of their discriminating information accessible through a few features. The reported coordinates connect these expert-defined patterns to specific model-internal readouts.

  • Problem

    LLM outputs can identify legal factors, but they leave open how factor information is represented internally, making internal analysis relevant to diagnosing and auditing legal applications.

    Source: §1 · p. 2

  • Method

    The study trains linear probes on model activations and SAE-feature readouts using CATO-labeled passages across three models, reporting factor-specific layer and feature coordinates.

    Source: §1 · p. 2, §2.2 · p. 4, §4 · p. 6

  • Results

    Across three models, all 26 CATO factors are readable from full activation vectors, and much of this discriminating information is accessible through one or a few selected SAE features.

    Source: §5.3 · p. 8, §6 · pp. 9–10

  • Takeaways & Limitations

    The 78 reported layer–feature coordinates give concrete locations for readouts of patterns that legal experts express as symbolic factors.

    Source: §6 · pp. 9–10

    Evidence is limited to controlled English narratives about U.S. trade-secret factors and three relatively small open models, leaving naturally occurring case files, other legal domains and languages, and larger models for future testing.

    Source: §7 · p. 10

Abstract

from arXiv · show

In case-based legal reasoning, legal professionals identify legally significant fact patterns in a new dispute and compare them with those of decided cases. In AI & Law, HYPO dimensions and CATO factors represent these patterns symbolically, organizing expert knowledge distilled from case narratives as explicit, structured, interpretable, and auditable legal concepts and relations that support case comparison, legal argument, and precedent-based reasoning. Large language models (LLMs) are increasingly used for legal tasks, yet their internal organization of legal knowledge remains difficult to trace. We investigate whether LLMs form internal representations corresponding to all 26 CATO factors. Two research questions examine linear decodability and sparse localization with sparse autoencoders. Experiments cover three open models, Qwen3-1.7B, Qwen3-8B, and Gemma-2 2B, supported by cross-model comparison and human audit of controlled natural-language passages. Results show that all 26 factors are linearly decodable in all three models. Single-feature sparse readouts cover the complete factor catalog, with best-layer test AUCs ranging from 0.86 to 1.00. Five selected features approach full-vector readout performance. We report 78 model-specific layer-feature coordinates, one for each factor in each model. Together, these results show that information corresponding to expert-defined legal factors can be read from the internal activations of LLMs processing legal narratives. By locating these readouts, our study connects legal language and the symbolic abstractions of HYPO and CATO to learned internal representations.

1. Introduction

CATO organizes expert-defined legally significant fact patterns into 26 factors used for case comparison and argument. This study asks whether LLM activations encode those factors and whether selected SAE features can expose them, finding that all factors are readable and a few features provide strong readouts.

1. Introduction

  • CATO organizes expert-distilled stereotypical fact patterns into 26 factors that make legally significant differences explicit for case comparison and argument.HYPO represents factual differences favoring parties in trade-secret disputes as dimensions [1].Source: §1 · p. 1, Table 1 · p. 3
  • Because LLM outputs do not reveal how legal-factor information is represented, internal analysis could help diagnose what a model recognizes and support auditing legal applications.A passage about reverse engineering might be associated with recoverability, familiar wording, or surrounding commercial context.Source: §1 · p. 2
  • The study asks whether internal signals corresponding to expert-defined legal factors can be identified in LLMs, using CATO as the reference.Its two questions concern reading factor presence from activations and localizing that information to a small number of features.Source: §1 · p. 2
  • Linear probes read factor presence from model states, while SAE readouts test whether one or five selected features distinguish factor-present from factor-absent passages.The authors report model-specific layer and feature coordinates for every factor.Source: §1 · p. 2
  • All 26 CATO factors are readable from the internal states of three models, and a few selected SAE features provide strong readouts.The study covers Qwen3-1.7B, Qwen3-8B, and Gemma-2 2B.Source: §1 · pp. 2–3

2. Background and Related Work

The background frames CATO factors as an expert-defined legal reference for examining model representations. It then introduces probes and SAE feature readouts as ways to test whether factor information is accessible in activations and sparse features.

2.1. Legal Factors as a Reference for Internal Representations

  • A CATO factor is a defeasible stereotypical fact pattern favoring one side, abstracted from a narrative and linked to that side’s claim.CATO’s 26-factor catalog provides the reference used throughout the study.Source: §2.1 · pp. 3–4
  • The factor definitions specify the legal criterion a candidate signal should capture, including the distinction between information that could be reverse-engineered and information actually reverse-engineered.These are F16 and F25, respectively.Source: §2.1 · p. 4

2.2. From Internal Activations to SAE Features

  • A linear probe learns a weighted sum of activation values to distinguish factor-present from factor-absent passages; successful prediction on held-out passages indicates factor information is accessible in the internal state.The study examines the residual stream, the vectors updated by successive transformer blocks.Source: §2.2 · p. 4
  • Sparse autoencoders reconstruct activation vectors from sparse combinations of learned features, which are tested as predictors of legal-factor presence.Individual activation coordinates can mix several kinds of information.Source: §2.2 · p. 4
  • A readout is a classifier fitted to selected feature activations and passage-level factor labels; each feature ID refers to a direction in a particular model-and-layer SAE.One-feature readouts use one activation, while five-feature readouts combine five, and evaluation uses passages not used to fit them.Source: §2.2 · p. 4
  • AUC measures how well a readout ranks factor-present passages above factor-absent passages, with 0.5 indicating chance ranking and 1 indicating perfect separation.AUC summarizes ranking across decision thresholds and does not depend on the class ratio.Source: §2.2 · p. 4

3. A Controlled Corpus for Factor Probing

The controlled corpus isolates CATO factor presence in short narratives while varying their settings and wording. Labels are checked through model annotation and human audit, then used for separate training and test partitions.

3. A Controlled Corpus for Factor Probing

  • The corpus covers all 26 CATO factors with short passages that vary business settings and wording, enabling comparable one-factor-at-a-time classification.Real cases often contain multiple factors together.Source: §3 · p. 5
  • The corpus contains 6,992 factor-present passages and 901 factor-free passages, with labels independently annotated against all 26 definitions and disagreements adjudicated.Passages were retained when their target factor was confirmed and any additional factor followed from catalog entailment relations.Source: §3 · p. 5
  • Human–LLM agreement was 98.6% (217/220) in a random audit of passages checked against factor definitions with model labels hidden.The audit included eight passages per factor and twelve factor-free controls.Source: §3 · p. 5
  • The training and test partitions contain 3,932 and 3,961 passages, respectively, with jointly generated passages kept together and no identical passages shared.A TF-IDF classifier using individual words and adjacent word pairs provides a comparison with internal-activation classifiers.Source: §3 · p. 5

4. Probing Design

The probing design compares factor readouts from full residual activations with readouts restricted to selected SAE features. It samples three layers per model, selects features on fitting data, and evaluates readouts on held-out passages.

4. Probing Design

  • The three pretrained models are sampled at roughly one-quarter, one-half, and three-quarters of their layer stacks, using model-specific residual SAEs.The sampled layers are 7/14/21 for Qwen3-1.7B, 9/18/27 for Qwen3-8B, and 6/13/20 for Gemma-2 2B.Source: §4 · p. 6
  • For each factor, the study reports the maximum test AUC across sampled layers for an L2-regularized logistic classifier trained on mean-pooled residual activations.Negatives exclude factors known to entail the target, since those passages also satisfy it.Source: §4 · p. 6
  • Features are ranked on readout-fitting passages by |AUC − 0.5|, then frozen top-1 or top-5 sets are used to fit new readouts; random five-feature sets provide a reference.The direct comparison averages AUC across 26 factors at each model’s middle sampled layer.Source: §4 · p. 6, Figure 2 · p. 7
  • For Qwen3-8B, feature-selection stability is assessed by resampling training passages and comparing selected sets with a pre-specified Jaccard-overlap threshold of 0.6.Four factors below the threshold receive ten bootstrap samples to check feature and classifier-weight similarity.Source: §4 · p. 6

5. Results and Discussion

All 26 CATO factors are readable from the three models’ internal activations, and selected SAE features retain much of the full-vector readout performance. The discussion compares where these readouts occur, which factors share features, and how stable the selected features are.

5.1. RQ1: Factor Information Is Readable from Internal Activations

  • All 26 factors had maximum held-out AUCs of 0.998–1.000 from linear classifiers, while TF-IDF also performed near-perfectly, leaving wording as a possible signal.The RQ1 result establishes readability from activations but does not separate factor information from wording that expresses it.Source: §5.1 · p. 7

5.2. RQ2: A Few SAE Features Provide Strong Factor Readouts

  • Across the same 26 factor tasks and middle layer within each model, single selected SAE features averaged AUCs of 0.944, 0.954, and 0.950; five selected features reached 0.986, 0.988, and 0.986, close to full-vector readouts.Random five-feature sets averaged AUCs of 0.551, 0.534, and 0.578.Source: §5.2 · p. 7
  • Every factor had a single-feature readout above 0.86 at one or more sampled layers; Figure 3 locates each factor’s strongest single-feature readout across the three models.Figure 3 shows selected layer–feature locations and their test single-feature AUCs; feature IDs are specific to each model’s SAE.Source: §5.2 · p. 7, Figure 3 · p. 8

5.3. Discussion

  • The best readout layers varied by factor: the middle sampled layer was most frequent in each model, but fewer than half of factors selected it.The median AUC advantage over the next-best sampled layer was 0.011 in each model, so another sampled layer often performed similarly.Source: §5.3 · p. 8
  • Some factors shared SAE coordinates: Qwen3-1.7B paired F16 with F25 and F20 with F24, while Qwen3-8B and Gemma-2 2B paired F24 with F27.The paired factors concern related but distinct legal criteria, such as information that could be reverse-engineered versus information actually reverse-engineered.Source: §5.3 · pp. 8–9
  • For F14, five-feature AUCs were 0.970, 0.969, and 0.965, exceeding single-feature AUCs of 0.861, 0.911, and 0.893 in model order.Full-vector AUCs were all at least 0.9998; readout contributions can be compared across passages to identify signals that raise or lower a factor score.Source: §5.3 · p. 9
  • In Qwen3-8B, 22 of 26 factors met the overlap threshold for selected five-feature sets; after retraining, weight-vector cosine similarity remained 0.95–0.99.For four factors, ten resampling rounds selected varying sets of five but only eight or nine distinct features per factor overall.Source: §5.3 · p. 9
  • Using the common CATO factor definitions, the study compares whether the same factor information is readable across models and how compactly each model represents predictive signals.Feature numbers belong to each model’s own SAE, so the shared reference is the legal factor rather than a cross-model feature ID.Source: §5.3 · p. 9

6. Conclusion

The study finds that CATO-factor information is readable from LLM activations and that selected SAE features provide compact readouts. It connects these readouts to expert-defined legal distinctions as objects for examining learned representations.

6. Conclusion

  • Across three models, all 26 CATO factors are readable from full activation vectors, with much of their discriminating information accessible through one or a few selected SAE features.The study reports 78 model-specific layer–feature coordinates, one for each factor in each model.Source: §6 · p. 9
  • Related factors sometimes share an SAE feature, so compact readouts can overlap across expert-defined distinctions.Source: §6 · p. 10
  • The study tests expert-defined factors by asking whether classifiers can predict them from activations produced as models read legal passages.Legal experts can judge what a passage expresses using factor definitions, then test whether reported features predict those judgments.Source: §6 · p. 10
  • Symbolic legal knowledge supplies expert-defined distinctions for studying model representations; this proof of concept uses controlled narratives.The same factor definitions support comparison across models despite differing internal coordinates.Source: §6 · p. 10

7. Limitations and Future Work

The evidence is limited to controlled English narratives about U.S. trade-secret factors and three relatively small open models. The authors identify evaluation on naturalistic legal texts, broader generalization checks, and tests of readout utility as future work.

Scope of the texts and legal domain

  • The study uses controlled English narratives about U.S. trade-secret factors and open models with 1.7B–8B parameters.Future evaluation should test frozen readouts on full judicial opinions and case files, other legal domains and languages, and larger models.Source: §7 · p. 10

Generalization and annotation

  • Training and test passages share a controlled generation procedure, and some positive and negative passages differ in length.The authors propose length-matched evaluation, more varied wording, contrastive passages that change legal facts, and multiple-expert annotation studies.Source: §7 · p. 10

From representation to use

  • Whether factor readouts help explain errors or whether model outputs depend on selected features remains to be tested.Proposed future work includes error analysis and interventions that suppress or amplify a feature.Source: §7 · p. 10
Loading 2610.28799v1…