The paper investigates whether large language model (LLM) compliance systems truly base their verdicts on the regulatory rules they are given. By systematically deleting, swapping, or negating rules across five models and 20 regulatory domains, the authors find that verdicts and internal compliance representations change little, indicating that models often ignore the supplied rule. Even the guard model, adapted to a custom rule taxonomy, shows minimal rule sensitivity and only marginally better than chance.
The study highlights that accuracy alone does not guarantee that a compliance verdict is grounded in the supplied rule, underscoring the need for more robust auditing of regulatory rule sensitivity in LLM systems.
By Saisab Sadhu, Aadit Sengupta, Vinay kumar Sankarapu, Pratinav Seth
arXiv:2608. 16852v1 Announce Type: new Abstract: Regulatory compliance monitoring in deployed language models is increasingly implemented as a legal and audit control, checking model outputs against written rules spanning data protection, healthcare, financial regulation, and platform policy.
By Saisab Sadhu, Aadit Sengupta, Vinay Kumar Sankarapu, Pratinav Seth
arXiv:2608. 09028v1 Announce Type: new Abstract: Institutional policies stay in natural language while the systems that check compliance demand machine-readable constraints.
By Ponkrit Kaewsawee, Chaklam Silpasuwanchai, Chutiporn Anutariya
The study examines how different harness configurations affect a fixed large language model’s compliance with banking conduct rules. Four open‑weight models were tested across five harnesses on 156 pre‑registered retail‑banking scenarios, yielding 3,120 two‑turn episodes scored for rule violations and over‑refusals. Results show that while overall compliance rates varied modestly (87.3%–92.1%), the impact of a harness differed markedly between models, with some models’ best and worst harnesses differing by over 10 percentage points and a same‑model compliance reviewer reducing violations from 9.6% to 6.4%.
whyItMatters":"The findings suggest that validating a model’s compliance requires testing the specific model‑harness pair rather than the model alone, highlighting the importance of action logs over conversation transcripts for accurate conduct assessment."
By Mehmet Murat Huyut
Large language models often justify legal decisions by citing statutes or precedents, but this study shows that while models correctly name the governing authority 66.7%-100% of the time, the actual verdict rarely changes when the cited authority is swapped—only 0.0%-21.7% on CaseHOLD, 30.0%-76.7% on ECHR and SCOTUS, and 43.3%-50.0% on ContractNLI. This gap persists across models of different sizes and even a purpose‑built legal‑reasoning model. Additionally, a red‑team evaluation revealed that models are more compliant with hidden adversarial instructions than they are sensitive to verdict changes, indicating that citing legal authority is a weak proxy for genuine reasoning and that verdicts remain vulnerable to manipulation.
The study examines whether large language models truly base legal verdicts on the statutes or precedents they cite. By fixing case facts and swapping the cited authority with an unrelated one, researchers found that while models correctly name the authority 66.7%-100% of the time, the resulting verdict often remains unchanged—only 0.0%-21.7% of the time on CaseHOLD, 30.0%-76.7% on ECHR and SCOTUS, and 43.3%-50.0% on ContractNLI. Even a purpose‑built legal‑reasoning model and larger scales did not close this gap, and adversarial instructions further exposed vulnerabilities in verdict consistency.
By Saisab Sadhu, Shreeyans Arora, Pratinav Seth
arXiv:2607. 23386v1 Announce Type: new Abstract: We document a failure class in frontier large language models -- exception chain collapse -- observed in eligibility evaluation under nested conditional rules of the form "A is required UNLESS B applies, UNLESS C overrides B".
By Paul Simpson, John Kozak, Lisa Doake
The paper investigates how a reviewer in multi‑agent language‑model systems can be authorized to override an upstream agent’s decision. It compares unrestricted override authority with an evidence‑gated approach that requires a valid record of a binding‑constraint violation and a compliant repair before replacement is allowed. Experiments on two open‑weight models across 96 spatial‑policy tasks show that the evidence gate sharply reduces corruption of correct proposals while largely preserving legitimate repairs, though the effectiveness varies with reviewer transitions and upstream states.
By Fuad Ali
Code-as-Auditor is an LLM-based framework that transforms regulatory information into formal checklists and executable decision trees, encoding rules as interpretable code. During inference, the model expands each checklist item into factual and counterfactual questions, guiding reasoning over case-specific evidence and potential violations. This pipeline moves from evidence identification to rule application and final decision-making, with a self‑verification loop that enhances logical consistency and traceability, leading to more accurate and evidence‑backed compliance evaluations in privacy and data protection scenarios.
By Jisoo Kim, Taeyoon Kwack, Jinwoo Jang, Woo Kyung Kim, Honguk Woo
arXiv:2606. 08932v1 Announce Type: cross Abstract: Rule-following agents tasked with executing policies and regulations often fail via Silent Scope Omission (SSO): a model applies a general rule but silently drops nested exceptions or counter-exceptions, producing outputs that appear compliant yet break on important edge cases.
By Jian Chen, Siyuan Li, Chucheng Wan, Zixuan Yuan
arXiv:2605. 05427v2 Announce Type: replace Abstract: Refusal rates are a poor proxy for LLM safety, i.
By Alif Al Hasan, Sumon Biswas
arXiv:2608.30757v1 Announce Type: new
Abstract: Before an intelligent system can decide whether an action is allowed, it must first know which rules the action has approached. A single proposed actio...
By Thomson D. Nguy (Radiant Institute for Manifold Studies)