Verdict Without the Rule: Diagnosing and Auditing Regulatory Rule Sensitivity in LLM Compliance Systems: what it means for business leaders

A study of five language models across twenty regulatory domains finds that compliance verdicts rarely change when the governing rule is deleted, swapped or reversed, so benchmark accuracy alone cannot show a system used the rule.

1. What the method is

The paper introduces two audit instruments for language-model compliance systems, the tools that take a document and a regulatory rule and return a verdict of compliant or non-compliant. The first, Output Compliance Sensitivity (OCS), is a black-box behavioral test: it deletes the rule, swaps it for a rule from an unrelated domain, or negates its mandatory obligations, and records how often the verdict changes while the document stays fixed. A score of 0 means the verdict never moves; a score near 0.5 would be expected if the verdict depended on the rule. The second, ICS-delta, looks inside the model and measures how far the internal direction that predicts compliance shifts under the same manipulations. Together they ask a question accuracy benchmarks skip: whether the rule had any part in producing the answer.

2. Why the method was developed

Compliance systems built on large language models already make legally consequential determinations in production, and they are evaluated almost entirely by accuracy on labeled cases. The authors argue that a correct verdict reached without consulting the supplied rule is indistinguishable, on such a benchmark, from one that required it. If the verdict survives the rule being removed, the system is reading surface features of the case or patterns from training, and calling the output a compliance determination is not warranted. Prior work had shown that legal interpretations by these models are unstable across prompt variations but had not diagnosed why, and safety classifiers such as Llama Guard are increasingly repurposed to check regulatory rules without evidence that they can condition on arbitrary policy text. The paper was written to supply a cheap, label-free check for this gap.

3. Who should care

Chief compliance officers, heads of legal operations and model-risk managers at banks, payment firms, insurers and healthcare providers who are buying or building automated checks against GDPR, HIPAA, anti-money-laundering rules or the EU AI Act should read this closely. Trust-and-safety and policy teams at platforms using guard models to enforce written policies face the same exposure. Vendors selling regulatory-technology products will need an answer when customers ask whether the verdicts depend on the rule. Internal audit and regulators evaluating AI-assisted compliance functions gain a concrete pre-deployment test that needs no gold labels. The authors state the finding does not apply to perturbations of the case text itself, and that the magnitude of the effect varies by dataset, so each organization should compute the score on data resembling its own deployment.

4. How the method works

For each sampled case the system is prompted with the document and the rule, then re-prompted under three conditions: the rule field emptied, the rule replaced with the most frequent rule text of a randomly chosen other domain, and every must or shall turned into must not or shall not. OCS is the share of cases whose verdict flips, averaged per sample, per domain and overall; cases whose rule has no mandatory verb are excluded from the negation test. ICS-delta reuses a published training-free probe: a direction in the model's residual stream, at a layer chosen on held-out data, separating compliant from non-compliant activations. The change in projection onto that direction under each perturbation is reported as a fraction of its baseline magnitude. A rule-necessity control isolates cases where deleting the rule turns a correct verdict wrong, and a bias-corrected permutation null accounts for each model's tendency to answer one way.

5. How it was evaluated

The main audit used OmniCompliance-100K, a dataset whose labels come from enforcement text, restricted to twenty domains spanning data protection, AI safety, finance, cybersecurity, education, platform policy and fundamental rights. Two hundred cases per domain were sampled identically for five locally run open models: Llama-3.1-8B, Llama-3.3-70B, Qwen2.5-7B, Mistral-7B and Llama-Guard-3-8B, totalling 64,485 generations with over 99.5 percent parseable verdicts. The protocol was repeated with the 70B model on LegalBench tax and privacy-policy tasks and on ContractNLI. Five textual features of each domain's rules were regressed against its sensitivity. Two interventions were tried on the least rule-sensitive cases: a prompt requiring the model to quote the relevant clause first, and steering the internal compliance direction during generation. The standard prompt truncated rules at 300 characters, a limit the authors flag.

6. How it performed

Sensitivity was uniformly low. Aggregate OCS ranged from 0.013 for the guard model to 0.094 for Qwen2.5-7B, far below the independence reference of about 0.5 in every one of 10,000 permutations, while the four general-purpose models scored 90.3 to 91.9 percent accuracy and deletion of the rule cost at most four points. The guard model sat at 51.1 percent, chance level. On cases where deleting the rule did break a correct verdict, swap sensitivity rose to 0.73 to 1.00, showing two regimes that accuracy cannot separate. Internal shifts were 12.8 to 22.9 percent of baseline. Sensitivity ran three to four times higher on LegalBench and ContractNLI, so no single number is portable. Rule-grounded prompting helped no model significantly and significantly hurt Qwen2.5-7B; steering never beat baseline. Only syntactic depth of the rule predicted sensitivity. (Source: arXiv 2610.12313, 2026)