U.S. FEDResearch
arXiv audit finds LLM compliance verdicts often survive deleting or swapping the rule
Sadhu, Sengupta, Sankarapu and Seth report in an October 8, 2026 arXiv paper that across five models and 20 regulatory and platform-policy domains, deleting, swapping or negating the governing rule often leaves LLM compliance verdicts unchanged. A guard model adapted to custom rules was the least rule-sensitive and least accurate, at 51% versus 90% to 92% for general-purpose models, and neither better prompting nor internal-representation interventions closed the gap.
Key points
- Researchers measure behavioral (OCS) and representational (ICS-delta) rule sensitivity under deletion, swapping and negation of the supplied rule.arXiv
- Across 20 domains, models' verdicts are often invariant to substantial perturbations of the supplied rule.arXiv
- The adapted guard model scored about 51% accuracy, barely above chance, versus 90% to 92% for general-purpose models.arXiv
- On cases where deleting the rule flips a previously correct prediction, models track the rule closely.arXiv
- Neither better prompting nor direct intervention on internal representations closes the sensitivity gap.arXiv