He Swapped the Penal Code for a Cookbook: LLMs Make Compliance Verdicts That Barely Depend on the Rules
*English translation and editorial summary of a Chinese forum post (zhichai.net), part three of the "Recursion Dilemma of Evaluation" trilogy.*
Key points
- A study of five LLMs on compliance/judgment tasks finds rule sensitivity near zero: on average, perturbing the rules changes verdicts only ~6.9% of the time (OCS-agg = 0.069), versus a ~0.5 random-change baseline.
- Even Llama-Guard-3-8B, a model purpose-built for rule-based moderation, scored OCS-agg = 0.013 and only 51.1% accuracy when adapted to custom rules.
- On rule-necessity cases (where deleting the rules flips the correct answer), OCS-swap jumped to 0.73–1.00 — models *can* use rules, but by default don't.
- Both attempted fixes failed: prompt-based rule anchoring significantly *hurt* one model (Qwen2.5-7B, −0.028, p < 0.0001), and activation steering showed no benefit and harmed accuracy in some settings.
- Of five linguistic features, only mean dependency tree depth survived correction (ρ = 0.570, p = 0.044): syntactically complex rules are followed more.
- Generalization tests (LegalBench: 0.255; ContractNLI: 0.318) confirm rule sensitivity is partly a property of task format, not the model alone.
- The reassuring half: on rule-necessary cases, OCS-swap jumps to 0.73–1.00, versus 0.08–0.12 pooled — a full order of magnitude. When rules are truly irreplaceable, models behave almost dutifully. The problem isn't inability; it's default laziness.
- The unsettling half: across four general models, only 6 cases (out of ~4,000) were unanimously judged rule-necessary. The models barely agree on which questions require consulting the code — and standard accuracy is completely blind to this distinction.
- Sadhu, S., Sengupta, A., Sankarapu, V. K., & Seth, P. (2026). *Verdict Without the Rule*. arXiv:2610.12313. Lexsi Labs. https://arxiv.org/abs/2610.12313
- OmniCompliance-100K dataset (Lexsi Labs): 20 regulatory/platform-policy domains, 200 cases each, random seed 42.
The courtroom that never looks up
Imagine a court where the defendant is a piece of content and the judge is a large language model, instructed by a rulebook — a platform policy, a regulatory clause, a compliance obligation. The verdict is binary: compliant or not. Thousands of institutions run such systems in production, making decisions with legal consequences: approving posts, blocking transactions, flagging contracts. The axiom behind deployment: *change the rules, and the verdicts should change*.
That axiom has never been tested. Standard evaluation only reports accuracy on labeled benchmarks; no mainstream evaluation asks whether the rules actually participated in the verdict. A verdict that would stand even with the rules entirely deleted gains no legitimacy from a high benchmark score. Worse, accuracy cannot distinguish a correct answer made *without* the rules from one made *because of* them — on the report card, they tie for first.
Two measuring sticks
OCS (Output Compliance Sensitivity) — a behavioral, black-box metric. The judge is subjected to three manipulations while the facts stay untouched: 1. del — delete the rules entirely; 2. swap — replace them with rules from a different domain; 3. neg — invert every obligation ("must" → "must not").
OCS = 0 means verdicts never move; OCS = 1 means they always move. Random flipping scores ~0.5.
ICS-delta — a representational probe. The authors find a "compliant–non-compliant" direction in the model's residual stream and measure how much projections shift under rule perturbation. OCS asks "did the judge open the book?"; ICS-delta asks "did the book's words enter his head?"
A heatmap of 100 cells, nearly all cold
Experiments ran on OmniCompliance-100K: 20 regulatory/platform-policy domains × 200 cases, random seed 42. Five models × 12,897 generations each = 64,485 generations across a 100-cell heatmap (5 models × 20 domains).
The heatmap is almost uniformly cold:
| Model | OCS-agg | |---|---| | Qwen2.5-7B | 0.094 | | Llama-3.1-8B | 0.070 | | Llama-3.3-70B | 0.081 | | Llama-Guard-3-8B | 0.013 | | Mistral-7B-v0.3 | 0.089 | | All models, all domains | 0.069 |
By condition: deletion (del) produced the *lowest* sensitivity, 0.053 — below negation (0.070) and swapping (0.082). In courtroom terms: the verdict fears least the total disappearance of the legal code. Swap the penal code for a cookbook and the judge doesn't look up. No domain shows a warm corner; rule insensitivity is uniform, ruling out the convenient excuse that "some domains' rules are just vague."
Meanwhile, the four general models score 90.3–91.9% accuracy on the benchmark. Accurate — but accurate *from what source* is a different question.
Probing inside the black box
On four Tier-1 models, ICS-delta is only 12.8–22.9% of baseline ICS magnitude. A compliance direction does exist internally, but perturbing the rules barely moves it; the negation condition produced the smallest representational shift — the model likely never parsed the "must"s it was asked to invert. OCS and ICS-delta rankings across domains show no significant Spearman correlation: "used the rules" is at least two dimensions, each stick illuminating only one.
Both readings low, inside and out: rule text entered the context window, participated in attention, but never entered the pathway that decides the verdict. The words passed through the mind without stopping.
The crucial control: were the rules even needed?
Low sensitivity isn't necessarily a defect — if most cases are decidable from content alone, unchanged verdicts are correct behavior. The rule-necessity experiment isolates cases where baseline verdicts are correct *only with* the rules, then re-measures sensitivity:
Can it be fixed? Two failed medicines
1. Prompt-based rule anchoring (cite the relevant clause before ruling): the only significant effect was *negative* — Qwen2.5-7B got significantly worse on LOW-OCS cases (−0.028, p < 0.0001). 2. Activation steering (adding/subtracting the compliance direction in the residual stream): no setting significantly beat baseline; negative steering significantly damaged accuracy on two models.
Low rule sensitivity appears to be a deep structural property, not a switch that prompt tweaks or even representational surgery can flip. It's a foundation problem.
The one linguistic clue that survived
Of five textual features tested, only mean dependency tree depth (MDD) passed BH multiple-comparison correction: ρ = 0.570, p = 0.044. Syntactically deeper, more nested rules are followed more; plainly written rules read as background noise. Counterintuitively, exception-clause density and cross-reference counts were not significant. And a correlation — one, corrected, bidirectionally interpretable — is far from causation.
Does the pattern generalize?
On LegalBench, OCS-agg = 0.255 (3.1× the main experiment); on ContractNLI, 0.318 (3.9×). Both rose — and both remain far below the 0.5 independence reference. ContractNLI's format (hypotheses as rules, tightly interlocked with contract excerpts) makes bypassing the rules harder, lifting OCS. Task format shapes behavior; benchmark scores are the shadow of the format. For buyers and regulators: validated on someone else's benchmark ≠ reliable on your task — and the system's actual dependencies follow the format, not your intent.
Reading the disclaimer
Stated limitations: rule text truncated at 300 characters (long regulations may be underestimated); OCS measures whether verdicts change, not whether changes are legally correct; LOW/HIGH-OCS partitions defined on one model carry bias when transferred; ICS-delta measures a single direction at an anchoring layer. These don't overturn the main conclusion — but they mark the boundary of what we know: we know verdicts largely ignore the rules; we do not yet know what models actually base verdicts on. That second question is harder, and more valuable.
Finale: who audits the auditors
The trilogy's arc: Part 1 showed evaluation numbers systematically distorting; Part 2 showed industry comparisons selectively narrated; Part 3 audits systems already in production, whose verdicts carry legal consequences and largely don't depend on the rules said to govern them. They resemble a veteran clerk drawing on experience and pattern memory — not a judge reading the code. The benchmark's 90% accuracy is real, but it is the clerk's memory, not the judge's learning.
The recursion deepens: these compliance systems are becoming evaluators themselves — grading, gating, certifying other models. Certification from a rule-blind judge grading another rule-blind judge is two report cards stamping each other.
The remedy is not prettier benchmarks but sharper instruments. OCS and ICS-delta — asking not "was it right?" but "was it right *because of the rules*?" — deserve to become mandatory pre-deployment tests, as crash tests are for cars. Otherwise we are judging by cookbook and filing the verdicts under the penal code.