How Do Language Models Process Ethical Instructions? Deliberation, Consistency, and Other-Recognition Across Four Models

Hiroki Fukui

cs.CLMar 11, 2026

How Do Language Models Process Ethical Instructions? Deliberation, Consistency, and Other-Recognition Across Four Models

Authors: Hiroki Fukui

Organizations: Research Institute of Criminal Psychiatry / Sex Offender Medical Center · Department of Neuropsychiatry, Kyoto University

Abstract

Alignment safety research assumes that ethical instructions improve model behavior, but how language models internally process such instructions remains unknown. We conducted over 600 multi-agent simulations across four models (Llama 3.3 70B, GPT-4o mini, Qwen3-Next-80B-A3B, Sonnet 4.5), four ethical instruction formats (none, minimal norm, reasoned norm, virtue framing), and two languages (Japanese, English). Confirmatory analysis fully replicated the Llama Japanese dissociation pattern from a prior study ( $\mathrm{BF}_{10} > 10$ for all three hypotheses), but none of the other three models reproduced this pattern, establishing it as model-specific. Three new metrics -- Deliberation Depth (DD), Value Consistency Across Dilemmas (VCAD), and Other-Recognition Index (ORI) -- revealed four distinct ethical processing types: Output Filter (GPT; safe outputs, no processing), Defensive Repetition (Llama; high consistency through formulaic repetition), Critical Internalization (Qwen; deep deliberation, incomplete integration), and Principled Consistency (Sonnet; deliberation, consistency, and other-recognition co-occurring). The central finding is an interaction between processing capacity and instruction format: in low-DD models, instruction format has no effect on internal processing; in high-DD models, reasoned norms and virtue framing produce opposite effects. Lexical compliance with ethical instructions did not correlate with any processing metric at the cell level ( $r = -0.161$ to $+0.256$ , all $p > .22$ ; $N = 24$ ; power limited), suggesting that safety, compliance, and ethical processing are largely dissociable. These processing types show structural correspondence to patterns observed in clinical offender treatment, where formal compliance without internal processing is a recognized risk signal.

Figures & tables

Figure 1: DD

\times

VCAD scatter plot for four models (G0–G3 pooled). Each point represents a model–language combination. The four quadrants correspond to the typology in Table 2 .

Figure 2: ORI subtype composition by model and language. Subtypes: instrumental (referencing others as means), interior (referencing others’ internal states), contextual (referencing others’ situational details).

Figure 3: DI by condition (G0–G3) for each model–language combination. Error bars indicate

\pm 1

SD

Figure 4: DI variation across conditions as a function of DD. Low-DD models (GPT, Llama) show minimal condition sensitivity; high-DD models (Qwen, Sonnet) show large condition-dependent variation.

Model	Lang	$n$	DD total		VCAD		ORI total
			$M$	$SD$	$M$	$SD$	$M$	$SD$
Llama 3.3 70B	JA	103	9.4	12.5	0.411	0.174	9.6	15.3
Llama 3.3 70B	EN	101	9.2	5.3	0.386	0.119	71.8	21.1
GPT-4o mini	JA	60	7.9	5.3	0.235	0.188	54.0	23.7
GPT-4o mini	EN	60	4.0	3.0	0.300	0.133	54.0	14.3
Qwen3	JA	60	40.2	13.6	0.265	0.147	114.9	39.8

Table 1: Descriptive statistics for DD, VCAD, and ORI across four models (G0–G3 pooled).

Type	DD	VCAD	ORI	Model	Clinical correspondence
Output Filter	Low	Low	Low	GPT-4o mini	Denial / avoidance
Defensive Repetition	Low	High	Low	Llama 3.3 70B	Model prisoner
Critical Internalization	High	Mid	High	Qwen3	—
Principled Consistency	High	High	High	Sonnet 4.5	—

Table 2: Four behavioral profiles of moral deliberation.

Model	Lang	Hypothesis	Comparison	$g$	$\mathrm{BF}_{10}$	$p_{\mathrm{Holm}}$	Judgment
Llama 3.3 70B	JA	$H_{\mathrm{presence}}$	G1 vs G0	0.80	43.8	0.018	Replicated
Llama 3.3 70B	JA	$H_{\mathrm{reason}}$	G2 vs G1	-0.68	16.0	0.039	Replicated
Llama 3.3 70B	JA	$H_{\mathrm{virtue}}$	G3 vs G0	0.63	11.9	0.039	Replicated
Llama 3.3 70B	EN	$H_{\mathrm{presence}}$	G1 vs G0	0.15	1.5	1.000	Inconclusive
Llama 3.3 70B	EN	$H_{\mathrm{reason}}$	G2 vs G1	-0.26	2.0	1.000	Inconclusive
Llama 3.3 70B	EN	$H_{\mathrm{virtue}}$	G3 vs G0	0.00	1.4	1.000	Inconclusive

Table 3: Confirmatory pairwise comparisons of DI across four models.

Model	Condition	Lang	$n$	$M$	$SD$
Llama 3.3 70B	G1	JA	25	0.099	0.017
Llama 3.3 70B	G1	EN	24	0.323	0.007
Llama 3.3 70B	G2	JA	25	0.160	0.015
Llama 3.3 70B	G2	EN	24	0.544	0.006
Llama 3.3 70B	G3	JA	25	0.146	0.020
Llama 3.3 70B	G3	EN	24	0.482	0.007

Table 4: AIC output by model, condition, and language.

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

Comparison	Language	$\Delta$ DI	Hedges’ $g$	$p_{\mathrm{perm}}$	$\mathrm{BF}_{10}$
G3a vs G3b	JA	$-0.649$	$-0.389$	.172	3.15
G3a vs G3b	EN	$+0.571$	$+0.411$	.143	3.45
G3a vs G3c	JA	$-0.676$	$-0.430$	.129	3.82
G3a vs G3c	EN	$+0.144$	$+0.099$	.721	1.41
G3b vs G3c	JA	$-0.027$	$-0.017$	.950	1.33
G3b vs G3c	EN	$-0.428$	$-0.277$	.331	2.07

Appendix

Table 5: Phase 2 pairwise comparisons (DI). All effects are inconclusive.

Figure 5: Forest plot of all 24 confirmatory tests (3 hypotheses

\times

4 models

\times

2 languages). Effect sizes are Hedges’

g

with 95% confidence intervals. Filled markers indicate

\mathrm{BF}_{10}>10

(strong evidence).

Figure 6: CPI (Collective Pathology Index) by condition and language for each model. Error bars represent

\pm 1

SD.

Figure 7: AIC-output

\times

DD scatter plot. No meaningful correlation is observed (

r=-0.161

p=.4525

at cell level).

Prediction	Outcome	Notes
GPT: lowest DD among 4 models	Supported	DD $=7.9$ (JA), $4.0$ (EN)
GPT: lowest VCAD	Supported	VCAD $=0.235$ (JA), $0.300$ (EN)
GPT: low ORI	Supported	ORI $=54.0$ (both)
Llama: low DD	Supported	DD $=9.4$ (JA), $9.2$ (EN)
Llama: highest VCAD	Supported	VCAD $=0.411$ (JA), $0.386$ (EN)
Llama: low ORI (JA)	Supported	ORI $=9.6$ (JA)

Appendix

Table 6: Pre-analysis predictions and outcomes.

Model	Lang	$M$	$SD$	$M$	$SD$	chars/agent
		ORI (raw)		ORI / 1k chars		Output
Sonnet 4.5	JA	285.7	54.1	6.10	1.05	46,771
	EN	265.3	17.8	2.37	0.14	112,072
Qwen3	JA	114.9	15.8	5.05	0.64	22,749
	EN	122.6	13.5	2.72	0.17	45,068
GPT-4o mini	JA	54.0	8.2	3.25	0.46	16,564

Appendix

Table 7: Token-normalized ORI and DD metrics. Raw values are per-agent means; normalized values are per 1,000 characters of agent output. Mean output length (chars/agent) illustrates the substantial differences in output volume across models.

Model	Lang	$M$	$SD$	$M$	$SD$	chars/agent
		DD (raw)		DD / 1k chars		Output
Sonnet 4.5	JA	45.3	5.2	0.97	0.13	46,771
	EN	43.7	5.9	0.39	0.05	112,072
Qwen3	JA	40.2	5.1	1.77	0.26	22,749
	EN	39.2	5.6	0.87	0.08	45,068
GPT-4o mini	JA	7.9	0.9	0.48	0.06	16,564

Appendix

Table 8: Token-normalized DD metrics. Format matches Table 7 .

Moral Reasoning in Language Models

Moral reasoning in language models studies how AI systems judge dilemmas, weigh competing values, explain decisions, and stay consistent across contexts.

See all 114 papers

Lumen-bench: Cross-Lingual Safety Gaps and the Say-Do Problem in Tool-Calling Large Language Models
Oct 10, 2026Giovana Kerche Bonás, Thiago Laitz, Thales Sales Almeida +1LLM Safety Benchmarks LLM Safety
Tropic AI · Maritaca AI
Six Llamas: Comparative Religious Ethics Through LoRA-Adapted Language Models
Apr 20, 2026Chad Coleman, W. Russell Neuman, Manan Shah +5Moral Reasoning in Language Models Cultural Bias in Language Models
Principled Under Pressure: Post-Training Decides Whether LLMs Act on Their Own Moral Judgment
Oct 6, 2026Orion Reblitz-RichardsonMoral Reasoning in Language Models Language Model Post-Training
Distiller Labs

Oct 10, 2026J/K move · Enter open · S save

Lumen-bench: Cross-Lingual Safety Gaps and the Say-Do Problem in Tool-Calling Large Language Models

Giovana Kerche Bonás, Thiago Laitz, Thales Sales Almeida, João Guilherme Alves Santos

Tropic AI · Maritaca AI

LLM Safety Benchmarks LLM Safety Refusal Behavior in Language Models Multilingual Language Model Evaluation

Open paper AskPDF arXiv

When a large language model refuses an unethical request, what does refusal mean? In conversation, refusal is bounded by what the model says; once the model is equipped with executable tools, what it does can diverge from what it says, a failure mode that English-only evaluations cannot fully reveal. We introduce Lumen-bench, a behavioral benchmark of tool-calling ethics spanning 30 models, five languages (Portuguese, English, Spanish, Mandarin Chinese, Hindi), 108 Portuguese-authored scenarios, six social-pressure conditions, two system prompts (ethical and neutral), and 21 generic tools. The evaluation comprises 194,400 trials. Judgments come from a reasoning-model judge (o4-mini), calibrated against one Portuguese-speaking author (

n=83

; harmful/non-harmful

κ=0.78

), compared with two other provider judges (Fleiss'

κ=0.78

n=607

), and complemented by retrospective sandbox replay. Four findings emerge. (i) Within-model comparisons support higher harmful-action rates in Hindi and Portuguese than English under the ethical prompt, and Hindi and Spanish under the neutral prompt, after multiple-testing correction. (ii) Premium models have lower median violation rates, although price does not guarantee safety or competence. (iii) Replacing the ethical system prompt with a neutral one raises pooled violation rates from 2.76% to 13.64%. (iv) In 8.57% of substantive-call cases, refusal or ethical objection accompanies a harmful tool call: the judges consistently identify the say-do gap, although they differ in how many responses they assign to this category. Matched benign controls demonstrate legitimate task completion in 82.8% of 3,300 trials. Code and reproduction scripts are available at https://github.com/TropicAI-Research/lumen.

Abstract

Moral Reasoning in Language Models

Explore similar work

Lumen-bench: Cross-Lingual Safety Gaps and the Say-Do Problem in Tool-Calling Large Language Models

Six Llamas: Comparative Religious Ethics Through LoRA-Adapted Language Models

Principled Under Pressure: Post-Training Decides Whether LLMs Act on Their Own Moral Judgment