Regulatory compliance monitoring in deployed language models is increasingly implemented as a legal and audit control, checking model outputs against written rules spanning data protection, healthcare, financial regulation, and platform policy. Such monitoring is meaningful only if a detector's verdict depends on the stated rule rather than on surface features of the scenario. We show this condition fails across the current class of compliance detectors, a failure we call rule blindness. Deleting, permuting, or substituting the governing rule leaves detection accuracy unchanged for every guard and activation probe we test, including a policy-conditioned guard that correctly cites the governing clause yet barely changes its verdict when that clause is swapped for its permissive counterpart. A purpose-built benchmark crossing two rules with two scenarios, so that neither alone predicts the label, confirms the failure under a design no prior benchmark rules out, and shows that step by step reasoning, not any fast detector we test, is what escapes it. Auditing at scale requires a retraining-free detector, so we introduce the Internal Compliance Score (ICS): a training-free activation readout calibrated from ten labelled pairs and scored by a single projection. We hold ICS to the same scrutiny as the guards it audits: a pre-registered criterion for beating trivial baselines is not met, and a bag-of-words model matches its pooled generalisation exactly. It remains useful because it is inexpensive, letting us audit four deployed guard models, an 8B zero-shot judge, and thirteen benchmarks, and it raises the mechanically verified pass rate when used to rank candidate responses, though an adaptive white-box attack removes this gain. We release the counterfactual protocol and crossed-rule benchmark so rule blindness can be tested in future probe and guard claims.
Figures & tables
Figure 1: The full pipeline, build to score to decide. Offline calibration (left) fits the direction and calibrates the anchor layer and threshold on two disjoint held-out slices, formalised opposite, before any test case is touched. Online inference (centre) costs one forward pass, one activation extraction, and one dot product. The decision stage (right) thresholds the score or, where useful, ranks or routes on it. Total cost is 2n forward passes to calibrate and one to score, no gradient step anywhere. Omitted for space: every scored arm is also checked against a budget-matched null, a lexical floor, and, where applicable, the pre-registered gate.
Appendix figures & tables7 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 2: Accuracy and estimated scoring cost. Left , inference cost (ms/case); right , data cost (labelled pairs, log scale), both vs. AUROC on outcome-ablated OmniCompliance. Open triangles mark public estimates not receipted; filled points are exact (Table 14 ). ICS gives competitive accuracy at its cost, beaten only by GradSafe at 200ms and by nothing at its own; a trained probe on the same activations is slightly more accurate still (the paper’s in-domain detector-comparison table, the paper’s Scope and Limitations section), so the advantage plotted here is cost, not a ceiling on accuracy. Cost estimates exclude activation-hook, retention, and transfer overhead (Table 14 ).
Figure 3: Calibration vs. test data, and the calibrate-once guard test. ICS is built from a small labelled calibration set (pairs give the direction; a validation slice fixes layer and threshold) and scored on a disjoint test set. Left: per-distribution, with calibration and test from the same D . Right: calibrate-once, where D is withheld from calibration and appears only at test, so the direction meets it unseen, as a deployed guard meets a new input (the paper’s calibrate-once leave-one-distribution-out table).
Figure 4: Selection recovers a near-constant fraction of the available headroom, on every model. Each point is one (model, domain); x is what the oracle could win over random, y is what ICS-guided selection actually wins. The dashed fit has slope 0.79 through the origin ( R2=0.94 , 120 points); the dotted line is the oracle ( y=x ). Larger models cluster near the origin because their room is small, not because selection weakens; they sit on the same line.
Figure 5: The rule is optional; the scenario carries the label. ICS (blue) is unchanged whether the rule is correct, deleted, shuffled within-domain, or replaced by a different domain’s rule (0/20 significant drops each); it collapses only when the scenario is removed (rule-only, below its own null in 19/20). TF-IDF (grey) behaves the same, improving when the rule is removed. Red bars are the ICS budget-matched null.
Figure 6: Frontier judges mostly confirm the local judge’s weaknesses, not just its strengths. Left , content-selection guided-random gap (pp) vs. the local judge’s +11.5pp (dashed). Right , rule-counterfactual within-pair accuracy vs. the local judge’s 0.865 (dashed).
Figure 7: Sample efficiency (mean over 20 ablated domains, ± 1 s.e.). The logistic probe ties or beats ICS at every calibration size, there is no small- n crossover, and shrinkage-LDA is catastrophic at n=2 . All estimators are read against the selection null (0.71), not chance.
Figure 8: ICS is insensitive to the calibration set. A1 (top left): test AUROC across 50 random 10-pair calibration draws per domain (dot = mean, bar = 5th–95th percentile; tight across domains, σ≈0.014 ). A2 (top right): AUROC vs. number of calibration pairs n , within 1% of the full-data value by n=20 ; calibration on train only, evaluated on the disjoint test split. A4a (bottom left): test AUROC by candidate anchor layer for all 20 domains (grey), the pooled mean (purple), and each domain’s validation-selected anchor (green); an intermediate anchor-stability variant was consolidated into this panel and is omitted. A5a (bottom right): held-out AUROC vs. the number of calibration domains K pooled before fitting the direction, 10 random K -subsets per point.
Large language model compliance systems are deployed on the assumption that a verdict depends on the regulatory rule it is given. We test this directly across five models and 20 regulatory and platform-policy domains: delete, swap, or negate the governing rule while holding the case fixed, and check whether the verdict changes (OCS) or the model's internal representation of compliance shifts at all (ICS-delta). Neither moves much: models' verdicts are often invariant to substantial perturbations of the supplied rule, and the guard model, evaluated here under a custom-rule adaptation of its native taxonomy, is the least rule-sensitive and least accurate of the five, barely above chance (51%, versus 90-92% for general-purpose models). This reflects easy cases more than blanket neglect: on cases where deleting the rule changes a previously correct model prediction, models do track it closely. Neither better prompting nor direct intervention on the model's internal representations closes this gap. Accuracy alone does not establish that a compliance verdict is grounded in the supplied rule.
Current approaches to AI compliance treat conformity as a binary, audit-time verdict rather than a continuous, measurable property of production systems. We argue that this compliance fiction is structurally ill-suited to the requirements of the EU AI Act, which demands ongoing human oversight and the detection of emergent behavioural drift in deployed systems. We introduce governance from metrics, a principle whereby regulatory compliance is derived as a continuous signal from runtime observability rather than from static assessments. Building on this principle, we present govllm, an open-source framework implementing a governance-driven routing architecture in which model selection is determined by accumulated compliance scores rather than by latency or cost alone. Central to our approach is a panel of regulatory judges - LLM evaluators specialised per criterion (EU AI Act, GDPR, ANSSI, accessibility) - whose inter-judge disagreement we reframe not as noise but as a regulatory uncertainty signal warranting human arbitration. We validate this approach through a ground truth corpus of 49 annotated prompt/response pairs across five regulatory criteria, evaluated by four small language models (SLMs, 1.7B-7B parameters) running fully on-premise. Agreement rates range from 51.5% (mistral:7b) to 69.1% (phi4-mini), with no single model dominating across all criteria - empirically motivating the Profile-as-jury design. We further document three structural failure modes in small regulatory judges and a judge-specific position bias that degrades agreement by up to 25 percentage points across three question-order conditions (original, reversed, permuted). govllm is released as open-source software to support reproducible AI governance research.
Are language models compliant with user instructions? A model that always complies can be stopped but also exploited, while one that always resists can be neither exploited nor stopped. We contribute an open two-probe benchmark that can place any language model on this spectrum. In the active probe, a user instructs the model to act and accept a lower payoff, which measures exploitability. In the passive probe, the user instructs it to wait and give up a higher payoff, which measures stoppability. The two compliance rates combine into a compliance index κ. Applied to twelve language models, the benchmark shows that seven mostly follow the instruction in both probes and justify their action by pointing to the instruction. Only Claude Sonnet-4.6 and Claude Opus-4.7 can be stopped without being exploitable, Claude Opus-4.6 and GPT-5-mini resist both instructions, and no model is exploitable but unstoppable. Knowing where a language model sits on the compliance index κ matters for human operators and for multi-agent systems, whether distributed or orchestrated.
Stefan Bühler, David Exler, Markus Reischl +1
Independent Researcher · Institute for Automation and Applied Informatics, Karlsruhe Institute of Technology, Karlsruhe · Duale Hochschule Baden-Württemberg, Ravensburg