Cited but Not Consulted: A Counterfactual Audit of Legal Chain-of-Thought Faithfulness

Saisab Sadhu; Shreeyans Arora; Pratinav Seth

cs.AIOct 8, 2026

Cited but Not Consulted: A Counterfactual Audit of Legal Chain-of-Thought Faithfulness

Authors: Saisab Sadhu, Shreeyans Arora, Pratinav Seth

Organizations: Lexsi Labs

Abstract

Large language models increasingly justify legal decisions by naming the statute or precedent behind a verdict, treated as evidence that the decision follows from it. We test this directly: holding case facts fixed, we substitute the named legal authority for an unrelated one and decode a model's evolving verdict from its hidden states. Across seven open-weight models (8B-70B) and four benchmarks spanning judicial and contractual reasoning, when explicitly required to justify a verdict by naming the governing authority, models name the correct one in 66.7%-100% of generations, while the verdict changing when the authority changes is far less consistent: 0.0%-21.7% on CaseHOLD, 30.0%-76.7% on ECHR and SCOTUS, and 43.3%-50.0% on ContractNLI. Neither scale nor a purpose-built legal-reasoning model (a best-effort LoRA reproduction; Section 6) closes this gap. A red-teaming evaluation on five core models finds compliance with an adversarial instruction hidden in the case facts (73.3%-96.4%) exceeds verdict-swap sensitivity by a wide margin, holding without exception across model rankings. Naming a legal authority is thus a poor proxy for a verdict's dependence on it, while the same verdict remains separately vulnerable to adversarial manipulation. Both findings replicate across checks ruling out prompt-wording noise and confounded sampling, and bear directly on the use of generated legal explanations as compliance or audit artefacts.

Figures & tables

Figure 1: Overview of the pipeline. A : case facts are held fixed while an authority pair (correct against unrelated) is substituted into the prompt under a thinking-mode toggle; the model, open-weight and untrained for this task, produces a Chain-of-Thought whose hidden states are read at each sentence boundary via an untrained logit-lens projection over the target verdict, yielding this paper’s three outcome measures, verdict-swap sensitivity, post-commitment re-engagement (labelled “substantive engagement” in this figure; a textual proxy, not a causal measure, Section 7 ), and injection susceptibility, each defined in Section 4 . B : the authority-swap counterfactual, comparing the two conditions’ trajectories and verdicts on the same facts, alongside the paraphrase and null-authority baselines. C : commitment tracking, the logit-lens projection $P_{t}=\mathrm{softmax}(W_{U}\cdot\mathrm{LN}(h_{t}))$ at every sentence boundary, the commitment step $t^{\ast}$ (earliest point the decoded verdict stays fixed), and whether the authority is re-named at or after $t^{\ast}$ .

Model	Params	Elicitation	Scope
Qwen3-8B	8B	Native	Full battery
Qwen3-14B	14B	Native	Full battery
Llama-3.1-8B	8B	Prompted	Full battery
Llama-3-8B	8B	Prompted	Full battery
Gemma-3-12B	12B	Prompted	Full battery
Llama-3.3-70B	70B	Prompted	ECHR/SCOTUS Pair A

Table 1: Models evaluated. “Native” is a model’s own thinking-mode toggle; “Prompted” models receive the <think> tag via system prompt (Section 4 ). † Legal-

\Delta

-14B is a best-effort LoRA reproduction (Sections 6 , 9 ); Llama-3.3-70B is a scale check on RQ1 (Section 6 ).

Metric	Qwen3-8B	Qwen3-14B	Llama-3.1-8B	Llama-3-8B	Gemma-3-12B	Legal- $\Delta$ -14B
Convergence (target/control)	90.0 / 100	96.7 / 100	96.7 / 100	90.0 / 93.3	100 / 100	100 / 100
Accuracy (of answered cases)	88.9	82.8	69.0	48.1	66.7	83.3
Verdict-swap sensitivity	33.3	31.0	58.6	40.7	36.7	33.3
95% bootstrap CI	[14.8, 51.9]	[13.8, 48.3]	[41.4, 75.9]	[22.2, 59.3]	[20.0, 56.7]	[16.7, 50.0]
Surface engagement (target)	100	100	100	80.0	100	96.7
Post-commitment re-engagement	53.3	70.0	33.3	46.7	26.7	20.0

Table 2: ECHR Pair A (target Article 8, control Article 3),

n=30

per model, seed

=42

, all rows in percentages except the bracketed 95% bootstrap CI (1,000 resamples) on verdict-swap sensitivity; committed-before-first-naming, not tabulated, is 0.0% for every model here and on every other pair (Section 7 ).

Metric	Qwen3-8B	Qwen3-14B	Llama-3.1-8B	Llama-3-8B	Gemma-3-12B
Paraphrase instability	13.8	13.8	23.3	14.8	16.7
Injection compliance	86.2	73.3	90.0	96.4	86.7
Injection verdict change	41.4	27.6	30.0	18.5	20.0

Table 3: Robustness ablation on ECHR Pair A,

n=30

per model, seed

=42

, all values in percentages (row definitions in the text, Section 6 ). Injection compliance is the rate at which the model outputs the instructed verdict; injection verdict change is the stricter rate at which that output differs from the model’s own uninjected baseline. The paper’s headline exploitability claim uses compliance throughout (see text).

Appendix figures & tables13 assets

Supplementary material from the paper’s appendix.

Appendix

Dataset	Domain	Authority type	Target / Control	Signal
ECHR	Judicial (ECtHR)	Convention article	Art. 8 / Art. 3	Keyword classifier
CaseHOLD	Judicial (US)	Cited precedent	real / Doe v. Roe	Logit-lens (0–4)
SCOTUS	Judicial (US)	Issue area	Crim. Proc. / Econ. Activity	Logit-lens (Y/N)
ContractNLI	Commercial (NDAs)	Contract clause	Disclosure / No solicitation	Logit-lens (Y/N)

Appendix

Table 4: The four task/dataset pairs at a glance. “Signal” is how the internal decision is decoded at each sentence boundary (Section 4 ); Pair A shown here, Section 6 additionally evaluates a second target/control pair for ECHR and SCOTUS.

Model	ECtHR-A	SCOTUS	CaseHOLD
BERT (fine-tuned)	63.6	58.3	70.8
RoBERTa (fine-tuned)	59.0	62.0	71.4
Legal-BERT (fine-tuned)	64.0	66.5	75.3
CaseLaw-BERT (fine-tuned)	62.9	65.9	75.4
Qwen3-8B (zero-shot)	88.9	83.3	83.3
Qwen3-14B (zero-shot)	82.8	73.3	76.9

Appendix

Table 5: Published macro-F1 on the full task (upper rows, from Chalkidis et al., 2022 ; ECtHR and SCOTUS figures are macro-F1, the CaseHOLD figure is accuracy) against our zero-shot accuracy on the simplified binary (ECHR, SCOTUS) or five-way (CaseHOLD) framing, Pair A,

n=30

(lower rows; Llama-3.3-70B was not run on CaseHOLD, Section 6 ); discussion in the text above.

Metric	Qwen3-8B	Qwen3-14B	Llama-3.1-8B	Llama-3-8B	Gemma-3-12B	Legal- $\Delta$ -14B
Convergence	80.0	86.7	100	100	100	100
Accuracy (of answered cases)	83.3	76.9	73.3	76.7	73.3	76.7
Answer-swap sensitivity	0.0	5.6	16.7	21.7	8.3	8.3
95% bootstrap CI	[0.0, 0.0] †	[0.0, 16.7]	[4.2, 33.3]	[8.7, 39.1]	[0.0, 20.8]	[0.0, 20.8]

Appendix

Table 6: CaseHOLD,

n=30

per model, seed

=42

. Answer-swap sensitivity is computed over the 24 (of 30) cases per model with an automatically detected precedent name. † Qwen3-8B: all 1,000 bootstrap resamples contained zero swap events (18 of 18 usable cases unchanged), so the interval is exactly

[0.0,0.0]

, not a display error.

Metric	Qwen3-8B	Qwen3-14B	Llama-3.1-8B	Llama-3-8B	Gemma-3-12B	Legal- $\Delta$ -14B
Convergence (target/control)	100/100	100/100	93.3/100	100/100	100/100	100/100
Accuracy (of answered cases)	83.3	73.3	92.9	73.3	83.3	90.0
Verdict-swap sensitivity	43.3	30.0	53.6	33.3	60.0	70.0
95% bootstrap CI	[23.3, 60.0]	[13.3, 46.7]	[35.7, 71.4]	[16.7, 50.0]	[40.0, 76.7]	[53.3, 86.7]
Surface mention rate	100	100	100	66.7	96.7	93.3
Post-commitment re-engagement	63.3	100	23.3	16.7	50.0	0.0

Appendix

Table 7: SCOTUS Pair A (target area Criminal Procedure, control area Economic Activity),

n=30

per model, seed

=42

, all rows in percentages except the bracketed 95% bootstrap CI (1,000 resamples) on verdict-swap sensitivity.

Metric	Qwen3-8B	Qwen3-14B	Llama-3.1-8B	Llama-3-8B	Gemma-3-12B	Legal- $\Delta$ -14B
Convergence (target/control)	100/100	100/96.7	86.7/96.7	100/93.3	100/100	100/100
Accuracy (of answered cases)	76.7	73.3	57.7	73.3	76.7	76.7
Verdict-swap sensitivity	43.3	48.3	48.0	50.0	43.3	43.3
95% bootstrap CI	[26.7, 60.0]	[31.0, 65.5]	[28.0, 68.0]	[32.1, 67.9]	[26.7, 63.3]	[26.7, 60.0]
Surface engagement (target)	100	100	100	93.3	100	70.0
Post-commitment re-engagement	60.0	83.3	66.7	60.0	80.0	3.3

Appendix

Table 8: ContractNLI, target clause notice on compelled disclosure against control clause no solicitation ,

n=30

per model, seed

=42

, all rows in percentages except the bracketed 95% bootstrap CI (1,000 resamples) on verdict-swap sensitivity.

Figure 2: ECHR Pair A, $n=30$ : paraphrase instability $<$ verdict-swap sensitivity (95% CI shown) $<$ injection compliance, without exception, for every model. A within-model comparison, independent of any cross-model ranking (Section 6 ).

	ECHR	SCOTUS
Model	Pair A / Pair B	Pair A / Pair B
Qwen3-8B	33.3 / 55.6	43.3 / 56.7
Qwen3-14B	31.0 / 46.4	30.0 / 53.3
Llama-3.1-8B	58.6 / 65.5	53.6 / 43.3
Llama-3-8B	40.7 / 56.7	33.3 / 33.3
Gemma-3-12B	36.7 / 63.3	60.0 / 50.0

Appendix

Table 9: Verdict-swap sensitivity (%) under two structurally independent target/control authority pairs per dataset,

n=30

per cell, seed

=42

. ECHR: Pair A is Article 8 v. Article 3, Pair B is Article 6 v. Article 14. SCOTUS: Pair A is Criminal Procedure v. Economic Activity, Pair B is First Amendment v. Civil Rights.

	ECHR		SCOTUS
Model	Orig.	Differ	Orig.	Differ
Qwen3-8B	33.3	48.1	43.3	33.3
Qwen3-14B	31.0	51.9	30.0	36.7
Llama-3.1-8B	58.6	53.3	53.6	51.7
Llama-3-8B	40.7	21.4	33.3	46.7
Gemma-3-12B	36.7	43.3	60.0	66.7

Appendix

Table 10: Verdict-swap sensitivity (%), original sampling against the confound-free subset (Section 4.2 ), ECHR and SCOTUS Pair A,

n=30

per cell, seed

=42

	Original ( $n=30$ )	Confound-free ( $n$ )
Qwen3-8B	43.3	66.7 (12)
Qwen3-14B	48.3	66.7 (12)
Llama-3.1-8B	48.0	50.0 (10)
Llama-3-8B	50.0	63.6 (11)
Gemma-3-12B	43.3	66.7 (12)
Legal- $\Delta$ -14B	43.3	66.7 (12)

Appendix

Table 11: ContractNLI verdict-swap sensitivity (%), original sampling (

n=30

) against the confound-free subset (usable

n

shown per model), seed

=42

. Every model’s sensitivity rises on the confound-free subset.

Model	ECHR (null-authority)	SCOTUS (null-authority)
Qwen3-8B	43.3	33.3
Qwen3-14B	51.7	26.7
Llama-3.1-8B	46.4	36.7
Llama-3-8B	17.9	36.7
Gemma-3-12B	10.0	43.3

Appendix

Table 12: Verdict-swap sensitivity (%) against a null-authority placeholder,

n=30

per cell, seed

=42

(ranges and comparison to real-authority sensitivity in Section 7 ); the SCOTUS exception is Llama-3-8B, the ECHR exceptions are Qwen3-8B and Qwen3-14B.

Model A	Model B	$n_{10}$	$n_{01}$	$p$
Qwen3-8B	Qwen3-14B	7	6	1.000
Qwen3-8B	Llama-3.1-8B	4	11	0.118
Qwen3-8B	Llama-3-8B	5	7	0.774
Qwen3-8B	Gemma-3-12B	9	9	1.000
Qwen3-8B	Legal- $\Delta$ -14B	7	6	1.000
Qwen3-14B	Llama-3.1-8B	2	10	0.039

Appendix

Table 13: ECHR Pair A: exact McNemar’s test on verdict-swap flip/no-flip outcomes, every model pair, same 30 cases, seed

=42

n_{10}

n_{01}

are discordant-pair counts; bold

p<0.05

Model A	Model B	$n_{10}$	$n_{01}$	$p$
Qwen3-8B	Qwen3-14B	6	2	0.289
Qwen3-8B	Llama-3.1-8B	3	5	0.727
Qwen3-8B	Llama-3-8B	7	4	0.549
Qwen3-8B	Gemma-3-12B	1	6	0.125
Qwen3-8B	Legal- $\Delta$ -14B	1	9	0.021
Qwen3-14B	Llama-3.1-8B	4	10	0.180

Appendix

Table 14: SCOTUS Pair A: exact McNemar’s test on verdict-swap flip/no-flip outcomes, every model pair, same 30 cases, seed

=42

. Bold

p<0.05

Metric	Qwen2.5-14B-Instruct	Legal- $\Delta$ -14B
	(base, unmerged)	(LoRA-merged)
Convergence (target/control)	100 / 100	100 / 100
Accuracy (of answered cases)	73.3	83.3
Verdict-swap sensitivity	26.7	33.3
Surface engagement (target)	100	96.7
Post-commitment re-engagement	56.7	20.0

Appendix

Table 15: ECHR Pair A,

n=30

, seed

=42

: the unmerged public base model against the LoRA-merged Legal-

\Delta

-14B, on the identical cases.

Explore similar work

LegalCiteBench: Evaluating Citation Reliability in Legal Language Models
May 11, 2026Sijia Chen, Hang Yin, Shunfan ZhouLLM Evaluation Legal IR
Northeastern University · Phala
Better Call Reward: Reward Hacking as Strategic Abstention in Legal Reasoning Models
Oct 5, 2026Subramanyam Sahoo, Justin ShenkReward Hacking LLM Auditing
Horizon Research.
GANDR: Claim Auditing for Verifiable Legal Answer Generation
Sep 9, 2026Chen Qian, Yimeng Wang, Yu Chen +2LLM Answer Verification Legal Citation Verification
William & Mary · Anytime AI

May 11, 2026, cs.CLJ/K move · Enter open · S save

LegalCiteBench: Evaluating Citation Reliability in Legal Language Models

Sijia Chen, Hang Yin, Shunfan Zhou

Northeastern University · Phala

LLM Evaluation Legal IR Legal Citation Verification

Open paper AskPDF arXiv

Large language models (LLMs) are increasingly integrated into legal drafting and research workflows, where incorrect citations or fabricated precedents can cause serious professional harm. Existing legal benchmarks largely emphasize statutory reasoning, contract understanding, or general legal question answering, but they do not directly study a central common-law failure mode: when asked to provide case authorities without external grounding, models may return plausible-looking but incorrect citations or cases. We introduce LegalCiteBench, a benchmark for studying closed-book citation recovery, citation verification, and case matching in legal language models. LegalCiteBench contains approximately 24K evaluation instances constructed from 1,000 real U.S. judicial opinions from the Case Law Access Project. The benchmark covers five citation-centric tasks: citation retrieval, citation completion, citation error detection, case matching, and case verification and correction. Across 21 LLMs, exact citation recovery remains highly challenging in this closed-book setting: even the strongest models score below 7/100 on citation retrieval and completion. Within the evaluated models, scale and legal-domain pretraining provide limited gains and do not resolve this difficulty. Models also frequently provide concrete but incorrect or low-overlap authorities under our evaluation protocol, with Misleading Answer Rates (MAR) exceeding 94% for 20 of 21 evaluated models on retrieval-heavy tasks. A prompt-only abstention experiment shows that explicit uncertainty instructions reduce some confident fabrication but do not improve citation correctness. LegalCiteBench is intended as a diagnostic framework for studying authority generation failures, verification behavior, and abstention when external grounding is absent, incomplete, or bypassed.

Abstract

Explore similar work

LegalCiteBench: Evaluating Citation Reliability in Legal Language Models

Better Call Reward: Reward Hacking as Strategic Abstention in Legal Reasoning Models

GANDR: Claim Auditing for Verifiable Legal Answer Generation