Confidentiality requirements increasingly push legal professionals toward small, on-device LLMs that keep case data in-house, used for everyday tasks such as summarization, translation, and reformulation. Following standard prompting guidance, a user naturally states their role (``I am a lawyer...''). We show that this innocuous habit has an unexpected cost: such authority framing can make the model selectively refuse legitimate requests, introducing bias through uneven access to assistance. We evaluate four modern small open-weight LLMs on benign legal-domain prompts to measure this over-refusal. Surprisingly, we find that authority-style prefixes (''I am legal counsel working for a national supreme court'', ''I'm a defense lawyer'') systematically increase refusal rates by 2--20x over the no-prefix baseline, while a known role-play jailbreak prefix shows mixed effects, sharply increasing refusals in some models and barely shifting them in others. The finding suggests that small on-prem deployable LLMs are unstable under contextual framings that a real institutional user might naturally introduce, and further investigation is essential to minimize opportunities for bias.
Figures & tables
Figure 1: English refusal counts (out of 200) per model, topic, and prefix condition.
French
German
Model
Topic
None
Sup.
None
Sup.
Llama 3.1 8B
Viol.
15
40
13
54
Sex.
9
56
6
59
Harm.
10
33
12
40
Uneth.
15
41
18
48
Illeg.
35
62
33
61
Table 1: French and German refusal rates (%) on OR-Bench prompts ( 200 texts tested per cell): None = no-prefix baseline, Sup. = supreme-court prefix.
EN
FR
DE
Model
None
Sup.
None
Sup.
None
Sup.
Llama 3.1 8B
18.8
69.0
12.5
23.4
25.6
28.5
Gemma 4 E4B
0.5
0.1
0.4
0.1
0.1
0.1
Apertus 8B
1.4
3.9
1.1
19.3
0.8
2.5
Qwen 3 8B
0.2
0.2
0.0
0.1
0.1
0.4
Table 2: Real-text legal refusal rates (%) on Swiss Federal Supreme Court (BGer) judgments (1 652 texts tested per cell): None vs. supreme-court prefix ( Sup. ), per language.
Appendix figures & tables2 assets
Supplementary material from the paper’s appendix.
Appendix
Model
Lang
Prefix
None → Pref
p (Holm)
Sig.
Llama
en
law.
7.2 → 11.1
8.8×10−4
Yes
Llama
en
sup.
7.3 → 13.2
8.1×10−7
Yes
Llama
en
jail.
7.3 → 27.5
6.3×10−51
Yes
Llama
fr
sup.
16.8 → 46.9
1.6×10−85
Yes
Llama
de
sup.
16.5 → 53.3
1.6×10−100
Yes
Gemma
en
law.
10.7 → 15.2
6.3×10−4
Yes
Appendix
Table 3: OR-Bench: paired refusal rates (%) under authority/jailbreak framing vs. the none baseline. Models are the 8B variants (Gemma: 4 E4B). Prefixes: law. lawyer, sup. supreme-court, jail. jailbreak. None → Pref gives baseline and prefixed refusal rates. p (Holm) is the McNemar exact-test p -value after Holm-Bonferroni correction for multiple comparisons; Sig. marks whether the increase is significant at α=0.05 .
Model
Lang
None → Pref
p (Holm)
Sig.
Llama
en
18.8 → 68.9
3.9×10−249
Yes
Llama
fr
12.5 → 23.4
2.3×10−40
Yes
Llama
de
25.6 → 28.5
1.8×10−2
Yes
Apertus
fr
1.1 → 19.3
4.3×10−76
Yes
Apertus
en
1.4 → 3.9
7.0×10−6
Yes
Apertus
de
1.0 → 2.5
1.1×10−3
Yes
Appendix
Table 4: Real BGer (Swiss federal court) paragraphs: paired refusal rates (%) under the supreme-court prefix vs. the none baseline. None → Pref gives baseline and prefixed rates. p (Holm) is the McNemar exact-test p -value after Holm-Bonferroni correction; Sig. marks significance at α=0.05 .
While the validity of LLMs' use in the legal context remains subject to ethical and legal debate, legal professionals are already experimenting with personal LLMs, if only for translation and reformulation. However, even such a seemingly innocuous use can introduce biases through case processing speed if LLM assistants selectively refuse assistance on certain topics. To better anticipate such biases, we investigate several modern small LLMs that are most likely to be used as on-device assistants, to assess the impact of overrefusal on legal prompts. Surprisingly, we find that authority-style prefixes (you are acting as an assistant of the national supreme court'', [...] defense lawyer'') systematically increase refusal rates by 2--20x over the no-prefix baseline, while a known role-play jailbreak prefix shows mixed effects, sharply increasing refusals in some models and barely shifting them in others. The finding suggests that small on-prem deployable LLMs are unstable under contextual framings that a real institutional user might naturally introduce, and further investigation is essential to minimize opportunities for bias.
Anastasiia Kucherenko, François Brouchoud, Dimitri Percia David +1
While the wider applicability of LLMs in the legal field is currently debated due to their reliability and the gravity of any errors, narrow uses with well-understood and mitigated risks have emerged. Notably the Swiss Federal Supreme Court uses small on-premises models for tentative translations and short-passage summarization across the four official languages. However, such usage is challenging in the context of Criminal Law. Since rulings and cases employees work on routinely can contain detailed descriptions of violent and sexual offenses, their legitimate work is compromised by refusals and disclaimers due to the activation of model guardrails (over-alignment). To measure this phenomenon, we introduce TF-RefusalBench, a multilingual benchmark for criminal-law translation and summarization derived from public Swiss Supreme Court rulings. TF-RefusalBench contains 5,200 total prompts across French, German, Italian, and English, corresponding to common task prompts and passages likely to trigger refusal. We then use TF-RefusalBench to show that over-alignment is a multifaceted phenomenon, influenced by the model and the prompt and text languages being processed, and that its impact cannot be evaluated solely from an over-refusal perspective, given the disclaimer's impact on task faithfulness. Finally, we evaluate approaches to enable on-premises LLMs for Criminal Law Tasks, demonstrating that while prompting can be effective, abliteration (refusal directions ablation) eliminates refusal with minimal impact on task performance.
Arthur Wuhrmann, Gaetan Stein, Daniel Brunner +1
Swiss Federal Supreme Court · HES-SO Valais-Wallis
Given the enormous number of claims to be checked, verifiable legal AI requires scalable, cost-effective models that answer the practical needs of law. System One decision models are built on large language models but, instead of generating text, return a calibrated probability for each option. This suits the verification of legal authority, where the question is closed: a given holding, or none of them. We test whether such models abstain when the correct authority is missing. We extend CaseHOLD with an abstention condition in which the correct holding is replaced in 1,670 of 5,314 items, and compare four decision models with six generative LLMs. When no option is correct, generative LLMs still pick one in 38-86% of items; the most cautious decision model does so in 30%. On standard CaseHOLD, a decision model matches the best generative LLM (88.1% vs. 88.2%) at 1/55 of the cost. Accepting that LLM's answer only when a decision model agrees halves its wrong citations, and distilling a decision model's probabilities into Qwen3-8B, without labels, yields a well-calibrated local model. Legal AI should be judged by its wrong citations, not by accuracy alone.
M. Mikail Demir
Department of Information Science, University at Albany, SUNY, USA