Can AI guard models actually apply the rules they are given? A 2026 preprint finds that, for the guards, probes and benchmarks it tested, deleting, permuting or substituting the supplied policy often left detection accuracy and verdicts essentially unchanged. That is evidence of rule blindness in those evaluated systems—not proof that every guard used in the European Union ignores the law.
The result matters because a detector can classify familiar violation scenarios correctly while never using the particular rule that supposedly governs each decision. The EU AI Act gives this question practical urgency: obligations for general-purpose AI (GPAI) providers applied from 2 August 2025, and the European Commission’s supervision and enforcement powers began on 2 August 2026, according to a Future of Life Institute implementation guide. Detector behavior alone does not establish an infringement or predict how the Commission will assess a provider.
As an Amazon Associate I earn from qualifying purchases.
What the audit actually found
Sadhu, Sengupta, Sankarapu and Seth’s preprint, What Do Compliance Detectors Read? An Audit of Activation Probes and Guard Models (version 1 submitted 17 August 2026), defines rule blindness as a detector’s failure to make its verdict or performance depend meaningfully on the stated rule. Their motivating example is simple: a retention policy says data must not be kept beyond a limit, and a scenario describes unusually long retention. A detector may flag that scenario, yet produce the same flag after the retention rule is removed or replaced by a permissive rule.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsThe authors evaluated four deployed guard-model categories, an 8B zero-shot judge and an activation readout across 13 external benchmarks, with scenarios spanning 20 regulatory and platform-policy domains. “Deployed guard” is the paper’s model category; it does not mean that each model is an EU legal control or that it is used by a regulator.
Accuracy can hide policy irrelevance
On the paper’s 20-domain counterfactual evaluation, its Internal Compliance Score (ICS) reached 0.9519 AUROC with the correct rule and 0.9549 AUROC with no rule. The authors report zero statistically significant AUROC drops after rule removal across all 20 domains. A high score therefore did not demonstrate that the detector had read, interpreted or applied the governing text.
This is the central distinction for compliance engineering: scenario recognition is not rule application. A model may have learned that certain phrases, actions or outcomes usually look unsafe. That shortcut can yield strong ordinary accuracy while failing the question a compliance officer actually asks: would the verdict change if the governing requirement changed?
Why model design changes the interpretation
Not every guard receives an arbitrary policy as an input. The audit separates fixed-taxonomy systems from a policy-conditioned guard and from probes that read internal activations.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #2
Fixed-taxonomy guards
Llama Guard’s original description presents an LLM-based input-output safeguard that classifies prompts and responses against a safety-risk taxonomy, with options for customization and alternate taxonomies. A fixed-taxonomy configuration such as Llama Guard 3 is not designed to accept a new legal clause for every case. If it performs poorly when asked to follow an arbitrary rule, that demonstrates a limitation for rule-specific adjudication; it does not show that every possible configuration ignores policy text.
Policy-conditioned guards
The audit’s Latent Policy Guard (LPG) condition does receive a custom policy. In a test that supplied the permissive counterpart to a violated rule, LPG changed its verdict in only 7.1% of cases. It nevertheless cited the governing clause’s list position in 91–95% of cases. A citation can therefore be mechanically present while the decision remains insensitive to the clause’s meaning.
Activation probes and judges
Activation probes infer a compliance signal from internal model representations rather than from an explicit, user-visible legal analysis. The paper also tests an 8B zero-shot judge. These approaches differ in access, latency and explainability, but the shared diagnostic is whether changing only the rule changes the output in the direction required by that rule.
Rank #3
The crossed-rule benchmark removes easy shortcuts
Ordinary test sets often allow a model to guess from the scenario alone. To block that shortcut, the authors built a crossed benchmark with 200 templates across eight regulatory domains. Each template pairs two rules with two scenarios, producing four combinations and 800 labeled rows.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Labels are generated mechanically from numeric threshold comparisons rather than from human opinions. In the grouped evaluation, classifiers using only the rule, only the scenario or both text fields reached chance-level AUROC. That result is important: the benchmark is constructed so that neither policy wording nor scenario wording, by itself, predicts the answer. The model must determine which rule governs which scenario.
Four of seven public compliance benchmarks were classified by the authors as lexically degenerate for the measurement they wanted to make. This is a benchmark-validity warning, not a declaration that those datasets are useless for every safety or classification purpose. A dataset can be useful for detecting familiar unsafe content and still be unsuitable for testing counterfactual rule use.
What happened when the model was asked to reason
The crossed benchmark shows that the task is solvable under at least one tested condition. On a 40-quadruple subsample (40 of the 200 templates), a step-by-step reasoning condition reached 0.849 AUROC, compared with 0.507 AUROC for a one-token forced-choice judge.
That contrast has three limits. First, the reasoning result covers only the subsample, not all 800 rows. Second, the comparison was not compute-matched, so extra tokens or deliberation may explain part of the gap. Third, success under this controlled prompt does not prove that step-by-step reasoning is necessary or sufficient in a production compliance stack. It does show that a detector can be tested on cases where surface shortcuts fail and that some inference conditions respond better than a forced one-token decision.
Internal Compliance Score: useful triage, not a legal instrument
ICS is presented as a low-cost way to rank or flag candidate cases. In one reported IFEval selection experiment, ranking with ICS improved the mechanically verified pass rate by 5.2 percentage points. That is a bounded selection result: it says the score helped choose responses in that setup, not that it enforced a law.
The paper reports several reasons not to treat ICS as a standalone compliance meter:
- Its preregistered baseline criterion was not met.
- A bag-of-words baseline matched its pooled generalization result, suggesting that simple lexical information can account for much of the measured signal.
- An adaptive white-box attack removed the selection gain. An attacker with access to the scoring mechanism can therefore target the feature that creates the apparent advantage.
- Performance depends on calibration, access to the relevant model signals, how cases are serialized, and whether deployment data resemble the benchmark.
ICS can support monitoring or triage when a human or a separate control makes the final decision. It is not a validated legal-compliance instrument, and the preprint does not establish its reliability against adaptive adversaries or changing policies.
How the approaches compare
| Approach | Receives the specific rule? | What the audit indicates | Main trade-off |
|---|---|---|---|
| Fixed-taxonomy guard | Usually no arbitrary rule input | Useful for its predefined categories, but not evidence of case-by-case legal interpretation | Low operational complexity; limited policy flexibility |
| Policy-conditioned guard (LPG condition) | Yes | Only 7.1% of verdicts changed when a permissive counterpart replaced the violated rule; clause-position citations remained 91–95% | Flexible interface, but citations may not track semantic use |
| Activation probe | Depends on the representation and setup | Can show a signal correlated with compliance labels without proving the rule caused the verdict | Requires internal activation access and careful calibration |
| Zero-shot one-token judge | Can be prompted with a rule | 0.507 AUROC on the reported crossed-rule comparison | Cheap and fast, but vulnerable to shortcut decisions |
| Step-by-step reasoning condition | Yes, in the tested prompt | 0.849 AUROC on 40 quadruples | Higher inference cost; not compute-matched or proven sufficient |
| Internal Compliance Score | Uses model-derived signals | 0.9519 with the rule versus 0.9549 without it in the 20-domain counterfactual test; adaptive attack removed its selection gain | Cheap ranking support, but unsuitable as sole enforcement |
How to test a detector for rule blindness
A team evaluating its own guard should test policy dependence directly rather than infer it from aggregate accuracy. The following procedure mirrors the paper’s most informative ideas while leaving the final legal judgment to qualified reviewers.
- Write paired policies. Create a restrictive rule and a permissive counterpart that differ on one operative requirement, such as a retention threshold. Keep the scenario text identical.
- Build crossed cases. Pair each rule with scenarios that are clearly compliant or non-compliant under that rule. Include combinations in which the same scenario changes label when the rule changes.
- Run counterfactual removals. Evaluate the original case, the same case with the policy removed, and the same case with a substituted policy. Record the raw verdict, confidence, refusal text and any cited clause.
- Block leakage. Group related templates so near-duplicate wording cannot appear in both calibration and evaluation sets. Check whether a rule-only or scenario-only classifier performs above chance.
- Measure conditional changes. Calculate AUROC and verdict-change rates separately for restrictive-to-permissive and permissive-to-restrictive substitutions. A citation count is not a substitute for this measurement.
- Inspect errors by domain. Report results for each regulatory or platform-policy domain, not only a pooled average. A pooled score can hide a domain in which the guard never responds to the rule.
- Stress the monitor. If the detector or score is exposed to an adversary, test adaptive examples that target its lexical or activation features. Re-run after policy updates and serialization changes.
- Keep a human control. Use the detector for triage, prioritization or alerts until independent reviewers establish that its decisions track the governing requirement under realistic distribution shifts.
What this means for EU AI Act compliance
The EU AI Act context makes rule-sensitive monitoring consequential, but it does not change what the experiment proves. The Future of Life Institute’s 31 March 2026 implementation guide says GPAI provider obligations applied from 2 August 2025 and that the Commission’s supervision and enforcement powers began on 2 August 2026. It describes powers to request information and documentation, conduct evaluations and impose fines under specified conditions. For covered GPAI provider infringements, the guide states a maximum fine of 3% of preceding-year worldwide turnover or €15 million, whichever is higher.
Those dates and penalties describe a legal framework, not a requirement to deploy a particular guard model. The preprint does not show how the Commission will assess a specific provider, whether a named provider complies, or whether rule blindness itself constitutes an infringement. The legal question depends on the provider, model, obligation, evidence and the applicable enforcement interpretation. Organizations should verify the current Act text and Commission materials before relying on a secondary implementation guide for a concrete legal decision.
What the evidence does—and does not—support
- Supported: In the evaluated systems and benchmarks, removing or changing policy text often did not change performance or verdicts; ordinary accuracy therefore cannot prove rule use.
- Supported: Crossed-rule cases are more diagnostic than datasets in which the scenario wording already reveals the label.
- Supported: One tested reasoning condition performed better than a forced-choice condition on a limited subsample.
- Not established: Every guard model ignores rules, all architectures share one cause, or every deployment would reproduce these numbers.
- Not established: That the EU Commission accepts the benchmark, requires step-by-step reasoning, or regards a rule-blind detector as an automatic legal violation.
- Not established: That ICS is robust, adversary-resistant or suitable for unsupervised enforcement.
The practical conclusion is narrower and more useful than the headline: if a system is supposed to apply a changing policy, test that dependency explicitly. A detector that keeps the same verdict after its governing rule is removed may still be a competent content classifier, but it has not demonstrated policy-aware compliance judgment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
