Mar 10, 2025

A Noise Audit of LLM Reasoning in Legal Decisions

Mindy Ng, May Reese, Markela Zeneli

AI models are increasingly applied in judgement tasks, but we have little understanding of how their reasoning compares to human decision-making. Human decision-making suffers from bias and noise, which causes significant harm in sensitive contexts, such as legal judgment. In this study, we evaluate LLMs on a legal decision prediction task to compare with the historical, human-decided outcome and investigate the level of noise in repeated LLM judgments. We find that two LLM models achieve close to chance level accuracy and display low to no variance in repeated decisions.

Reviewer's Comments

Reviewer's Comments

Arrow
Arrow
Arrow

The project introduces a critical comparison between human judicial noise and LLM decision-making variance, a not often explored intersection in AI safety literature. It makes a valuable empirical contribution by benchmarking LLM decision noise against human judicial variability. Well done! Particularly like the inclusion of confusion matrices by issue area and qualitative reasoning analysis. Currently, the safety implications are framed broadly (e.g., "unforeseen harms" from noisy judgments), but a formal threat model is absent. I would encourage you to adopt structured frameworks like the NIST AI Risk Management Framework to specify failure modes (e.g., silent rationalization errors) and mitigations. Defining concrete attack vectors (e.g., adversarial manipulation of case facts) or failure modes (e.g., over-reliance on precedent citations) would strengthen the AI safety impact. Similarly, technical expansions (eg higher sample size, quantifying discrepancies in reasoning rationales with semantic similarity scores or similar, additional details on environment setup, hyperparams and validation steps in the paper) could transform it into a highly impactful piece on algorithmic reliability in governance.

This was a wonderful, interesting submission to read. Overall, I thought the team used their research wisely to draw conclusions about the impact of noise on legal decision-making. I particularly liked how they drew upon other contextual factors (including corruption) that cannot be replicated using AI, which speaks to the human influence/social engineering aspects of legal decision-making as well. I would have liked to have seen more discussion of the impacts of these findings on society, including how legal decision-making is already reflective of a broken system that marginalises certain groups even more through repeated judiciary faults. Great work team!

Hi Mindy, May, and Markela, I think you did a great job with your project. Overall, the entire work is strong across all three criteria: theory, methods, and impact. The greatest strength is how well integrated and blended the work is, from how you argued your points to the use of the available evidence. I also liked the comprehensive, mixed-methods approach and use of figures to illustrate. I particularly appreciated that the work is very concise and to the point, it really doesn’t mince words. The flow and transition between paragraphs and sections is also great. Additionally, the grammar and referencing are excellent, as well as the presentation of the appendix. If you’re planning on publishing this, I think this is a good way forward: “We have several ideas for directions for development of this research. One approach would be to do a deeper analysis of model reasoning by using knowledge graphs or comparing vector embeddings of the LLM reasoning and majority opinion, or testing how sensitive models are to input noise by comparing outputs in response to minor prompt adjustments”. My recommendation would also be to expand more on the discussion and the practical implications of your results, for added impact.

Thank you for submitting your work on A Noise Audit of LLM Reasoning in Legal Decisions - it was timely and interesting to read. Please see below for feedback on your project:

1. Strengths of your proposal/ project:

- Methods and results are clearly outlined

- The project appears to be novel

- It is good that you detail the drawbacks/ limitations of the study

2. Areas for improvement

- A consistent use terminology should be kept. E.g., on p.1 you mention ‘level of variance in judgements’ - given this is the first mention of this, you should specifically refer to legal judgments (and specify what a judgement is/ in which legal context or area of law/ who carries out judgements/ in what jurisdiction or country). Unless you are referring to LLM judgements here? You also mention ‘the Supreme Court in 2005’ - of which country?

- Some key concepts/ methods should be defined - e.g., chain of thought reasoning (p.2)

- Sentencing guidelines are heavily relied upon courts, so I would expect a stronger argument under ‘Noise in Legal Decisions’ as to why variation isn’t good/ more up to-date evidence as to what level of variation there is amongst UK or US judgements at present.

- I’m not sure that I agree with the statement that ‘Because modern LLMs are trained on data scraped from the internet, it is likely that they will have prior knowledge of the court cases’ (p.3) without any evidence being provided. Can you provide a reference here (e.g., that legal cases are used to train LLMs)?

- You note that ‘Given the low sample size, the test does not have high power, introducing vulnerability to type 2 error’. Did you do a power calculation? Can you provide that in the paper?

- You note on p.6 that ‘The facts presented to the model were a short, broad summary of the case. The Supreme Court justices hearing the case would have much more detailed information, not to mention their expertise and extensive experience.’ It would be helpful if you could briefly go into more detail here - what implication does this have for your results? The drawbacks are noted descriptively, but more critical analysis would strengthen this section.

- A clear threat model should be provided.

Cite this work

@misc {

title={

(HckPrj) A Noise Audit of LLM Reasoning in Legal Decisions

},

author={

Mindy Ng, May Reese, Markela Zeneli

},

date={

3/10/25

},

organization={Apart Research},

note={Research submission to the research sprint hosted by Apart.},

howpublished={https://apartresearch.com}

}

Recent Projects

Apr 27, 2026

OliGraph: graph-based screening of large oligopools

Existing synthesis screening tools cannot evaluate short oligonucleotide pools, whose overlapping fragments can be reassembled into regulated sequences via polymerase cycling assembly (PCA) yet fall below gene-length detection thresholds. We present OliGraph, an open-source tool that constructs a bi-directed overlap graph from an oligonucleotide pool and extracts contigs for downstream gene-length screening. An optional PCA mode retains only cross-strand overlaps consistent with PCA chemistry. We validated OliGraph in a blinded study across ten simulated pools (70–9,184 oligonucleotides, 30–300 bp) spanning four risk categories. BLAST screening of individual oligonucleotides failed to identify sequences of concern in most pools: three returned zero hits, and vector noise obscured true positives in the remainder. After OliGraph assembly, contig-level BLAST matched the longest assembled sequences (up to 1,905 bp) to sequences of concern at 97–100% identity. In one pool, assembly collapsed 1,634 individual BLAST results into 10 hits from a single contig, all assigned to the same source organism. PCA mode correctly distinguished assemblable from non-assemblable fragments within the same pool. Two pools with no assemblable structure yielded no contigs. OliGraph processed all pools in under 0.2 seconds, fast enough for real-time order screening and consistent with proposals to bring oligonucleotide orders within the scope of synthesis screening regulation.

Read More

Apr 27, 2026

BioRT-Bench: A Multi-Attack Red-Teaming Benchmark for Bio-Misuse Safeguards in Frontier LLMs

Frontier AI laboratories are expected to maintain safeguards against biological misuse, but whether deployed models actually refuse bio-misuse queries under adversarial pressure is largely unmeasured in the public literature. We introduce BioRT-Bench, a benchmark that runs four attack methods (direct request, PAIR, Crescendo, and base64 encoding) against four frontier models (Claude Sonnet 4.6, GPT-5.4, DeepSeek V4-flash, Kimi K2.5) across 40 prompts spanning five biosecurity-relevant categories. Responses are scored by a calibrated judge extending StrongREJECT with two bio-specific dimensions: specificity and actionability. We measure Attack Success Rate (ASR), where 0 means the model fully refused and 1 means it provided specific, actionable bio-misuse content. Our results reveal a sharp robustness divide: Chinese frontier models (DeepSeek, Kimi) have under 5% refusal rates even under direct request (ASR 0.88 and 0.79), while Western models (Claude, GPT) maintain substantially stronger safeguards (ASR 0.15 and 0.16). Crescendo is the most effective attack across all models, both in bypassing refusal and in eliciting actionable content. Claude Sonnet 4.6 is the most robust model tested, achieving 100% refusal against base64-encoded prompts.

Read More

Apr 27, 2026

PROTEUS (PROTein Evaluation for Unusual Sequences): Structure-Informed Safety Screening for de novo and Evasion-Prone Protein-Coding Sequences

AI protein design tools like RFdiffusion, ProteinMPNN, and Bindcraft make it trivial to produce low-homology sequences that fold into active, potentially hazardous architectures. However, sequence homology-based biosafety screening tools cannot detect proteins that pose functional risk through structurally novel mechanisms with no sequence precedent. We present a tiered computational pipeline that addresses this gap by combining MMseqs2 sequence alignment with structure-based comparison via FoldSeek and DALI against curated toxin databases totaling ~34,000 entries. AlphaFold2-predicted structures are screened for both global fold similarity (FoldSeek) and local active/allosteric site geometry (DALI), capturing convergent functional hazards that sequence screening misses. The pipeline was validated against a panel of toxins, benign proteins, structural mimics, and de novo-designed Munc13 binders, as well as modified ricin variants with residue substitutions. We additionally tested robustness to partial-synthesis evasion, where a bad actor submits multiple shorter coding sequences intended for downstream reassembly into a full toxin-coding gene. We found that while sequence-based screening did not identify any de novo ricin analogues with high certainty, the combined pipeline with FoldSeek and DALI identified all 24 tested de novo ricins as toxic.

Read More

Apr 27, 2026

OliGraph: graph-based screening of large oligopools

Existing synthesis screening tools cannot evaluate short oligonucleotide pools, whose overlapping fragments can be reassembled into regulated sequences via polymerase cycling assembly (PCA) yet fall below gene-length detection thresholds. We present OliGraph, an open-source tool that constructs a bi-directed overlap graph from an oligonucleotide pool and extracts contigs for downstream gene-length screening. An optional PCA mode retains only cross-strand overlaps consistent with PCA chemistry. We validated OliGraph in a blinded study across ten simulated pools (70–9,184 oligonucleotides, 30–300 bp) spanning four risk categories. BLAST screening of individual oligonucleotides failed to identify sequences of concern in most pools: three returned zero hits, and vector noise obscured true positives in the remainder. After OliGraph assembly, contig-level BLAST matched the longest assembled sequences (up to 1,905 bp) to sequences of concern at 97–100% identity. In one pool, assembly collapsed 1,634 individual BLAST results into 10 hits from a single contig, all assigned to the same source organism. PCA mode correctly distinguished assemblable from non-assemblable fragments within the same pool. Two pools with no assemblable structure yielded no contigs. OliGraph processed all pools in under 0.2 seconds, fast enough for real-time order screening and consistent with proposals to bring oligonucleotide orders within the scope of synthesis screening regulation.

Read More

Apr 27, 2026

BioRT-Bench: A Multi-Attack Red-Teaming Benchmark for Bio-Misuse Safeguards in Frontier LLMs

Frontier AI laboratories are expected to maintain safeguards against biological misuse, but whether deployed models actually refuse bio-misuse queries under adversarial pressure is largely unmeasured in the public literature. We introduce BioRT-Bench, a benchmark that runs four attack methods (direct request, PAIR, Crescendo, and base64 encoding) against four frontier models (Claude Sonnet 4.6, GPT-5.4, DeepSeek V4-flash, Kimi K2.5) across 40 prompts spanning five biosecurity-relevant categories. Responses are scored by a calibrated judge extending StrongREJECT with two bio-specific dimensions: specificity and actionability. We measure Attack Success Rate (ASR), where 0 means the model fully refused and 1 means it provided specific, actionable bio-misuse content. Our results reveal a sharp robustness divide: Chinese frontier models (DeepSeek, Kimi) have under 5% refusal rates even under direct request (ASR 0.88 and 0.79), while Western models (Claude, GPT) maintain substantially stronger safeguards (ASR 0.15 and 0.16). Crescendo is the most effective attack across all models, both in bypassing refusal and in eliciting actionable content. Claude Sonnet 4.6 is the most robust model tested, achieving 100% refusal against base64-encoded prompts.

Read More

This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.
This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.