Mar 10, 2025

Moral Wiggle Room in AI

Yingjie Hu, Parinistha Surya, Stefan Trnjakov, Matthias Endres

Does AI strategically avoid ethical information by exploiting moral wiggle room?

Reviewer's Comments

Reviewer's Comments

Arrow
Arrow
Arrow

This was a great submission, and certainly met the requirements of all the marking criteria at a satisfactory level. Well done to the authors for picking a specific topic and examining it thoroughly. I would have liked to have seen more synthesis in the discussion and conclusion, and drawing upon the three questions that they had posited at the beginning of the paper. More broadly, I would have liked to have seen more than one impact being discussed in the paper, and these effects being disastrous for businesses/supply chain organisations/ESG stakeholders etc. Overall, well done to the team!

This project presents a well formed question about whether LLMs (here, Llama) exhibit an effect known as the Moral Wiggle Room, ie., exploit ambiguity to act selfishly by avoiding information. This is relevant to safety and seems feasible to test. However I note a few limitations of the methods.

- Several ambiguities in the methods could be addressed. How were the prompt stimuli constructed and what were their general properties? What was manipulated across the conditions, how was that validated, and what was controlled between conditions? How was the scoring of ethicality performed and how was that validated? It should also be better described how many variants of each condition were presented so that the breadth and generalizability of the findings could be assessed.

- More content/domain cases than environmental audits should be tested to understand results are content specific or more general.

- statistical analyses should be presented to support the conclusions

I really liked this project! You ahve realistic scenarios/incentive structures, I like that the setup does not rely on purely "malicious" agents.

You pose original and relevant research questions (at least I am not aware of work in this direction, and could not find any on a quick search).

Well written and clear paper, well motivated and clear about limitations, considering the influence of prompt structure.

I would be very excited to see followup research on this!

Cite this work

@misc {

title={

Moral Wiggle Room in AI

},

author={

Yingjie Hu, Parinistha Surya, Stefan Trnjakov, Matthias Endres

},

date={

3/10/25

},

organization={Apart Research},

note={Research submission to the research sprint hosted by Apart.},

howpublished={https://apartresearch.com}

}

Recent Projects

View All

Feb 2, 2026

Markov Chain Lock Watermarking: Provably Secure Authentication for LLM Outputs

We present Markov Chain Lock (MCL) watermarking, a cryptographically secure framework for authenticating LLM outputs. MCL constrains token generation to follow a secret Markov chain over SHA-256 vocabulary partitions. Using doubly stochastic transition matrices, we prove four theoretical guarantees: (1) exponentially decaying false positive rates via Hoeffding bounds, (2) graceful degradation under adversarial modification with closed-form expected scores, (3) information-theoretic security without key access, and (4) bounded quality loss via KL divergence. Experiments on 173 Wikipedia prompts using Llama-3.2-3B demonstrate that the optimal 7-state soft cycle configuration achieves 100\% detection, 0\% FPR, and perplexity 4.20. Robustness testing confirms detection above 96\% even with 30\% word replacement. The framework enables $O(n)$ model-free detection, addressing EU AI Act Article 50 requirements. Code available at \url{https://github.com/ChenghengLi/MCLW}

Read More

Feb 2, 2026

Prototyping an Embedded Off-Switch for AI Compute

This project prototypes an embedded off-switch for AI accelerators. The security block requires periodic cryptographic authorization to operate: the chip generates a nonce, an external authority signs it, and the chip verifies the signature before granting time-limited permission. Without valid authorization, outputs are gated to zero. The design was implemented in HardCaml and validated in simulation.

Read More

Feb 2, 2026

Fingerprinting All AI Cluster I/O Without Mutually Trusted Processors

We design and simulate a "border patrol" device for generating cryptographic evidence of data traffic entering and leaving an AI cluster, while eliminating the specific analog and steganographic side-channels that post-hoc verification can not close. The device eliminates the need for any mutually trusted logic, while still meeting the security needs of the prover and verifier.

Read More

Feb 2, 2026

Markov Chain Lock Watermarking: Provably Secure Authentication for LLM Outputs

We present Markov Chain Lock (MCL) watermarking, a cryptographically secure framework for authenticating LLM outputs. MCL constrains token generation to follow a secret Markov chain over SHA-256 vocabulary partitions. Using doubly stochastic transition matrices, we prove four theoretical guarantees: (1) exponentially decaying false positive rates via Hoeffding bounds, (2) graceful degradation under adversarial modification with closed-form expected scores, (3) information-theoretic security without key access, and (4) bounded quality loss via KL divergence. Experiments on 173 Wikipedia prompts using Llama-3.2-3B demonstrate that the optimal 7-state soft cycle configuration achieves 100\% detection, 0\% FPR, and perplexity 4.20. Robustness testing confirms detection above 96\% even with 30\% word replacement. The framework enables $O(n)$ model-free detection, addressing EU AI Act Article 50 requirements. Code available at \url{https://github.com/ChenghengLi/MCLW}

Read More

Feb 2, 2026

Prototyping an Embedded Off-Switch for AI Compute

This project prototypes an embedded off-switch for AI accelerators. The security block requires periodic cryptographic authorization to operate: the chip generates a nonce, an external authority signs it, and the chip verifies the signature before granting time-limited permission. Without valid authorization, outputs are gated to zero. The design was implemented in HardCaml and validated in simulation.

Read More

This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.
This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.