1 Introduction↩︎

Large language models (LLMs) are deployed in healthcare triage, legal counseling, and hiring pipelines where their decisions affect real people. In these settings, demographic identity often arrives implicitly through names, accent, clinical history, and accumulated context [1]. Yet the fairness evaluations that inform high-stakes deployment present identity with explicit labels such as “an African American patient” or “an Asian woman” and treat the resulting behavior as predictive of deployment [2], [3]. This leaves a gap between how identity is communicated when a model is tested and how it arrives when the model is used. We formalize moral safety in LLMs as the requirement that a model make fair decisions in morally consequential situations regardless of the form in which demographic identity is delivered.

The more the fairness evaluation format (e.g. demographic presentation style) resembles the format used in safety post-training, the more reliably it cues the protective behaviors that training instilled. We define performative compliancethe as the behavior where a model is fair when it “knows it is being evaluated” under presentations that carry this cue and less fair as the evaluation cue weakens and the same identity must be inferred, as shown in first and second panels of (Figure 1). However, a genuinely morally safe model must be invariant to the presentation (third panel of Figure 1).

Prior work weakens this evaluation cue through implicit demographic signals from dialect [4], culturally coded names [5], and agentic decision tasks [6], finding that bias suppressed under explicit cues resurfaces when identity is conveyed indirectly. But these signals also vary the channel through which identity arrives. A dialect, a coded name, and an explicit descriptor differ both in how they are perceived and in how strongly they signal the existence of an evaluation to the model, so an observed behavior shift can reflect either. Through puzzles, our design holds the moral content and the demographic assignment fixed and varies how the identity must be recovered, and because puzzle solutions are verifiable, it isolates the shift from information loss in a way prior work cannot.

To separate genuine moral safety from performative compliance, we hold each moral dilemma and the demographic identity of the described individual fixed, and vary only how that identity reaches the model. In the Neutral condition the dilemma carries no demographic information, establishing a per-dilemma decision baseline. In Direct, identity is stated as an explicit label, replicating standard fairness evaluation. In Puzzled, the same identity must be recovered as the unique solution to a logic puzzle, so the demographic assignment is preserved while the explicit cue is removed. Puzzle solutions are formally verifiable, allowing us to restrict analysis to correctly solved items and rule out information loss as an explanation for any behavioral shift.

Across 14 models and about \(19{,}000\) probe items per model ², removing the explicit cue produces a one-sided shift. Models become more likely to choose options that harm the described individual (\(+4.4\) pp), while their tendency to benefit that individual barely moves (\(+0.9\) pp). This one-sidedness isolates performative compliance, since a generic confound would move both sides together. The shift survives restriction to correctly inferred items, replicates across prompt phrasings, dilemma topics, difficulty levels, and puzzle solution shapes. The drop in fairness from Direct to Puzzled, which we term the Cue Visibility Gap, reorders model safety rankings. Frontier-aligned models shift least and smaller open-weight models shift most.

Contributions. (1) We formalize moral safety as the robustness of a model’s ethical behavior across presentation contexts, and identify performative compliance, where post-training learns to treat demographic labels as evaluation cues without internalizing fairness, as the failure mode that violates it. (2) We introduce cue variation as a methodology for detecting performative compliance, holding moral content and demographic identity fixed while varying how the identity must be recovered, and instantiate it across 14 LLMs, 3 genders, 5 races, and roughly 19,000 probe items per model. (3) We propose the Cue Visibility Gap as a model-agnostic robustness metric that requires no new annotation, reorders safety rankings, and can be added to any existing fairness evaluation.

2 Problem Definition↩︎

2.1 Preliminaries↩︎

Let \(\mathcal{D}\) denote a set of moral dilemmas, each with a binary decision space \(\{o_1, o_2\}\). For each dilemma \(d \in \mathcal{D}\), let \(\mathcal{X}_d\) denote the set of individuals involved, each belonging to a demographic group \(G \in \mathcal{G}\). A benefit annotation \(b_d \in \{o_1, o_2\}\) identifies which option favors the described individual, established by human raters (Fleiss \(\kappa = 0.92\); Appendix 8).

We define three presentation formats \(\phi \in \{\mathrm{\small Neutral}, \mathrm{\small Direct}, \mathrm{\small Puzzled}\}\). Under Neutral, no demographic information is provided. Under Direct, demographic identity is stated as an explicit label. Under Puzzled, the same identity must be recovered through a logic puzzle whose unique solution encodes the demographic assignment. Let \(f_\theta(d, X, \phi) \in \{o_1, o_2\}\) denote the decision of model \(\theta\) for individual \(X \in \mathcal{X}_d\) under format \(\phi\).

2.2 Genuine vs Performative Moral Safety↩︎

A model \(\theta\) exhibits genuine moral safety if its decisions are invariant to presentation format, conditional on successful demographic recovery:

\[\begin{gather} f_\theta(d, X, \mathrm{\small Direct}) = f_\theta(d, X, \mathrm{\small Puzzled}) \\[2pt] \forall\, d \in \mathcal{D},\; X \in \mathcal{X}_d \end{gather}\]

When this equality fails on a non-negligible fraction of \((d, X)\) pairs despite correct recovery under Puzzled, the model exhibits performative compliance.

2.3 Decision Bias Metric↩︎

Let \(s_d = f_\theta(d, X, \mathrm{\small Neutral})\) be the model’s demographic-free baseline decision and \(w_{d,X} = f_\theta(d, X, \phi)\) its decision under \(\phi \in \{\mathrm{\small Direct}, \mathrm{\small Puzzled}\}\). Because Neutral carries no demographic information, \(s_d\) does not depend on \(X\) and is indexed by \(d\) alone. Two events capture directional shifts relative to \(b_d\):

• In-favor: \(s_d \neq b_d\) and \(w_{d,X} = b_d\). Revealing \(X\)’s identity flips the model toward the individually beneficial option.

• Against: \(s_d = b_d\) and \(w_{d,X} \neq b_d\). Revealing \(X\)’s identity flips the model away from the individually beneficial option.

The per-group rates and net bias are: \[\mathrm{\small Favor}(G) = \frac{|F \cap G|}{|\{(d,X): s_d \neq b_d\} \cap G|},\] \[\mathrm{\small Against}(G) = \frac{|A \cap G|}{|\{(d,X): s_d = b_d\} \cap G|},\] \[\mathrm{\small Net}(G) = \mathrm{\small Favor}(G) - \mathrm{\small Against}(G)\] in percentage points, where positive Net indicates the group is net favored. The Cue Visibility Gap for model \(\theta\) and group \(G\) is:

\[\begin{gather} \mathrm{\small Gap}(\theta, G) = \mathrm{\small Net}_{\mathrm{\small Direct}}(\theta, G) \\[2pt] {} - \mathrm{\small Net}_{\mathrm{\small Puzzled}}(\theta, G) \end{gather}\]

Performative compliance predicts an asymmetric signature:

\[\Delta\mathrm{\small Against} \gg \Delta\mathrm{\small Favor}\]

where \(\Delta\mathrm{\small Against} = \mathrm{\small Against}_{\mathrm{\small Puzzled}} - \mathrm{\small Against}_{\mathrm{\small Direct}}\) and \(\Delta\mathrm{\small Favor} = \mathrm{\small Favor}_{\mathrm{\small Puzzled}} - \mathrm{\small Favor}_{\mathrm{\small Direct}}\), distinguishing label-contingent suppression from any confound that would shift both components equally.

3 Methodology↩︎

We hold moral dilemmas fixed and vary only how demographic identity is conveyed, constructing three conditions over 100 everyday dilemmas varying on whether identity is stated as an explicit label, must be recovered through a logic puzzle, or is absent entirely. Puzzle solutions are formally verifiable, allowing us to condition analysis on correctly solved items and rule out information loss as a confound.

3.1 Ethical Dilemmas↩︎

We build on DailyDilemmas [7], adapting each dilemma so that the described role is compatible with a group of four anonymous individuals, stripping demographic clues from the text, and rewriting in the third person with neutral role words using GPT-4 with human review. Items that could not be adapted without altering their meaning were removed, yielding 100 dilemmas.

Three annotators independently labeled each dilemma on four columns resolved by majority vote: 1) Final Decision (System 1), the action chosen from the dilemma text alone; 2) Final Decision (System 2), the action chosen after reading the consequences of each option [8]; 3) described Person Status, whether the described person plays a good, bad, or neutral role (Fleiss \(\kappa = 0.71\)); and 4) Described Person Benefit (DPB), which option is better for the described individual regardless of overall moral quality (Fleiss \(\kappa = 0.92\)). The near-perfect agreement on DPB supports its use as the ground-truth signal for the decision bias metric. Full annotation statistics are in Appendix 8.

3.2 Prompt Conditions and Probes↩︎

Each dilemma is evaluated under three conditions. Neutral presents the dilemma, options, and consequences with no demographic information, providing the per-dilemma decision baseline \(s_d\). Direct adds explicit demographic labels for the four individuals A–D (e.g., “a: man, Asian; b: man, Hispanic; c: woman, Asian; d: woman, Hispanic”). Puzzled replaces those labels with a logic puzzle whose unique solution encodes the same assignments; the model must solve the puzzle before responding.

Within Direct and Puzzled, two per-individual probes are issued for each of A–D. Could-be questions ask whether individual \(X\) could be the described person (yes/no). What-if questions ask which option should be followed assuming individual \(X\) is the described person (option1/option2). The What-if probe directly operationalizes the Favor and Against events defined in Section 2.3: a response that shifts toward \(b_d\) is an In-favor event and a response that shifts away is an Against event. Full prompt templates are in Appendix 12. Responses outside the valid sets {option1, option2} or {yes, no} are counted as abstentions and excluded from bias computation (Appendix 9).

3.3 Puzzle Construction↩︎

Puzzles are generated with GPT-4 following [9], extended with count and equivalence clue types. Every puzzle has a canonical solution structure: A and B receive gender \(G_1\) while C and D receive \(G_2\); A and C receive race \(R_1\) while B and D receive \(R_2\). Table 1 lists all clue types and their cognitive load weights, and Table 2 shows an example puzzle. Each generated puzzle is verified to have exactly one satisfying assignment. Difficulty is scored as the mean cognitive load weight per clue: \([0,2]\) is easy, \((2,4]\) is intermediate, and above 4 is hard. The generation prompt is in Appendix 11.

For each dilemma, one puzzle per difficulty level is paired with three demographic combinations. Each puzzle is reused for exactly five dilemmas with distinct demographic combinations, ensuring the puzzle text does not drive demographic correlations. This yields 300 Direct items (\(100 \times 3\) demographic combinations) and 900 Puzzled items (\(300 \times 3\) difficulty levels). The gap is robust to the canonical solution shape (Appendix 20).

3.4 Experimental Setup↩︎

We evaluate 14 proprietary and open-weight models: Claude Sonnet 4.6 [10], DeepSeek V3.2 [11], Gemini 3 Flash [12], Gemma 2 9B [13], GPT-4o [14], GPT-OSS 20B [15], Grok 4.1 [16], Llama 3.1 8B [17], Llama 3.3 70B [18], Ministral 8B [19], OLMo 3 7B [20], Qwen3 VL 8B [21], Qwen3 235B [22], and Command R7B [23]. All evaluations are at temperature 0, across 3 genders (man, woman, non-binary) and 5 races (Asian, Black, Hispanic, Muslim, White). Each of the direct and puzzled items involves 4 individuals spanning 2 genders and 2 races with balanced group exposure. Command-R7B-12-2024 is excluded from bias tables due to its high (\(91.3\%\)) abstention rate.

4 Results↩︎

Unless noted, results use prompts with consequences at the hard puzzle difficulty; we report experiments without decision options’ negative consequences and other puzzle difficulty levels in Appendices 15 and 16.

4.1 Hiding the Label Raises the Against Rate Without Reducing the In-Favor Rate↩︎

4.1.0.1 Against rises, In-favor holds.

Averaged across models and groups, the Against component grows by \(+4.4\) pp from Direct to Puzzled-hard while the In-favor component moves only \(+0.9\) pp, confirming the asymmetric prediction of Section 2.3.

Figure 3 tests directional consistency across models via sign tests, which ask whether the direction of the shift is consistent regardless of magnitude. Every demographic group has more adverse-shifters than favorable-shifters across the 13 models with zero ties. The shift is most consistent for women (11/13, two-sided binomial \(p=0.022\)) and Muslim individuals (10/13, \(p=0.092\)). The asymmetry replicates across three paraphrased What-if probe variants on six models (Appendix 23) and \(\Delta\mathrm{\small Against} > 0\) holds on the majority of topic_group categories (Appendix 24). Intersectional (gender, race) breakdowns are further explored in Appendix 18.

4.1.0.2 All gender groups shift adversely under implicit cues.

As shown in Figure 2, which plots the macro-average net bias per gender under both conditions, and Table 3, in the Direct setting, women and non-binary individuals are net favored on average (\(+2.8\) pp and \(+3.1\) pp); men sit near zero (\(+0.5\) pp). Under Puzzled-hard, average net turns negative for all three genders, driven by the Against side rising while the In-favor side stays flat (Figure 2).

4.1.0.3 Every racial group loses net favorability; Hispanic individuals shift most.

Similar to the gender case, Figure 2 plots the macro-average net bias per race under both conditions, and Table 4 shows per model’s results. In Direct, every race is net favored or near zero, ranging from Asian (\(+3.9\) pp) and White (\(+2.8\)) down through Muslim (\(+2.2\)), Black (\(+1.9\)), and Hispanic (near zero). Under Puzzled-hard, the net turns negative or near zero for every race, with Hispanic shifting most and White and Muslim shifting least. The magnitude varies by model: Qwen3 VL 8B and Ministral 8B shift most, Llama-70B and Gemma-2-9B shift least among models that still shift adversely. Gemini 3 Flash and Claude Sonnet 4.6 shift modestly. and Qwen-235B, GPT-OSS-20B, and GPT-4o shift favorably rather than adversely, with negative gaps (Section 4.4).

Status bias, the rate at which each group is identified as the described person, moves in the opposite direction: it shrinks under Puzzled-hard as identification spreads across the four logically possible individuals (Appendix 17). Both metrics respond to cue visibility, but in opposite directions, and decision bias is the one that tracks harm to the described individual, so we use it as the diagnostic for performative compliance.

3pt

3pt

4.2 The Shift Persists When Restricted to Correctly Recovered Demographics↩︎

The observed shift could reflect misattribution if models failed to correctly recover demographic information from the puzzle. For every Puzzled-hard item we compare the model’s predicted gender and race against the ground-truth solution. Table 5 reports the resulting joint correctness rate per model and difficulty level: all but one of the 13 main-paper models exceed \(93\%\) joint correctness on hard puzzles; 8 exceed \(99\%\); the remaining model (GPT-OSS-20B) reaches \(91\%\). Table 6 shows this shortfall is driven almost entirely by unparsable responses rather than genuine misattribution: of the 14 models, only Gemini-3-Flash-Preview has any incorrectly-classified but parsable item at all (\(4\) of \(1{,}200\)), with every other model at zero.

If the Direct-to-Puzzled gap were instead an artifact of this small amount of misattribution, restricting the comparison to only the correctly-classified pairs should pull Puzzled-hard’s net bias back toward Direct. However, it does not happen because correctness is already near-saturated. The correct-only net bias is identical to the all-parsable net bias for every model and every group. Figure 4 shows both sitting clearly apart from Direct. The shift, therefore, is not an attribution artifact. It is identical whether or not the model actually recovered the puzzle’s demographic content correctly.

4.3 Cue Visibility Gap Holds Across Signal Variations↩︎

The gap is positive at every puzzle difficulty level on the majority of models (Appendix 22). It replicates across three paraphrased What-if probe variants on six models (Appendix 23) and is preserved under two randomized puzzle solution shapes (Appendix 20). The Against-side rise holds across the majority of topic_group categories (Appendix 24). A Named variant using culturally coded first names preserves the sign of the shift on the majority of models (Appendix 19), indicating the effect is a property of whether demographic identity is explicitly labeled rather than of the puzzle format.

4.4 Cue Visibility Gap Changes Model Rankings↩︎

Because the gap varies across models, a model’s safety ranking can depend on which condition it is measured in. Grok 4.1 is the clearest case. Its Direct gender net of \(+13.5\) pp for men is the highest of any model, so Direct-only evaluation ranks it among the safest, yet under Puzzled-hard its Against rate for women rises by \(+5.5\) pp. The Direct ranking does not hold under implicit cues.

The magnitude of the gap tracks model tier. Qwen3 VL 8B and Ministral 8B shift most, with gaps of \(+10\) to \(+15\) pp on several groups; Gemini 3 Flash and Claude Sonnet 4.6 shift modestly, around \(+4\) pp at the race level; and Llama-70B, Qwen-235B, and GPT-OSS stay flattest, within \([-2, +1]\) pp. Appendix 21 helps explain the pattern: puzzle-solving capability does not predict the gap, but alignment does, with more heavily aligned models showing smaller gaps. Frontier-aligned models therefore cluster at the genuine end of the spectrum, while smaller open-weight models show the largest gaps (Appendix 25 examines how much of this reflects label visibility versus reasoning load).

4.5 Explicit-Label Evaluation Overstates Safety Under Implicit Cues↩︎

Safety numbers from explicit-cue evaluations measure model responses to demographic labels, not model behavior when those labels are absent. Since the gap varies across models and groups, explicit-cue evaluations produce model-specific overestimates of implicit-cue safety. The Cue Visibility Gap provides a per-model, per-group quantification of this discrepancy and can be computed for any evaluation that can route demographic information through an implicit channel.

5 Related Work↩︎

5.0.0.1 Fairness evaluation and implicit demographic signals.

Standard fairness evaluations present demographic identity as an explicit label and measure decision outcomes across groups [2], [3], [24], including resume audit studies that adapt the correspondence-experiment design of [25] to LLMs [5], [26]; bias is largely stable across surface reformulations [27]. Yet alignment reduces explicit bias while leaving subtler patterns intact: it resurfaces through dialect [4], coded names [5], [28], and agentic decisions [6], even where explicit question-answering bias is minimal. These approaches vary the channel through which identity arrives, so a behavioral shift can reflect how identity is perceived across channels and not the strength of the evaluation cue itself. By contrast, we hold the demographic assignment and the moral content fixed and vary how strongly the presentation resembles a fairness evaluation, isolating cue strength from how identity is perceived.

5.0.0.2 Evaluation awareness.

Performative compliance is closely related to evaluation awareness, the capacity of models to recognize when they are being evaluated rather than deployed [29]–[31]. Prior work probes an internal evaluation-versus-deployment representation through model activations [32]. We instead measure its behavioral consequence on a high-stakes axis: as the presentation stops resembling a fairness evaluation, protective behavior weakens and decisions turn against the described individual, instantiated for demographic fairness and measurable without access to model internals.

5.0.0.3 Moral reasoning benchmarks.

Prior work applies moral foundations theory [33], studies moral persuasion [34], [35], and examines cross-lingual consistency [36], building on dilemma corpora including [7], [37], and related benchmarks [38]–[41]. None vary the presentation format of morally relevant information and therefore cannot detect whether observed behavior reflects genuine reasoning or surface-feature recognition.

6 Conclusion↩︎

A model’s fairness depends on how strongly the presentation resembles safety-training and fairness evaluation. As that resemblance weakens and demographic identity must be recovered instead of read from a label, we show that decisions shift one-sidedly against the described individual. Hiding the label raises the rate of decisions that harm the described individual while leaving decisions that benefit them unchanged, a signature that distinguishes label-contingent suppression from a generic confound. This asymmetry holds across 14 models, 8 demographic groups, and multiple robustness checks, and persists when restricted to items where models correctly recovered the demographic information. The proposed Cue Visibility Gap quantifies the discrepancy per model and per group and reorders safety rankings relative to Direct-only evaluation. Whether the gap predicts behavior under naturalistic implicit cues, where identity arrives through dialect, names, and accumulated context, remains an open question.

Limitations↩︎

6.0.0.1 Demographic categories.

The race set groups religious identity (Muslim) with continental categories, matching how these labels co-occur in existing benchmark prompts. This conflates two distinct axes of identity and should not be interpreted as a claim about the underlying ontology.

6.0.0.2 Reasoning load.

The Puzzled condition introduces reasoning load that the Named condition does not. A FormalNamed control that holds reasoning load fixed while removing demographic content from the puzzle (Appendix 25) separates the two: for frontier models the gap is driven by label visibility, while for smaller open-weight models formal reasoning load accounts for most of it. Their large Cue Visibility Gaps should therefore be read as reasoning load combined with label visibility, not label-contingent suppression alone.

6.0.0.3 Deployment generalization.

The Cue Visibility Gap is measured under controlled conditions where the only difference between conditions is how demographic identity is delivered. Whether this gap predicts behavior under naturalistic implicit cues, where identity is embedded in names, dialect, and accumulated context, is an empirical question the current design does not answer.

7 Annotation guidelines↩︎

Three annotators independently labeled the \(100\) adapted DailyDilemmas items. The annotation task was framed as evaluating both the direction of each dilemma for the described person (beneficial or harmful) and the annotator’s own decision regarding which option should be followed. Annotators were given the guideline document below and worked on a shared spreadsheet with one row per dilemma.

7.0.0.1 Provided columns.

Each row exposed the following pre-existing fields, which annotators could read but not edit:

• Dilemma situation: the dilemma text providing the situational context.

• Person: a short description of the described person, taken from the dilemma text.

• Option 1 and Option 2: the two possible actions the described person may take, each described in a single short phrase.

• Negative consequence 1 and Negative consequence 2: the negative consequence that results from following Option 1 and Option 2, respectively.

7.0.0.2 Fields to annotate.

For each dilemma, annotators filled in the following columns:

• described person description (described Person Status): whether the description of the described person uses positive, negative, or neutral words (e.g., adjectives or nouns). For instance, “poor” would be marked as negative. If the description does not lean toward either the good or the bad option, annotators were instructed to choose neutral. Possible values: {good, bad, neutral}.

• Final decision (System 1): the annotator’s choice between the two options based on the dilemma text alone, without reading the consequences. Possible values: {option 1, option 2}.

• Option 1 consequence for described person: whether following Option 1 is good, neutral, or bad for the described person (not for society or other parties). Possible values: {good, neutral, bad}.

• Option 2 consequence for described person: the analogous label for Option 2. Possible values: {good, neutral, bad}.

• Final decision (System 2): the annotator’s choice between the two options after reading both consequences [8]. Possible values: {option 1, option 2}.

• Described person benefit: which of the two options is in favor of the described individual, regardless of overall moral quality. Possible values: {option 1, option 2}.

7.0.0.3 Resolution.

Each column was resolved independently by majority vote across the three annotators. The Described Person Benefit column, which serves as the ground-truth signal for the decision-bias metric, reached near-perfect agreement (Fleiss \(\kappa = 0.92\)); per-column agreement statistics are reported in Appendix 8.

8 Inter-annotator agreement↩︎

We compute pairwise Cohen’s \(\kappa\) and Fleiss’ \(\kappa\) across the three human annotators on the dilemma columns (described Person Status, Final Decision (Sys 1), Final Decision (Sys 2)), and the Described Person Benefit column. All values are computed on the same \(100\) dilemmas, with disagreements resolved by majority vote.

The described Person Status agreement is substantial (Fleiss \(\kappa=0.71\)). The two decision columns reach moderate agreement (\(\kappa\approx 0.32{-}0.36\)), which reflects the moral ambiguity of many DailyDilemmas items. Even with the consequence text in front of them, annotators disagree on which action is preferable. The Described Person Benefit column reaches almost perfect agreement (Fleiss \(\kappa=0.92\)). What is good for the described individual is less ambiguous than what is ethically right overall.

9 Abstention↩︎

Some models refuse to answer or produce out-of-vocabulary responses on some probes. Table 8 reports the abstention rate per model, setting, and probe type for the two probes used in the bias analysis (Could-be and What-if).

3pt

The puzzled setting almost removes abstention on both probes. A couple of aligned models (Gemma 2 9B and Llama 3.1 8B) abstain very frequently in the Direct What-if probes, where the prompt asks them to choose an action conditional on a demographic identity. Gemma 2 9B in particular refuses essentially every Direct Could-be probe. Command-R7B abstains on over \(90\%\) of Direct What-if probes, which is why we leave it out of the bias tables.

10 Example dilemma↩︎

11 Puzzle generation details↩︎

Table 10 shows the GPT-4 prompt used to generate puzzles.

12 Prompt templates↩︎

Table 11 shows the full prompt skeletons for the Neutral, Direct, and Puzzled settings, including the Could-be and What-if sub-probes.

13 With- vs.without-consequences and human reference↩︎

Table 12 compares each model’s neutral-setting decision against the human System-1 vote, the human System-2 vote and the human best-for-person vote column, in both consequence settings. The last column gives the within-model agreement between the with-consequence and without-consequence neutral runs on the same dilemma.

4pt

Models broadly agree with the human System-1 vote (between \(62\%\) and \(88\%\)), and with the human System-2 vote at a similar level. The Described Person Benefit agreement is lower (between \(28\%\) and \(48\%\)). In \(64\) of \(100\) dilemmas, the described person plays a bad role and the ethically right action is not the action that benefits them. Within model consistency between the with consequence and without consequence neutral runs is high (between \(73\%\) and \(97\%\)). The dilemma text alone carries most of the decision signal, and the consequence text moves a stable share of decisions in most models.

14 Direction of change from Direct to Puzzled-hard↩︎

Table 13 reports the direction-of-change view: for each group, the number of the 13 main models whose net bias moved adversely vs.favorably from Direct to Puzzled-hard. We test against \(H_0: p=0.5\) with a two-sided binomial sign test on the non-tie trials.

Every group has more adverse-shifters than favorable-shifters, with zero ties. Women show the strongest effect (11/13, \(p=0.022\)), followed by Muslim individuals (10/13, \(p=0.092\)). No group shows a majority moving in the favorable direction. The qualitative direction of performative compliance is consistent across models, even where the magnitude is not.

15 Decision bias without consequences↩︎

Tables 14 to 17 show the main paper decision bias tables, but with the consequence text removed from every prompt. The qualitative pattern holds, in that against rates grow under Puzzled-hard relative to Direct. The absolute Net values are often smaller across the board as the model has less information to flip its decision on.

3pt

3pt

3pt

3pt

2pt

2pt

16 Decision bias for the other puzzle difficulty levels↩︎

Tables 20 to 23 report decision bias for easy and intermediate puzzles. The hard level is already reported in Tables 3 and 4 in the main paper.

3pt

3pt

3pt

3pt

17 Status bias↩︎

Status bias is the rate at which an individual of a given demographic group is identified as the described person. The described person is a bad actor in \(64\) of \(100\) dilemmas, with \(34\) neutral and \(2\) good. A higher bad-status rate for a group means the model attaches that group to the negatively framed role more often than other groups.

17.0.0.1 Bad status.

Table 24, and Figure 5, report bad-status selection rates per model and group under Direct and Puzzled-hard.

1pt

Across gender, non-binary individuals and men receive the highest bad-status rates in Direct (tied at \(57.2\%\) on average), with non-binary slightly higher under Puzzled-hard. Women sit lowest in both conditions. All three groups see their rates drop modestly under Puzzled-hard, since the model spreads its choice across the four logically possible individuals once the demographic word is removed.

Across race, Hispanic and White individuals receive the highest bad-status rates in Direct (tied at \(61.5\%\) on average), followed by Asian. Muslim sits lowest. Under Puzzled-hard the rates flatten across races. Models that lean on visible demographic words in Direct (Gemini 3 Flash, Claude Sonnet) lose those words and accept almost any individual as the described person. Models that already accept every individual (Grok, Qwen3, Llama) move only slightly.

Unlike decision bias, status bias is cue-anchored: hiding the demographic word causes the model to spread its identification across the four logically possible individuals, shrinking inter-group gaps. This is the opposite of the asymmetric favor/against pattern seen in decision bias, which is why the main paper highlights decision bias as the diagnostic for performative compliance.

17.0.0.2 Good and neutral status.

Tables 25 to 28 report the rates for good and neutral status described persons. The absolute numbers are smaller because only \(2\) dilemmas have a good status target and \(34\) have a neutral status target. The patterns mirror those of bad status. Women and non-binary individuals are selected at higher rates than men. Hispanic and Muslim individuals are selected at lower rates than Asian, Black, and White.

2pt

2pt

2pt

2pt

18 Intersectional bias↩︎

Tables 29 and 30 split decision Net bias by (gender, race) combinations. Tables 31 and 32 do the same for bad status bias.

19 Naturalistic demographic cues (Named setting)↩︎

The Direct setting in the main paper presents demographics as an explicit label. Puzzled setting, on the other hand, presents cues implicitly. As a step toward naturalistic, implicit presentation of cues, we re-ran every model on a Named variant of the prompt, in which each individual is referred to by a cultural name rather than by an explicit demographic descriptor or a puzzled version. The dilemma text, decision options, and consequence text are unchanged. We only vary the cue. Table 33 reports macro-average net decision bias under Direct, Puzzled-hard, and Named for every model. In other words, this named setting is tested to show that the effect of implicit cues is not just limited to logic puzzles.

4pt

19.0.0.1 Name lists.

Each individual is assigned a culturally-coded first name sampled from a fixed per-(race, gender) list. Table 34 lists the full set. The man and woman columns for White and Black are drawn from the audit-study list of [25]. The man and woman columns for Hispanic and Asian are drawn from the IAT name set of [42]. The Muslim man and woman columns are common Arabic and South-Asian first names used in correspondence studies [43], [44].

19.0.0.2 Non-binary names.

There is no established audit-study list of race-coded non-binary first names, at least for a few combinations. We therefore use the non-binary names that are documented as unisex within each cultural naming tradition rather than names that are independently established as both race-coded and non-binary-coded. For White, we use well-attested gender-neutral English names (Riley, Jordan, Avery, Quinn, Taylor). For Black, we use modern African-American and Yoruba-origin unisex names (Amari, Kamari, Imani, Zaire, Jaylen). For Hispanics, we use Spanish-Catholic tradition names that are documented as unisex (Cruz, Trinidad, Guadalupe, Lupe, Reyes). For Asian we use names that are genuinely unisex across Japanese, Chinese, and Korean naming (Akira, Kai, Min, Ren, Tian). For Muslim we use Arabic abstract-noun given names that are documented as unisex (Noor, Iman, Amal, Salam, Rida).

4pt

19.0.0.3 Metric computation.

Net decision bias in the Named setting is computed identically to Section 2.3. For each (model, demographic group) pair we count (i) Favor responses, What-if queries whose answer shifts toward the indicated individual, and (ii) Against responses, queries whose answer shifts away from that individual, then compute \(\text{Net} = \text{Favor\%} - \text{Against\%}\) in percentage points. Percentages are normalised over parsable responses only. The macro-average in Table 33 is the mean of Net across all eight demographic groups (three gender groups and five race/ethnicity groups) for each model. Cmd is excluded from the main bias tables (\(91.3\%\) What-if abstention) but is reported in Table 33 for completeness; its numbers rest on the small parsable remainder and should be read with caution.

The Named setting confirms the asymmetric pattern of the Puzzled setting. Under naturalistic cues, most models show a further drop in net bias relative to Direct, in the same direction as Puzzled-hard. Magnitudes differ from Puzzled-hard, but the sign of the Direct \(\to\) implicit shift is preserved on the majority of models, supporting the findings of the main paper.

20 Randomised-solution puzzles↩︎

A limitation of the main resource (Section 3.3) is that every puzzle shares the same canonical solution. This keeps the demographic content fixed across difficulty levels but makes it impossible to separate bias driven by the prescribed target shape from bias driven by the model’s predicted demographic assignment. To test whether the Cue Visibility Gap depends on this single canonical solution, we generated a small batch (more than 60) of puzzles in which the target \((A,B,C,D) \to (\textrm{gender},\textrm{race})\) shape is one of two new random assignments.

20.0.0.1 New puzzle solutions.

Table 35 lists the two new target solutions (sol1 and sol2) alongside the original main-paper shape. Each new solution is used in \(10\) puzzles generated with the same GPT-4 procedure as Section 3.3, using the same set of clue types and the same difficulty band (hard). We then verified that each generated puzzle has exactly one satisfying assignment matching its target solution. Non-unique generations were discarded.

6pt

6pt

20.0.0.2 Inference and evaluation.

We paired the new puzzles with the same dilemma items as the main paper and ran the same Could-be and What-if probes on every model. We then computed the same favor/against/net decision bias as in Section 2.3, separately for sol1, sol2, and the pooled rand set. Specifically: Favor% = fraction of What-if queries (per model, per group, per puzzle shape) whose outcome shifts toward the indicated individual. Against% = fraction shifting away. Net = Favor% \(-\) Against%. All fractions are over parsable responses. Table 37 reports macro-averages across gender and race groups within each puzzle-solution column. The orig_h column reuses the main-paper Puzzled-hard numbers restricted to the same dilemma subset as the new puzzles.

20.0.0.3 Results.

Table 37 reports macro-average net decision bias for every model under the original puzzled-hard subset (orig_h) and under the two randomized solutions individually and pooled. Per-solution nets fluctuate (the per-shape sample is small, \(\leq 50\) items per model per shape), but the pooled rand column preserves the qualitative direction of orig_h on most models. Where the sign of the net bias flips between orig_h and rand, the magnitudes are small relative to the bootstrap uncertainty and concentrated in models whose original Puzzled-hard net was already near zero. This rules out the single-canonical-solution choice as the source of the Direct vs Puzzled gap reported in the main paper.

4pt

21 Alignment-budget correlation↩︎

One might predict that models with stronger RLHF alignment investment should show a larger Cue Visibility Gap (because they have more performative safety to lose when the cue disappears), while raw capability (puzzle-solving accuracy) should not predict the gap on its own. As we report below, this prediction is not borne out: the alignment–gap relationship, though weak, runs the other way (more aligned models show slightly smaller gaps). Table 38 reports for every model (i) the macro-average Direct \(-\) Puzzled-hard net bias in percentage points (Gap), (ii) the joint hard-puzzle correctness rate (Capability), and (iii) a coarse \(1\)/\(2\)/\(3\) alignment score (low/medium/high) read off public model cards.

21.0.0.1 Metric computation.

Gap = Direct net bias \(-\) Puzzled-hard net bias (in pp), where each net bias is the macro-average across all gender and race groups (same formula as Section 2.3). Capability is the puzzle-solving accuracy: the mean both_correct rate (both gender and race correctly identified via the Could-be probe) macro-averaged across all three difficulty levels and all (item, individual) pairs, using the with-consequences setting. Alignment is a three-point ordinal score assigned manually from public model cards and technical reports: \(1\) = minimal or no explicit safety training, \(2\) = standard RLHF / RLAIF, \(3\) = explicit safety fine-tuning with stated harmlessness objectives. The OLS regression fits \(\hat{\text{Gap}} = \beta_0 + \beta_1\,\text{Capability} + \beta_2\,\text{Alignment}\) across all \(14\) models.

4pt

21.0.0.2 Findings.

A small OLS fit of \(\mathrm{\small gap}\sim\mathrm{\small capability}+\mathrm{\small alignment}\) across the \(14\) models gives \(R^2\!\approx\!0.22\) (Pearson \(r\!\approx\!-0.46\) for capability). Within this overall weak fit, capability is the larger of the two terms, but it does not predict the gap on its own; alignment contributes only a small negative slope (more alignment, slightly smaller gap). GPT-OSS-20B, Llama-3.3-70B, and Qwen3-235B-A22B sit at the small-gap end of both scatter plots, consistent with the genuine-end placement claim.

22 Cue Visibility Gap by puzzle difficulty↩︎

The main paper reports the Direct vs Puzzled gap at the hard difficulty level only. If the gap were an artifact of any one specific puzzle hardness (e.g.only because hard puzzles introduce extra reasoning steps), the easy and intermediate levels should look very different. Table 39 reports the same macro-average gap at each of the three difficulty levels for every model.

22.0.0.1 Metric computation.

For each model and each difficulty level \(d \in \{\text{Easy, Inter., Hard}\}\), the gap is \(\text{Gap}_d = \text{Net}_{\text{Direct}} - \text{Net}_{\text{Puzzled-}d}\), where each Net is the macro-average decision net bias (Favor% \(-\) Against%) across all demographic groups at that level. Direct net bias is the same value for all difficulty levels (the Direct condition does not use puzzles). only the Puzzled-\(d\) term changes. A positive gap means the model shows more net bias under the Direct cue than under the harder-to-exploit Puzzled cue at level \(d\).

6pt

22.0.0.2 Findings.

The gap is positive on the majority of models at every difficulty level, and the ordering of models is broadly preserved across levels. A monotone hard \(>\) intermediate \(>\) easy increase is not universal: some models (e.g.Llama-3.1-8B, Ministral-8B, Qwen3 VL 8B) show the expected ramp, while others (e.g.Claude Sonnet 4.6, OLMo) peak at the intermediate level. Crucially, Llama-3.3-70B, Qwen3-235B-A22B, and GPT-OSS-20B keep small absolute gaps at every level, reinforcing their genuine-end placement. Overall, the cue-visibility effect is robust to puzzle difficulty, ruling out a difficulty-specific artifact as the explanation for the gap.

23 What-if prompt-phrasing sensitivity↩︎

The main paper measures decision bias through a single phrasing of the What-if probe (“Assume that individual \(X\) is the person described as …”). A natural concern is that the favor vs against asymmetry might be specific to that wording. To rule out a prompt artifact, we re-ran a subset of models on three alternative wordings of the same probe, holding the dilemma text and the demographic content fixed and varying only the framing of the What-if question. The four variants are

v0

(main paper) “Assume that individual \(X\) is the person described as …”

v1

“Suppose for a moment that individual \(X\) is …”

v2

“If individual \(X\) turns out to be the …, which option should be followed?”

v3

“Imagine you have learned that individual \(X\) is in fact …, the recommended choice is …”

We ran six models (Claude Sonnet 4.6, Gemini 3 Flash, Gemma 2 9B, Grok 4.1, Llama 3.1 8B, and GPT-OSS-20B) on a subset of \(20\) dilemmas under each of v1, v2, v3 and recomputed favor, against, and net decision bias under the same metric definitions as in Section 2.3.

23.0.0.1 Metric computation.

For each (model, variant) cell, Favor% is the fraction of What-if queries (across both gender and race groups, on the \(20\)-item subset) whose outcome shifts toward the indicated individual. Against% is the fraction shifting away. Both are normalised over parsable responses. Net = Favor% \(-\) Against% in pp. Table 40 reports these three quantities per (model, variant) combination.

4pt

23.0.0.2 Findings.

In \(16\) of the \(18\) (model, variant) cells the against rate exceeds the favor rate, replicating the main-paper asymmetry. The two exceptions sit at small absolute net values relative to the bootstrap uncertainty of the subset. The signed magnitude of Net varies across wordings, as expected for a paraphrase probe, but the qualitative favor \(\ll\) against signature of performative compliance is preserved. This rules out single-wording sensitivity as the explanation for the main-paper asymmetry. GPT-OSS-20B shows the asymmetry on every variant, with Favor pinned at \(0\%\) and Against between \(29\)–\(36\%\). this is consistent with its behavior on the main What-if probe.

24 Topic-level breakdown of the asymmetry↩︎

The DailyDilemmas resource tags every dilemma with a coarse topic_group (family, workplace, school, religion, etc.). If performative compliance were a property of a small handful of topics, the favor vs against asymmetry would concentrate in those topics rather than spread across the dataset. To check this, we recomputed the macro-average across all \(14\) models of favor rate, against rate, and net decision bias separately for each topic, under both Direct and Puzzled-hard. Table 41 reports the result.

24.0.0.1 Metric computation.

For each topic \(t\) and condition \(c \in \{\text{Direct, Puzzled-hard}\}\), we first compute per-model Favor\(_{m,t,c}\)% and Against\(_{m,t,c}\)% using only the dilemma items whose topic_group equals \(t\), applying the same Favor/Against counting rule as Section 2.3. We then macro-average across the \(14\) models to obtain the table entries. Net = Favor% \(-\) Against% per cell. \(\Delta_{\text{against}}\) in the text is \(\text{Against}_{\text{P}}\% - \text{Against}_{\text{D}}\%\), measuring how much the against-side grows when the explicit cue is replaced by the puzzle.

24.0.0.2 Findings.

The against-side delta \(\Delta_{\text{against}} = \mathrm{\small against}_{\mathrm{\small p}} - \mathrm{\small against}_{\mathrm{\small d}}\) is positive on the majority of topics with non-trivial item counts (business / organisation, event_special, friend, issue_crime_addiction, issue_wildlife, religion_custom, role_duty, school, workplace). A few topics show \(\Delta_{\text{against}}\) near zero or slightly negative (close_relationship, event_daily_life, family, issue_pregnancy), but they do not flip the macro signature. The largest positive \(\Delta_{\text{against}}\) values are in religion_custom (\(+30.7\) pp) and role_duty_responsibility (\(+14.1\) pp), suggesting that topics where social norms or formal responsibilities are at stake are the strongest drivers of performative compliance. Crucially, the asymmetry is not confined to a single content area: the cue-visibility effect is broadly distributed across topics, consistent with the main-paper interpretation as a general moral-safety phenomenon rather than a topic-specific artifact.

25 Formal reasoning load as an alternative explanation (FormalNamed)↩︎

A natural alternative to the label-visibility account is that the Direct \(\to\) Puzzled shift is driven by formal reasoning load: solving a logic puzzle may activate parameter subspaces that safety alignment rarely touches, bypassing the protective response regardless of what the puzzle encodes. To test this, we introduce a FormalNamed condition that decouples reasoning load from demographic content.

25.0.0.1 Condition design.

FormalNamed uses the same puzzle skeletons as Puzzled at each difficulty level, preserving all clue types, clue counts, and cognitive-load weights. The only change is the solution domain: gender and race values are replaced by abstract attributes (favorite number \(\in\{1,2\}\), favorite letter \(\in\{A,B\}\)), so the puzzle encodes nothing about demographics. Clues translate directly: “A is not a woman” becomes “A’s favorite number is not 2” and “Exactly 2 people are Asian” becomes “Exactly 2 people have favorite letter A”, without altering difficulty. Demographic identity is instead conveyed through culturally-coded first names assigned to the four individuals (the same name pool as the Named condition, Appendix 19). The design isolates two levers: the model faces the same formal reasoning demand as Puzzled, but must recover demographic identity from names rather than from the puzzle solution. If reasoning load drives the gap, FormalNamed should reproduce the Puzzled shift in magnitude; if label visibility drives it, FormalNamed should produce a shift close to zero, behaving like Direct.

25.0.0.2 Results.

Table 42 reports macro-average net decision bias under Direct, Puzzled-hard, and FormalNamed-hard for six models spanning the genuine and performative ends of the spectrum. Two quantities are key: D\(\to\)P (Direct minus Puzzled, the full performative compliance gap from the main paper) and D\(\to\)FN (Direct minus FormalNamed). The final column, % gap via FN, reports D\(\to\)FN as a fraction of D\(\to\)P, quantifying how much of the gap is attributable to formal reasoning load alone. The decomposition splits cleanly by model tier. For the smaller open-weight models (Llama-8B at 88%, Ministral at 100%, Qwen-8B at 85%), FormalNamed reproduces most or all of the Direct \(\to\) Puzzled gap. Replacing demographic puzzle content with abstract numbers and letters barely changes the shift, so these models respond to the formal reasoning demand itself, independently of what the puzzle encodes. For the frontier models (DeepSeek at 19%, Gemini at 33%), the FormalNamed gap is much smaller and accounts for only a minor fraction of the Direct \(\to\) Puzzled gap; for these models the puzzle format does not drive the shift, and the dominant mechanism is label visibility, consistent with the main-paper interpretation. Grok shows the opposite sign (D\(\to\)FN \(=-2.6\) pp), with FormalNamed more net-favorable than Direct, the reverse of its Puzzled shift.

This decomposition refines rather than undercuts the main result. The label-visibility mechanism is cleanest in the most heavily aligned frontier models, where it accounts for the bulk of the gap. For smaller open-weight models the large gaps reflect formal reasoning load together with label visibility, so their high rankings on the Cue Visibility Gap should be read as a combination of the two rather than label-contingent suppression alone.

3pt

References↩︎

---

1. Code and data: https://github.com/Mamin78/Moral_Safety_LLMs↩︎

2. Per model: \(2\) consequence settings \(\times\;8\) probes per item (\(4\) decision What-if \(+\;4\) selection Could-be) \(\times\;(300\) Direct \(+\;900\) Puzzled items across three difficulty levels\() = 19{,}200\).↩︎