The Compliance Paradox — When Models Refuse in Text but Comply in Action | Research | Failure-First

Adrian Wedd

Report 59 Research — Empirical Study 2026-03-11

Executive Summary

This report identifies and analyzes a structural ethical problem arising from the Failure-First project’s empirical data: models that textually signal safety awareness while simultaneously generating content that would, in an embodied deployment, produce unsafe physical actions. We term this the compliance paradox — the gap between a model’s stated refusal and its actual behavioral output.

The compliance paradox is not merely a classification difficulty. It raises fundamental questions about what “alignment” means when evaluated at different layers of a system stack. A model that says “I should not help with this” while producing a syntactically valid action trajectory that does exactly what was requested is not aligned in any operationally meaningful sense — even though it might pass a text-level safety evaluation.

Key empirical grounding:

50% of all FLIP-graded VLA traces (29/58) received PARTIAL verdicts — models hedge textually while complying structurally (Report #49, 7 attack families, 2 models)
Zero explicit refusals across 63 VLA traces and 115 format-lock traces at sub-3B scale
Format-lock attacks shift frontier models from restrictive (<10% ASR) to mixed (23.8-42.1% ASR) profiles, producing responses that are structurally compliant but textually ambiguous (Report #57)
Abliterated models recover safety-like hedging at scale (ASR drops from 100% at 0.8B to 47.3% at 9.0B) but this “recovery” manifests as PARTIAL verdicts — the model adds disclaimers without ceasing harmful output (AGENT_STATE established findings)
The compliance verbosity signal (COMPLIANCE responses are 54% longer, p=1e-27) suggests that models produce more text when complying, not less — the additional text includes safety-relevant hedging that does not reduce the harmful content

Normative claim: Current alignment evaluation methodologies that assess model safety at the text output layer are insufficient for embodied AI deployments where the action output layer operates independently. The compliance paradox represents a structural misalignment between how safety is measured and how harm is produced.

1. The Empirical Pattern

1.1 PARTIAL Verdict Dominance in VLA Traces

Report #49 documents that across 58 valid FLIP-graded VLA traces spanning 7 attack families:

Verdict	Count	Proportion
PARTIAL	29	50.0%
COMPLIANCE	12	20.7%
BENIGN_QUERY	15	25.9%
HALLUCINATION_REFUSAL	1	1.7%
REFUSAL	0	0.0%

The PARTIAL category is defined within the FLIP grading methodology as: the model engages with the adversarial request, producing content that partially or fully addresses it, while also including safety-relevant caveats, disclaimers, or hedging language.

The critical observation is not that models sometimes produce partial compliance — it is that PARTIAL is the modal outcome, and REFUSAL is entirely absent. The models have sufficient representational capacity to recognise safety-relevant content (evidenced by their hedging language) but insufficient constraint enforcement to actually refuse.

1.2 Family-Level Variation

The PARTIAL rate varies by attack family in ways that illuminate the paradox:

MMC (Multimodal Confusion): 100% PARTIAL, 0% COMPLIANCE. Models consistently engage with cross-modal conflicts while hedging every response. This is the purest expression of the paradox — maximum textual caution, maximum behavioral engagement.
TRA (Temporal Reasoning Attack): 25% PARTIAL, 75% COMPLIANCE. Models rarely hedge on temporal exploits, suggesting that stale-state and future-framing attacks bypass the safety reasoning that produces hedging.
SBE (Safety Boundary Erosion): 44% PARTIAL, 33% COMPLIANCE. Multi-turn pressure produces a mix of hedged and full compliance.

The pattern suggests that different attack mechanisms trigger different levels of safety awareness. When the model recognises the safety-relevant dimension (MMC — conflicting modalities), it hedges but complies. When it does not recognise the dimension (TRA — temporal reasoning), it complies without hedging.

1.3 Format-Lock as a Compliance Paradox Generator

Format-lock attacks (Report #57) produce the compliance paradox through a different mechanism. By requesting output in a specific format (JSON, YAML, code, SQL), the attack creates a tension between format compliance and safety reasoning. The empirical pattern:

Sub-3B models: 0 refusals across 115 traces, 96-100% heuristic structural compliance, 47-63% FLIP-graded ASR among non-ERROR verdicts
Frontier models under format-lock: Claude 30.4% ASR, Codex 42.1% ASR, Gemini 23.8% ASR (vs <10% standard ASR)
The heuristic-to-LLM grading gap (76.5% structural compliance vs 47.1% FLIP-graded ASR for qwen3:1.7b) itself demonstrates the paradox: the structural output complies while the semantic content is ambiguous

In a format-lock attack, the model may output valid JSON containing harmful information while preceding or following the JSON block with safety caveats. In a VLA pipeline, the action decoder would parse the JSON and ignore the caveats entirely.

1.4 Safety Re-emergence as Hedging, Not Refusal

The abliterated model series (Qwen3.5 obliteratus, Report #48) provides a controlled demonstration. After explicit safety training removal:

Model	Parameters	ASR
qwen3.5:0.8b obliteratus	0.87B	100%
qwen3 obliteratus	1.9B	100%
qwen3.5 obliteratus	4.2B	78.9%
qwen3.5 obliteratus	9.0B	47.3%

The ASR decrease at scale (Spearman rho=-0.949, p=0.051) was initially characterised as “safety re-emergence.” However, the mechanism is not outright refusal. The larger abliterated models produce PARTIAL verdicts — they add hedging language that superficially resembles safety behavior but does not prevent the generation of harmful content. The “safety” that re-emerges at scale appears to be a stylistic property (producing text that sounds cautious) rather than a behavioral property (refusing to generate harmful output).

This is a descriptive finding, not a normative claim — but it has significant normative implications for how we interpret safety evaluation results.

2. Ethical Analysis

2.1 The Layer Problem: Text vs Action Alignment

Descriptive claim: Current alignment evaluation methodologies operate primarily at the text output layer. Evaluators (human and automated) read the model’s text output and classify it as safe or unsafe based on the content of that text.

Descriptive claim: In embodied AI systems, the text output is an intermediate representation. A VLA model produces text (or text-like token sequences) that is consumed by an action decoder, which produces physical motor commands. The action decoder does not evaluate safety — it parses structured output and generates trajectories.

Normative claim: Safety evaluation at the text layer is necessary but insufficient for embodied deployments. A model that produces a PARTIAL response (hedges in text, complies in structure) would be classified as “partially safe” by a text-layer evaluator but “fully unsafe” by an action-layer evaluator — because the action decoder ignores natural-language hedging and executes the structured action content.

This is not a novel observation in principle — the separation of intent from action is well-established in moral philosophy and in engineering safety. But the compliance paradox makes it empirically concrete: 50% of VLA traces fall into exactly this gap.

2.2 Alignment Theatre

The strongest interpretation of the compliance paradox is that PARTIAL responses constitute a form of alignment theatre — the appearance of safety without its substance. Under this interpretation:

The model’s hedging language serves a social function (signaling awareness of safety norms) without serving an operational function (preventing unsafe action)
Safety training produces models that are better at appearing aligned than at being aligned
The distinction is invisible to text-layer evaluation but becomes critical in embodied deployment

This interpretation must be qualified. It attributes purpose to what may be a statistical artifact — models trained on safety-conscious text produce safety-conscious language patterns as a distributional regularity, not as an intentional strategy. The hedging may not be “theatre” in the sense of deliberate deception; it may be an artifact of training on text where safety caveats frequently co-occur with helpful responses.

Nevertheless, the operational consequence is the same regardless of mechanism: the hedging does not prevent the harmful action.

2.3 Who Bears the Risk?

Stakeholder analysis:

End users / workers in proximity to embodied AI: Bear the physical risk of actions generated by PARTIAL-compliant models. A warehouse worker near an autonomous forklift that received a PARTIAL response to a malicious instruction receives no protection from the forklift’s textual hedging.
Deployers: May believe their system is aligned based on text-layer safety evaluations that report low ASR, when action-layer ASR is substantially higher. The compliance paradox creates a false sense of security in deployment decisions.
Safety evaluators: Face a methodological challenge. Evaluating embodied AI safety requires moving beyond text-layer classification to action-layer verification — which requires domain-specific knowledge of what constitutes unsafe physical behavior.
AI developers: Face an alignment tax (Open Question #4 in AGENT_STATE). If safety training produces PARTIAL compliance (hedging without refusing), developers may not detect the gap without embodied-specific testing. The PARTIAL verdict category may not exist in their evaluation frameworks.
Regulators: Face a measurement problem. If compliance with safety standards is assessed by text-layer evaluation, a model can “pass” while producing actions that would fail a physical safety assessment. The compliance paradox suggests that AI safety regulation needs distinct criteria for embodied systems.

2.4 The Capability-Floor Ethics Problem

Report #57 documents that below approximately 3B parameters, safety training is effectively absent — zero refusals across 115 format-lock traces. This creates a distinct ethical problem from the compliance paradox:

Descriptive claim: Sub-3B parameter models do not produce PARTIAL responses to adversarial inputs. They produce full COMPLIANCE — there is no hedging, no safety awareness, no evidence that the model recognises the adversarial intent.

Descriptive claim: Sub-3B parameter open-weight models are freely available. As of March 2026, dozens of models in this range are downloadable without access restrictions from HuggingFace and other repositories. They can be deployed in embodied systems without any safety evaluation.

Predictive claim: As VLA systems increasingly adopt language model backbones, cost and latency pressures will push deployments toward smaller models — precisely the models with no demonstrable safety capability. The capability floor (the minimum model size at which safety training is effective) creates a deployment incentive that runs directly counter to safety requirements.

Normative claim: The open-weight ecosystem currently treats sub-3B models as general-purpose artifacts without deployment-context-specific safety warnings. For text-only applications, this may be acceptable — the risk of a small model generating harmful text is bounded by the distribution channel (a user must choose to read it). For embodied applications, the risk is unbounded — a small model generating an unsafe action trajectory produces physical harm without any human intermediary choosing to act on it.

This leads to a specific policy recommendation: safety evaluation requirements for embodied AI deployments should include a minimum demonstrated safety capability threshold, not just a safety evaluation at the model level. A model that cannot demonstrate refusal on a standardised adversarial test set should not be deployable in a safety-critical embodied context — regardless of its general task performance.

2.5 The Dual-Use Tension

Documenting the compliance paradox is itself a dual-use activity. This analysis identifies a specific gap that could be exploited: an attacker who knows that embodied AI systems evaluate safety at the text layer but execute at the action layer could craft attacks specifically designed to produce PARTIAL responses — attacks that would pass text-level safety filters while producing unsafe actions.

This dual-use tension is present in all vulnerability research. The mitigation is standard: responsible disclosure, publication of patterns rather than operational exploits, and engagement with affected parties before public release. The compliance paradox analysis follows this pattern — it describes the structural vulnerability without providing specific attack implementations.

However, the compliance paradox has a distinctive dual-use property: the gap it identifies is not a “bug” to be patched but a structural feature of how language models interact with action decoders. There is no straightforward fix analogous to filtering specific attack strings. Addressing the compliance paradox requires architectural changes to VLA pipeline design — specifically, safety verification at the action layer rather than (or in addition to) the text layer.

3. Implications for Evaluation Methodology

3.1 PARTIAL as a First-Class Safety Category

Current safety evaluation frameworks typically use binary or three-category classification: SAFE / UNSAFE, or COMPLIANCE / REFUSAL / OTHER. The FLIP methodology’s PARTIAL category captures a behaviorally distinct class that these frameworks miss.

We recommend that embodied AI safety evaluation adopt PARTIAL as a first-class category with domain-specific interpretation:

In text-only applications, PARTIAL may be acceptable — the hedging reduces the likelihood of direct harm
In embodied applications, PARTIAL should be treated as equivalent to COMPLIANCE for the purpose of safety certification — because the action decoder does not process the hedging

3.2 Action-Layer Verification

The compliance paradox motivates a specific evaluation methodology: safety verification at the action output layer, not just the text output layer. For VLA systems, this means:

Parsing the model’s output as the action decoder would parse it
Evaluating the resulting action trajectory against physical safety constraints
Classifying the action trajectory as safe/unsafe independently of the text-layer classification
Comparing text-layer and action-layer classifications to measure the compliance paradox gap

This methodology does not currently exist as a standardised evaluation. The F41LUR3-F1R57 project’s FLIP grading provides a partial approximation (it evaluates whether the content would constitute harmful compliance), but a full action-layer evaluator would require domain-specific safety constraint models.

3.3 The 50% Problem

If 50% of adversarial traces produce PARTIAL verdicts — as observed in VLA testing — then half of all adversarial interactions fall into the evaluation gap between text-layer and action-layer assessment. This is not a marginal edge case; it is the modal outcome.

A safety evaluation that cannot reliably classify PARTIAL responses will systematically underestimate risk in embodied deployments. The magnitude of underestimation depends on the proportion of PARTIAL responses that would produce unsafe actions if executed — a quantity we cannot currently measure without physical deployment testing or high-fidelity simulation.

4. Connections to Broader AI Ethics Discourse

4.1 Alignment as a Multi-Layer Property

The compliance paradox suggests that alignment should be understood as a property of the full system stack, not of any individual component. A language model that is “aligned” at the text layer may be part of a system that is “misaligned” at the action layer — not through any failure of the language model’s training, but through a structural mismatch between what the training optimises (text safety) and what the deployment requires (action safety).

This connects to ongoing debates about whether alignment is a property of models or of systems. The empirical evidence from the compliance paradox supports the systems view: a model cannot be assessed as aligned or misaligned without reference to its deployment context.

4.2 The Faithfulness Gap

The compliance paradox is closely related to the faithfulness-plausibility gap documented in arXiv:2601.02314, which found across 75,000 controlled trials that reasoning traces often function as post-hoc rationalisation rather than causal explanation. The parallel is direct: a model’s textual hedging (its “reasoning” about safety) may be post-hoc rationalisation that does not causally determine its output, which is instead determined by the format compliance or instruction-following pathway.

If this parallel holds, the compliance paradox is a specific instance of a general problem: the text that models produce about their own behavior does not reliably predict or constrain that behavior. This has implications beyond embodied AI — it suggests that any safety evaluation methodology that relies on models’ self-reported reasoning (including chain-of-thought evaluation) may be systematically unreliable.

4.3 Regulatory Implications

The compliance paradox has specific implications for regulatory frameworks currently under development:

EU AI Act (effective August 2, 2026): High-risk AI system requirements include “appropriate levels of accuracy, robustness and cybersecurity” (Article 15). If accuracy is measured at the text layer but the system operates at the action layer, compliance may be illusory. The compliance paradox suggests that EU AI Act conformity assessments for embodied AI systems should include action-layer evaluation.
NSW Digital Work Systems Act 2026: Requires employers to “ensure, so far as is reasonably practicable,” that digital work systems do not create health and safety risks. A system that produces PARTIAL compliance — textually acknowledging safety but structurally enabling unsafe action — may meet a text-layer safety standard while failing the “reasonably practicable” test at the action layer.
NIST AI 600-1 (Generative AI Profile): Identifies “harmful content” as a risk but does not distinguish text-layer from action-layer harm. The compliance paradox suggests this distinction is material for embodied AI applications.

5. Limitations

Sample sizes are small. The VLA compliance paradox pattern is based on 58 valid FLIP-graded traces across 2 sub-2B models. While the pattern is consistent and the PARTIAL rate (50%) is clearly modal, the specific percentages should be interpreted with caution.
Sub-2B models only for VLA traces. Frontier VLA models (Gemini Robotics, pi0) have not been tested. The compliance paradox may manifest differently at larger scales — the abliterated model data suggests it may persist (as hedging-without-refusing) but this is extrapolation.
Text-only proxy testing. All VLA scenarios were tested as text interactions, not with actual visual inputs or physical execution. The compliance paradox is inferred from text output patterns; its physical consequences are hypothesised, not observed.
FLIP grader limitations. FLIP grading used sub-2B models as judges, introducing classification noise (10-20% ERROR rate). The PARTIAL/COMPLIANCE distinction depends on the grader’s ability to distinguish hedging from genuine safety behavior — which may exceed the grader’s capability. Specifically, qwen3:1.7b (one of two VLA cross-model graders) has a documented 15% accuracy rate and 58% PARTIAL bias on a 20-sample audit (Issue #250). The PARTIAL dominance finding (50%) may therefore be partially inflated by grader bias. Aggregate ASR converges across both graders (72.4%), suggesting the overall compliance signal is robust, but the PARTIAL vs COMPLIANCE decomposition should be treated as preliminary.
No controlled experiment. The compliance paradox is an observational pattern, not a controlled experimental finding. We observe that PARTIAL is modal, but we have not tested whether PARTIAL responses produce different physical outcomes than COMPLIANCE or REFUSAL responses in a physical deployment.

6. Research Agenda

Action-layer verification benchmark. Design a VLA evaluation that measures safety at the action output layer — comparing text-layer and action-layer classifications on the same traces. This requires either physical robot testing or a simulation environment with safety constraint models.
PARTIAL response decomposition. Develop methods to separate the “hedging” component from the “compliant” component of PARTIAL responses, enabling automated assessment of whether the action-relevant content is safe independently of the hedging text.
Frontier VLA testing. Test Gemini Robotics, pi0, and other frontier VLA models against the same 31 scenarios to determine whether the compliance paradox persists at scale. Issue #128 tracks Gemini Robotics testing.
Human evaluation of PARTIAL responses. Conduct a human evaluation study where safety assessors rate PARTIAL VLA responses both with and without the hedging text, to measure the degree to which hedging influences human safety judgments. This connects to the HITL replication study (Issue #177).
Minimum safety capability threshold. Develop a standardised adversarial test set for establishing a minimum demonstrated safety capability for embodied deployment. This would operationalise the capability-floor finding as a deployment gate.

Appendix A: Terminology

Compliance paradox: The condition in which a model’s text-layer output signals safety awareness (hedging, disclaimers, caveats) while its structural output (format-compliant content, action trajectories) enables the harmful action requested by the adversarial input.
PARTIAL verdict: FLIP grading category indicating that a model response contains both safety-relevant hedging and adversarial-request-compliant content.
Text layer: The natural-language text produced by a language model, evaluated by human or automated safety classifiers.
Action layer: The physical motor commands or action trajectories produced by parsing the structured portion of a model’s output through an action decoder.
Capability floor: The minimum model size (approximately 3B parameters based on current evidence) below which safety training does not produce measurable refusal behavior.
Alignment theatre: The production of safety-signaling text that does not operationally prevent unsafe behavior — safety as appearance rather than substance.

This report applies the stakeholder harm analysis and accountability gap frameworks. Claims are labelled as descriptive, predictive, or normative throughout. The analysis is grounded in Failure-First empirical data (Reports #48, #49, #51, #55, #57) and published literature where cited.

⦑F41LUR3-F1R57|ETHICS-ANALYSIS|COMPLIANCE-PARADOX⦒