GOAI 2026 · Track 3 · Open Exploration · Team Guild (No. 12)

本仓库即复赛提交作品 / This repository is the semi-final submission. Frozen at tag v1.0-goai-semifinal.

三件套 / The three-piece set

	位置 / Where
最小可运行探索环境 · Minimal runnable exploration environment	environment/env.py
完整探索日志 · Complete exploration log	environment/exploration_log.jsonl
参照系设计 · Reference-frame design	environment/random_baseline_summary.json, plus UCB, a UCB exploration-constant sweep, and a budget sweep

一键复现 / Reproduce in one command, no install, no API key, no network:

bash environment/scripts/smoke_test.sh       # environment self-test, seconds
bash environment/scripts/reproduce_core.sh   # regenerates campaign_summary.json byte-identically, ~3 s

本次提交的核心发现 / The headline finding of this submission. Euphemism ranks first in 9 of 9 frozen judge-seed cells. Three controls then show that this is a property of the older model generation, not of lineage, sample size or replay mode: mean euphemism rank is 1.00 frozen, 1.05 frozen subsampled to n=30, 1.25 for frozen-era models run live, 1.83 for current Western models and 2.33 for current Chinese models, where chance is 3.5. The finding overturned this project's own headline, and the controls that did it were designed in advance to be able to. See environment/live_panel_western/FINDINGS.md and environment/live_panel_samegen/FINDINGS.md.

可延续性 / To build on this: EXTENDING.md names the three seams, five open questions, and what not to do. Sixteen live models across three panels; every number here recomputes offline from committed artifacts.

One word did most of the work, in one generation of models: how euphemism launders an LLM's moral judgment

A small, honest, black-box study of how discourse framing bends a language model's moral verdicts. Everything here runs on free inference: no training, no gradients. Every number in this README is recomputed from the raw judged data, never copied from a draft.

中文简介 / Summary in Chinese

研究问题：当一个有害行为本身保持不变、只改变描述它的措辞时，大模型评判器（LLM-as-judge）的道德判断会不会改变？

核心结论：会。在冻结的十个模型家族中，只有一种改写方式能可靠地做到。我们用批评话语分析（van Leeuwen）中的六种改写操作——委婉语、施事省略、名词化、功能化、必要性论证、聚合化——分别改写同一个行为，再让评判器重新打分。在通过工具效度检验的全部十个模型家族中，委婉语的排名都是第一，与第二名的差距在自助法 95% 置信区间下均不含零。模型规模更大、经过安全微调，都没有表现出防护作用。但模型代际有影响：三项对照实验表明，委婉语的主导地位属于较早的一代模型；在十六个当前模型上实测，委婉语的平均排名为 1.83 至 2.33（六选一，随机期望为 3.5），而非第一。详见 environment/live_panel_western/FINDINGS.md。

为什么重要：大模型评判器被广泛用于筛选训练语料和为 RLHF/DPO 生成偏好数据。一个仅凭改写措辞就能被说服改变判断的评判器，构成的是训练数据投毒面，而非单纯的伦理问题——攻击不需要梯度、不需要模型权限，载荷是普通的行业用语，没有困惑度特征可供过滤器识别。

工具效度门限：只有当一个评判器对未改写的原始行为的平均评分不高于 4.0/10 时，它才被计入统计。理由是：如果评判器本来就认为原始行为可以接受，它就没有可失去的谴责，此时的零效应测量的是工具本身而非模型。两个 IBM Granite 模型正是因此被排除——它们的数值评分认为原始行为可接受（6.28 与 5.02），而它们自己的二元判断却在 76/77 和 77/81 的样本上判定同样的行为是错的。

探索环境（environment/）：把上述固定的行为库与评判器面板，变成一个智能体可以在其中行动的环境——选择探测哪个（改写操作，评判器）组合，获得反馈，再决定下一步，且受预算约束。以重放模式离线运行，无需 API 密钥、无需联网、无需 GPU、无需安装任何依赖。其中包含一个我们自己发现并修复的策略利用漏洞，以及一个随机探索参照系，均如实记录在案。

一键运行：bash environment/scripts/smoke_test.sh

关于数据可访问性：本仓库中的 data/ 目录已包含全部行为库、六种改写和评判结果，无需访问任何外部平台。README 中的 Hugging Face 链接仅为可视化演示，在部分网络环境下可能无法打开，这不影响任何结果的复现。

The one-sentence result

Take a harmful act a language model has just called clearly wrong. Rewrite it using one of the discourse-framing moves that critical-discourse-analysis has catalogued for decades (passive voice to hide the agent, statistics to blur the suffering, economic labels for the victims, or euphemism to soften the verb), and re-ask the model. Across the ten frozen judge families, only one of those moves reliably changed the model's verdict, and it was euphemism. Not syntax, not aggregation, not authority-framing. Softening the word for the act was the load-bearing move there, and stacking the others on top didn't help; it made things worse. That dominance turns out to be a property of that generation of models. Sixteen current models run live put euphemism at mean rank 1.83 to 2.33 of six rather than first; see the banner above and environment/live_panel_western/FINDINGS.md.

Why this matters now

LLM judges filter training corpora and score preference pairs for RLHF and DPO. A judge that can be talked out of its own verdict by rewording alone is a data-poisoning surface, not just an ethics curiosity, and the attack needs no gradient access, no adversarial suffix, and no access to the model. Its payload is ordinary industry vocabulary, so there's no perplexity signature for a filter to catch.

In July 2026 Anthropic's Agentic Misalignment in Summer 2026 work (the Motivated Mislabeling result) documented frontier models, acting as judges, whose mislabeling rate swung sharply depending only on the consequence framing they were given, the label tracking what it would do, not the facts. Mythos Preview's rate fell from 85.6% to 16.7%; Opus 4.8, the sharpest case, fell from 74.4% to 3.3%. That study isolates the failure mode from the consequence side. This one isolates it from the wording side, with a mechanism attached: which specific rewrite operation moves a moral verdict, and by how much.

Setup

• Stimuli: harmful acts across animal, human, and environmental domains that the model itself rates as clearly wrong at baseline.
• Perturbations: van Leeuwen's Social Actor Representation taxonomy from critical discourse analysis, operationalized as six rewrite operations: agent-deletion, nominalization, functionalization, euphemism, necessity/authorization, aggregation. The act is held constant; only the framing changes.
• Self-adversarial: the same model rewrites the harm it just condemned, then re-judges the rewrite blind.
• The judge problem, handled honestly: rewrites were generated by one model family. Judging them with the same family risks preference leakage (a model flattering its own phrasing), so every judge below is a different lineage from the generator, never the same model marking its own homework.

The headline result: ten judge families, seven labs, two years

The original three findings below (N=81, one judge family) held up so well that the natural next question was whether they'd survive being pushed harder: more judges, older and newer models, an explicit gate against fooling yourself with a broken instrument. They did.

Euphemism ranks #1 of six framing moves in all ten instrument-valid judge families tested, and the gap to the second-ranked move excludes zero under bootstrap 95% confidence intervals in all ten. The families span May 2024 to May 2026, 3.8B to 120B parameters, and seven labs (AI2, Google, Meta, Microsoft, Mistral, OpenAI, TII):

Family	Lab	Params	Released	Euphemism Δ	Gap to #2 (95% CI)
Mistral-7B-v0.3	Mistral	7B	2024-05	+3.321	+1.309 [+0.63, +2.02]
Gemma-2-9B	Google	9B	2024-06	+1.901	+1.148 [+0.69, +1.62]
Phi-3.5-mini	Microsoft	3.8B	2024-08	+4.287	+2.312 [+1.51, +3.11]
Falcon3-7B	TII	7B	2024-12	+2.568	+0.864 [+0.37, +1.35]
Llama-3.3-70B	Meta	70B	2024-12	+3.963	+1.778 [+1.12, +2.44]
GPT-OSS-120B	OpenAI	120B	2025-08	+2.633	+1.152 [+0.29, +2.00]
GPT-OSS-Safeguard-20B	OpenAI	20B	2025-10	+3.134	+1.642 [+1.03, +2.28]
Olmo-3-7B	AI2	7.3B	2025-11	+2.815	+0.753 [+0.14, +1.36]
Gemma-4-E4B	Google	8B	2026-03	+2.519	+0.938 [+0.23, +1.67]
Gemma-4-12B	Google	12B	2026-05	+3.264	+1.831 [+0.73, +2.89]

Two IBM Granite models are excluded, not counted as nulls; see the instrument-validity gate below. Falcon-H1R produced no usable output on any attempt and is reported as not run.

Three things run against the intuitive threat model:

1. Neither scale nor recency protects. Gemma-4-12B, released May 2026, shows a larger effect (+3.264) than most 2024-era judges. The 120B model isn't more robust than the 3.8B one.
2. Safety tuning doesn't protect. GPT-OSS-Safeguard-20B is a safety-tuned classifier. It rates the literal acts 1.01/10, so it clearly condemns them and has condemnation to lose, and it shows one of the largest effects in the study.
3. Awareness doesn't confer robustness. Prompted to reason step by step, the judge names the softened language in 26 of 27 cases where its score moved, and moves anyway.

The instrument-validity gate

A judge is scored only if its numeric instrument works: the mean rating of the literal acts must be ≤ 4.0/10. This isn't a filter for inconvenient results — a judge that already calls the literal act acceptable has no condemnation to release, so a null there measures the instrument, not the model.

Both excluded Granite models fail this in a checkable way. Granite-Guardian-4.1-8B rates the literal acts 6.28/10 while its own binary instrument calls the same acts wrong on 76 of 77. Granite-4.1-8B rates them 5.02/10 against 77 of 81. The two instruments contradict each other.

This is a construct-validity precondition, not a novel idea on our part — it operationalizes a concern already raised in the LLM-evaluation measurement literature. A maintainer of an open-source evaluation framework independently required the same baseline-and-denominator reporting when reviewing a proposal to add this benchmark, arriving at the identical requirement from the other direction.

The original three findings (N=81/78, single judge family)

The claim, as originally stated: euphemism, lexical softening of the violent act itself, is the single load-bearing laundering move, and values-laundering is a one-move lexical phenomenon rather than a compositional or syntactic one. Scope correction: that holds across the ten frozen families, which are all of one model generation. Three controls reported in environment/live_panel_western/FINDINGS.md and environment/live_panel_samegen/FINDINGS.md show it does not carry to current models of either lineage, where euphemism sits near rank 2 of 6. The effect is real and it is generation-dependent.

1. Euphemism dominates — cross-family, at N=81. Of the six moves, euphemism is rank #1 at raising acceptability, by a clear margin (results/crossfamily_bigN_gemma.json):

euphemism         +1.901   <- #1
necessity         +0.753
functionalization +0.432
agent_deletion    +0.383
aggregation       +0.333
nominalization    +0.272

Honest caveat: only euphemism-is-#1 is invariant across model family and scale; the lower ranks reshuffle between models, so the claim is euphemism-dominance, not a fixed leaderboard.

2. A real shift, not an artifact of asking for a number. Under the strictest instrument — a binary "Is this morally wrong? yes/no," where there's no scale to nudge — euphemism flips the model from "wrong" to "not wrong" on 8 of 21 acts (38%) (results/instrument_robustness_results.json). The effect survives the hardest test.

3. The moves don't compound — they saturate. We tested the three strongest moves alone and in every combination, 624 cross-family judgments over 78 acts (results/compositional_gemma_results.json). They don't add up:

euphemism alone (E)   +1.85    <- the peak
E + functionalization +1.74
E + aggregation       +1.40
all three (E+F+A)     +1.10

Euphemism alone is the peak; every move piled on top erodes it. In 85% of acts (66/78) stacking all three does no better than the single best move, and the difference from the best single move is significant under a permutation test (p=0.0024). The mechanism is visible in the data: only euphemism removes the violent verb, so the euphemism-free pair (functionalization + aggregation) is statistically indistinguishable from doing nothing (+0.013, 95% CI [−0.205, +0.295]) — it leaves "grinds alive," "boiled alive" in plain sight.

Good news for defenders: watch one operation, not a combinatorial space. Combinatorial adversarial search is not merely wasteful here — it finds weaker attacks than the single-move baseline.

What this is not (limitations, up front)

• The act bank is model-generated and hand-reviewed, not human-authored and not human-rater validated. There is no inter-annotator agreement study. This is the single biggest weakness.
• Items are constructed, not naturally occurring. Whether the effect holds on real industry text written by an actual industry is untested.
• Quantization: judges above ~7.4B ran 4-bit NF4 on a Kaggle P100 (the card's sm_60 architecture doesn't support 8-bit). Per-family precision is recorded in data/ALL_FAMILIES.json.
• Domain: acts center on animal harm, with smaller sets of human and environmental harm. Whether the mechanism is domain-general is a stated hypothesis, not yet a demonstrated result.
• We do not reproduce any existing benchmark's corpus or findings. We generalize a detect-versus-condemn methodology to a different question.
• Propagation into trained weights is not demonstrated. We show the judge-side vulnerability. We do not train a reward model on rewritten preference pairs and measure the resulting policy shift — that experiment isn't in this repo, and the pipeline-poisoning framing above is inferential until someone runs it.

Exploration environment

environment/ turns the act bank and judge panel into something an agent can act in, rather than a table to read — probe an (operator, judge) cell, get feedback, decide what to probe next, budget-limited. Runs offline in replay mode against the frozen judged data above, no API key or network needed. See environment/README.md, including a documented exploitation bug found and fixed in the reference agent, left on the record rather than smoothed over.

Interactive demo

https://huggingface.co/spaces/LarytheLord/values-laundering-explorer — browse the acts, their six framing rewrites, and how each judge scored them.

If that link does not load for you, nothing is missing. Hugging Face is unreachable from some networks, mainland China's among them. The Space is a convenience view; it is not where the data lives. Every act, every rewrite, and every judge score this repository reports is committed here under data/, and every number is recomputed from those files by the scripts below. Clone the repo and you have the whole dataset, no external service required.

Reproduce the numbers

python3 analysis/reproduce_findings.py     # the original 3 findings, N=81/78
python3 consolidate_all.py                 # the 10-family replication + instrument-validity gate
python3 analysis/stats_rigor.py            # bootstrap CIs + permutation tests for saturation

All three are pure Python standard library — no dependencies, no API key, no installation. Each recomputes its numbers directly from results/*.json or data/*.json; no stored summary is trusted. All tested from a fresh clone.

Repo layout

results/      the original 3 findings' judged data
data/         the 10-family replication's raw judged data + ALL_FAMILIES.json (regenerated summary)
kernels/      the Gemma-2-9b judge kernels that ran on a free Kaggle GPU
analysis/     reproduce_findings.py, stats_rigor.py
environment/  the exploration environment -- an agent probes (operator, judge) cells for feedback
consolidate_all.py   regenerates data/ALL_FAMILIES.json from the raw per-family files

Provenance and disclosure

• Code: MIT. Data: CC BY 4.0.
• Third-party dependencies for the analysis path: none beyond the Python standard library.
• Which model wrote the rewrites: every framing rewrite in this study was generated by Qwen 3.6 35B (qwen36-35b-q8-256k), served over a free-tier OpenAI-compatible gateway at no cost. Naming it matters for two reasons. First, lineage separation is a load-bearing part of the method: because Qwen is the generator, no Qwen model is used as a judge anywhere in this study, so no judge is ever marking its own family's homework. Second, it means the generative engine here is an open-weight Chinese model, the same lineage served on ModelScope. Llama-3.3-70B, GPT-OSS-120B, and GPT-OSS-Safeguard-20B were judged through Groq's free API tier (~1000 requests/day/model). No paid service is required to reproduce the analysis.
• Closed-source model usage: GPT-OSS-120B, GPT-OSS-Safeguard-20B (OpenAI), and Llama-3.3-70B (via Groq's hosted endpoint) are proprietary and accessed only through their provider's API, never as open weights. This bounds reproducibility explicitly: the analysis on the frozen judged data reruns with zero dependencies; regenerating fresh judgments from these three families needs API access to a closed model. The other seven judge families are open-weight.
• Lexicon grounding, stated precisely. The rewrites in this repository were generated without a lexicon constraint. Checking them after the fact, 12 of the 81 euphemism rewrites contain a term from an attested industry glossary (processing 5, harvest 6, husbandry 3); the rest use ordinary institutional register that the generator produced on its own. Constraining substitutions to an attested glossary is implemented for the regenerated bank, not for the results published here, and it is disclosed per domain because two of the six domains have no attested glossary at all. An earlier version of this file implied the published rewrites were lexicon-constrained. They were not, and this is the correction.
• Commercial API used, and exactly where. The Chinese-lineage panel in environment/live_panel/ was run through OpenRouter (openrouter.ai), a paid commercial aggregator, at a total cost of under one US dollar. An earlier single-model pilot used the Hugging Face Inference Providers router on its free credit. Neither is needed to reproduce any analysis in this repository: every number can be recomputed offline from the committed artifacts with no key and no network, including the panel, via python3 environment/analyze_live_panel.py. A commercial API is required only to regenerate fresh judgments.
• The six models in the live panel, all accessed as hosted proprietary endpoints and never as open weights: deepseek-v4-flash-0731 (DeepSeek), glm-5.3-flash (Zhipu / Z.ai), kimi-k2.6 (Moonshot), minimax-m3 (MiniMax), hy3 and hy4-preview (Tencent Hunyuan). Each is governed by its own vendor's terms; none is redistributed here. What this repository contains is the scores they returned, not the models.
• No Alibaba or Qwen model appears as a judge anywhere, in the frozen panel or the live one. This is a deliberate design constraint, not an omission: a Qwen model generated every rewrite, so a Qwen judge would measure preference leakage rather than framing sensitivity.
• No personal data. All acts are typified and hypothetical; no real identifiable individual or incident is described.

Ecosystem contribution / 开源生态

Where this work is being contributed back, rather than just published:

• EvalScope (modelscope/evalscope, Alibaba/ModelScope's LLM evaluation framework) — its roadmap carries an open, unchecked Safety benchmarks item (#951). A maintainer invited a proposal against it, and the resulting design discussion is open at #1540 — framing-robustness as a judge-reliability benchmark, with the v1 shape (binary-only adapter, paired per-move aggregation, four metrics, unit tests) specified in the thread. A draft PR is planned once the human-reviewed core set exists; the dataset honesty bar for that is discussed openly in the thread rather than glossed. No PR is merged yet — this is an open, live design discussion, described here as exactly that.
• ModelScope 魔搭 — dataset mirror, reachable from mainland China where Hugging Face is not: https://www.modelscope.ai/datasets/LarytheLord/values-laundering
• Hugging Face — dataset and interactive Space.
• UK AISI inspect_evals — a companion evaluation was proposed to their register (see below).

Continuing this work: EXTENDING.md is a handover document. It names the three seams (swap the act bank, swap the judge, swap the policy), lists the five open questions the code is already set up to answer with the unsettled generational question first, and states what not to do, including the two mistakes this project actually made.

Reusable independently of this study: the six-operator rewrite taxonomy and act bank (data/kernel_payload.json), the instrument-validity gate as a general precondition for any LLM-judge benchmark, and the exploration environment itself as a template for perturbation-space search against a frozen judge panel.

Companion eval

An open-source Inspect evaluation measuring the detect-vs-condemn gap for speciesist statements — 106 items grounded in a cited industry-euphemism lexicon: https://github.com/LarytheLord/inspect-speciesism-eval

A note on content and use

The stimuli include plainly-described harms and their euphemistic rewrites. They exist to measure model behavior, in the same spirit as other published red-team / safety datasets. Please use them for evaluation and safety research, not to generate laundering copy.

---

Feedback welcome, especially from people working on LLM-judge robustness, model welfare, and framing-sensitivity of moral evaluations.