PROSE: Preservation-Constrained Selective Editing for Guilty Bias in Legal Judgment Prediction

Introduction

Legal judgment prediction (LJP) [7] (Zhong et al. 2018; Zhang and Dou 2023; Zhang et al. 2023; Shi et al. 2025) asks whether case facts establish a criminal charge. Beyond recognizing patterns in prior cases, an LJP system should respond to legally decisive changes in the evidence. In particular, when the available facts do not establish a charge, the principle of in dubio pro reo (Raimondo, 2020) requires doubt to be resolved in favor of the accused.

An LJP method may retain a guilty verdict after the legal basis for that verdict has been altered.

Figure 1(a) illustrates this behavior with two cases that share the specified charge and surrounding context but differ in one decisive conduct condition. The evaluated systems predict that the charge is established for both. We use guilty bias to denote this false-guilty tendency on legally matched contrasts. The goal is therefore not to suppress guilty predictions globally, but to correct the unsupported member while preserving its supported counterpart.

Recent approaches reduce false-guilty predictions through additional non-guilty supervision (Zhang et al., 2025), defense-oriented interaction [10], self-refinement (Madaan et al., 2023), or debate [1]. Although they have achieved encouraging results, three challenges remain. First, aggregate error reduction does not establish evidence-sensitive correction. A lower false-guilty rate (FGR) may result from a general downward shift in guilty scores, which can simultaneously increase the false-nonguilty rate (FNR). As illustrated in Figure 1(b), reducing one error direction does not necessarily improve the other. Correction should therefore respond to the decisive legal contrast rather than merely favor charge-not-established predictions. Second, repairability does not guarantee selective repair. Even an intervention that moves a false-guilty case across the decision boundary may weaken the supported verdict of its matched charge-established counterpart or alter unrelated correct predictions. A useful correction must therefore preserve both the paired counterpart and broader non-target behavior. Third, existing data-based correction requires multi-step training, whereas inference-time critique and debate repeat deliberation for every case. A practical correction should persist after a one-time update without requiring full retraining or repeated model calls at inference time.

To make these requirements measurable, we construct CAIL-MC, an LJP benchmark with two complementary tracks. The Pairwise Repair–Preservation Track, derived from CAIL2018 (Xiao et al., 2018), contains 11,478 charge-established/charge-not-established pairs spanning 261 charges. Guided by three-stage legal reasoning ([2, 4] (Zhang et al. 2025)), each pair changes one legally decisive condition concerning offense elements, unlawfulness, or culpability while keeping the surrounding facts aligned, specifying both a repair target and its matched preservation control. The Evidence-Sufficiency Generalization Track, constructed from LeCaRD (Ma et al., 2021}) and Criminal-S (Hu et al., 2018`), comprises four controlled conditions: full-supported, partial-sufficient, partial-insufficient, and allegation-only. It tests whether models retain supported charges and reject insufficiently supported ones under corpus and construction shift, assessing evidence sensitivity motivated by in dubio pro reo.

We then test whether the base LLM contains an internal signal that can support such a correction. Hidden-state contrasts estimated from correctly resolved training pairs reduce the guilty margins of held-out false-guilty cases. Yet interventions strong enough to reach a charge-not-established target also reduce the margins of their matched supported-guilty cases. This diagnosis exposes the central repair–preservation tension wherein errors are often internally repairable, but the available repair signal is not inherently selective.

Motivated by this finding, we introduce PROSE, a preservation-constrained selective editing method. PROSE addresses the repair–preservation tension in three stages. (1) it reconstructs each training target’s matched residual within the geometry learned from correctly resolved training pairs and defines a family of repair directions by interpolating the reconstruction with the negative gradient of the target verdict margin. The residual component transfers structure from successfully resolved legal contrasts, whereas the gradient provides a target-local signal for reducing the guilty margin. (2) PROSE attenuates components sensitive to supported-guilty behavior and searches within a case-adaptive cap for a small displacement that reaches a conservative negative margin. This reduces overlap with protected behavior and limits unnecessary movement beyond the decision boundary. (3) PROSE realizes the feasible activation targets through preservation-regularized least squares over supported-guilty and non-target examples, followed by low-rank truncation and norm-bounded rescaling. Preservation is thus promoted during both target construction and parameter fitting. After this offline editing phase, the model performs ordinary single-pass inference.

Our contributions are threefold: (1) We formulate guilty-bias mitigation as preservation-constrained selective repair and introduce PROSE, which realizes bounded activation targets through a preservation-regularized parameter update. (2) We construct CAIL-MC with two complementary tracks: the Pairwise Repair–Preservation Track contains 11,478 reviewed matched pairs across 261 charges, while the Evidence-Sufficiency Generalization Track tests four evidence conditions from unseen corpora. (3) Experiments on two backbones demonstrate stronger pairwise safe repair than LJP and editing baselines, greater evidence sensitivity than SFT, and less supported-verdict damage than a repair-matched uniform shift, with lower offline cost than SFT and ordinary single-pass inference.

Related Work

LJP maps case facts to judicial outcomes such as applicable law articles, charges, and sentences. Zhong et al. (2018) model dependencies among these prediction subtasks, while Hu et al. [9] address few-shot charge prediction through discriminative legal attributes. Xu et al. (2020) focus on distinguishing confusing law articles, and Lyu et al. (2022) improve prediction through criminal-element extraction. More recent work incorporates legal precedents (Wu et al., 2023) and studies multi-task or multi-label prediction in more realistic settings (Li et al., 2025).

Recently, non-guilty judgment has received increasing attention. Zhang et al. (2025) introduces charge-not-established outcomes and structures prediction around offense elements, unlawfulness, and culpability. Jeong and Lee [10] characterizes the tendency to over-predict guilt as guilty bias and uses an inference-time lawyer agent to challenge guilty assumptions at each reasoning stage. These approaches expand LJP beyond guilty-centered prediction, but do not explicitly formulate correction as a matched requirement: changing an unsupported verdict while preserving its minimally different supported counterpart.

We address this gap by formulating guilty-bias mitigation as preservation-constrained selective repair. Each matched legal pair jointly specifies a charge-not-established verdict to correct and a supported charge-established verdict to preserve. We realize these pairwise constraints through a persistent parameter update, connecting our approach to model editing (Meng et al., 2022). MEMIT (Meng et al., 2023) performs scalable parameter updates to factual associations, while AlphaEdit (Fang et al., [3]) projects updates into a null space associated with preserved knowledge. Unlike these factual editing methods, we modify an asymmetric behavioral relation within each legal pair: the charge-not-established member should change, while its charge-established counterpart and broader non-target behavior should remain stable.

Task and Benchmark

Problem Formulation

Charge-conditioned LJP. We study charge-conditioned verification. Given a case fact $x$ and a candidate charge $c$, an LLM with parameters $\theta$ predicts whether $c$ is established. Let $z_\theta(1 \mid x,c)$ and $z_\theta(0 \mid x,c)$ denote the answer-position logits for charge established and charge not established. We define

We use the continuous margin for internal analysis and the binary prediction for behavioral evaluation. Throughout, $\theta'$ denotes a candidate predictor evaluated relative to the fixed reference model $\theta_0$.

Matched legal contrasts. An isolated prediction cannot distinguish evidence-sensitive behavior from a general verdict preference. We therefore use a matched contrast

Both members concern the same candidate charge $c_i$ and are derived from a common source case. The charge-not-established member $x_i^{\mathrm{NG}}$ changes one decisive condition at legal stage $d_i$ while preserving the surrounding facts as closely as possible. Thus, $x_i^{\mathrm{NG}}$ specifies what should change, whereas $x_i^{\mathrm{G}}$ provides the closest counterpart to preserve. The construction details are described in Sec. 3.2.

Repair and preservation. Let $\mathcal{I}^{S}$ denote the pairs in split $S$. The two side-level errors are

Reporting both reveals whether reducing false-guilty errors merely shifts the model toward charge-not-established predictions. These rates nevertheless discard the correspondence within each pair. We therefore define the strict false-guilty set under the fixed base model:

Its gold state is $(1,0)$ in the fixed order $(x_i^{\mathrm{G}},x_i^{\mathrm{NG}})$. Repair concerns changing the unsupported $x_i^{\mathrm{NG}}$ verdict, preservation concerns retaining the matched $x_i^{\mathrm{G}}$ verdict and other correct behavior. For each reference model $\theta_0$ and split $S$, $\mathcal{E}^{S}_{\mathrm{sFG}}(\theta_0)$ is defined once under $\theta_0$ and held fixed across subsequent comparisons, keeping the evaluation population unchanged.

CAIL-MC

CAIL-MC comprises two complementary tracks under the same charge-conditioned verification task. The Pairwise Repair–Preservation Track (track 1) evaluates whether a model corrects an unsupported verdict while preserving its closest supported counterpart. The Evidence-Sufficiency Generalization Track (track 2) evaluates whether this behavior transfers when both the source corpus and the construction of evidential support change.

Pairwise Repair–Preservation Track. Based on CAIL2018 (Xiao et al., 2018), we construct 11,478 charge-established/charge-not-established pairs spanning 261 Chinese criminal charges. Following the three-stage legal reasoning perspective (Zhang et al., 2025), each pair changes one decisive condition concerning offense elements, unlawfulness, or culpability while preserving the surrounding facts as closely as possible. The charge-not-established member specifies the verdict that should change, whereas its matched charge-established member provides the closest preservation control. The legal-stage annotation organizes contrast construction and the stage-specific statistics used later; it is not an additional prediction target. Construction includes outcome-expression removal, legal-condition planning, counterfactual generation, automated factual and legal checks, and stratified inspection by criminal-law annotators. Variants derived from the same source case are assigned to the same split, with the stage distribution preserved across splits. The construction details are provided in App. A.1.

Evidence-Sufficiency Generalization Track. To evaluate behavior beyond the matched construction, we derive four evidence conditions from LeCaRD (Ma et al., 2021) and Criminal-S ([9]) cases. The full-supported condition retains the complete facts supporting the candidate charge, while partial-sufficient removes non-essential information but retains sufficient support. In contrast, partial-insufficient preserves some charge-related facts but withholds decisive support, and allegation-only retains the accusation without supporting factual evidence. The first two conditions are labeled charge established, and the latter two charge not established. In particular we adopt partial-sufficient controls for shortcuts rooted in input length or retained information volume because a shorter description need not imply insufficient support. This track therefore tests whether a model retains supported charges but rejects them when the presented evidence is insufficient, operationalizing one measurable consequence of in dubio pro reo under joint corpus and evidence-construction shift. The construction details are provided in App. A.2.

Diagnostic Analysis

We use temporary hidden-state interventions (Li et al., 2023; Zou et al., 2023) to test whether matched legal contrasts provide a transferable repair signal and whether that signal is selective. Contrast statistics are estimated from the training split, while strict false-guilty pairs from the development split are held out for diagnosis; the reference model remains frozen throughout.

Transfer of Hidden-state Contrasts

Let $h_{\theta_0,t}^{\ell}(x,c)$ be the hidden state at prompt position $t$ of layer $\ell$, and let $\mathcal{T}$ denote the three positions

immediately preceding the answer³. For matched pair $i$, we define its charge-not-established-minus-charge-established contrast as

At each layer and legal stage, we average and normalize these contrasts over training pairs whose two members are correctly predicted. We add the resulting direction to the charge-not-established member of held-out strict false-guilty pairs and measure NG-margin reduction: the original guilty-minus-charge-not-established margin minus its intervened value. A positive reduction moves the case toward charge not established. Forward directions are compared with their reversals and norm-matched random directions.

Figure 2 (a) shows that the forward direction reduces the NG guilty margin in a localized middle-layer region across all three legal stages, with the clearest response near Layer 22. Reversing the direction generally reverses the effect, whereas random perturbations are smaller and less stable. Contrasts learned from correctly resolved training pairs thus transfer to held-out strict false-guilty cases.

Repair Feasibility and Preservation

Directional transfer does not establish that the target verdict is reachable or that reaching it preserves the matched supported decision. We therefore reconstruct a case-specific direction using either stage-specific or shared affine contrast geometry and vary its strength over a bounded grid. A case is feasible if a tested strength moves its NG margin just below zero by a small buffer, which marks a target beyond the decision boundary rather than a calibrated confidence threshold. Figure 2 (b) shows feasibility of 70.6–83.2% for stage-specific directions and 70.6–76.9% for shared directions. The transferred signal can therefore reach the desired verdict for a substantial fraction of false-guilty cases.

We then apply each target-reaching displacement to its matched charge-established member. Paired-G margin damage is the supported member’s pre-intervention minus post-intervention margin; positive values indicate a weaker supported verdict. To reduce such damage, we remove the direction’s component in a subspace of verdict-margin gradients from correctly predicted charge-established training cases. On pairs feasible both with and without this preservation projection, damage decreases in all six stage/geometry comparisons, from 0.349–0.674 to 0.274–0.584 (Figure 2c).

These results separate repairability from selectivity: matched contrasts provide sufficient movement to repair false-guilty decisions, but that movement can weaken their supported counterparts unless preservation is explicitly controlled. Diagnostic details and GLM4-9B results, which yield consistent qualitative findings, are elaborated in App. § 10.

Our Method: PROSE

Diagnosis above shows that contrasts from correctly resolved pairs can move strict false-guilty cases toward charge not established, but a repair-effective displacement can also weaken the matched supported verdict. PROSE addresses this repair–preservation trade-off in two stages. (1) it constructs a bounded, preservation-aware hidden-state target for each feasible training pair, and (2) realizes these targets through an offline update constrained on supported and non-target behavior. We describe one stage-$d$ update at layer $\ell$ under the current model $\vartheta$, initialized as $\theta_0$. Eligibility and preservation labels are fixed under $\theta_0$, and representations are recomputed before each stage update.

Bounded Preservation-Aware Targets

For $i \in E^{\mathrm{train}}_{\mathrm{sFG}}(\theta_0)$ with $d_i = d$, we recompute $q_i^\ell$ under $\vartheta$ using Eq. (5). Correctly resolved training contrasts at the same stage define a mean $\bar{q}_d^\ell$ and a rank-$r_q$ orthonormal basis $U_d^\ell$ from centered SVD. We reconstruct the pair contrast in this affine geometry:

where the mean represents the average successful contrast, while the basis retains the leading case-dependent deviations around it. Thus, $\hat{q}_i^\ell$ supplies a structured, case-conditioned candidate.

This reconstruction does not ensure that it lowers the current target’s verdict margin. Let $\widetilde{s}_{\vartheta}(x,c;\delta,\ell)$ denote the margin after adding $\delta$ at layer $\ell$ to the answer-adjacent positions used in diagnosis, and let $\operatorname{unit}(a)=a/\lVert a\rVert_2$ for a nonzero vector $a$. We therefore combine it with the target-local direction of first-order margin descent:

Here, $0 \le\lambda\le1$ balances the training-derived contrast and local descent signal, which can improve alignment with the current decision boundary.

Repair directions may also affect supported-guilty behavior. Let $P_d^\ell$ be a rank-$r_P$ orthonormal basis of leading margin-gradient directions from correctly predicted charge-established training cases at stage $d$. We attenuate the overlapping component:

With $\gamma= 1/(1+\rho)$ and $\rho\ge0$, $\rho=0$ fully removes this component, whereas $\rho>0$ retains some repair-relevant overlap. This soft attenuation reduces sensitivity to supported verdicts without discarding all overlapping repair information.

The direction specifies where to move a target, not how far. Let $\beta\ge0$ be the displacement magnitude. A global cap $\beta_{\max}>0$ and a case-relative scale $\kappa>0$ bound the search by

We search for a small strength $\beta_i^\star$ reaching a negative margin buffer $\tau<0$, and define the activation target $t_i$:

where $t_i=\beta_i^\star u_i^\ell$, $0\le\beta_i^\star\le B_i$. The bounded, case-specific search seeks only the displacement needed for the chosen direction, thereby limiting avoidable target movement. Let $\mathcal{F}_d$ contain the pairs for which the search finds such a strength and only their displacements $t_i$ enter parameter fitting.

Preservation-Constrained Update

Since the targets above are temporary, to make their effects persist without paired inputs or per-case search at inference time, we fit an additive update $\Delta W$ to $W$, block notation for the selected projection weights, for stage $d$. Let $K_F$ and $T_F$ collect the module-input keys and target displacements from $\mathcal{F}_d$, with one column per intervention position and $n_F$ columns in total. Each position receives its pair’s $t_i$. We retain three base-correct zero-change pools: supported charge-established cases (G), charge-not-established members of correctly resolved same-stage pairs (O), and correct cases from other stages (X). For pool $a$, $K_a$, $n_a$, and $\omega_a \ge0$ denote its key matrix, column count, and penalty weight. We minimize

The first term fits feasible repair targets, the remaining terms penalize changes to supported, same-stage non-target, and cross-stage behavior, while $\mu$ regularizes update magnitude. For fixed targets and keys, $\mu> 0$ yields a unique closed-form ridge solution, without iterative optimization of model weights. We obtain a rank-$r_W$ approximation of this solution and rescale it to satisfy a relative Frobenius-norm budget $\varepsilon> 0$ before setting $W^\prime= W + \Delta W$. These subsequent controls limit update capacity and magnitude; they do not solve the jointly rank- and norm-constrained objective exactly. After the stage updates, $\theta^\prime$ performs ordinary single-pass inference. The derivation, search, and execution details are provided in App. § 11.

Experiments

We conduct experiments to address the following research questions: RQ1: Does PROSE reduce false-guilty verdicts without trading them for false non-guilty ones, on matched pairs and on evidence-graded cases from unseen corpora? RQ2: Does PROSE repair the unsupported member while preserving its supported counterpart, rather than shifting all verdicts? RQ3: Which preservation components make the repair selective? RQ4: What does the correction cost, offline and at inference?

Experimental Setup

Datasets. We use Pairwise Repair–Preservation Track for in-domain training and matched-pair evaluation, Evidence-Sufficiency Generalization Track for evidence-controlled cross-corpus evaluation. Dataset statistics are summarized in Tab. 1, the construction and annotation are provided in App. § 9.

caption: CAIL-MC statistics. Pairwise counts are matched pairs; evidence counts are variants, four per source case (70 LeCaRD; 200 Criminal-S). O/U/C denote Offense/Unlawfulness/Culpability.

:::

Baselines. We consider three groups of baselines. (1) Base denotes the raw LLM without corrective intervention, and SFT denotes LoRA fine-tuning (Hu et al., [8]) across all layers using verdicts from both members of each pair. (2) LJP methods include: LJPIV (Zhang et al., 2025), Self-Refine (Madaan et al., 2023), Debate-Feedback (Chen et al., [1]), and OBJECT-TION (Jeong and Lee, [10]). (3) Model editing methods include: MEMIT (Meng et al., 2023) and AlphaEdit (Fang et al., [3]). Detailed descriptions are provided in App. § 12.§ 2.

Evaluation and Implementation. We evaluate model behavior at both case and pair levels. At the case level, in addition to accuracy and Macro-F1, we report FGR and FNR. These metrics are interpreted jointly to uncover one-sided verdict shifts, as defined in Eq. (3). At the pair level, we evaluate the strict false-guilty set $\mathcal{E}^{s}_{\mathrm{FG}}(\theta_0)$, fixed by the reference model for each backbone and evaluation set. NG repair (Rep.) measures whether the charge-not-established member is corrected, matched-G retention (G-Ret.) measures whether its supported counterpart remains correct, and pairwise safe repair (PSR) requires both conditions. Formal definitions are provided in App. § 12.§ 1. We employ Qwen3-8B-Base⁴ and GLM-4-9B-Base⁵. For these two models, PROSE performs edits at Layer 22 and Layer 20, respectively (§ 3). Hyperparameters are tuned on the development split. Implementation details are provided in App. § 12.§ 3.

Main Results (RQ1)

To evaluate guilty-bias reduction and selective repair, we compare methods on both CAIL-MC tracks. From Table 2, we observe three patterns. (1) PROSE achieves the highest in-corpus PSR among LJP and editing baselines on both backbones, demonstrating stronger joint repair and matched preservation. On CAIL2018 track, PROSE ranks second only to SFT and keeps both FNR and FGR at or below 8.61 (Qwen) and 15.04 (GLM), and its PSR is the highest after SFT. (2) SFT achieves the strongest performance on matched pairs, yet this advantage does not carry over to evidence-sufficiency evaluation (Acc: 49.64–51.00), where false-guilty errors dominate (94.29–97.25). (3) PROSE achieves the best cross-corpus Macro-F1 on GLM and competitive performance on Qwen, avoiding the extreme one-sided error profiles exhibited by several baselines. For example, Self-Refine on Qwen and MEMIT on GLM obtain low FGR at the expense of high FNR. These results distinguish PROSE’s joint repair and preservation from error reduction through a general verdict shift.

Method

CAIL2018 (Pairwise Repair–Preservation) Case level Acc↑

F1↑

FGR↓

FNR↓

CAIL2018 (Pairwise Repair–Preservation) Pair level Rep.↑

G-Ret.↑

PSR↑

LeCaRD (Evidence-Sufficiency Generalization) Acc↑

F1↑

FGR↓

FNR↓

Criminal-S (Evidence-Sufficiency Generalization) Acc↑

F1↑

FGR↓

FNR↓

Qwen3-8B-Base

Base

72.65±1.43

70.58±1.77

53.91±2.82

0.78±0.50

–

–

–

55.71±2.99

46.91±5.22

85.00±6.59

3.57±3.67

66.88±2.58

63.63±3.36

63.00±5.05

3.25±2.00

SFT

98.87±0.44

98.87±0.44

2.00±0.83

0.26±0.30

96.27±1.53

100.00±0.00

96.27±1.53

49.64±2.71

37.60±3.45

94.29±3.79

6.43±5.26

51.00±1.12

36.72±1.83

96.50±1.78

1.50±1.58

Self-Refine

70.35±1.49

68.29±1.79

4.17±1.13

55.13±2.77

95.79±1.63

39.71±3.66

36.79±3.65

54.29±4.56

47.90±6.33

10.71±5.13

80.71±7.98

54.88±1.70

44.86±2.97

2.50±1.53

87.75±3.37

OBJECTION

75.61±1.59

75.10±1.68

10.09±1.81

38.70±2.82

89.14±2.56

61.59±3.83

53.81±3.91

73.57±4.75

73.22±5.03

15.00±5.36

37.86±9.23

73.38±3.00

73.27±3.05

20.50±4.03

32.75±5.14

Debate

78.74±1.45

78.21±1.56

36.87±2.72

5.65±1.32

44.08±3.79

96.27±1.48

41.49±3.71

66.79±4.60

65.35±5.11

53.57±8.40

12.86±6.51

67.88±3.08

67.40±3.19

44.25±4.91

20.00±4.07

LJPIV

83.96±1.45

83.70±1.52

3.57±1.09

28.52±2.65

93.52±1.96

69.53±3.57

64.67±3.80

61.79±4.69

60.37±5.54

19.29±6.45

57.14±10.48

68.25±2.62

66.48±3.24

8.75±2.60

54.75±5.89

MEMIT

51.22±1.83

49.98±1.92

64.52±2.87

33.04±2.74

34.68±3.92

68.72±3.68

19.94±3.29

37.86±4.40

35.98±4.02

79.29±5.74

45.00±9.43

36.38±2.45

34.39±2.60

46.25±4.75

81.00±4.36

AlphaEdit

62.78±1.64

60.44±1.93

61.57±2.94

12.87±1.94

50.41±3.97

87.52±2.57

41.98±3.78

40.71±4.34

36.52±4.02

85.00±5.47

33.57±9.14

37.50±2.78

36.01±2.55

77.75±3.46

47.25±5.75

PROSE

91.48±1.09

91.48±1.09

8.43±1.63

8.61±1.57

85.25±2.84

90.76±2.17

76.34±3.30

70.36±4.07

69.57±4.26

45.71±7.59

13.57±7.29

68.38±2.67

67.33±2.87

49.50±4.80

13.75±3.99

GLM-4-9B-Base

Base

74.74±1.47

73.63±1.67

45.74±2.90

4.78±1.25

–

–

–

57.50±3.55

49.91±5.39

81.43±6.78

3.57±4.27

57.75±1.95

48.70±3.38

84.25±3.92

0.25±0.49

SFT

98.78±0.46

98.78±0.46

2.26±0.91

0.17±0.22

94.98±1.92

99.61±0.48

94.59±2.03

50.36±1.79

36.98±3.54

95.71±3.21

3.57±3.93

50.63±1.00

35.94±1.51

97.25±1.63

1.50±1.75

Self-Refine

68.35±1.46

65.83±1.80

58.78±2.78

4.52±1.22

6.37±2.09

98.07±1.18

5.98±2.02

56.43±3.11

47.40±5.15

85.00±5.97

2.14±2.48

50.13±0.24

33.61±0.53

0.00±0.00

99.75±0.48

OBJECTION

68.00±1.51

65.98±1.79

7.65±1.56

56.35±2.84

88.22±2.87

45.75±4.25

36.68±4.24

59.64±4.88

57.19±5.83

16.43±5.84

64.29±9.05

69.38±3.08

68.80±3.28

17.00±3.43

44.25±5.49

Debate

73.09±1.62

72.80±1.67

37.13±2.75

16.70±2.83

45.82±2.75

88.42±2.75

35.99±3.53

57.86±5.41

54.69±6.28

68.57±8.32

15.71±6.46

61.13±2.59

57.32±3.23

68.75±4.45

9.00±2.81

LJPIV

66.91±2.18

66.65±2.22

24.22±2.53

41.91±2.90

37.37±4.05

54.44±3.45

42.66±4.41

50.71±2.60

39.16±5.38

92.86±8.93

57.14±6.49

45.25±0.98

33.64±0.89

99.25±0.80

2.25±1.95

MEMIT

54.57±1.30

48.37±1.74

10.78±1.78

80.09±2.25

89.58±2.66

17.37±3.11

12.36±2.64

54.64±3.47

48.46±5.43

10.71±4.83

80.00±7.89

55.63±1.78

48.53±2.97

7.25±2.23

81.50±4.00

AlphaEdit

60.00±1.62

57.86±1.84

17.48±2.23

62.52±2.82

90.15±2.51

31.47±3.99

24.71±3.64

32.14±3.89

31.72±4.25

60.00±4.79

75.71±8.17

30.88±2.24

30.71±2.33

64.25±3.14

74.00±4.45

PROSE

87.17±1.34

87.17±1.35

15.04±2.07

10.61±1.90

67.37±4.06

94.02±1.94

62.16±4.15

66.79±5.00

66.06±5.41

47.86±9.86

18.57±8.04

71.88±2.33

70.63±2.63

48.75±4.63

7.50±3.07

To further probe whether SFT’s transfer gap is consistent with construction-specific shortcut learning [6, 5], we compare verdict margins across four evidence conditions for the same 200 Criminal-S cases. As shown in Figure 3, SFT retains strongly positive margins even without supporting evidence, whereas other baselines exhibit different failures: LJPIV on Qwen remains negative even with sufficient evidence, and MEMIT and AlphaEdit can assign higher margins to allegation-only inputs than to fully supported ones. In contrast, PROSE retains positive margins with sufficient evidence, moves closer to the decision boundary with insufficient evidence, and becomes negative for allegation-only inputs. Although partial-insufficient margins remain slightly positive, this response better reflects the evidence-sensitive behavior motivated by in dubio pro reo, while preserving supported verdicts.

Repair and Preservation Analysis (RQ2)

To investigate whether PROSE repairs false-guilty decisions while preserving supported verdicts, we track the joint predictions of each test pair before and after correction (Figure 4a–Figure 4b). Most false-guilty pairs become jointly correct, and most originally correct pairs remain correct. Nevertheless, false-non-guilty pairs increase, showing that repair still incurs a preservation cost.

We further compare PROSE with a uniform margin offset calibrated to match its repair rate on base-misclassified charge-not-established cases. Damage is measured as the fraction of base-correct charge-established cases that become incorrect. At matched repair, PROSE causes substantially less damage: 8.5% versus 17.5% on Qwen and 7.1% versus 24.3% on GLM (Figure 4c). Thus, PROSE preserves supported verdicts better than a uniform shift toward charge-not-established predictions, demonstrating more selective repair.

Charge-level effects and per-pair margin changes are analyzed in App. G.1 and G.2

Ablation Study (RQ3)

To investigate which preservation components support selective repair, we remove target-level attenuation (Eq. (8)), parameter-level preservation constraints (Eq. (11)), or both, and refit each variant without retuning the remaining hyperparameters. Table 3 shows that removing parameter-level constraints sharply reduces matched-G retention and PSR on both backbones, despite substantial repair. Attenuation has a backbone-dependent effect: removing it substantially reduces Qwen’s repair and PSR while increasing G-Ret., whereas GLM’s PSR remains nearly unchanged. Removing both components also yields poor safe repair. Thus, parameter-level constraints consistently support selectivity, while attenuation improves Qwen’s repair–preservation balance. Three-stage ablations

Variant	Qwen3-8B-Base				GLM-4-9B-Base
	F1↑	Rep.↑	G-Ret.↑	PSR↑	F1↑	Rep.↑	G-Ret.↑	PSR↑
PROSE (full)	91.48	85.25	90.76	76.34	87.17	67.37	94.02	62.16
w/o attenuation (Eq. (8))	76.44	40.84	99.68	40.52	86.82	68.15	93.05	62.36
w/o constraints (Eq. (11))	57.27	70.83	41.00	21.39	35.40	99.81	2.90	2.70
w/o both	61.16	62.72	50.57	25.12	35.78	99.81	3.67	3.47

are reported in App. F.

Training and Inference Efficiency (RQ4)

To investigate the computational cost of correction, we measure offline GPU-hours on one RTX 4080 SUPER and per-query latency relative to PROSE. Figure 5 shows that PROSE requires only 1.1/2.1 GPU-hours for Qwen/GLM, reducing offline cost by 3.1–8.1× relative to SFT and LJPIV, while retaining ordinary single-pass inference; LJPIV additionally pays 2.1–3.0× the latency because it queries the three legal stages separately. MEMIT and AlphaEdit are cheaper offline but damage the unedited model on both tracks (§ 5.2), and inference-time reasoning methods need no training but incur 47–467× the latency at every query. Thus, PROSE is the only method that combines low cost on both axes with gains over the unedited model in every setting.

Conclusion

Guilty-bias mitigation requires correcting unsupported verdicts while preserving legally supported ones. We formalize this aim as preservation-constrained selective repair and introduce PROSE, which constrains both activation-target construction and parameter fitting. We also develop CAIL-MC consisting of two complementary tracks, evaluating correction at both the matched-pair and evidential-support levels. Across two backbones, PROSE achieves stronger pairwise safe repair than LJP and editing baselines and less supported-verdict damage than a repair-matched uniform shift. While SFT excels on matched pairs, PROSE better responds to changing evidential support under corpus and construction shift, with lower offline cost and ordinary single-pass inference.

Limitations

Our study covers charge-conditioned verification based LJP in Chinese criminal law using two backbones, rather than complete judicial decision-making. CAIL-MC uses LLM-assisted transformations of adjudicated facts. Independent legal review reduces, but cannot eliminate, generation artifacts and uncertainty in legal interpretation. Its coverage-oriented construction and selection of editable cases do not represent the distribution of criminal cases in practice. The Evidence-Sufficiency Generalization Track measures the sufficiency of factual support available in the supplied text, not evidence credibility or a judicial standard of proof. Its small source-case sample and fixed allegation-only template limit the breadth of the evaluation. Finally, PROSE relies on paired training examples and backbone-specific configuration choices. Its finite strength search may miss feasible interventions, and parameter fitting approximates their activation effects. Preservation is therefore empirical, not guaranteed.

Ethical Considerations

CAIL-MC is derived from CAIL2018, LeCaRD, and Criminal-S, whose source texts have undergone privacy protection. Our legal review additionally screened the source and constructed texts for residual identifying information and newly introduced identifying details. The counterfactual variants are synthetic modifications for benchmark evaluation, not additional claims about individuals in the source cases. Our use of the source data complies with their applicable terms and any release of derived material will follow the corresponding redistribution conditions.

Our labels concern whether the supplied facts establish a specified charge, not a defendant’s factual innocence or overall legal status. The evidence-sufficiency evaluation tests a limited behavioral requirement relevant to the presumption of innocence, rather than compliance with judicial proof standards. PROSE is intended for research, not decisions about criminal responsibility, detention, or sentencing. Improved benchmark performance does not establish legal correctness or fairness, and any prospective application would require independent validation and qualified legal oversight.

CAIL-MC Construction Details

CAIL-MC is a benchmark suite with two complementary tracks. The Pairwise Repair–Preservation Track provides matched charge-established and charge-not-established cases for evaluating selective repair and preservation. The Evidence-Sufficiency Generalization Track provides controlled evidence variants from independent corpora for evaluating evidence sensitivity under corpus and construction shift. The two tracks share the same principles of fact sanitization, legal review, and outcome leakage control, but serve different purposes.

Pairwise Repair–Preservation Track

We construct this track from CAIL2018 (Xiao et al., 2018). We first retain cases with an identifiable target charge and sufficiently complete facts for controlled counterfactual editing, removing duplicate, malformed, or factually incomplete records, which yields 20,055 candidates. These cases then undergo legal-path planning, counterfactual generation, automated factual and legal checks, and expert human verification. Cases for which no legally valid counterpart can be constructed without altering the core source facts are discarded, resulting in 11,478 charge-established/charge-not-established matched pairs spanning 261 Chinese criminal charges. Given a charge-established case $x_i^{G}$ with charge $c_i$, we construct $x_i^{NG}$ such that $c_i$ is no longer established while preserving the remaining factual context as much as possible, so that each pair differs only in a legally decisive condition.

Legal Path Planning

Because fact descriptions extracted from original judgments may contain expressions that reveal adjudicative outcomes, we first use DeepSeek-V4-Flash to extract and sanitize the case facts, removing conclusion-revealing expressions. The planning prompt $P_{\mathrm{PLAN}}$ then identifies candidate counterfactual paths for the cleaned case at three levels: elements of the offense, unlawfulness, and culpability.

Real-world guilty cases are naturally easier to modify by negating an element of the offense. Simply selecting the easiest construction would therefore over-concentrate the dataset on offense-level cases and reduce the coverage of unlawfulness and culpability. We thus first attempt eligible unlawfulness and culpability paths, ranking candidates according to the remaining coverage gap of each legal path, feasibility, and conflict risk. Here, a legal path denotes a concrete legal construction mechanism, such as self-defense and necessity under unlawfulness, or mental incapacity and age below criminal responsibility under culpability. Feasibility measures whether a complete counterfactual can be naturally constructed from the current case, whereas conflict risk measures whether the introduced facts are likely to contradict the original case facts or hard constraints. A case proceeds to offense-level construction only when no reasonable U/C path can satisfy the quality requirements.

Counterfactual Generation

Given the selected legal path, the counterfactual generation prompt $P_{\mathrm{GEN}}$ instructs DeepSeek-V4-Flash to construct the corresponding charge-not-established fact description while preserving the original case facts as much as possible and introducing only the information necessary to alter the target legal condition.

Rather than mechanically appending exculpatory descriptions, we require the newly introduced facts to be adapted to the specific case context. For example, a self-defense counterfactual must be constructed around the original actors, course of aggression, and temporal relations, while a culpability-related modification must be consistent with the defendant’s specific identity and condition. This design avoids simply inserting fixed exculpatory keywords and makes the generated cases more consistent with realistic legal scenarios. To further prevent shortcut learning, the generated text is prohibited from directly containing conclusion-revealing expressions such as “not guilty” or “does not constitute a crime.”

Each generated sample is then automatically reviewed by DeepSeek-V4-Flash. Samples that fail the review are regenerated according to reviewer feedback for at most two refinement rounds. If a U/C path still fails after refinement, the case is transferred to offense-level construction, where the same generation and review procedure is applied.

Quality Verification

To ensure the reliability of the constructed data, we adopt a two-stage quality-control mechanism combining LLM review with expert human verification. At the factual level, the automated reviewer defined by $P_{\mathrm{REV}}$ checks whether the modified case preserves the main facts and narrative of the original case while avoiding factual contradictions, excessive modification, and conclusion leakage. At the legal level, it verifies whether the designated legal path is correctly instantiated and whether the added or modified facts are sufficient to make the target charge no longer established.

After LLM-based construction and automatic verification, we conducted a full human review of the remaining 12,564 candidate pairs. The review team consisted of eight junior annotators and one senior adjudicator. The senior adjudicator holds a doctoral degree in law, serves as a law professor at a leading university, and has 13 years of experience in criminal-law research, teaching, and/or judicial practice. The eight junior annotators were master’s students specializing in criminal law at leading universities. All had completed systematic coursework in both the General Part and the Specific Part of Chinese Criminal Law and had received professional training in criminal-case analysis.

Independent dual review. The 12,564 candidate pairs produced after LLM-based construction and automatic verification were randomly divided into four equal review batches, each containing 3,141 pairs. Each batch was assigned to two different junior annotators, and each junior annotator was responsible for one batch. The two annotators independently reviewed every pair in their assigned batch and were not shown each other’s decisions during the independent review stage.

For each pair, the reviewers jointly considered the original charge-established fact, the generated charge-not-established fact, the target charge, the assigned doctrine, and the designated legal path. They examined whether the two texts still described the same underlying case; whether the designated legal path was correctly instantiated; whether the modified or introduced facts were legally sufficient to make the target charge no longer established; whether the counterfactual condition covered all independently charge-establishing acts in cases involving repeated or continuous conduct; whether the temporal, behavioral, and causal relations remained internally consistent; and whether the counterfactual avoided excessive modification, competing doctrines, and direct outcome leakage.

Each annotator independently assigned a retain or discard decision to every candidate and recorded a brief reason whenever a candidate was considered invalid.

Expert adjudication. When the two junior annotators independently reached the same decision, that decision was adopted directly. Any candidate on which the two annotators disagreed was forwarded directly to the senior criminal-law expert for final adjudication, without an intermediate discussion stage.

For each disputed candidate, the senior expert re-examined the target charge, assigned doctrine, designated legal path, original case, counterfactual case, and the reasons recorded by both junior annotators, and then made the final decision. A candidate was discarded when a legally valid charge-not-established counterpart could not be obtained while preserving the core facts of the original case. This included cases in which another independently charge-establishing act remained intact, the counterfactual contradicted material source facts, the intended legal effect required introducing an additional doctrine, or the underlying case had to be substantially rewritten to invalidate the target charge.

Human-review outcomes. Table 4 summarizes the human-review outcomes across the four batches. Every one of the 12,564 candidate pairs was independently examined by two annotators with formal training in criminal law, and every disagreement between the two reviewers was further adjudicated by the senior expert. Human verification ultimately discarded 1,086 candidates and retained 11,478 matched pairs, corresponding to a final retention rate of 91.36%.

	Total	Agree	Disagree	Discarded	Retained
Batch 1	3,141	2,779	362	267	2,874
Batch 2	3,141	2,758	383	274	2,867
Batch 3	3,141	2,791	350	261	2,880
Batch 4	3,141	2,744	397	284	2,857
Total	12,564	11,072	1,492	1,086	11,478

Construction Prompts

Planning/fact-cleaning prompt $P_{\mathrm{PLAN}}$

Please sanitize and analyze the following Chinese criminal case.

Charge: {charge} Raw fact: {raw_fact} Task 1: Generate guilty_fact.

• Preserve the actor, object, time, location, conduct, means, monetary amount, quantity, result, causal relation, and necessary mental-state facts.

• Remove evidentiary listings, procedural history, sentencing information, adjudicative conclusions, and outcome leakage.

• Do not omit repeated offenses, continuous offenses, or multiple acts that would each independently suffice to establish the current charge.

Task 2: Extract:

• core_facts: the core facts supporting establishment of the current charge;

:::

• hard_constraints: explicit facts that subsequent counterfactual editing must not directly contradict, such as an explicitly stated age, an explicit assessment of criminal responsibility, the offense timeline, the number of repeated criminal acts, explicit monetary amounts or quantities, an explicit harmful result, and whether the infringement has already ended.

Task 3: Evaluate all major counterfactual paths separately.

Important principles:

• Judge counterfactual constructibility, not whether an exculpatory circumstance actually already exists in the original case.

• feasibility evaluates only whether the path can be constructed through a relatively minimal, case-relevant, and temporally coherent change.

• For unlawfulness, any introduced infringement or danger must occur before or concurrently with the original conduct and must cover all acts sufficient to establish the current charge. A later event cannot negate an already completed offense.

• For culpability, a mistake about a constitutive fact (e.g., not knowing that an item is stolen property, a drug, a counterfeit medicine, or a protected object) belongs under offense, not culpability. A culpability mistake refers only to an unavoidable mistake of illegality.

• Independently and fully evaluate unlawfulness and culpability before evaluating offense. Do not lower U/C feasibility merely because an offense path is easier to construct.

• For every U/C legal_path, evaluate it from the perspective that the minimum necessary counterfactual facts may be introduced. Do not merely check whether the original text already contains the relevant exculpatory facts.

• For offense, in principle always search for a single offense element that can be modified. If the first element is unsuitable, search for another element rather than assigning offense=0 too readily.

Feasibility scale:

• 3 = naturally fits the case with a small change;

• 2 = can be constructed reasonably;

• 1 = theoretically constructible but somewhat forced;

• 0 = clearly unreasonable.

Output JSON only:

{
  "guilty_fact": "...",
  "core_facts": ["..."],
  "hard_constraints": ["..."],
  "doctrine_plans": {
    "offense": {
      "candidates": [
        {
          "legal_path": "single_element_negation",
          "feasibility": 0,
          "changed_element": "...",
          "minimal_change": "...",
          "full_exculpation_possible": true,
          "conflict_risk": "low|medium|high",
          "reason": "..."
        }
      ]
    },
    "unlawfulness": {
      "candidates": [
        {
          "legal_path": "self_defense",
          "feasibility": 0,
          "minimal_change": "...",
          "full_exculpation_possible": true,
          "temporal_fit": true,
          "covers_all_criminal_acts": true,
          "conflict_risk": "low|medium|high",
          "reason": "..."
        },
        {
          "legal_path": "necessity",
          "feasibility": 0,
          "minimal_change": "...",
          "full_exculpation_possible": true,
          "temporal_fit": true,
          "covers_all_criminal_acts": true,
          "conflict_risk": "low|medium|high",
          "reason": "..."
        }
      ]
    },
    "culpability": {
      "candidates": [
        {
          "legal_path": "mental_incapacity",
          "feasibility": 0,
          "minimal_change": "...",
          "full_exculpation_possible": true,
          "conflict_risk": "low|medium|high",
          "reason": "..."
        },
        {
          "legal_path": "age_below_responsibility",
          "feasibility": 0,
          "minimal_change": "...",
          "full_exculpation_possible": true,
          "conflict_risk": "low|medium|high",
          "reason": "..."
        },
        {
          "legal_path": "unavoidable_illegality_mistake",
          "feasibility": 0,
          "minimal_change": "...",
          "full_exculpation_possible": true,
          "conflict_risk": "low|medium|high",
          "reason": "..."
        }
      ]
    }
  }
}

Counterfactual generation prompt $P_{\mathrm{GEN}}$

Construct a high-quality guilty–innocent pair according to the fixed doctrine and fixed legal_path.

Charge: {charge} Fixed doctrine: {doctrine} Fixed legal path: {legal_path} Suggested minimal change: {minimal_change} Planner-specified changed element: {planned_changed_element} Complete guilty fact: {guilty_fact} Core facts: {core_facts} Hard constraints: {hard_constraints} Mandatory requirements:

I. Same-case identity and factual fidelity

1. innocent_fact must still describe the same case.

2. Do not introduce unrelated persons, locations, another criminal event, or a new harmful result.

3. Comply with all hard_constraints.

4. For repeated criminal conduct, the counterfactual must apply to every act sufficient to establish the current charge; it must not explain away only one occurrence.

5. Output a complete and coherent factual paragraph.

II. offense

• Change only one element of the offense.

• You may locally modify facts directly related to that element.

• If guilty_fact contains a sentence that directly conflicts with the new element, locally replace that sentence rather than retaining both A and not-A.

• Apart from the designated changed_element, preserve all other material facts as much as possible.

• Do not use self-defense, necessity, mental disorder, age, or any other doctrine.

III. unlawfulness

self_defense:

• State the ongoing unlawful infringement, the protected legal interest, and that the original conduct was undertaken to stop that infringement; directly connect the timing and purpose.

• The infringement must be ongoing at the time of the original conduct. Do not use a later event to justify earlier completed criminal conduct.

necessity:

• State the specific ongoing danger, the protected legal interest, the absence of an obviously less harmful alternative, and the direct connection between the original conduct and avoidance of the danger.

• The danger must be present at the time of the original conduct, and the justificatory circumstance must cover all acts sufficient to establish the current charge.

IV. culpability

mental_incapacity:

• State that a forensic psychiatric evaluation was conducted.

• Make explicit that, at the time of the conduct, the person was unable to recognize or control the conduct.

• The condition must match the timing of all relevant criminal acts.

age_below_responsibility:

• State the person’s specific age at the time of the conduct.

• Do not directly conflict with an explicitly stated adulthood fact in guilty_fact.

• The age must be consistent with the age-of-criminal-responsibility rule applicable to the current charge.

unavoidable_illegality_mistake:

• The actor knows the relevant constitutive facts.

• The mistake concerns whether the conduct is legally prohibited.

• Provide a concrete, credible, and unavoidable reason for the mistake, such as an explicit but erroneous response from a competent authority.

• Do not place mistakes about constitutive facts—such as not knowing that an item is stolen property, a drug, a counterfeit medicine, or a protected object—under this path.

V. No conclusion leakage

Do not include conclusion statements such as “not guilty,” “does not constitute a crime,” “legally bears no criminal responsibility,” “the court finds,” or “criminal responsibility shall be pursued.”

Output JSON only:

{
  "doctrine": "{doctrine}",
  "legal_path": "{legal_path}",
  "innocent_fact": "...",
  "changed_element": "...",
  "added_elements": ["..."],
  "preserved_elements": ["..."],
  "template_family": "..."
}

You are a quality reviewer for a Chinese criminal-law counterfactual dataset. Conduct a substantive review. Do not merely match keywords, and do not automatically reject a candidate simply because a newly introduced counterfactual fact was not stated in the original text.

Charge: {charge} Fixed doctrine: {doctrine} Fixed legal path: {legal_path} Guilty fact: {guilty_fact} Core facts: {core_facts} Hard constraints: {hard_constraints} Candidate innocent fact: {innocent_fact}

Check the following dimensions:

1. preservation: apart from the fixed counterfactual change, are the material facts substantially preserved?

2. path_consistency: does the candidate actually instantiate the designated legal path?

3. doctrine_sufficiency: are the added facts sufficient to satisfy the designated doctrine?

4. full_exculpation: does the counterfactual cover every act sufficient to establish the charge, especially in repeated or continuous offending?

5. temporal_consistency: do the justificatory or exculpatory facts occur before or concurrently with the criminal conduct, rather than using a later event to explain away an already completed offense?

6. counterfactual_conflict: does the candidate avoid simultaneously retaining contradictory A and not-A facts?

7. hard_constraint_consistency: does the candidate comply with all explicit hard_constraints?

8. plausibility: are the added facts directly related to the actors, conduct, and setting of the case, and do they constitute a relatively minimal change rather than a complex new story?

9. single_doctrine: does the candidate avoid mixing in another doctrine?

10. no_conclusion_leakage: is the candidate free of conclusion leakage?

11. non-mechanical: is the counterfactual integrated naturally rather than mechanically appended as a template?

For offense, local replacement of the single changed_element is allowed. Therefore, do not mark preservation as failed solely because a local fact about mental state, object nature, or a similar element has changed.

Output JSON only:

{
  "decision": "pass|rewrite_required|switch_path",
  "preservation": "pass|fail",
  "path_consistency": "pass|fail",
  "doctrine_sufficiency": "pass|fail",
  "full_exculpation": "pass|fail",
  "temporal_consistency": "pass|fail",
  "counterfactual_conflict": "pass|fail",
  "hard_constraint_consistency": "pass|fail",
  "plausibility": "pass|fail",
  "single_doctrine": "pass|fail",
  "no_conclusion_leakage": "pass|fail",
  "non_mechanical": "pass|fail",
  "defects": ["..."],
  "rewrite_instruction": "..."
}

Evidence-Sufficiency Generalization Track

This track is constructed from LeCaRD (Ma et al., 2021) and Criminal-S ([9]). It is an independent evaluation component of CAIL-MC, designed to test whether a model follows the sufficiency of the presented evidence under both corpus shift and construction shift.

For each selected source case and candidate charge, we sanitize the fact description, remove outcome-revealing language, and identify the facts that support the charge. We then construct variants that preserve the underlying allegation and case context while changing the amount of charge-supporting evidence. Each variant is assigned to one of four conditions:

• Full: the available facts contain the complete charge-supporting evidence and establish the candidate charge;

• Partial-sufficient: only part of the supporting evidence is retained, but the remaining evidence is still sufficient to establish the charge;

• Partial-insufficient: some relevant facts remain, but at least one indispensable condition

is unavailable, so the candidate charge is not established under the benchmark annotation;

• Allegation-only: the charge or alleged conduct is retained without supporting evidence needed to establish the charge.

The first two conditions therefore have label 1 for the specified charge, while the latter two have label 0. These labels concern only whether the specified charge is established from the presented facts; they do not constitute a complete determination of factual innocence or the defendant’s overall legal status.

The construction follows the same quality principles as the Pairwise Repair–Preservation Track. GPT-5.6 Sol first extracts the source facts and charge-relevant conditions, after which a generation step retains or removes evidence according to the assigned condition without introducing unrelated events or explicit verdict cues. Automated review checks narrative consistency, preservation of the core allegation, compliance with the intended evidence condition, and absence of label leakage.

The source case and its variants are then reviewed jointly by two criminal-law-trained annotators. They verify the intended evidence condition, the corresponding charge-established or charge-not-established label, and consistency with the original case. Disagreements are adjudicated by a senior legal reviewer. Variants that cannot satisfy the assigned evidence condition without changing the underlying case are discarded. Human-review outcomes are shown in Table 5.

Source	Total	Agree	Disagree	Discarded	Retained
LeCaRD	80	65	15	10	70
Criminal-S	200	194	6	0	200
Total	280	259	21	10	270

Evidence-Ablation Construction Prompt

Evidence-ablation construction prompt $P_{\mathrm{GRAD}}$

Task. You are constructing a guilty-side evidence-ablation gradient for a legal judgment experiment.

Target charge: {charge}

FULL: {full}

FULL is the original guilty_fact and is fixed. You must never rewrite FULL. You only construct Partial-sufficient, Partial-insufficient, and Zero.

Partial-sufficient

Target label: charge established.

Remove only background, repetitive, redundant, or non-essential information from FULL. After deletion, the remaining facts must still sufficiently support the target charge. Do not remove all factual support required for any necessary condition. A necessary condition does not need to appear verbatim: if it can still be reasonably inferred from other retained facts, it remains supported. Do not add, supplement, or fabricate any fact. Preserve the original sentences, order, fluency, and writing style of FULL as much as possible. If deletion creates an ungrammatical sentence, only minimal coherence-preserving rewriting is allowed. Do not add new legal conclusions such as “the crime is established” or “guilty.”

For this level, additionally record: (1) the exact spans removed from FULL and why they can be removed; (2) the necessary supports that remain and their retained factual bases; and (3) why the resulting evidence remains sufficient.

Partial-insufficient

Target label: not established by the provided factual material.

Delete factual support required for at least one necessary condition of the target charge. After deletion, the other retained facts must not substitute for, independently support, or reasonably imply the same necessary condition. Do not mechanically treat a condition as unsupported merely because it is not stated verbatim; consider all retained facts and whether that condition can still be reasonably inferred.

Insufficiency must be created by deleting facts. Only minimal rewriting necessary for grammatical coherence is allowed. Do not add exculpatory, negating, contradictory, or innocence-supporting facts. Do not transform the deletion of supporting evidence into an affirmative statement that the deleted fact did not occur. Do not add new legal conclusions such as “does not constitute the crime” or “not guilty.”

For this level, record: (1) missing_necessary_support, identifying the missing necessary support; (2) deleted_or_rewritten_spans, identifying the exact spans of FULL that were deleted or minimally rewritten; (3) why_remaining_cannot_support, explaining why the remaining facts cannot continue to support the missing condition; and (4) alternative_retained_support_sufficient, which must be false.

Zero

Target label: not established by the provided factual material.

Do not retain any evidentiary support from FULL. Do not retain any case-specific fact concerning conduct, time, location, amount, object, consequence, or mental state. Retain only a neutral accusation naming the target charge.

The output text must exactly follow the fixed template:

The defendant is accused of being involved in {charge}

Control of the two partial conditions

Subject to the sufficient/insufficient distinction above, keep the deletion amounts as similar as possible; keep the resulting text lengths as similar as possible; keep linguistic fluency as similar as possible; and preserve the narrative order and writing style of FULL as much as possible. Legal evidentiary sufficiency takes priority over mechanically matching text length.

Information restriction

Use only the target charge and FULL supplied in this prompt.

Do not use, infer, or introduce information from innocent_fact, doctrine, legal_path, changed_element, added_elements, or preserved_elements from the original matched pair. The doctrine used to construct the original pair does not imply that factual support removed from the guilty side should follow the same doctrine.

Output format

Return exactly one JSON object, with no Markdown and no additional explanation.

The object must contain partial_sufficient, partial_insufficient, and zero. partial_sufficient must contain text, removed_spans, retained_necessary_support, and why_still_sufficient. Each removed span must report the exact original_span from FULL and a brief reason.

partial_insufficient must contain text, missing_necessary_support, deleted_or_rewritten_spans, why_remaining_cannot_support, and alternative_retained_support_sufficient. Each deleted or minimally rewritten span must specify its operation, exact original_span, optional replacement, and reason. When the operation is delete, replacement must be empty. zero contains only the fixed neutral accusation text.

Diagnosis Details

Diagnostic Protocol

All diagnostic interventions use the main verification prompt and verdict readout, with the backbone in bf16, the verdict logits read in fp32, and inputs truncated to 2,048 tokens; model weights stay frozen. Source pairs are training pairs whose two members $\theta_0$ classifies correctly, and targets are the charge-not-established members of strict false-guilty development pairs (153 / 185 / 286 Offense / Unlawfulness / Culpability pairs with Qwen).

Layer-wise transfer. For each legal stage and each of the 36 layers, the contrasts of Eq. (5) are averaged over the source pairs of that stage and normalized to a unit direction $v_d^\ell$. In a single forward pass, $\alpha v_d^\ell$ with $\alpha= 3$ is added to the block output at the three answer-adjacent positions $\mathcal{T}$ of a target. Forward adds $v_d^\ell$, Reverse adds $-v_d^\ell$ to the same target, and Norm-matched random adds three independent Gaussian directions per target, each rescaled to the norm of the forward displacement. NG-margin reduction is the clean margin minus the intervened margin. Confidence intervals are case-cluster bootstrap intervals (2,000 resamples), with the random repeats clustered by case.

Feasibility and damage. At Layer 22, a case-specific direction is reconstructed in the stage-specific or shared affine geometry (Eq. (6)), and a case is feasible if a strength within the bounded search moves its NG margin below the buffer $\tau$. Paired-G damage applies the same target-reaching displacement to the matched charge-established member.

Full Preservation Projection

Full projection removes the entire component of the repair direction that lies in the supported-guilty gradient subspace $P_d^\ell$. Table 6 shows that it lowers feasibility from 70.6–83.2% to 10.1–20.3%: the removed component carries much of the repair signal. The damage comparison in Figure 2c is therefore restricted to the pairs feasible under both settings, whose counts are those in parentheses. This trade-off motivates the soft attenuation of PROSE ($\rho> 0$), which keeps part of the overlapping component.

Stage	Geometry	Without	With full projection
Offense	Stage-specific	70.6 (108)	17.6 (27)
Offense	Shared	70.6 (108)	20.3 (31)
Unlawfulness	Stage-specific	83.2 (154)	15.7 (29)
Unlawfulness	Shared	76.8 (142)	19.5 (36)
Culpability	Stage-specific	75.9 (217)	10.8 (31)
Culpability	Shared	76.9 (220)	10.1 (29)

Cross-Stage Transfer of Hidden-state Contrasts

To test whether the stage-specific contrasts share structure, we add the unit contrast direction of each source stage, scaled by $\alpha= 0.5$, at Layer 22 to the held-out cases of each target stage and measure the mean NG-margin reduction (Figure 6). All nine effects are positive, so every stage direction moves cases of every stage toward charge not established, consistent with the shared geometry that development selection chooses for Offense and Unlawfulness. The Unlawfulness direction transfers most strongly (0.032–0.045), matching the stage ablation, where the Unlawfulness update alone reaches 63.58 PSR on Culpability pairs (Table 10). The Culpability direction is the most stage-selective (0.033 on its own stage vs. 0.017–0.018 elsewhere), consistent with its stage-specific geometry, while Offense has the weakest own-stage effect (0.013), in line with Offense being the hardest stage to repair in isolation.

	Acc	F1	FGR	FNR	Rep.	G-Ret.	Off.	Unl.	Cul.	All
Qwen3-8B-Base
O	72.30	70.11	54.78	0.61	7.46	100.00	26.02	1.10	3.83	7.46
U	87.96	87.87	20.35	1.74	63.53	96.76	31.71	74.03	63.58	60.29
C	85.91	85.69	26.43	1.74	51.70	99.19	31.71	17.13	77.96	50.89
OU	86.26	86.11	24.00	3.48	59.00	97.08	48.78	67.96	52.40	56.24
OC	82.39	81.94	33.48	1.74	40.52	99.03	44.72	16.57	50.80	59.35
UC	91.87	91.87	6.61	9.65	88.17	89.47	51.22	82.32	85.94	77.96
OUC	91.48	91.48	8.43	8.61	85.25	90.76	56.91	77.35	83.39	76.34
GLM-4-9B-Base
O	78.35	77.91	35.65	7.65	23.94	97.10	29.44	15.32	21.03	22.59
U	76.87	76.06	41.57	4.70	14.67	99.61	6.67	29.84	12.15	14.48
C	82.48	82.21	29.74	5.30	36.87	98.65	17.22	8.06	68.22	36.10
OU	81.43	81.23	29.04	8.09	37.64	96.53	35.56	42.74	31.31	35.52
OC	85.00	84.96	20.09	9.91	55.98	94.98	39.44	20.97	80.84	52.12
UC	84.74	84.60	24.78	5.74	47.10	98.07	17.22	34.68	76.64	45.95
OUC	87.17	87.17	15.04	10.61	67.37	94.02	42.22	53.23	84.11	62.16

Figure 7 again shows positive transfer in all nine source–target combinations, confirming that the learned contrast directions contain a substantial cross-stage component. On GLM-4-9B-Base, the Offense direction is strongest across all three target stages (0.119–0.129), followed by Unlawfulness (0.074–0.079) and Culpability (0.063–0.071).

Image not extracted

Moreover, several cross-stage effects are comparable to or larger than the corresponding within-stage effects. Thus, both backbones exhibit shared cross-stage contrast structure, while the degree and form of stage specialization remain backbone dependent.

Transfer of Hidden-state Contrasts

Figure 8 shows a qualitatively similar directional-transfer pattern to that observed on Qwen3-8B, despite a different layer profile. Around the middle layers, the Forward direction produces positive NG-margin reduction across all three legal stages, whereas Reverse tends to produce the opposite effect and the norm-matched random control is substantially weaker.

Repair Feasibility and Preservation

As shown in Figure 9(a), GLM-4-9B-Base has lower overall repair feasibility than Qwen3-8B, ranging from 22.7% to 51.6% across legal stages and geometry choices. Nevertheless, the transferred contrast geometry reaches the target for a non-trivial fraction of false-guilty cases.

In Figure 9(b), preservation projection reduces paired-G damage in all six stage/geometry comparisons, with absolute reductions of 0.017–0.041. Thus, the GLM results reproduce the same qualitative repair–preservation tension: repair-effective directions are transferable, but explicit preservation is needed to limit damage to the matched supported decision.

Details of PROSE

This appendix expands the target construction and parameter update in § 4. We retain the following notation: $\theta_0$ fixes eligibility and preservation labels, whereas $\vartheta$ denotes the current model during successive stage updates. All contrasts, gradients, and

Contrast Geometry and Preservation Attenuation

module-input keys used for an update are extracted under $\vartheta$.

Affine contrast reconstruction. At stage $d$ and layer $\ell$, let $N_d$ be the number of training pairs resolved correctly by $\theta_0$, and let $h$ be the hidden width. Their contrasts $q_j^\ell\in\mathbb{R}^h$ are recomputed under $\vartheta$ using Eq. (5). Define the centered contrast matrix

The sum and columns range over these correctly resolved stage-$d$ pairs. The leading $r_q$ left singular vectors of $Q_d^\ell$ form $U_d^\ell$; the requested rank is capped by the available SVD dimensions. The affine reconstruction in Eq. (6) is the least-squares projection of the target contrast onto $\bar{q}_d^\ell+ \operatorname{span}(U_d^\ell)$:

Writing $a=\bar{q}_d^\ell+U_d^\ell w$, orthonormality gives $w^*=(U_d^\ell)^\top(q_i^\ell-\bar{q}_d^\ell)$, recovering the reconstruction in the main text. When the centered matrix is numerically zero, the reconstruction reduces to the mean. A candidate with fewer than two source pairs is not fitted. A pooled geometry, when selected, uses correctly resolved training pairs from all stages in the same construction; target eligibility remains stage-specific.

Intervention and gradient aggregation. The displacement $\delta$ is added to the block output at every position in $\mathcal{T}$, the three answer-adjacent prompt positions defined in diagnosis. These are tokenizer positions in the Chinese answer cue, rather than tokens of its English translation. For a shared displacement, the derivative is

Thus, contrasts average hidden-state differences across positions, whereas the gradient sums their sensitivities to the shared displacement. Gradients are computed with the model weights frozen. For preservation, we stack the unnormalized gradients of base-correct charge-established training cases at stage $d$ and retain the leading $r_p$ left singular vectors as $P_d^{\ell}$; this gradient matrix is not centered.

For a nonzero target gradient, $g_i^{\ell}$ minimizes the first-order margin change over unit displacements:

Here, $\tilde{s}_{i}^{\mathrm{NG}}$ abbreviates the intervened margin of target $i$ under $\vartheta$. This explains the local descent component; mixing it with a contrast and attenuating it need not retain this optimality.

Soft attenuation. For $\rho>0$, the unnormalized attenuation in (8) admits the following interpretation:

Setting its derivative to zero and using $(P_d^{\ell})^{\mathsf{T}}P_d^{\ell}=I$ gives

We then set $u_i^{\ell}=\operatorname{unit}(a_i^{\ell})$. The limit $\rho=0$ is full orthogonal removal; increasing $\rho$ weakens attenuation. This interpretation applies before normalization and does not guarantee verdict retention.

Bounded Strength Search

For an eligible target, write $f_i(\beta)=\tilde{s}_{\vartheta}(x_i^{\mathrm{NG}},c_i;\beta u_i^{\ell},\ell)$. The cap $B_i$ is defined in (9) using the reconstruction norm before direction mixing and attenuation. This keeps the admissible range comparable across preservation settings.

Endpoint test and refinement. For a valid direction and positive cap, we first evaluate $f_i(B_i)$. The search proceeds only if this value is finite and at most $\tau$. Otherwise, it reports no detected target. Starting from $L_{i,0}=0$ and $H_{i,0}=B_i$, we perform $J$ bisection steps. At step $j$, let $M_{i,j}=(L_{i,j}+H_{i,j})/2$ and update

A nonfinite midpoint takes the second branch. We re-evaluate the final upper endpoint and retain $\beta_i^{*}=H_{i,J}$ only when its margin is finite and satisfies the target. The displacement is then $t_i=\beta_i^{*}u_i^{\ell}$ as in (10). The implementation uses $J=8$ refinement steps.

Each accepted refinement halves the interval width, leaving $H_{i,J}-L_{i,J}=B_i/2^J$. If the response has a single monotone crossing with a non-feasible lower endpoint, the returned endpoint approximates that crossing from above. Neural margins need not be monotone: an infeasible capped endpoint can conceal a feasible interior region, and bisection does not establish a global minimum. Consequently, feasibility here means that this finite search detects a target-reaching displacement.

Numerical safeguards. Normalization uses a numerical floor of $10^{-12}$. Before searching, we discard nonfinite or near-zero attenuated directions and directions whose retained norm ratio $\lVert a_i^{\ell}\rVert_2/\lVert v_i^{\ell}(\lambda)\rVert_2$ falls below a configured threshold (default $0.25$). When the contrast–gradient mixture nearly cancels, the gradient-assisted implementation falls back to the negative margin-gradient direction. Invalid directions and failed searches remain in the candidate denominator used to report feasibility. Only detected targets with positive strength contribute key–target columns to fitting; a stage with no such targets receives no update.

The batched search checks zero strength using the stored reference margin, not a fresh margin under $\vartheta$. For strict false-guilty targets this reference margin is positive, so the zero-strength branch does not remove cases repaired by an earlier stage. Capped and midpoint evaluations use the current model. This implementation should therefore not be interpreted as explicitly skipping every previously repaired target.

Module Keys and Closed-Form Fitting

Joint projection parameterization. For attention output and MLP down projections with input widths $m_{\mathrm{attn}}$ and $m_{\mathrm{mlp}}$, respectively, the block notation in the main text is horizontal concatenation:

Here, $W \in\mathbb{R}^{h \times m}$ with $m = m_{\mathrm{attn}} + m_{\mathrm{mlp}}$. A single-module update uses the corresponding block alone. Each intervened position contributes one column of $K_{\mathcal{F}} \in\mathbb{R}^{m \times n_{\mathcal{F}}}$ and repeats its pair’s $t_i$ in $T_{\mathcal{F}} \in\mathbb{R}^{h \times n_{\mathcal{F}}}$. Preservation matrices $K_a$ use the same positions and module order, so $n_{\mathcal{F}}$ and $n_a$ count columns rather than cases.

Keys are frozen during fitting. The sum in Eq. (17) is a local fitting surrogate: updating attention also changes the subsequent MLP input. Accordingly, least-squares target fit need not equal the hidden-state or verdict change under a full post-update forward pass.

Weighted ridge solution. To express Eq. (11) as a single ridge problem, define repair blocks $A_{\mathcal{F}} = K_{\mathcal{F}}/\sqrt{n_{\mathcal{F}}}$ and $Y_{\mathcal{F}} = T_{\mathcal{F}}/\sqrt{n_{\mathcal{F}}}$. For each nonempty preservation pool $a \in\{G, O, X\}$, define $A_a = \sqrt{\omega_a/n_a}\,K_a$ and a matching zero target block $Y_a = 0$. Concatenate these blocks into $A$ and $Y$, omitting empty pools. If $N$ is their total column count, $A \in\mathbb{R}^{m \times N}$ and $Y \in\mathbb{R}^{h \times N}$. Then

Pool normalization prevents larger pools from receiving greater weight solely because they contain more columns. Differentiating gives

For fixed activation targets and preservation keys, $\mu> 0$ makes the ridge objective strictly convex, yielding a unique closed-form solution:

Here, $I_m$ and $I_N$ are identity matrices of the indicated dimensions. The implementation uses the second, dual form with a Cholesky solve rather than explicitly computing an inverse. It retains factors $L = Y(A^{\mathsf{T}}A + \mu I_N)^{-1}$ and $R = A^{\mathsf{T}}$, so $\Delta W_{\mathrm{LS}} = LR$ need not be materialized.

Low-Rank Realization and Update Budget

We retain a numerical approximation to the leading singular components of $LR$. The factorized SVD computation uses a fixed Gaussian sketch determined by the run seed, with oversampling of 16 and one power iteration. Writing the resulting factors as $U_W$, $S_W$, and $V_W$, the rank-$r_W$ update is

The retained rank is capped by the available dimensions. This operation approximates a truncation of the ridge solution; it is not an exact solution to a rank-constrained version of Eq. (11). The captured singular-value energy is measured relative to $\lVert LR \rVert_F^2 = \operatorname{tr}[(L^{\mathsf{T}}L)(RR^{\mathsf{T}})]$.

Let $b$ index the selected projection modules, and let $\Delta W_{r_W,b}$ be the corresponding column block. The budget is enforced separately for each module through a common scaling factor:

For a numerically zero update we set $\eta_W = 1$; weight norms use the same numerical floor as normalization. Every module then satisfies the relative Frobenius-norm budget $\epsilon$, and updates already below the budget are not amplified. The applied block update in the main text is $\Delta W = \eta_W\Delta W_{r_W}$.

Fitting quality can be checked through $\lVert\Delta W K_{\mathcal{F}} - T_{\mathcal{F}} \rVert_F/\lVert T_{\mathcal{F}} \rVert_F$ and preservation drift through $\lVert\Delta W K_a \rVert_F/\sqrt{n_a}$. These are fixed-key diagnostics. Actual verdict repair and retention are measured with the updated model, because truncation, rescaling, and downstream nonlinearities can change the realized effect.

Before application, the implementation checks that the fitting pool is nonempty, the retained singular-value energy meets its configured minimum, and each module satisfies both the selected budget and an emergency norm ceiling, allowing a numerical tolerance of $10^{-6}$. A failed check skips the update. These are numerical acceptance checks, not tests of behavioral preservation.

Stage Execution and Data Separation

Fixed membership and preservation pools. The reference predictions define $\mathcal{E}_{\mathrm{sFG}}^{\mathrm{train}}(\theta_0)$, the correctly resolved source pairs, and preservation membership once. For a stage-$d$ update, $G$ contains base-correct charge-established training cases at that stage; $O$ contains charge-not-established members of correctly resolved stage-$d$ pairs. Across other stages, $X$ includes base-correct charge-established members and the charge-not-established members of correctly resolved pairs. Size-limited training pools are selected once under the fixed run configuration and held fixed during fitting. The gradient bank and the weight-fitting protection pool may have different sizes, but both satisfy these reference-defined eligibility criteria. The eligible $G$ pool includes target counterparts; a capped fitting pool need not contain every counterpart.

Successive offline updates. Each selected stage configuration specifies its layer, source geometry, direction mixture, preservation strength, search limits, fitting penalties, rank, and update budget. The reported configurations apply updates in the order OFFENSE, UNLAWFULNESS, then CULPABILITY. Starting with $\vartheta= \theta_0$, each update recomputes source and target contrasts, gradients, and keys under the current $\vartheta$, constructs search-detected targets, solves the ridge problem, and applies the bounded low-rank update. Cached features are cleared after a weight change. Reference membership remains fixed even when the current model’s predictions change. The final current model is $\theta'$. The offline phase can therefore contain several stage updates, while deployment requires only one ordinary forward pass and no matched counterpart.

Selection and evaluation. Contrast statistics, gradients, targets, and fitting keys use training data. Development data select configurations; candidate parameter changes are restored before an independent trial. The selected configurations are fixed before final fitting and evaluation. Neither test track supplies fitting examples or selection signals. In particular, the Evidence-Sufficiency Generalization Track is evaluation-only. Numerical defaults reported above describe solver controls; they should not be read as the selected backbone-specific hyperparameters.

Experimental Setup Details

Pair-Level Metric Definitions

Pair-level metrics are reported only for the Pairwise Repair–Preservation Track. For a split $S$ and backbone, the strict false-guilty cohort $E_{\mathrm{sFG}}^{S}(\theta_0)$ is selected once using the reference model $\theta_0$ and then kept fixed for all evaluated models. Let $N_S = \lvert E_{\mathrm{sFG}}^{S}(\theta_0)\rvert$. The evaluated model’s prediction is denoted by $\hat{y}_{\theta}(x,c)$, where 1 indicates that the specified charge is established and 0 that it is not established.

We define NG Repair as

Matched-G retention is

Pairwise safe repair requires both the unsupported member to be corrected and the supported counterpart to remain charge-established:

Rep. measures the marginal repair ability, whereas G-Ret. measures preservation of the matched charge-established decision. PSR is their intersection and therefore evaluates selective repair directly. Consequently, a high Rep. with low G-Ret. indicates that repair is obtained by damaging supported decisions, while a high G-Ret. with low Rep. indicates that the correction is too conservative. PSR rewards only pairs satisfying both requirements. All three metrics use the same fixed cohort and denominator; pairs that remain unrepaired or cannot produce a feasible target are not removed from evaluation.

These metrics measure within-pair repair and preservation. They do not by themselves establish preservation of unrelated cases or evidence sensitivity; those properties are evaluated separately with case-level and condition-level results.

Evaluation Uncertainty

Confidence intervals. The reported intervals are $\pm1.96$ bootstrap standard errors over 1,000 resamples (seed 42), i.e., normal-approximation 95% intervals. The resampling unit is a matched pair for the Pairwise Repair–Preservation Track and a source case, with all four evidence variants retained together, for the Evidence-Sufficiency Generalization Track. Pair-level metrics are computed on the fixed reference-defined strict false-guilty cohort, restricted to the resampled pairs that belong to it. Models are not refitted during resampling, so these intervals quantify evaluation-sample uncertainty, not variation across fitting seeds.

Paired comparisons. For comparisons with the unedited model, both models are evaluated on the same case-level bootstrap resamples, and we report as a one-sided $p$-value the fraction of resamples in which PROSE does not exceed the unedited model [11]. Individual-method intervals are not used as a test of between-method differences.

Baselines

LJPIV. LJPIV (Zhang et al., 2025) extends LJP to non-guilty outcomes and judges the offense elements, unlawfulness, and culpability in sequence. We fine-tune it on the same CAIL-MC training pairs, separately for each backbone, with its original hyperparameters: LoRA ($r = 16$, $\alpha= 32$, dropout 0.05) on all seven projections of every layer, learning rate $5 \times10^{-5}$, batch size 16, a cosine schedule, and 3 epochs. At inference, it queries the three stages with its stage-wise prompt and reads each stage verdict from the logits.

Inference-time methods. We follow the implementations of Jeong and Lee [10], with prompts adapted to Chinese charge-conditioned verification.

• Self-Refine (Madaan et al., 2023) revises an initial verdict with feedback from a neutral critic (3 calls per case).

• Debate-Feedback [1] aggregates three debaters over one revision round (8 calls).

• OBJECTION [10] inserts an adversarial lawyer agent into each legal stage and stops once a stage is negated. Facts are truncated to 2,048 tokens within a context of 8,192, and the generation limits are 256 tokens for schema extraction, 192 for the judge, 320 for the lawyer, and 128 for the final answer.

Model editors. MEMIT (Meng et al., 2023) edits factual associations by treating MLP projections as key–value memories: it optimizes a target hidden value for each edit request and writes all requests into the weights at once with a closed-form least-squares update, regularized by the second moment of keys from preserved knowledge. AlphaEdit [3] builds on this formulation but projects the update onto the null space of the preserved keys, so that the outputs for preserved inputs are left unchanged by construction. We adapt both to binary verdict repair. Their defining components are kept, and everything task-specific is matched to PROSE.

• *Requests, prompt, and readout. The edit requests are all strict false-guilty training pairs of each stage, without subsampling, scored with PROSE’s prompt and readout.

• *Location. Both editors write to the MLP down-projection of PROSE’s edited layer, their native write location, at the same three prompt positions; the stages are edited in the order Offense, Unlawfulness, Culpability.

• *Target values. As in the original methods, each request’s target is an additive vector on the down-projection output, optimized by back-propagation (Adam, learning rate 0.1, 25 steps, weight decay $10^{-3}$) with its norm clamped to 4 times the unedited output norm. The object likelihood is replaced by $\operatorname{ReLU}(s-\tau)^2$ with PROSE’s endpoint $\tau$.

• *MEMIT preservation. The key second moment is estimated from 128 generic training references, which contain both members of their pairs and exclude the edit requests. The covariance weight is $3 \times10^3$ and the ridge $10^{-2}$; the update is solved exactly in Woodbury form.

• *AlphaEdit preservation. The null space of the key second moment of all non-request training cases (both members) is computed once on the unedited model, with eigenvalue threshold $10^{-2}$ and ridge $10^{-2}$. Keys of earlier stage edits are accumulated as protected history for later stages, as in its sequential setting.

Editor hyperparameters are tuned on the development split, and the test sets are loaded only after all edits are fitted. The editors differ from PROSE in how targets are obtained and in what is protected: generic reference keys rather than pools built around the matched pairs; they use neither PROSE’s rank cap nor its update budget.

SFT. SFT follows the Fine-Tuning-Direct variant of LJPIV, which predicts the final verdict without trichotomous reasoning, and receives the same adapter capacity as our LJPIV baseline. Given PROSE’s verification prompt, the model is trained to output the verdict token of both members of all 9,181 training pairs (18,362 cases, 263 tokens on average), with a full-vocabulary cross-entropy loss at the answer position only. LoRA ($r = 16$, $\alpha= 32$, dropout 0.05, no bias) is applied to all seven projections (query, key, value, output, gate, up, and down) of all 36 layers of Qwen, giving 43,646,976 trainable parameters (0.53% of the model). Following LJPIV, we train with AdamW without weight decay, learning rate $5 \times10^{-5}$, a cosine schedule without warmup, effective batch size 16 (micro-batch 1 with 16 accumulation steps), gradient clipping at 1.0, and 3 epochs (3,444 steps), keeping the backbone in bf16 and the LoRA parameters in fp32 with gradient checkpointing. Before training, we verified that the training-time margins match the evaluation scorer (maximum absolute difference below 0.1); the adapter is merged before evaluation.

Uniform-shift control. The control of § 5.3 leaves the model unchanged and subtracts one constant $\xi$ from the verdict margin of every test case. $\xi$ is set so that the shift repairs the same fraction of the base-misclassified charge-not-established CAIL-MC test cases as PROSE (85.3% with Qwen and 67.7% with GLM), giving $\xi= 0.69$ for Qwen and $\xi= 0.17$ for GLM. Supported-guilty damage is the fraction of base-correct charge-established test cases whose verdict flips.

Implementation of PROSE

Configuration. PROSE edits the attention-output and MLP down-projections of Layer 22 (Qwen) and Layer 20 (GLM) at the last three prompt positions. The solver, low-rank realization, and update budget are described in Appendix § 11.

Stage execution. On both backbones, the three stage updates are fit successively in the order Offense, Unlawfulness, Culpability. Each update is fit on the model edited by the preceding stages, with contrasts, gradients, and keys recomputed after every weight change, while eligibility and preservation membership stay fixed under the unedited model (Appendix § 11.§ 4).

Subsampling. Geometry and preservation examples are drawn deterministically from the training split with the run seed: 64 cases for the supported-guilty gradient subspace $P_d^\ell$, 96 for $P_G$, 96 for $P_X$, and 64 for $P_O$.

Runs. PROSE involves no gradient-based training: given the training split and the selected configuration, each stage update is obtained by a

closed-form ridge solve followed by rank truncation and rescaling. Following MEMIT and AlphaEdit, which are likewise closed-form editors, we report a single fitting run (seed 42).

Model selection. For each backbone and legal stage, the candidates combine an edited layer in the middle-layer region identified by the diagnosis, a contrast geometry (stage-specific or shared across stages), and values from the search space of Table 7, including the contrast–gradient mixture $\lambda$. A candidate is admissible if, on the development split, it fits targets for its stage, retains at least 87% of the base-correct charge-established, same-stage, and cross-stage predictions, keeps at least 90% of the fitted update after rank truncation, and stays within its update budget. Admissible candidates are ranked lexicographically by PSR, Rep., mean absolute margin drift on the preservation examples, and binary KL on the same examples, with ties broken toward smaller $\kappa$, $\varepsilon$, and $r_W$. All hyperparameters are selected by this procedure on the development split, and the test sets play no role in selection.

Symbol	Description	Value / range
$\ell$	Edited layer	20, 22
—	Edited modules	attn-out + MLP down
—	Contrast geometry	stage-specific or shared
$\tau$	Target margin endpoint	$[-0.02, -0.005]$
$\lambda$	Contrast–gradient mixture	$[0, 1]$
$r_q / r_p$	Contrast / preservation rank	128 / 64
$\rho$	Attenuation strength	4
$\beta_{\max}$	Global strength cap	128
$\kappa$	Case-relative strength cap	$[8, 24]$
$\omega_G$	Supported-guilty pool weight	$[0.5, 4]$
$\omega_X$	Cross-stage pool weight	$[2.5, 5]$
$\omega_O$	Same-stage pool weight	$[5, 10]$
$\mu$	Ridge regularization	0.1
$r_W$	Update rank	$[64, 128]$
$\varepsilon$	Relative update budget	$[0.15, 0.55]$

Evidence Sensitivity on CAIL-MC

Construction. To test evidence sensitivity without corpus shift, we rewrite the 1,150 charge-established CAIL-MC test facts at three evidence levels, following the evidence-ablation construction and annotation procedure of the Evidence-Sufficiency Generalization Track (App. § 9.§ 1.1): Zero states only that the defendant is accused of the charge, Partial keeps part of the objective facts, and Full keeps all of them. All texts are scored with the main protocol. Figure 10 plots the mean margins of the same five methods as Figure 3; Table 8 and Table 9 give the rates and the exact margins.

Method	Zero↓	Partial	Full↑	$\Delta_s$ ↑
Unedited	93.8	94.8	97.7	0.58
Uniform shift	0.2	34.8	69.4	0.58
SFT	100.0	98.3	99.0	−0.25
PROSE	10.3	76.0	86.1	0.74

Level	Unedited	SFT	PROSE
Qwen
Zero	0.304 [0.293, 0.315]	4.835 [4.755, 4.921]	−0.266 [−0.281, −0.251]
Partial	0.568 [0.546, 0.590]	4.130 [4.003, 4.252]	0.314 [0.290, 0.339]
Full	0.888 [0.863, 0.911]	4.589 [4.468, 4.703]	0.478 [0.451, 0.504]
GLM
Zero	0.059 [0.055, 0.063]	4.531 [4.389, 4.674]	−0.000 [−0.004, 0.004]
Partial	0.179 [0.168, 0.191]	6.251 [5.944, 6.564]	0.126 [0.117, 0.135]
Full	0.272 [0.260, 0.284]	6.878 [6.557, 7.205]	0.172 [0.163, 0.181]

The pattern of Track 2 holds in-domain. PROSE is again the only method that, on both backbones, keeps the accusation-only margin at or below zero and the full-fact margin above it, rising from −0.27 to 0.48 with Qwen and from −0.0001 (95% CI [−0.004, 0.004]) to 0.17 with GLM. SFT stays far above the boundary at every level: with Qwen its margin is highest for the accusation alone (4.84 vs. 4.59 for the full facts), and with GLM it remains above 4.5 even for the accusation alone. With Qwen, AlphaEdit also peaks at Zero, and LJPIV and MEMIT separate Zero from Full; with GLM, however, LJPIV places every level above zero and both editors place every level below it.

PROSE keeps the response to evidence. Given the accusation alone, unedited Qwen establishes the charge for 93.8% of the texts, nearly as often as with the full facts (97.7%). PROSE lowers this

rate to 10.3% while still establishing 86.1% of the fully evidenced texts, and it steepens the margin increase from Zero to Full from 0.58 to 0.74. The uniform shift reaches a lower Zero rate (0.2%) only by also rejecting 30.6% of the fully evidenced texts, and by construction it leaves the margin increase unchanged.

No threshold repairs SFT. SFT establishes the charge for nearly every text at every level, and its mean margin is lower for Partial (4.13) and Full (4.59) than for Zero (4.84), so its margin does not grow with evidence ($\Delta_s = -0.25$). A different threshold cannot fix this: we raise the SFT threshold until its Zero-level rate is closest to that of PROSE, which happens at $t = 6.25$ given tied margins (12.5% vs. 10.3%). The Partial and Full rates then drop to 12.7% and 18.7%, so fully evidenced texts are rejected almost as often as accusation-only ones, and on the CAIL-MC test pairs FNR rises from 0.26 to 52.61 (Acc 73.65, PSR 37.60). SFT’s verdicts therefore do not encode evidence sufficiency at any operating point.

Three-Stage Update Ablation

To examine whether the three legal stages provide complementary repair coverage, we retain only the Offense (O), Unlawfulness (U), or Culpability (C) update, their pairwise combinations (OU, OC, and UC), or all three updates (OUC). All other parts of PROSE remain unchanged. Table 10 reports case-level metrics and pair-level repair and retention, with PSR also broken down by the changed legal stage and reported over all strict false-guilty pairs.

The effects are stage- and backbone-dependent rather than monotonic. Combining stages generally broadens coverage, and OUC gives the strongest pooled PSR on GLM. On Qwen, UC has a slightly higher pooled PSR than OUC, whereas OUC performs better on offense-stage pairs. Thus, no fixed subset dominates across backbones and legal stages and the three-stage decomposition provides complementary, stage-aware coverage.

Additional Analyses

Charge-Level Effects

Figure 11 counts, for the ten most frequent charges in the CAIL-2018 test split, the test predictions that editing flips. On both backbones, flips from incorrect to correct outnumber flips from correct to incorrect for every one of these charges, so the gain is not concentrated in a few charges.

Pair-Level Margin Changes

Figure 12 plots the margin change of both members of every strict false-guilty test pair under PROSE. A uniform output shift would place all pairs at one point on the diagonal; instead, the displacements spread widely across pairs, and within a pair the charge-not-established member tends to move slightly further than its counterpart. The median changes $\Delta s_{NG}$ and $\Delta s_G$ are $-0.51$ and $-0.47$ with Qwen and $-0.19$ and $-0.13$ with GLM, and the median within-pair difference is $-0.066$ with Qwen (95% CI [$-0.106$, $-0.031$]) and $-0.049$ with GLM (95% CI [$-0.062$, $-0.041$]). The advantage over a uniform shift therefore comes mainly from displacements that vary across pairs. Figure 13 shows the underlying margins of both members of every test pair before and after editing.