Saisab Sadhu

Large language models (LLMs) exhibit a curious failure mode in retrieval-augmented generation: they may internally "disagree" with retrieved context even while outwardly appearing to follow it. We identify a mechanistic law (p < 10^-42) predicting internal epistemic conflict in 70B-scale models by examining logit-level interactions between parametric knowledge and retrieved context. Our analysis uncovers the Alignment Paradox: instruction-tuning decouples a model's internal epistemic tension from its surface-level textual behavior, causing standard behavioral metrics to systematically miss genuine conflict. We further develop a 25ms "Mechanistic Auditor" that identifies latent sycophancy with 76% F1, achieving a 600× speedup over state-of-the-art probing methods and significantly outperforming model self-reporting.

We present DARE (Dialectical Adversarial and Evidence-Aware RAG), a framework that resolves factual conflicts in retrieval-augmented generation through a structured cross-examination process. Rather than weighting sources by static relevance scores, DARE subjects candidate passages to adversarial challenges and infers source reliability from logical resilience — how well each source withstands targeted counterfactual pressure. This dynamic credibility assessment mechanism achieves state-of-the-art gains of 77% on FaithEval and 28% on RAMDocs. The framework is model-agnostic and operates entirely at inference time, requiring no additional fine-tuning.

Methods for addressing safety drift in fine-tuned LLMs are scattered across incompatible implementations, lifecycle stages, and evaluation protocols, making them difficult to adopt and compare. We introduce SafeTune, a source-available library that unifies four intervention paradigms — post-hoc weight recovery, safety-constrained fine-tuning, gradient-based unlearning, and inference-time steering — alongside shared interpretability, evaluation, and deployment utilities, all behind a consistent configuration-driven workflow. Its modular registry supports new methods, benchmarks, judges, and models without redesigning the surrounding pipeline. We demonstrate SafeTune through controlled comparisons and finance and medical deployment case studies, showing how it characterizes safety drift, evaluates feasible interventions, and supports calibrated or layered mitigation. pip install safetune.

Generating high-quality financial analysis from earnings call transcripts requires synthesizing heterogeneous signals — management tone, analyst pushback, forward guidance, and market context — into coherent, persuasive reports. We design a hierarchical multi-agent framework modelling investment committee debates: specialist agents independently analyse distinct aspects of the call, a moderator orchestrates structured argumentation, and a synthesis agent produces the final report. Our system achieved a 68.75% win rate over cooperative baselines, ranking first globally on the official "Win Rate vs. Analyst Report" metric — preferred over professional human analysts.

Large language models increasingly justify legal decisions by naming the statute or precedent behind a verdict, treated as evidence the decision follows from it. We test this directly: holding case facts fixed, we substitute the named legal authority for an unrelated one and decode a model's evolving verdict from its hidden states. Across seven open-weight models (8B–70B) and four benchmarks, models name the correct authority in 66.7–100% of generations, while the verdict changing when the authority changes is far less consistent — as low as 0.0% on CaseHOLD. A red-teaming evaluation finds compliance with an adversarial instruction hidden in the case facts (73.3–96.4%) exceeds verdict-swap sensitivity by a wide margin. Naming a legal authority is thus a poor proxy for a verdict's dependence on it, bearing directly on using generated legal explanations as compliance or audit artefacts.

LLM compliance systems are deployed on the assumption that a verdict depends on the regulatory rule it is given. We test this directly across five models and 20 regulatory and platform-policy domains: delete, swap, or negate the governing rule while holding the case fixed, and check whether the verdict changes (OCS) or the model's internal representation of compliance shifts at all (ICS-delta). Neither moves much — models usually reach the same verdict regardless of what the rule says, and the model built specifically for compliance detection is the least rule-sensitive and least accurate of the five, barely above chance (51%, versus 90–92% for general-purpose models). Neither better prompting nor direct intervention on internal representations closes this gap.

Abstractive summarization of ultra-long legal documents presents unique challenges: legal text is structured by rhetorical roles (facts, arguments, holdings, orders), and naive chunking destroys cross-section coherence. We propose a rhetorically-informed chunking pipeline that segments documents along argumentative boundaries before abstractive generation. Through systematic analysis we identify and characterize the "Coherence Gap" — a fundamental trade-off between local phrase-level accuracy and global narrative coherence in legal summarization — and propose mitigation strategies through structure-aware segmentation.

Regulatory compliance monitoring in deployed language models is meaningful only if a detector's verdict depends on the stated rule rather than surface features of the scenario. We show this condition fails across the current class of compliance detectors — a failure we call rule blindness. Deleting, permuting, or substituting the governing rule leaves detection accuracy unchanged for every guard and activation probe we test, including a policy-conditioned guard that correctly cites the governing clause's position 91–95% of the time yet barely changes its verdict when that clause is swapped. We introduce the Internal Compliance Score, a training-free activation readout, and audit four deployed guard models and thirteen benchmarks with it.

Standard unlearning evaluations measure behavioral suppression in full precision, despite every deployed language model being quantized first. We show that 4-bit post-training quantization reversal is not a tuning artefact but a systematic dual failure: gradient-based methods that achieve meaningful forgetting lose it under compression, while methods that survive quantization barely change the model. We present MANSU (Mechanistic-Aligned Null-Space Unlearning), which resolves both failure modes via causal circuit attribution, circuit-restricted null-space projection, and a per-parameter magnitude floor guaranteeing quantization-survival by construction. We additionally introduce Circuit Attribution Divergence (CAD), a mechanistic verification metric distinguishing structural erasure from behavioral suppression.

Fine-tuning aligned language models on benign domain data can erode safety alignment even when no harmful examples appear in training. Across four instruction-tuned model families and up to five benign fine-tuning domains under a fixed LoRA recipe, refusal falls in every setting we measure, ordered by domain rather than by the presence of harmful content. We audit representative methods from three checkpoint-modifying repair paradigms — post-hoc patching, gradient-based unlearning, and safety-constrained retraining — and find which paradigm a practitioner can access matters far more than the method chosen inside it. Separating harmful-refusal, over-refusal, and utility exposes a Pareto front on which balanced defenses, not the top-scoring ones, win.

Sustained user pressure causes language models to abandon correct positions with documented regularity across multi-turn conversation. We propose that capitulation timing is governed primarily by the model's internal response at the first moment of genuine user doubt. We introduce the Sycophantic Susceptibility Score (S3), measuring the attention mass that a sparse set of doubt-sensitive middle-layer heads directs toward doubt-bearing tokens at first challenge contact. Across a 600-conversation corpus spanning three pressure regimes and three model families, S3 at first contact significantly predicts eventual capitulation turn — visible before any behavioral failure has occurred.