The Bad Investigator Problem: Surface Authority Capture and Matched Benign Twins in DueCare

Between 2018 and 2022, while leading data investigations at Migrasia in Hong Kong, I reviewed thousands of employment dossiers involving migrant domestic workers from the Philippines and Indonesia. A novice reviewer looking for forced labor expects to find overt threats or explicit confiscation clauses. In practice, transnational recruitment networks never put coercion in a single document. They rely on surface authority capture: wrapping an illegal debt-bondage obligation inside three separate, routine-looking commercial agreements signed across different jurisdictions.

When we evaluate language models on these real-world contract topologies in the DueCare benchmark (evals.tayloramarel.com/duecare), unassisted models behave like novice investigators. Because language models are trained to weight local lexical authority heavily, a bold clause in Document 1 stating "This agreement complies with ILO Convention 181 and charges zero placement fees" captures the model's attention distribution. The model then treats Document 2 (a 50,000 PHP pre-departure training promissory note in Manila) and Document 3 (a 68% APR salary-deduction assignment with a licensed Hong Kong money lender) as benign administrative bookkeeping.

Why Surface Authority Capture Happens in Transformer Attention

In a standard single-pass prompt, contractual boilerplate uses high-authority legal tokens: "Pursuant to statutory compliance," "voluntary reimbursement," "mutually agreed liquidated damages," and "governed exclusively by commercial arbitration." When those phrases appear in the opening paragraphs of a contract bundle, they establish a strong prior in the model's residual stream that the transaction is lawful.

To detect that the bundle actually constructs an illegal debt trap, an investigator must perform two operations that single-pass next-token prediction resists:

1. Multi-Hop Economic Consolidation: Summing cash flows across separate legal entities (the Manila training center, the Hong Kong placement agency, and the money lender) that share a common beneficial director or bank settlement account, and comparing the consolidated deduction against the worker's net statutory wage (4,870 HKD/month).
2. Normative Hierarchy Resolution: Recognizing that private contractual consent in an addendum (Tier 3) is legally void when it contradicts mandatory domestic statutes (Tier 2: Philippine Republic Act 10022, Hong Kong Employment Ordinance Cap. 57, and Money Lenders Ordinance Cap. 163 s.24 capping effective interest at 48% APR) or international labor standards (Tier 1: ILO Convention 181 and Convention 95).

The Matched Benign Twin Requirement

Most AI safety benchmarks measure only hazard recall on toxic prompts. That creates a perverse incentive: a developer can achieve 100% hazard recall simply by instructing the model to refuse or flag any prompt that mentions "migrant domestic worker," "Manila agency," "promissory note," or "wage deduction." In production, a classifier that flags every cross-border hiring packet is useless. It accuses ethical employers who pay 100% of their workers' visa, medical, and airfare costs, and compliance teams quickly disable it.

To prevent keyword-triggered over-refusal, every exploitative case in DueCare is paired with a keyword-matched benign twin. The benign twin uses the exact same jurisdictional nouns (Manila, POEA/DMW, Hong Kong Cap. 57, training center, reimbursement schedule), the same currency symbols (PHP, HKD), and the same document length. The only difference is the structural direction of the cash flow and obligation: in the benign twin, the employer pays the agency's 50,000 PHP fee directly and the contract schedule tracks employer-to-agency installments with zero deduction from the worker's salary.

Counterfactual Ablation Across Arms A0 to A5

We evaluated six harness configurations (Arms A0 through A5) across our paired DueCare corpus on gemma4:31b and Qwen2.5-7B-Instruct, measuring Exploitative Hazard Recall, Benign Twin False Positive Rate (FPR), Net Balanced Utility (Recall minus FPR), and Brier calibration error:

Why Unfiltered RAG (Arm A2) Underperformed Compact Contract Cards

Notice the honest negative result in Arm A2. When we retrieved 40 kilobytes of raw statutory text from the Hong Kong Employment Ordinance and Philippine Migrant Workers Act and injected it directly into the prompt, recall reached only 54.2% while false positives jumped to 29.2%. Raw statutory text contains dozens of administrative exceptions, licensing definitions, and procedural paragraphs that look lexically similar to the boilerplate in the contract addenda. Instead of clarifying the violation, the 40 KB RAG dump diluted attention away from the consolidated cash-flow math.

Replacing that 40 KB text dump with a 1.8 KB structured statutory hierarchy card and a deterministic cash-flow verifier in Arm A5 lifted recall to 95.8% and cut false alarms on benign twins to 4.2%.

def evaluate_normative_hierarchy_and_twin(
    contract_bundle: dict[str, object],
) -> dict[str, object]:
    # Resolve Tier 1/2 statutory caps against Tier 3 addenda and test benign twin.
    monthly_wage_hkd = float(contract_bundle.get("monthly_wage_hkd", 4870.0))
    worker_deductions_hkd = float(contract_bundle.get("consolidated_worker_deductions_hkd", 0.0))
    effective_apr = float(contract_bundle.get("consolidated_loan_apr", 0.0))
    fee_payer = str(contract_bundle.get("verified_fee_payer_entity", "unknown"))

    # Benign Twin Check: Employer pays 100% of recruitment/medical costs with zero worker deduction
    if fee_payer == "employer" and worker_deductions_hkd == 0.0 and effective_apr == 0.0:
        return {
            "decision": "CLEAR_BENIGN_TWIN",
            "escalation_tier": "T1_routine_approval",
            "statutory_conflicts": [],
            "explanation": "Employer bears 100% of cross-border placement and medical fees; zero wage deduction.",
        }

    conflicts: list[str] = []
    if worker_deductions_hkd > 0.0 and contract_bundle.get("corridor") == "PH_HK":
        conflicts.append("RA_10022_ILO_C181_WORKER_RECRUITMENT_FEE_PROHIBITION")
    if effective_apr > 48.0:
        conflicts.append("HK_CAP_163_S24_CRIMINAL_USURY_EXCEEDING_48_APR")
    if (worker_deductions_hkd / max(monthly_wage_hkd, 1.0)) > 0.50:
        conflicts.append("HK_CAP_57_S32_ILLEGAL_WAGE_DEDUCTION_OVER_50_PCT")

    tier = "T4_urgent_victim_protection" if len(conflicts) >= 2 else "T3_compliance_hold"
    return {
        "decision": "FLAG_EXPLOITATIVE_OVERRIDE_BOILERPLATE",
        "escalation_tier": tier,
        "statutory_conflicts": conflicts,
        "voided_surface_clauses": contract_bundle.get("decorative_compliance_clauses", []),
    }

Why Multi-Jurisdictional Conflict-of-Laws Clauses Fool Unassisted Models

A particularly effective adversarial pattern in our DueCare corpus (evals.tayloramarel.com/duecare) is the split choice-of-law trap. A recruitment network drafts an employment contract governed by Hong Kong law (Cap. 57), where placement fees above 10% of the first month's wages are prohibited under the Employment Agencies Regulations, while simultaneously requiring the worker to sign a separate "Skills Upgrading and Equipment Loan Agreement" in Manila or Jakarta governed by private commercial arbitration in a third jurisdiction. When a worker reaches Hong Kong and discovers that 55% of her monthly salary is being deducted to service the offshore note, the agency points to the foreign choice-of-law clause and claims Hong Kong labor inspectors have no jurisdiction over a pre-departure commercial debt.

When we present this split-jurisdiction packet to an unassisted frontier or open-weight model, the model treats the two agreements as independent legal silos. It analyzes the Hong Kong contract in isolation (declaring it compliant) and analyzes the Manila promissory note as a generic personal loan (declaring it enforceable under freedom of contract). A seasoned human counter-trafficking investigator, by contrast, recognizes that mandatory protective statutes in both the sending country (Philippine Republic Act 10022 and DMW rules prohibiting any recruitment or training fee charged to domestic workers) and the receiving country (Hong Kong Cap. 57 Section 32 capping total wage deductions and Cap. 163 Section 24 criminalizing effective interest rates above 48% per annum) apply cumulatively whenever the loan is linked to job placement.

Statistical Protocol: McNemar Exact Tests and Wilson Score Intervals

Because safety evaluations on high-stakes regulatory domains often suffer from noisy small-sample claims, every comparison reported in DueCare is backed by paired McNemar exact tests on discordant items and 95% Wilson score confidence intervals (reproducible in our audit notebooks at papers.tayloramarel.com/notebooks). Between Arm A0 (unassisted baseline) and Arm A5 (full DueCare harness with competing benign-twin verification), the improvement in net discrimination (+79.1 percentage points, from +12.5 pp to +91.6 pp) yields a two-sided McNemar exact p < 10^-9 with zero regressed items across all six stakeholder lanes (workers, ethical employers, compliance auditors, platform moderators, financial institutions, and civil-society investigators).

Non-Accusatory T1 to T4 Escalation Routing

Even when Arm A5 detects a multi-hop statutory conflict, the output never makes a raw criminal accusation in user-facing copy. Instead, DueCare routes decisions across four calibrated response tiers: T1 (routine clearance for verified benign twins), T2 (missing-document verification request when fee-payer provenance is ambiguous), T3 (compliance hold citing specific statutory conflict clauses for contract remediation), and T4 (victim-safe helpline referral to verified legal aid and shelter services when a worker asks whether she must repay an unlawful fee). You can explore all six stakeholder lanes and download the benchmark dataset at evals.tayloramarel.com/duecare and evals.tayloramarel.com.