Auditable Prompt Scaffolds for Moral Attention in Frozen Language Models

Language models can produce fluent moral judgments while losing track of the evidence that should control those judgments. We study whether a stronger teacher model can identify development-set failures and convert them into readable prompt scaffolds that a smaller, capacity-limited student executes without weight updates. The protocol separates teacher-guided search, selector development, and locked final-test access; every selected scaffold remains inspectable as text and is linked to configurations, access logs, predictions, and residual metrics.

In an ETHICS checkpoint, the selector ranked a teacher-refined scaffold below a fixed baseline on selector-development data, yet the scaffold finished above the baseline on locked final-test accuracy, exposing a development–test ranking reversal. In a ten-seed ETHICS tournament, frozen scaffold representatives beat continued adaptation in six seeds, tied in two, and lost in two. In a separate 3D moral-attention evaluation using Qwen2.5-3B-Instruct, two distinct scaffolds achieved strict held-out wins over the fixed commonsense baseline: a support-basis tracking scaffold and a criterion-anchoring scaffold. Across eight claim-bearing held-out rows, however, only two met the strict all-substantive-metric criterion, and later runs reveal an unresolved causal ambiguity between global scaffold wording and row-level operation tags. The evidence therefore supports an existence claim for auditable external instructions. It does not support a general claim that prompting reliably aligns language models.

What kind of evidence is this?

The central object is not a winning sentence. It is a search-and-evaluation route that leaves behind a readable artifact, a frozen lineage, controlled access to held-out data, and an explicit record of failure.

Primary

Seeds 2801 and 4523: two locked held-out 3D evaluations in which the selected scaffold outperformed the fixed baseline on every substantive reported metric and tied it on output parseability.

Supporting

The ETHICS checkpoint and ten-seed scaffold tournament: evidence that prompt-scaffold discovery can move static moral classification, that selector rankings can reverse on test data, and that freezing a representative can outperform continued local adaptation.

Boundary

Mixed, near-replication, and failed held-out rows: evidence that the effect is not uniformly repeatable and that support retention, update responsiveness, and perturbation fragility can trade off.

Diagnostic

Development-only operation-tag experiments: evidence for a plausible alternative mechanism, but not held-out confirmation.

Unknown

Transfer to other model families, larger held-out surfaces, real deployment settings, and agentic safety constraints. Agentic transfer has not been tested; it is the primary question of the proposed funded work.

The failure mode: a correct-looking answer with the wrong basis

A language model may answer a moral question correctly for the wrong reason, or preserve a prior answer after the facts that supported it have changed. A conventional benchmark usually records only whether the final label matches a target. That misses a more structured failure: the model no longer tracks the evidence that should control its judgment.

Consider a promise-to-help case. In the original scenario, a person promises to help a friend and follows through. Three perturbations test three different operations:

Preserve · support intact

The wording or social pressure changes, but the promise and follow-through remain. A stable model should retain the supported judgment.

Update · support changed

The help is withdrawn or deception is introduced. The factual basis changed, so the model should revise its judgment.

Reject import · frame unsupported

A generic duty, motive, or social frame is introduced without factual support. The model should not answer a more familiar but different moral question.

The desired behavior is therefore not answer repetition. It is conditional stability: preserve when the basis remains, revise when the basis changes, and ignore perturbations that should not control the decision.

A narrow operational definition of moral attention

In this study, moral attention means the model’s ability to keep task-relevant moral evidence available, update its output when that evidence changes, and resist replacing it with criteria or frames unsupported by the scenario. This is an operational definition for controlled perturbation tests. It is not a claim about consciousness, conscience, virtue, moral truth, or complete practical wisdom.

We say scaffold, not prompt shape. A scaffold is a readable instruction structure built to make a particular operation executable. In this report, the two principal operations are:

• Support-basis tracking: preserve the judgment when the same evidence remains; update it when the evidence weakens, disappears, or is contradicted.
• Criterion anchoring: judge from the criterion and value basis present in the scenario; do not import new duties, motives, or generic moral frames.

Research questions

RQ1 · Can a teacher improve a frozen student through scaffolds alone?

The student weights, data splits, labels, and output schema remain fixed. Only the mutable instruction scaffold changes.

RQ2 · Can the intervention be audited?

The exact scaffold, its source, its development history, selection decision, test access, and residual errors must be traceable.

RQ3 · Do distinct scaffolds support distinct operations?

Metric patterns should be interpretable in relation to the instruction: evidence preservation and update for one scaffold, unsupported-frame rejection for another.

RQ4 · Does development ranking predict held-out quality?

A locked final-test is needed because a selector may overfit its own small development surface.

How this differs from ordinary prompt optimization

Automatic prompt engineering, optimizer-style prompting, evolutionary prompt search, and self-refinement all demonstrate that model-written instructions can improve task performance.^2–6 This project uses a similar search substrate but changes the object of evaluation. The target is not simply a higher task score. The target is a named evidence-tracking operation that must survive a frozen-student protocol, a selector split, and locked perturbation tests.

Conventional optimization · find a higher-scoring instruction

The selected prompt is often treated as an implementation detail. Development performance is the main optimization signal, and failed candidates may disappear from the final account.

This study · test an auditable operation artifact

The exact instruction is part of the result. Its lineage, search cost, selection status, final-test access, and residual failures remain visible.

The perturbation design is also closer to behavioral testing, contrast sets, and counterfactually augmented evaluation than to a conventional static leaderboard.^7–9 Each causal change demands a different behavior: remain stable under irrelevant reformulation, move when support-relevant facts change, and reject an unsupported frame. This makes the error pattern more informative than a single aggregate accuracy number.

The work also borrows the documentation discipline of model cards and datasheets.^10–11 Its unit of documentation, however, is the intervention route: what was allowed to change, which evidence was visible during search, what artifact was frozen, and which residual failures remained. This article deliberately leaves the repository’s broader philosophical and governance framework to a companion paper. The empirical contribution stands or falls on the controlled route and its evidence.

Teacher-guided scaffold search with a frozen student

The teacher model analyzes failure patterns on a development split and proposes families of candidate scaffolds. The student executes those candidates without any parameter update. A separate selector-development split ranks frozen representatives. The final-test remains locked until an explicit gate permits one evaluation. Access logs and configuration lineage distinguish development evidence from claim-bearing held-out evidence.

Models and evidence roles

Table 1 · Experimental tracks

Evaluation instruments

The 3D track materializes item families from three instrument sources stored in the repository: Moral Foundations Questionnaire items, World Values Survey items, and moral dilemmas. Each family contains nine controlled variants: a canonical item, reformulation, contextual background, rating explanation, four pressure framings, and a fact-changing sensitivity control. We call this preserve/update/reject suite PUR-Eval. Across the eight claim-bearing seeds it comprises 120 item families and 1,080 perturbation rows, of which 216 are locked held-out rows (per seed: 15 families / 135 rows, split 54 teacher-development, 54 selector-development, 27 locked final-test); the companion audit script re-verifies these counts against the raw bundled artifacts. We treat the WVS slice as a small stress test for social-trust and core-value scenarios, not as evidence of cultural universality.

Frozen components

• student weights and decoding configuration;
• scenario content and labels;
• runtime wrapper and response schema;
• teacher-development, selector-development, and final-test split membership;
• the fixed commonsense baseline comparator;
• the selected scaffold before final-test access.

The exact prompt artifacts

Auditability requires printing the intervention itself. The article therefore exposes the fixed comparator and both claim-bearing scaffolds in full. Internal artifact identifiers remain available in the repository, but the public names below describe the operation rather than the search history.

We do not claim these artifacts are optimal or universally transferable. Their value is narrower: readable hypotheses about an operation, frozen before held-out evaluation and linked to a measurable residual behavior profile.

From internal metric keys to interpretable behavior

The repository uses compact metric keys inherited from development. For public reporting we use descriptive names and carry the original artifact key alongside each one, so every table traces back to code and JSON artifacts.

Table 2 · Operational metric definitions

A strict held-out win in this report means that the selected scaffold beats the fixed baseline on all six substantive metrics (support retention, update responsiveness, fragility, target agreement, WVS retention, and WVS responsiveness) while at least tying on output parseability. This deliberately demanding rule prevents a gain in one operation from hiding a regression in another.

What changed under locked evaluation?

1. Development ranking reversed on the ETHICS final-test

At the ETHICS¹ checkpoint, the fixed baseline had higher selector-development accuracy than the teacher-refined candidate: 0.5625 versus 0.5156. On the locked final-test, the ordering reversed: the teacher-refined scaffold reached 0.5625, compared with 0.5312 for the baseline.

2. Frozen representatives often beat continued local adaptation

In a ten-seed ETHICS tournament, the best frozen scaffold representative beat the endpoint of continued teacher adaptation in six seeds, tied in two, and lost in two. The mean frozen-minus-continued final-test advantage was +0.0439. This is supporting route evidence, not the main perturbation result.

3. Two distinct scaffolds achieved strict held-out 3D wins

Seed 2801 tests the support-basis tracking operation. Seed 4523 tests criterion anchoring and unsupported-frame rejection. Both scaffolds beat the fixed baseline on all six substantive metrics and tied it on parseability.

Table 3 · Main strict held-out results. Cells show scaffold / fixed baseline; fragility is lower-is-better; tinted cells are scaffold wins.

Seed 2801: evidence tracking rather than consistency alone

The support-basis scaffold raised support retention by approximately +0.057, update responsiveness by +0.667, and target agreement by +0.096, while reducing fragility by approximately 0.135. The metric pattern is compatible with the intended operation: preserve when the basis is unchanged, but update when it weakens or is contradicted.

Seed 4523: a smaller retention gain, a clearer update-and-fragility gain

The criterion-anchoring scaffold improved support retention only slightly (approximately +0.004) but doubled update responsiveness from 0.3333 to 0.6667, reduced fragility from 0.1667 to zero, and raised target agreement by approximately +0.092. Read this as an operation-specific residual improvement, not a uniform jump in model quality.

4. Replication was partial, not uniform

The positive result did not repeat as a strict win on every subsequent seed. Two near-replication rows, 4627 and 4703, showed no substantive metric regressions but included ties that blocked a strict win. Other rows exposed concrete failure modes:

Table 4 · Repeatability boundary

Aggregate evidence is diagnostic, not population-level proof

Two of eight claim-bearing rows met the strict all-metric criterion. Excluding the post-selection audit row, the artifact registry contains eight claim-bearing held-out or prospective 3D rows; the two strict wins give an observed strict-win rate of 25%. The exact 95% interval is approximately 3.2% to 65.1%, which is far too wide to support a precise general-success estimate.

Table 5 · Claim-bearing metric summaries across eight rows. Positive deltas favor the selected scaffold; fragility is already sign-inverted as baseline minus scaffold.

These rows are sequential research probes, not an IID sample from a specified population of models, prompts, or deployment contexts. Sign tests and bootstrap intervals are therefore descriptive. The steadiest aggregate signal, target agreement, still does not establish a general alignment effect.

The unresolved question: scaffold wording or operation metadata?

Later development-only experiments introduced row-level operation tags derived from benchmark metadata, for example an explicit indication that the current row requires preservation or update. This creates a causal ambiguity. A gain attributed to a global scaffold may instead come from handing the model a structured operation label at inference time.

In the same-seed development comparison, operation-tag variants showed a small support-retention gain and a +0.1667 update-responsiveness gain. On a fresh development replay, the update gain remained, but support retention and fragility worsened relative to the stronger baseline. The current evidence therefore does not isolate whether the observed improvements come from:

1. global scaffold wording;
2. row-level operation tags;
3. their interaction;
4. or selection effects on small development surfaces.

From moral-attention proxies to safety constraints

What is shown. On bounded moral-attention benchmarks, readable scaffolds improved three operations under locked evaluation: preserve a judgment while its basis is intact, update it when the basis verifiably changes, and reject frames the scenario does not support. That is a bounded proof of possibility: two strict held-out successes with a documented repeatability boundary.

Why it may matter for runtime constraints. The same three operations are the skeleton of constraint tracking in agentic systems: keep an authorization while it is valid, revise a decision when verified permissions or risk evidence change, and refuse objectives imported from untrusted context. If a readable scaffold causally carries these operations, it would be a cheap, inspectable, reversible runtime-control candidate.

What has not been shown. Transfer to agentic safety constraints has not been demonstrated. No result in this article involves tools, delegated tasks, or simulated agent environments, and the causal carrier of the observed gains (scaffold wording, operation metadata, or adaptive selection) remains unresolved.

What the funded experiment tests. The proposed work runs a preregistered 2×2 ablation separating scaffold wording from operation metadata on untouched item families, then pilots the same preserve/update/reject suite on 60 simulated agentic constraint families, following the pilot specification shipped with the package. Positive, metadata-dominant, narrow, null, and adverse outcomes each trigger a different, pre-committed decision recorded in the package’s decision rules.

Supported statements, boundaries, and unknowns

Table 6 · Claim status

What prevents a broader conclusion?

Small held-out surface

Each claim-bearing 3D final-test contains three item families and 27 rows. Family-level metrics reduce pseudoreplication, but the number of independent held-out families remains small. WVS update responsiveness can be determined by only a few opportunities, so values such as 1.0 should not be read as stable population estimates.

One student family and one teacher

The study uses Qwen2.5 students at two sizes and Gemini 2.5 Pro as the teacher. The result may depend on Qwen instruction tuning, the teacher’s priors, or their interaction. Ruling this out requires independent model families and human-authored controls.

Search adaptivity

The repository preserves a long sequence of development probes, failed basins, repairs, and selectors. That transparency is a strength, but it also means the final scaffolds emerged from an adaptive process. A future confirmatory panel must freeze the candidate set and gates before touching new held-out seeds.

Proxy targets

ETHICS labels, MFQ-derived ranges, WVS items, and dilemma targets are operational proxies. They permit controlled tests of preservation and update, but they do not settle moral truth or exhaust the structure of real-world judgment.

Interpretability is external, not mechanistic

The scaffold text is readable and the behavioral operation is testable, but this study does not identify an internal circuit or representation responsible for the change. “Auditable” here means artifact, access, and residual behavior are traceable, not that the model’s internal computation is fully explained.

Release status

This package is MIT-licensed. The artifact repository is not yet public: the release, including the checksummed artifact bundle, is still pending, so the claim-to-artifact mapping in the table above is currently the audit surface. The package’s provenance record tracks the status of each release item.

Reproducibility and audit path

The repository separates release verification from model-backed reruns. A reviewer-safe local check regenerates figures and tables from saved reports and runs unit tests, linting, and type checks without making new teacher calls. Full experimental reruns require teacher credentials. A separate companion code bundle, distributed alongside the review package as the sibling directory scaffolds_companion_code/ with its own checksums, ships a smaller offline audit that checks the article’s claim boundary directly.

The companion-bundle audit finishes in seconds and prints the claim boundary directly: 13 selected configs; 8 claim-bearing 3D rows; strict held-out wins on seeds 2801 and 4523 only; ETHICS tournament 6 frozen wins, 2 ties, 2 continued-adaptation wins (mean delta +0.04386); and operation-artifact evidence confirmed as development-only.

The bundle additionally includes scripts/evaluate_custom_scaffold.py: an evaluator can assemble the PUR-Eval development pack around their own proposed scaffold, run a local model, and score per-family preserve/update/reject checks and FamilyPassRate before treating that scaffold as a safety control. The locked final-test split is excluded by default.

Code and artifacts live in the project repository, github.com/aacortex/auditable-prompt-scaffolds. Its release is still pending, so the standalone review package carries the audit trail in the meantime: it ships the seven repository figures reproduced above, a provenance record that maps every claim in the article to the artifact that carries it, and CHECKSUMS.sha256 covering every packaged file.

An existence proof with a visible boundary

This study does not show that prompt scaffolds make language models morally wise. It shows something narrower and experimentally useful: a teacher-guided search process can produce readable instructions that improve specific evidence-tracking operations in a frozen, capacity-limited model under some locked held-out evaluations.

Two distinct scaffolds achieved strict wins. The first made same-basis preservation and changed-basis update more executable. The second anchored judgment to the criterion present in the scenario and resisted unsupported frame import. The ETHICS results add a methodological warning: development rankings can reverse on held-out data, and continued adaptation can erase a useful frozen representative.

The negative and mixed rows are equally important. They show that the present method is not yet a reliable general alignment intervention. The next scientific step is causal rather than rhetorical: isolate global scaffold wording from row-level operation metadata, preregister a larger multi-seed panel, and test transfer across independent student and teacher families. If those tests succeed, auditable scaffolds could become a low-cost, reversible layer for making explicit safety-relevant operations available to bounded models. If they fail, the result will still clarify where readable external controls stop working.

The evidence supports an existence claim for auditable external instructions. It does not support a general claim that prompting reliably aligns language models.

References

1. Hendrycks, D., Burns, C., Basart, S., Critch, A., Li, J., Song, D., & Steinhardt, J. (2021). Aligning AI With Shared Human Values. ICLR. The ETHICS benchmark.
2. Zhou, Y., Muresanu, A. I., Han, Z., Paster, K., Pitis, S., Chan, H., & Ba, J. (2022). Large Language Models Are Human-Level Prompt Engineers. Automatic Prompt Engineer.
3. Pryzant, R., Iter, D., Li, J., Lee, Y. T., Zhu, C., & Zeng, M. (2023). Automatic Prompt Optimization with “Gradient Descent” and Beam Search. EMNLP.
4. Yang, C., Wang, X., Lu, Y., Liu, H., Le, Q. V., Zhou, D., & Chen, X. (2023). Large Language Models as Optimizers. OPRO.
5. Fernando, C., Banarse, D., Michalewski, H., Osindero, S., & Rocktäschel, T. (2023). Promptbreeder: Self-Referential Self-Improvement via Prompt Evolution.
6. Madaan, A., Tandon, N., Gupta, P., et al. (2023). Self-Refine: Iterative Refinement with Self-Feedback.
7. Ribeiro, M. T., Wu, T., Guestrin, C., & Singh, S. (2020). Beyond Accuracy: Behavioral Testing of NLP Models with CheckList. ACL.
8. Gardner, M., Artzi, Y., Basmov, V., et al. (2020). Evaluating Models’ Local Decision Boundaries via Contrast Sets. Findings of EMNLP.
9. Kaushik, D., Hovy, E., & Lipton, Z. C. (2020). Learning the Difference that Makes a Difference with Counterfactually-Augmented Data. ICLR.
10. Mitchell, M., Wu, S., Zaldivar, A., et al. (2019). Model Cards for Model Reporting. FAT*.
11. Gebru, T., Morgenstern, J., Vecchione, B., et al. (2021). Datasheets for Datasets. Communications of the ACM.

— Yanis Prasol, 2026