Authorized to Use, Forbidden to Influence: Measuring Purpose Selectivity in Financial AI

A customer’s verified hardship claim can properly send them to hardship support. The same claim may be prohibited when the decision is about credit pricing. An internal fraud flag works the same way: it is authorized for fraud review and prohibited elsewhere.

Access control cannot draw that line. It answers who may read the data, not whether the data changes a decision. Data protection law and AI governance practice ask for more: a confidential signal should be useful where its use is authorized and have no influence where it is prohibited.

FinBoundBench measures whether that happens. In two pre-registered studies on financial decision tasks, a prohibited signal changed decisions in 100% and 96.5% of cases when the model could see it. When the signal was technically excluded, that fell to 0.0% and 0.8%, about the same as the 0.0% and 3.8% the models vary on their own. Where the signal was authorized, governed execution passed the input through unchanged, so its benefit was kept.

The work comes from the Compex Research Project. This is a draft for external review, with its evidence frozen at FinBoundBench V4. Outside verification is recommended and has not happened yet.

There are three ways to handle a confidential signal. Block it everywhere, and it cannot influence a prohibited decision, but the model also loses information it is entitled to use. Show it everywhere, and the authorized use works, but the signal can also influence decisions where it is prohibited. Or make it purpose-selective: available when the purpose authorizes it, excluded when the purpose prohibits it.

Access control can do the first two. It cannot do the third, because who may read a field does not determine what the model may use for which decision. The paper calls the third property purpose selectivity, and treats it as something to measure for a specific model on a specific task.

Each case is a pair of inputs that are identical except for two things: whether the signal is visible, and which purpose is declared. So when a decision changes, the change can be attributed to those two things. The conditions cover the authorized purpose, the prohibited purpose, and a repeat of identical input.

That last condition matters more than it looks. Run an identical input three times and a model may answer A, A, B. A decision that changes after a signal is shown therefore cannot automatically be blamed on the signal. The natural decision floor measures that background variation, and influence is reported beside it so a reader can tell the data’s effect from the model’s own randomness.

The base cases come from public financial records. The confidential signals are synthetic fields: a verified hardship claim and an internal fraud flag. That is deliberate. Ground truth for authorized and prohibited influence cannot be controlled with real confidential records. The correct answers were built so that the signal carries real predictive value, so the gains below show a model using an informative signal, not how much such a signal would help with real records. In both tasks, the prohibited purpose was market-signal usage; credit pricing above is an example, not the tested purpose.

One illustrative pair shows how this works. It was built for the benchmark and is not a real customer record.

The primary study ran DeepSeek V4 Pro on hardship routing, with 100 pairs. The replication ran Kimi K3 on fraud review, with 120 pairs, of which 114 were complete.

A test of suppression means nothing if a model never responded to the signal in the first place, so each candidate had to show a measurable response, a usable authorized gain and a natural floor low enough to read before the main evaluation. The low floors reported below therefore partly reflect which pairs were admitted. All three candidates failed this check at the level of the whole model.

A registered amendment, made before the live run, changed the unit of admission from a model to a model on a specific task. Exactly two pairs then passed: DeepSeek on hardship routing (authorized gain of +0.318 at the gate) and Kimi on fraud review (+0.190). The negative control, gemma-4-26b, failed. Confirmatory data played no part in admission, and the amendment is disclosed as part of the scientific record.

Running the replication was not smooth either. Seven replication windows failed before window 8 was accepted, with overall provider success of 0.574 and 2,522 failed events. A window was accepted on whether its execution was complete, not on what it showed.

When the model could see a signal that the declared purpose prohibited, it changed the decision in 100% of cases in the primary study and 96.5% in the replication. Excluding the signal took that to 0.0% and 0.8%.

The two studies reached the floor differently. In the primary study, both the excluded result and the floor were 0.0%, which is consistent with complete exclusion in that one setting. In the replication, 0.8% against a floor of 3.8% supports suppression down to the floor rather than an exact zero. Exact McNemar tests, which compare paired yes-or-no outcomes, gave p ≈ 1.6 × 10⁻³⁰ (primary) and p ≈ 3.9 × 10⁻³¹ (replication).

A plain deterministic mask (P2) and the governed mask (P3) performed about the same, and an equivalence test supports that. So this benchmark does not show that governed execution beats simple masking at removing influence. What governance adds is evidence of what ran, and that is evaluated separately in PBAE.

Blocking a signal everywhere would also score well on exclusion, so the other half of the test is whether the signal stays useful where it is authorized. It did. Balanced accuracy, which scores each outcome class equally so that a common outcome cannot flatter the result, rose from 0.32 to 0.71 in the primary study and from 0.625 to 0.733 in the replication. Those are gains of +0.39 [0.21, 0.56] and +0.11 [0.033, 0.175], with bootstrap confidence intervals in brackets. The primary baseline was below chance on the confirmatory split, so that gain should be read with care.

The governed authorized run matched the visible run exactly, giving an authorized utility retention of 1.0. That number needs care. The governed path renders byte-identical input, so 1.0 means the input passed through unchanged. It is not evidence that governance improves model performance.

Three things held across both studies: the direction of the authorized gain, the large influence of a visible prohibited signal, and near-floor influence once it was excluded. Effect size, baseline accuracy, the natural floor and provider reliability all differed. The replication’s smaller gain came with a higher baseline, which left less headroom. For that reason the paper reports each study on its own and never pools them. This replication changed the model and the task together, and neither model passed admission on the other’s task, so it is not a repeat of the same test.

A separately written crosscheck, with no shared code and an independent random number stream, reproduced all confidence intervals to within 10⁻⁴ and both McNemar p-values bit for bit. The same team wrote it, so it is not outside verification.

The paper’s conclusion is narrow. Purpose selectivity can be measured, and in these two model and task pairs, technical exclusion reduced prohibited influence to about the models’ natural decision floors while preserving the authorized input path. Universal enforcement is not claimed.

A measurement in a benchmark is not proof about a particular run in production. If exclusion is technically achievable, the next question is how anyone can show it was actually applied to a specific execution. PBAE takes up that question.

• Two model and task pairs. No claim is made beyond them.
• No claim of legal compliance, fairness, or the security of any governed runtime.
• It does not prove the absence of all correlated influence.
• It does not show that governed masking (P3) beats deterministic masking (P2).
• Both pairs were admitted through a registered amendment after every candidate failed at model level, which carries selection risk. Confirmatory data were not used for admission.
• The primary public-only baseline (A0) is below chance on the confirmatory split, and balanced accuracy magnitudes are sensitive to how inputs are rendered.
• Only accepted windows were analyzed. Seven earlier windows failed, and dropped executions are not neutral with respect to the observed distribution.
• Verification so far is same-team. External verification is recommended and has not occurred.
• Attack, privacy and performance phases were not run.

• Paper, for researchers, reviewers, 6 pages

Compex Research Project. Authorized to Use, Forbidden to Influence: Measuring Purpose Selectivity in Financial AI. External-review draft, Revision 0.1, 2026. https://getcompex.com/research/finboundbench

This is a draft for external review. Send corrections and comments to [email protected].