Paper deep dive
MAC: Multi-Agent Constitution Learning
Rushil Thareja, Gautam Gupta, Francesco Pinto, Nils Lukas
Intelligence
Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 95%
Last extracted: 3/22/2026, 5:27:56 AM
Summary
The paper introduces Multi-Agent Constitutional Learning (MAC), a framework that optimizes structured, rule-based prompts for LLMs using a network of specialized agents (Annotator, Decision, Creator, Editor). MAC addresses limitations in existing prompt optimization methods by providing interpretable, auditable rule sets for tasks like PII tagging, achieving significant performance gains over baselines without requiring parameter updates.
Entities (6)
Relation Signals (4)
reMAC → augments → MAC
confidence 95% · reMAC mitigates this by supplementing the learned constitution with concrete examples at test time.
MAC+ → improves → MAC
confidence 95% · We also present MAC+, which improves performance by training agents on successful trajectories
MAC → optimizes → Constitutions
confidence 95% · MAC optimizes constitutions through a network of specialized agents that propose, critique, and refine rule updates.
MAC → outperforms → GEPA
confidence 90% · MAC outperforms recent prompt optimization methods by over 50%
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Constitutional AI is a method to oversee and control LLMs based on a set of rules written in natural language. These rules are typically written by human experts, but could in principle be learned automatically given sufficient training data for the desired behavior. Existing LLM-based prompt optimizers attempt this but are ineffective at learning constitutions since (i) they require many labeled examples and (ii) lack structure in the optimized prompts, leading to diminishing improvements as prompt size grows. To address these limitations, we propose Multi-Agent Constitutional Learning (MAC), which optimizes over structured prompts represented as sets of rules using a network of agents with specialized tasks to accept, edit, or reject rule updates. We also present MAC+, which improves performance by training agents on successful trajectories to reinforce updates leading to higher reward. We evaluate MAC on tagging Personally Identifiable Information (PII), a classification task with limited labels where interpretability is critical, and demonstrate that it generalizes to other agentic tasks such as tool calling. MAC outperforms recent prompt optimization methods by over 50%, produces human-readable and auditable rule sets, and achieves performance comparable to supervised fine-tuning and GRPO without requiring parameter updates.
Tags
Links
- Source: https://arxiv.org/abs/2603.15968v1
- Canonical: https://arxiv.org/abs/2603.15968v1
Trouble viewing inline? Open PDF directly →
Full Text
90,532 characters extracted from source content.
Expand or collapse full text
MAC: Multi-Agent Constitution Learning Rushil Thareja 1 Gautam Gupta 2 Francesco Pinto 3 Nils Lukas 1 Abstract Constitutional AI is a method to oversee and con- trol LLMs based on a set of rules written in natu- ral language. These rules are typically written by human experts, but could in principle be learned automatically given sufficient training data for the desired behavior. Existing LLM-based prompt op- timizers attempt this but are ineffective at learning constitutions since (i) they require many labeled examples and (i) lack structure in the optimized prompts, leading to diminishing improvements as prompt size grows. To address these limitations, we propose Multi-Agent Constitutional Learning (MAC), which optimizes over structured prompts represented as sets of rules using a network of agents with specialized tasks to accept, edit, or re- ject rule updates. We also present MAC+, which improves performance by training agents on suc- cessful trajectories to reinforce updates leading to higher reward. We evaluate MAC on tagging Per- sonally Identifiable Information (PII), a classifica- tion task with limited labels where interpretability is critical, and demonstrate that it generalizes to other agentic tasks such as tool calling. MAC outperforms recent prompt optimization methods by over 50%, produces human-readable and au- ditable rule sets, and achieves performance com- parable to supervised fine-tuning and GRPO with- out requiring parameter updates. Github Repo — PyPI Package — Website 1. Introduction Constitutional AI guides LLM behavior using structured prompts that enumerate natural-language rules defining what the model should and should not do (Bai et al., 2022; Huang et al., 2024; Sharma et al., 2025). Because these 1 Mohamed bin Zayed University of Artificial Intelligence (MBZUAI) 2 Indraprastha Institute of Information Technology Delhi (IIIT Delhi) 3 Google DeepMind. Correspondence to: Rushil Thareja <rushil.thareja@mbzuai.ac.ae>. Preprint. March 18, 2026. Figure 1. In our MAC framework (1) an Annotator agent performs the downstream task given the constitution. (2) A Decision agent analyzes errors and reviews the constitution to add, edit, or remove rules. (3a) The Rule Proposer creates new candidate rules and (3b) the Rule Editor updates existing rules, producing a candidate constitution. (4) The update is evaluated with the task metric, and (5) the process repeats k times until performance improves. rules are applied at inference time rather than embedded into model weights, they can be inspected, modified, and audited without retraining. This makes constitutional AI par- ticularly attractive for domains such as healthcare, finance, and legal compliance, where transparency is essential and task definitions evolve over time. A rule specifies when an action should or should not be taken. An effective rule must be both unambiguous to a human auditor and reliably followed by the LLM. However, writing such rules is difficult. Natural language that seems clear to humans can be interpreted inconsistently by models, and effectiveness must be validated empirically due to the probabilistic nature of LLMs. In practice, developing a ro- bust constitution requires iterative refinement where experts write rules, test them, observe failures, and revise. This process is slow, expensive, and must be repeated whenever task definitions change or new domains arise. Automatic Prompt Optimization (APO) (Yang et al., 2023; Agrawal et al., 2025) methods could in principle automate this process, but existing approaches are poorly suited for constitution learning. They typically require large amounts of labeled data, produce unstructured prompt modifications that are difficult to interpret, and show diminishing returns 1 arXiv:2603.15968v1 [cs.AI] 16 Mar 2026 MAC: Multi-Agent Constitution Learning as prompts grow longer (Ramnath et al., 2025). Moreover, they discard the structured, rule-based format that makes constitutional AI auditable in the first place. We formalize constitution learning as the task of automat- ically deriving a set of interpretable rules from limited input-output examples. Unlike general prompt optimization, constitution learning restricts updates to an explicit set of natural-language rules with predefined structure, preserving the transparency that makes constitutional AI valuable. We propose Multi-Agent Constitutional Learning (MAC), which optimizes constitutions through a network of special- ized agents that propose, critique, and refine rule updates. Rather than optimizing a monolithic prompt, MAC treats the constitution as a modular structure where rules can be added, edited, or removed independently. Figure 1 illustrates our overall approach. The multi-agent design decomposes the optimization problem into subtasks, improving reliability and enabling lower-capacity models to contribute effectively (Chan et al., 2023; Chen et al., 2024; Du et al., 2023). We evaluate MAC on Personally Identifiable Information (PII) tagging across finance (Li et al., 2025), legal (Chalkidis et al., 2019), and healthcare datasets (Caufield, 2020). PII tagging is a natural testbed for constitution learning because it requires transparent decision-making, suffers from lim- ited labeled data, and definitions vary substantially across domains and jurisdictions. Fine-tuning is also impractical in this setting due to cost, and inference-time rule application avoids the memorization risks associated with training on sensitive data (Carlini et al., 2023; Huang et al., 2022; Kim et al., 2023). We further demonstrate that MAC generalizes beyond classification to agentic tasks by adapting it to tool calling on BFCL (Patil et al., 2025). 1.1. Contributions We make the following contributions: • We formalize constitution learning and propose Multi- Agent Constitutional Learning (MAC), where special- ized agents propose, critique, and refine rules. •We evaluate MAC on PII tagging across finance, le- gal, and healthcare domains, demonstrating over 50% improvement over prompt optimization baselines and performance comparable to supervised fine-tuning. • We introduce two variants: reMAC, which uses test- time retrieval, and MAC+, which trains agents on suc- cessful trajectories to reinforce effective updates. • We show that MAC generalizes beyond classification to agentic tasks by adapting it to tool calling on BFCL. ECHR - Legal The case originated in an application (no. 29366/03) against the Republic of Poland lodged with the Court under Article 34 of the Convention for the Protection of Human Rights and Fundamental Freedoms (“the Convention”) by Mr D. Stępniak on 25 July 2003. The Polish Government (“the Government”) were represented by their Agent, Mr J. Wołąsiewicz. On 15 August 2022, Paul Sanders contacted the Customer Support Org. and, for account verification, provided the swift code YQXFUSMA262, the id Nm-80877, and confirmed his address at 76273 Reginald Forks, 39502, Michellebury. A 19-year-old man presented to the emergency department 12 hours after insertion of a high-pressure container into the rectum; endoscopic removal was achieved using a 40 m pneumatic dilatation balloon (Rigiflex®, Boston Scientific) under fluoroscopic control. PUPA - Finance MACCROBAT - Healthcare Figure 2. Example document snippets with private spans indicated. 2. Background Controlling LLM Behavior.Large language models can be controlled through two approaches: training-time inter- ventions and inference-time interventions. Training-time methods include supervised fine-tuning (SFT) and reinforce- ment learning from human feedback (RLHF). These meth- ods are effective but require vast labeled data, computational resources, and risk memorization of sensitive training exam- ples (Carlini et al., 2023). Inference-time methods instead guide behavior through the prompt, leaving model weights unchanged and includes few-shot prompting (Brown et al., 2020), chain-of-thought prompting (Wei et al., 2022), and rule-based prompting (Ouyang et al., 2022). Constitutional AI guides LLM behavior at inference time using an explicit constitution (Bai et al., 2022; Huang et al., 2024): a set of natural-language rules, as illustrated in Ta- ble 1. By placing constraints on the prompt’s structure, it improves transparent and auditable control. For example, constitutional classifiers apply such rules to judge whether input text is harmful or non-harmful (Sharma et al., 2025). Automatic Prompt Optimization (APO) uses LLMs to iteratively refine prompts based on task performance (Ram- nath et al., 2025). Given labeled examples and a task metric, APO methods generate candidate modifications, evaluate them, and retain improvements. We survey evolutionary and proposal-based prompt opti- mization methods, such as Genetic-Pareto (GEPA) (Agrawal et al., 2025), which performs guided evolutionary search over prompts using task feedback, and Multiprompt Instruc- tion Proposal Optimizer (MIPRO) (Opsahl-Ong et al., 2024), which iteratively proposes and selects prompts based on val- idation performance. Both methods optimize prompts as unstructured text, putting no constraints on their format. Private Information Tagging aims to identify sensitive text spans in documents. These spans may correspond to direct identifiers such as names or account numbers, or indirect references that become sensitive 1 in context (Schwartz and 1 Definitions of what constitutes private information vary across 2 MAC: Multi-Agent Constitution Learning Table 1. Example natural-language constitutional rules learnt by MAC for private information tagging across different domains. DomainExample Constitutional Rules LegalMark as private specific dates when they appear in the context of personal events or actions, such as births, deaths, or significant life events. Do not mark general references or narrative text containing similar time periods. Examples: mark “1975”, “22 August 2003”; do not mark “on a day in June”. HealthcareMark terms such as heart failure subtypes (e.g., diastolic heart failure, systolic heart failure) when explicitly mentioned in a patient’s medical history as private. Do not mark generic medical conditions without an explicit subtype or detailed description. FinanceMark as private any phrase indicating a specific financial timeframe (e.g., FY2022, YTD FY2021) when it appears in direct association with identifiable information. Do not mark generic narrative context or standalone labels without specific identifiers. Examples: mark “FY2022 balance sheet”, “Q4 2021 sales report” (if associated with identifiable information); do not mark “next year”, “past fiscal year” without identifiers. Solove, 2011; McCallister, 2010). Existing approaches typi- cally rely on pretrained taggers, rule-based pattern matching, or context-aware detectors operating over fixed label sets (Microsoft, 2025; NVIDIA, 2025; Zaratiana et al., 2025). Notation. Letx ∈ Xdenote an input (e.g., a document) andy ⋆ (x)∈Ydenote the ground-truth output (e.g., a set of labeled spans), which reflects a task-specific definition re- vealed only through labeled examples. The agent is guided by a constitutionC = ⟨r 1 ,...,r |C| ⟩, which is an ordered list of natural-language rules. Letθdenote fixed LLM weights andπa fixed role prompt specifying the task and output format. Given an inputxand constitutionC, the agent produces a predictionˆy(x) = A θ,π (x;C). We as- sume access to a labeled datasetD =(x i ,y ⋆ i ) N i=1 and a verifiable task metricμ : Y ×Y → [0, 1]that compares predictions to ground truth. 3. Conceptual Approach We begin by describing our core algorithm for MAC and then we describe two extension variants MAC+ and reMAC. 3.1. Constitutional Learning The goal of constitution learning is to automatically derive a set of interpretable rules from labeled examples. Given train- ing dataD train and validation dataD val , and a task metric μ :Y×Y → [0, 1], we seek a constitutionCthat maximizes task performance. Formally, we optimize: C ⋆ = arg max C∈C μ (A θ,π (D val;C ),Y ⋆ val )(1) whereA θ,π (x;C)denotes the prediction of an LLM-based agent with fixed weightsθand role promptπ, conditioned on inputxand constitutionC. Throughout optimization, the model weights θ and role prompt π remain fixed. organizations, jurisdictions, and datasets, and can evolve over time. 3.2. Multi-Agent Constitution Learning (MAC) We call our algorithm Multi-Agent Constitution Learning (MAC), which optimizes constitutions through a network of specialized agents. MAC consists of four agents: •ANNOTATOR(B,C): applies the current constitution C to a batch of inputs B and produces predictions ˆ Y . •DECISION(FN,FP,C,R max ):analyzes er- rors and selects an update operationop ∈ ADDEDIT, REMOVE, along with a rationalerand target rule index i. •CREATOR(FN,FP,r): drafts a new rule based on observed errors and the rationale. •EDITOR(c i ,FN,FP,r): modifies existing rulec i based on observed errors and the rationale. Given predictions ˆ Y and ground-truth labelsY ⋆ , a helper function MATCH computes the task metricμ( ˆ Y ,Y ⋆ )and ex- tracts false negatives (FN) and false positives (FP), along with their surrounding context within a fixed character win- dow. Because private information tagging is a span-level classification task, we use F1 as the standard evaluation met- ric, computed (using MATCH) via exact span-level matching between predicted and ground-truth private phrases. Using multiple agents allows decomposing the optimization problem into subtasks, so that each agent can focus on its own individual task, which has been shown to improve reliability (Chan et al., 2023; Chen et al., 2024; Du et al., 2023). For reproducibility 2 , we provide prompts for the Annotator, Decision, Rule Creator, and Rule Editor agents in the Appendices 9.2.1, 9.2.2, 9.2.3, and 9.2.4. Appendix 9.9 presents sample outputs from individual MAC agents. 2 We will also publish our software with all details to reproduce our experiments, including the learned constitutions as open-source code. 3 MAC: Multi-Agent Constitution Learning Algorithm 1 MAC: Multi-Agent Constitution Learning 1:Input: Training dataD train , validation dataD val , rule budget R max , epochs E 2: Initialize: C ←∅, C ⋆ ←∅, μ ⋆ ← 0 3: for e = 1 to E do 4: for all batch B ⊂ D train do 5: ˆ Y ← ANNOTATOR(B,C) ▷ Apply current constitution 6: FN,FP,μ← MATCH( ˆ Y ,Y ⋆ B ) ▷ Compute errors 7: op,r,i← DECISION(FN,FP,C,R max ) 8:if op = ADD then 9:C prop ← C∪CREATOR(FN,FP,r) 10:else if op = EDIT then 11:C prop ← (C\c i )∪EDITOR(c i ,FN,FP,r) 12:else 13:C prop ← C\c i ▷ REMOVE 14:end if 15: μ prop ← MATCH(ANNOTATOR(B,C prop ),Y ⋆ B ) 16:if μ prop > μ then 17:C ← C prop ▷ Accept update 18:end if 19: end for 20: μ val ← MATCH(ANNOTATOR(D val ,C),Y ⋆ val ) 21: if μ val > μ ⋆ then 22: C ⋆ ← C, μ ⋆ ← μ val ▷ Track best 23: end if 24: end for 25: Return: C ⋆ 3.3. Core Algorithm for MAC MAC optimizes the constitution through an iterative epoch- batch procedure, summarized in Algorithm 1. At each step, the ANNOTATOR applies the current constitutionCto a batchB(Line 5). The MATCH operation computes errors and the task metricμ(Line 6). The DECISION agent an- alyzes the errors and selects an update operation (Line 7). Based on this decision, either the CREATOR or EDITOR agent proposes an updated constitution C prop (Lines 8–14). The proposed constitution is evaluated on the same batch (Line 15). If the task metric improves (μ prop > μ), the up- date is accepted (Lines 16–18). Otherwise, the proposal is retried up to a fixed number of times using a higher sampling temperature; if no retry yields an improvement, the original constitution is retained. After a fixed number of batches, the constitution is evaluated on the validation setD val , and the version with the highest validation performance is re- tained asC ⋆ (Lines 20–23). Validation F1 over batches for MAC runs across different models and datasets is shown in Appendix 9.6. 3.4. Two Variants: MAC+ and reMAC MAC+.The effectiveness of MAC depends on each agent performing its role reliably, but smaller models (ex. 3B) may struggle with complex reasoning tasks such as diagnosing error patterns or proposing precise rules. MAC+ addresses this by fine-tuning each agent on high-quality trajectories Figure 3. MAC+: Optimizing each agent for its assigned role via supervised fine-tuning on rollouts generated by a larger model. Figure 4. reMAC: Retrieval-augmented MAC, where documents from the training set are retrieved and added at test time. generated by a larger model (ex. 14B). LetA (S) denote an agent instantiated with a smaller model andA (L) the same agent with a larger model. We execute MAC using A (L) and collect input-output tracesT A =(z j ,o j ) M A j=1 for each agentA ∈ DECISION, CREATOR, EDITOR, where z j is the input context ando j is the output produced by A (L) . We then fine-tuneA (S) onT A via supervised fine- tuning by training each agent only on traces relevant to its role. To avoid memorization, we fine-tune on data from different domains (healthcare & finance) than those used for evaluation (legal), training agents on task structure rather than dataset-specific content. Statistics on the collected trajectories from each agent used for fine-tuning are shown in Appendix 9.8. Retrieval-Augmented MAC (reMAC). MAC learns a constitution that captures general domain patterns, but ab- stract rules may be insufficient for highly specialized termi- nology or context-dependent definitions. reMAC mitigates this by supplementing the learned constitution with concrete examples at test time. LetR : X × D train × k → X k be a retrieval function returningktraining examples for a test input x. The ANNOTATOR prediction becomes: ˆy(x) = A θ,π x;C,R(x,D train ,k) (2) where retrieved examples are included as few-shot demon- strations alongside the constitutionC. Importantly, as shown in Figure 4 retrieval is applied only at inference 4 MAC: Multi-Agent Constitution Learning and does not modify the constitution so that its auditability is preserved. 4. Evaluation We evaluate MAC on private information tagging across legal, healthcare, and finance domains and then show gen- eralization to other tasks, such as tool calling. We focus on tagging because it combines the core challenges con- stitution learning addresses: (i) classification, (i) limited labeled data, (i) a need for transparent, auditable decisions, and (iv) settings where concerns about memorization make training-based approaches undesirable. 4.1. Experimental Setup Datasets. We evaluate MAC on private information tag- ging across three domains: legal, healthcare, and finance. For legal, we use the ECHR dataset (Chalkidis et al., 2019), containing case documents from the European Court of Human Rights. For healthcare, we use MACCROBAT (Cau- field, 2020), containing clinical documents with dense, over- lapping private spans across 49 fine-grained privacy types. For finance, we use a subset of PUPA (Li et al., 2025), derived from real-world user-assistant interactions. These domains differ substantially in privacy definitions, docu- ment structure, and annotation density, enabling evaluation across sparse-privacy (legal), heavy-redaction (healthcare), and intermediate (finance) regimes. We sample 192 docu- ments per domain, split into 160 train, 16 validation, and 16 test documents. We use 192 documents because the small- est dataset (MACCROBAT) contains 192 usable documents, and we apply the same split consistently across all domains for consistency. Full statistics are provided in Appendix 9.1. Models and Metrics. We use Qwen 2.5 Instruct models (Qwen et al., 2025) at 3B, 7B, and 14B parameters, as they are standard non-reasoning instruction-tuned models with a complete size family and are commonly used in prior prompt-optimization work. We report F1 computed via exact span-level matching between predicted and ground- truth private spans, which is the standard evaluation metric for this task (Sang and De Meulder, 2003). Baselines. We compare MAC against 3 types of base- lines: (i) Pretrained taggers: Microsoft Presidio (Microsoft, 2025) with SpaCy, BERT, and Stanza backends, and Nvidia GLiNER-PII (NVIDIA, 2025). (i) Prompt optimization: GEPA (Agrawal et al., 2025), which performs evolution- ary prompt search, and MIPRO (Opsahl-Ong et al., 2024), which iteratively proposes and selects prompt variants. Both are configured with the same computational budget as MAC (480 forward passes). (i) Training-based: Supervised fine-tuning (SFT) and GRPO (Shao et al., 2024), included Table 2. Performance comparison (F1) with pretrained taggers. MethodLegalFinanceHealthcare MAC (14B)67.345.526.7 Microsoft Presidio (SpaCy)57.332.812.0 Microsoft Presidio (BERT)10.45.22.7 Microsoft Presidio (Stanza)54.044.79.1 Nvidia GLiNER57.135.95.3 as upper-bound references despite memorization concerns. Full implementation details are available in Appendix 9.3. Computational Budget. For fair comparison,all optimization-based methods use the same computational budget.MAC runs for 3 epochs over 20 batches of 8 documents, totaling 480 forward passes. GEPA and MIPRO are configured with equivalent budgets: GEPA uses maxmetriccalls = 480and MIPRO is capped at 480 total evaluations. Training-based baselines use the same data splits and epoch count. Full implementation details are provided in Appendix 9.3. 4.2. Experimental Results Figure 5 presents a comparison of test F1 between MAC, pretrained taggers, and prompt-optimization baselines (GEPA & MIPRO) across model sizes (3B, 7B, & 14B). MAC matches or outperforms pretrained taggers. Ta- ble 2 compares MAC (14B) against pretrained PII taggers commonly used in practice, including Microsoft Presidio with different NER backends and Nvidia GLiNER-PII. MAC outperforms all baselines across domains: +17% in Legal (67.3 vs. 57.3), +2% in Finance (45.5 vs. 44.7), and +123% in Healthcare (26.7 vs. 12.0). The gain is largest in Healthcare, where pretrained taggers struggle with fine- grained medical privacy types that fall outside standard PII categories. In Finance, where privacy definitions more closely align with standard PII, the gap is smaller but MAC still achieves the best performance. Unlike pretrained tag- gers, which rely on fixed label sets, MAC adapts to domain- specific privacy definitions through the constitutions alone. MAC outperforms prompt optimization baselines. Ta- ble 3 compares MAC against GEPA and MIPRO across model sizes. MAC outperforms both baselines in 8 of 9 dataset-model configurations. The largest gain is observed in Legal at 3B (+174%, 36.0 vs. 13.15 F1). The only case where MAC underperforms is Healthcare at 3B, where GEPA achieves 16.47 vs. 9.70 F1. In all other settings, improvements range from +28% to +153%. These results demonstrate that structured rule optimization consistently 5 MAC: Multi-Agent Constitution Learning <13714 10 20 30 40 50 60 70 F1 Legal <13714 5 10 15 20 25 Healthcare <13714 5 10 15 20 25 30 35 40 45 Finance GEPA MIPROV2 MAC Presidio (SpaCy) Presidio (BERT) Presidio (Stanza) NVIDIA GLiNER Figure 5. Test F1 across model sizes for MAC compared to baseline prompt optimizers and pretrained PII taggers. Table 3. Performance comparison (F1) across model sizes. DatasetOptimizer3B7B14B Legal GEPA12.7052.0550.09 MIPRO13.1538.6144.31 MAC36.00 55.10 67.30 Finance GEPA11.8922.5128.75 MIPRO9.8122.3426.80 MAC30.10 37.50 45.50 Healthcare GEPA16.4712.9416.77 MIPRO12.4716.7520.60 MAC9.70 20.10 26.70 outperforms unstructured prompt search. reMAC improves utility during inference. Table 4 shows results for reMAC, which augments the learned con- stitution with retrieved examples at test time. While we evaluatek ∈ 1, 2, 3, 4, 5, we report the representative set- tingsk ∈ 1, 3, 5here for brevity; Appendix 9.5 presents the full test F1 curves overkfor all models and datasets. We evaluate two retrieval strategies: random sampling from the training set, and similarity-based retrieval using cosine similarity over sentence embeddings 3 . Retrieval consistently improves performance across all 18 dataset-model configurations. The largest gain is observed in Healthcare at 7B with similarity-based retrieval (+273%, 9.91 to 36.97 F1 at 5-shot). Averaged across settings, reMAC yields improvements of 75.5% (3B), 90.4% (7B), and 69.4% (14B). Gains are largest in Healthcare (176.5%), where specialized medical terminology benefits most from concrete examples. These results show that test-time re- trieval complements learned constitutions, particularly for domains with context-dependent definitions. MAC+ improves over MAC. Table 5 compares MAC+ against training-based baselines on ECHR (Legal) using a 3B model. MAC+ fine-tunes each agent on trajectories gen- 3 We use the following pre-trained sentence transformer: https://huggingface.co/sentence-transformers/all-MiniLM-L6-v2 Table 4. reMAC: Retrieval-augmented MAC. F1 for varying num- bers of retrieved examples added to MAC constitutions. DatasetModel 0-Shot 1-shot 3-shot 5-shot Random Retrieval: Legal 3B38.7940.94 45.6433.17 7B54.85 64.9362.2960.56 14B73.4177.35 77.7476.29 Finance 3B17.4221.82 25.1825.06 7B38.7932.3235.88 46.73 14B48.47 49.5540.6042.61 Healthcare 3B16.4331.7224.99 34.35 7B10.0622.84 28.4325.27 14B16.1634.1846.51 47.00 Similarity-Based Retrieval: Legal 3B42.5641.0252.59 58.15 7B56.36 66.3663.6659.30 14B72.2178.4879.39 79.97 Finance 3B13.8225.95 33.9222.39 7B38.7947.8845.33 50.60 14B48.4746.6446.19 49.95 Healthcare 3B16.9732.99 33.8832.78 7B9.9128.8536.63 36.97 14B16.3439.6346.36 49.60 erated by a 14B model executing MAC on out-of-domain data (healthcare and finance), then evaluates on legal docu- ments. Loss curves for all agents are shown in Appendix 9.7, and we fine-tune agents using LoRA (rank 64). This setup trains agents on task structure rather than domain- specific patterns, avoiding memorization. MAC+ achieves 59.02 F1, outperforming both SFT (56.59) and GRPO (39.68). Gains are primarily from higher recall (48.27 vs. 44.17 for SFT) while maintaining comparable precision (75.93 vs. 78.72), indicating that specialized agents identify more private spans without sacrificing accuracy. Figure 6 shows that MAC+ also converges faster, exceeding 0.4 F1 within approximately 10 batches while no baseline reaches this threshold. These results demonstrate that agent-level distillation improves performance for smaller models with- out requiring in-domain training data. 6 MAC: Multi-Agent Constitution Learning Table 5. Optimized MAC vs. training-based baselines on legal for the 3B Model. MAC+ tunes on Healthcare & Finance only. Method Precision RecallF1 Training Baselines: GRPO64.6128.6339.68 SFT78.7244.1756.59 MAC Variants: MAC64.3224.9535.96 MAC+75.93 48.27 59.02 Table 6. Performance of MAC+ agents. The Annotator is evaluated using F1 on the Legal test set. All other agents are evaluated using an LLM-as-a-judge win rates (remaining cases are ties). AgentBase Model MAC+ Classification (F1 score) Annotator Agent32.959.02 LLM-as-a-Judge (Win rate) Decision Agent9.0%86.0% Rule Editor Agent25.0%74.0% Rule Proposer Agent3.0%97.0% Analysis of MAC+. To understand the source of MAC+ improvements, we evaluate each agent individually. We construct an evaluation set of 100 input-output traces per agent. For the Annotator, we use trajectories collected from MAC executions with the 14B model (for which we have sufficient samples). For the remaining agents, we supple- ment MAC-collected trajectories with additional samples generated by a 7B model. For each trace, we re-run the input through both the base model and the fine-tuned model, enabling direct comparison under identical inputs. The An- notator is evaluated using F1. Other agents are evaluated using an LLM-as-a-judge protocol with GPT-OSS 120B (prompt in Appendix 9.12). Table 6 shows substantial improvements across all agents after using MAC+. The Annotator improves from 32.9 to 59.02 F1 (1.8×). Win rates increase from 9.0% to 86.0% for Decision (9.6×), from 25.0% to 74.0% for Rule Editor (3.0×), and from 3.0% to 97.0% for Rule Proposer (32×). These results confirm that MAC+ gains stem from improved performance on each agent’s specialized sub-task, rather than from any single component. Tool-MAC: MAC for agentic tool-calling. To demon- strate that MAC applies beyond private information tagging, we evaluate on the BFCL tool-calling benchmark (Patil et al., 2025), specifically the parallel sub-task that requires decomposing a single natural-language request into mul- tiple independent function calls. We choose tool calling because it shares key properties with PII tagging: both re- 0102030405060 Batch Index 0.0 0.1 0.2 0.3 0.4 0.5 0.6 Validation F1 Score Epoch 1Epoch 2Epoch 3 MAC+ MAC SFT GRPO GEPA MIPRO Figure 6. Validation F1 vs training batches comparison of MAC variants against baselines on 3B models for the ECHR dataset. quire precise structured outputs, and tool arguments can contain sensitive information that must be handled correctly (Alizadeh et al., 2025; Wang et al., 2025; Yan et al., 2025). To adapt MAC for tool calling, we modify the agent prompts to reason about function signatures rather than privacy def- initions, replace the optimization metric (accuracy instead of F1), and adapt the MATCH operation to identify failed tool calls rather than false positives or negatives. Table 7 shows results for a 3B model. MAC improves accuracy by +5.5% over the 82% baseline, outperforming GEPA (+4.0%) and MIPRO (+2.5%). The learned rules address common failure modes, such as mismatched argument types, and improve tool selection for multi-step user intents. These results show that MAC can learn constitutions for diverse downstream tasks, with adaptations limited to task-specific prompts and metrics while the core multi-agent optimization loop remains unchanged. 4.3. Qualitative Analysis The first three rules from all constitutions learned by MAC across Legal, Healthcare, and Finance datasets and across the 3B, 7B, and 14B model sizes are provided in Ap- pendix 9.4. GEPA and MIPRO learned prompts for the Legal dataset across the same three model sizes are pro- vided in Appendices 9.10 and 9.11, respectively. On average, MAC learns 9 rules across datasets and model sizes, following a consistent structure similar to the sam- ple rules in Table 1. Rules are typically phrased as “Mark . . . ” definitions of private entities, optionally augmented with examples or explicit inclusion/exclusion criteria, ensur- ing transparency and enabling direct stakeholder inspection and updates. Legal and Healthcare require a comparable number of rules (7.33 and 7.67), while Finance requires more on average (12), which we attribute to its sparser, shorter private entities and lowest average characters per privacy group (Appendix 9.1), necessitating more indepen- dent rules to precisely guide span boundaries and improve 7 MAC: Multi-Agent Constitution Learning Table 7. Tool-calling accuracy after optimization. Baseline = 82%. MethodFinal AccuracyImprovement MAC87.5%+5.5% GEPA86.0%+4.0% MIPRO84.5%+2.5% performance. Overall, the length of full MAC prompts (with learned constitutions) lies between MIPRO and GEPA (Ta- ble 8). On closer inspection of the learned constitutions, we observe that smaller models (3B) exhibit recurring artifacts, including overly short or low-quality rules with substantial repetition, incorrect edit decisions, and redundant updates, with the Decision Agent showing limited diversity and a bias toward adding new rules. These issues are substantially reduced when using larger models (14B), motivating the use of distillation in MAC+, which yields significant perfor- mance improvements. Despite these limitations, MAC still outperforms GEPA for smaller models. GEPA’s reflection and full prompt rewrites make it difficult for low-capacity models to preserve task-relevant behavior, whereas MAC constrains updates to the constitution and decomposes the problem across specialized agents, enabling the discovery of performance-improving rule sets even with a 3B model. 5. Discussion & Limitations MAC is particularly effective for smaller models. Table 3 shows that the performance gap between MAC and prompt- optimization baselines decreases as model size increases. The average improvement over GEPA drops from 98.5% at 3B to 50.6% at 14B. We attribute this to how MAC struc- tures the optimization problem. Rather than rewriting the full prompt, MAC restricts updates to explicit rules while keeping the rest of the prompt fixed. MAC further decom- poses updates into decision, rule creation, and rule editing stages handled by separate agents, limiting the complex- ity of each LLM call. This decomposition is particularly beneficial for smaller models, which struggle with complex multi-step reasoning in a single call. When does MAC underperform? MAC underperforms GEPA in one setting: Healthcare at 3B (9.70 vs. 16.47 F1). We hypothesize this occurs because healthcare privacy defi- nitions in MACCROBAT span 49 fine-grained types with dense, overlapping spans. At 3B, the DECISION agent may lack the capacity to diagnose such complex error patterns, leading to suboptimal rule updates. This suggests MAC may struggle when (i) the task requires fine-grained distinctions beyond the agent’s reasoning capacity, or (i) error patterns are too complex to address with single-rule updates. Future work could explore hierarchical rule structures or ensemble decision-making to address such cases. Table 8. Average prompt length across all datasets and models. MetricMAC GEPA MIPRO Average Characters3,679.25,264.71,425.8 Constitutional prompts are preferred for transparency. As model capacity increases, the performance gap between MAC and baselines narrows. However, MAC remains preferable from a transparency perspective. MAC learns structured rules that follow a fixed format (Table 1), en- abling auditing beyond raw performance. Example constitu- tions are provided in Appendix 9.4, with GEPA and MIPRO prompts in Appendices 9.10 and 9.11. GEPA prompts are substantially more verbose than MAC and MIPRO (Table 8). On average, MAC prompts are approximately 30% shorter than GEPA prompts, and up to 70% shorter on Legal data. Because the base prompt remains fixed and only the con- stitution evolves, stakeholders do not need to repeatedly inspect entirely new prompts for each dataset or task. Agent specialization without memorization. MAC+ trains agents on out-of-domain data (healthcare and finance) and evaluates on legal documents, learning task structure rather than domain-specific patterns. This is critical for private information tagging, where fine-tuning on sensitive data risks memorization (Carlini et al., 2023). MAC+ outper- forms both SFT and GRPO on out-of-domain evaluation (Table 5), suggesting that agent-level distillation provides a safer alternative to direct fine-tuning when privacy is a concern. Limitations. While we perform extensive evaluations of our methods, we identify the following limitations. First, the length of the constitution presents a utility/transparency trade-off where adding rules improves utility but makes them more difficult to audit. We do not evaluate this trade- off, which would require a user-study and likely exceeds the scope of our work. Second, our experiments assumes the task metric is reliable. However, ifμis noisy, sparse, or mis- aligned with the true objective, MAC may learn rules that optimize the metric without improving actual task perfor- mance. Third, rules can interact in unexpected ways when the constitution grows too large. Adding a new rule may conflict with existing rules or cause unintended side effects on previously correct predictions. This may become a prob- lem once the constitution outgrows the maximum context length of the ANNOTATOR or DECISION agent, which we do not evaluate in our work. 6. Conclusion Constitutional AI offers transparent, inference-time control over LLM behavior, but writing effective constitutions is dif- ficult and time-consuming. We formalize constitution learn- 8 MAC: Multi-Agent Constitution Learning ing as the task of automatically deriving interpretable rules from labeled examples, and propose MAC, a multi-agent method where specialized agents propose, critique, and re- fine rules. MAC outperforms prompt-optimization baselines by over 50% on private information tagging across legal, healthcare, and finance domains, and matches or exceeds pretrained taggers without task-specific training. Retrieval augmentation (reMAC) improves performance for special- ized domains, while agent specialization (MAC+) enables smaller models to match larger ones without memorization risks. MAC also generalizes to tool calling, demonstrating applicability beyond classification. We hope this work initi- ates research on constitution learning as a transparent and effective alternative to unstructured prompt optimization. 7. Impact Statement All datasets used in our experiments are publicly available and contain either personally identifiable information (PII) that is authorized for public release or data shared with full consent from the relevant stakeholders. Any biases regarding what is considered private arise from the provided annotations, which reflect domain- or stakeholder-specific definitions. In addition, the underlying language models may encode biases from their pretraining data, which are outside the scope of this work and not modified by our approach. This work lowers the barrier to deploying privacy-preserving language model systems. By enabling privacy behavior to be specified and adapted through explicit constitutions rather than model fine-tuning, stakeholders can mark and revise what is considered private using only rule updates, without retraining models or exposing sensitive data during opti- mization. This is particularly important in privacy-sensitive deployments, where fine-tuning can introduce memorization risks and operational constraints. More broadly, our work advances a new paradigm of con- stitution learning, in which transparent, auditable rule sets are learned directly from data under task feedback. By restricting optimization to explicit rules rather than uncon- strained prompt rewrites, this approach improves trust, inter- pretability, and stakeholder control while achieving strong performance. We believe this represents an important step toward safer and more accountable use of language models in high-stakes applications. 8. Author Acknowledgment Francesco Pinto (affiliated with Google DeepMind) con- tributed in an individual advisory capacity. References Lakshya A Agrawal, Shangyin Tan, Dilara Soylu, Noah Ziems, Rishi Khare, Krista Opsahl-Ong, Arnav Singhvi, Herumb Shandilya, Michael J Ryan, Meng Jiang, Christo- pher Potts, Koushik Sen, Alexandros G. Dimakis, Ion Stoica, Dan Klein, Matei Zaharia, and Omar Khattab. Gepa: Reflective prompt evolution can outperform re- inforcement learning, 2025. URLhttps://arxiv. org/abs/2507.19457. Alan Akbik, Tanja Bergmann, Duncan Blythe, Kashif Ra- sul, Stefan Schweter, and Roland Vollgraf. Flair: An easy-to-use framework for state-of-the-art nlp. In Pro- ceedings of the 2019 conference of the North American chapter of the association for computational linguistics (demonstrations), pages 54–59, 2019. Meysam Alizadeh, Zeynab Samei, Daria Stetsenko, and Fabrizio Gilardi. Simple prompt injection attacks can leak personal data observed by llm agents during task execution. arXiv preprint arXiv:2506.01055, 2025. Yuntao Bai, Saurav Kadavath, Sandipan Kundu, Amanda Askell, Jackson Kernion, Andy Jones, Anna Chen, Anna Goldie, Azalia Mirhoseini, Cameron McKinnon, et al. Constitutional ai: Harmlessness from ai feedback. arXiv preprint arXiv:2212.08073, 2022. Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Lan- guage models are few-shot learners. Advances in neural information processing systems, 33:1877–1901, 2020. Nicholas Carlini, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Florian Tramer, and Chiyuan Zhang. Quantifying memorization across neural language mod- els, 2023. URLhttps://arxiv.org/abs/2202. 07646. J. Harry Caufield. Maccrobat2020 dataset.https://doi. org/10.6084/m9.figshare.9764942.v2 , 2020. Version 2 of the MACCROBAT2018 dataset on Figshare. Ilias Chalkidis, Ion Androutsopoulos, and Nikolaos Ale- tras. Neural legal judgment prediction in English. In Anna Korhonen, David Traum, and Llu ́ ıs M ` arquez, ed- itors, Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pages 4317– 4323, Florence, Italy, July 2019. Association for Compu- tational Linguistics. doi: 10.18653/v1/P19-1424. URL https://aclanthology.org/P19-1424. Chi-Min Chan, Weize Chen, Yusheng Su, Jianxuan Yu, Wei Xue, Shanghang Zhang, Jie Fu, and Zhiyuan Liu. 9 MAC: Multi-Agent Constitution Learning Chateval: Towards better llm-based evaluators through multi-agent debate. arXiv preprint arXiv:2308.07201, 2023. Justin Chen, Swarnadeep Saha, and Mohit Bansal. Recon- cile: Round-table conference improves reasoning via con- sensus among diverse llms. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 7066–7085, 2024. Yilun Du, Shuang Li, Antonio Torralba, Joshua B Tenen- baum, and Igor Mordatch. Improving factuality and rea- soning in language models through multiagent debate. In Forty-first International Conference on Machine Learn- ing, 2023. Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen- Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language mod- els. arXiv preprint arXiv:2106.09685, 2021a. Edward J. Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen- Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. Lora: Low-rank adaptation of large language mod- els, 2021b. URLhttps://arxiv.org/abs/2106. 09685. Jie Huang, Hanyin Shao, and Kevin Chen-Chuan Chang. Are large pre-trained language models leaking your per- sonal information?, 2022.URLhttps://arxiv. org/abs/2205.12628. Saffron Huang, Divya Siddarth, Liane Lovitt, Thomas I Liao, Esin Durmus, Alex Tamkin, and Deep Ganguli. Collective constitutional ai: Aligning a language model with public input. In Proceedings of the 2024 ACM Con- ference on Fairness, Accountability, and Transparency, pages 1395–1417, 2024. Navjeet Kaur, Ashish Saha, Makul Swami, Muskan Singh, and Ravi Dalal. Bert-ner: A transformer-based approach for named entity recognition. In 2024 15th international conference on computing communication and networking technologies (ICCCNT), pages 1–7. IEEE, 2024. Siwon Kim, Sangdoo Yun, Hwaran Lee, Martin Gubri, Sungroh Yoon, and Seong Joon Oh. Propile: Probing privacy leakage in large language models, 2023. URL https://arxiv.org/abs/2307.01881. Jing Li, Aixin Sun, Jianglei Han, and Chenliang Li. A survey on deep learning for named entity recognition. IEEE transactions on knowledge and data engineering, 34(1):50–70, 2020. Siyan Li, Vethavikashini Chithrra Raghuram, Omar Khattab, Julia Hirschberg, and Zhou Yu. Papillon: Privacy preser- vation from internet-based and local language model en- sembles. In Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technolo- gies (Volume 1: Long Papers), pages 3371–3390, 2025. Erika McCallister. Guide to protecting the confidentiality of personally identifiable information. Diane Publishing, 2010. Microsoft. Presidio: Data protection and de-identification sdk.https://microsoft.github.io/ presidio/, 2025. Accessed: 2025-08-28. NVIDIA. GLiNER-PII: PII/PHI Detection Model.https: //huggingface.co/nvidia/gliner-PII, 2025. Accessed: 2026-01-05; Token classification model for detecting personally identifiable information (PII) and protected health information (PHI) built on the GLiNER architecture. Krista Opsahl-Ong, Michael J Ryan, Josh Purtell, David Broman, Christopher Potts, Matei Zaharia, and Omar Khattab. Optimizing instructions and demonstrations for multi-stage language model programs, 2024. URL https://arxiv.org/abs/2406.11695. Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Car- roll Wainwright, Pamela Mishkin, Chong Zhang, Sand- hini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feed- back. Advances in neural information processing systems, 35:27730–27744, 2022. Shishir G. Patil, Huanzhi Mao, Charlie Cheng-Jie Ji, Fanjia Yan, Vishnu Suresh, Ion Stoica, and Joseph E. Gonzalez. The berkeley function calling leaderboard (bfcl): From tool use to agentic evaluation of large language models. In Forty-second International Conference on Machine Learning, 2025. Qwen, :, An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, Huan Lin, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Yang, Jiaxi Yang, Jingren Zhou, Junyang Lin, Kai Dang, Keming Lu, Keqin Bao, Kexin Yang, Le Yu, Mei Li, Mingfeng Xue, Pei Zhang, Qin Zhu, Rui Men, Runji Lin, Tianhao Li, Tianyi Tang, Tingyu Xia, Xingzhang Ren, Xuancheng Ren, Yang Fan, Yang Su, Yichang Zhang, Yu Wan, Yuqiong Liu, Zeyu Cui, Zhenru Zhang, and Zihan Qiu. Qwen2.5 technical re- port, 2025. URLhttps://arxiv.org/abs/2412. 15115. 10 MAC: Multi-Agent Constitution Learning Kiran Ramnath, Kang Zhou, Sheng Guan, Soumya Smruti Mishra, Xuan Qi, Zhengyuan Shen, Shuai Wang, Sang- min Woo, Sullam Jeoung, Yawei Wang, et al. A system- atic survey of automatic prompt optimization techniques. arXiv preprint arXiv:2502.16923, 2025. Erik Tjong Kim Sang and Fien De Meulder. Introduction to the conll-2003 shared task: Language-independent named entity recognition. In Proceedings of the seventh conference on Natural language learning at HLT-NAACL 2003, pages 142–147, 2003. Xavier Schmitt, Sylvain Kubler, J ́ er ́ emy Robert, Mike Pa- padakis, and Yves LeTraon. A replicable comparison study of ner software: Stanfordnlp, nltk, opennlp, spacy, gate. In 2019 sixth international conference on social networks analysis, management and security (SNAMS), pages 338–343. IEEE, 2019. Paul M Schwartz and Daniel J Solove. The pii problem: Privacy and a new concept of personally identifiable in- formation. NYUL rev., 86:1814, 2011. Zhihong Shao, Peiyi Wang, Qihao Zhu, Runxin Xu, Junxiao Song, Xiao Bi, Haowei Zhang, Mingchuan Zhang, Y. K. Li, Y. Wu, and Daya Guo. Deepseekmath: Pushing the limits of mathematical reasoning in open language mod- els, 2024. URLhttps://arxiv.org/abs/2402. 03300. Mrinank Sharma, Meg Tong, Jesse Mu, Jerry Wei, Jorrit Kruthoff, Scott Goodfriend, Euan Ong, Alwin Peng, Raj Agarwal, Cem Anil, et al. Constitutional classifiers: De- fending against universal jailbreaks across thousands of hours of red teaming. arXiv preprint arXiv:2501.18837, 2025. Robin Staab, Mark Vero, Mislav Balunovi ́ c, and Martin Vechev. Large language models are advanced anonymiz- ers. arXiv preprint arXiv:2402.13846, 2024. Bo Wang, Weiyi He, Shenglai Zeng, Zhen Xiang, Yue Xing, Jiliang Tang, and Pengfei He. Unveiling privacy risks in llm agent memory. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 25241–25260, 2025. Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al. Chain-of-thought prompting elicits reasoning in large language models. Advances in neural information pro- cessing systems, 35:24824–24837, 2022. Biwei Yan, Kun Li, Minghui Xu, Yueyan Dong, Yue Zhang, Zhaochun Ren, and Xiuzhen Cheng. On protecting the data privacy of large language models (llms) and llm agents: A literature review. High-Confidence Computing, page 100300, 2025. Chengrun Yang, Xuezhi Wang, Yifeng Lu, Hanxiao Liu, Quoc V Le, Denny Zhou, and Xinyun Chen. Large lan- guage models as optimizers. In The Twelfth International Conference on Learning Representations, 2023. Urchade Zaratiana, Gil Pasternak, Oliver Boyd, George Hurn-Maloney, and Ash Lewis. Gliner2: An efficient multi-task information extraction system with schema- driven interface, 2025. URLhttps://arxiv.org/ abs/2507.18546. 9. Appendix 9.1. Dataset Statistics The full statistics for the Legal, Healthcare and finance datasets used as part of this work are available in Table 9. 9.2. Agent Prompts The full system prompts used for each agent are lengthy and are omitted for brevity. We instead summarize the key logic and responsibilities of each agent below. 9.2.1. ANNOTATOR AGENT TheAnnotatoragent applies the current constitution to perform span-level private information tagging. Its system prompt defines the agent as a constitutional privacy anno- tation model and instructs it to apply the natural-language rules systematically to identify all private phrases in a given document, targeting high precision and recall. The user prompt provides (i) the full constitution text as a list of rules and (i) the document to be annotated. The agent is required to return a strict JSON object of the form "privatephrases": [...], where each entry is a text span extracted from the document. The prompt emphasizes that, when uncertain, the agent should prefer marking a span as private, explicitly prioritizing low false negatives (FN) over low false positives (FP), consistent with privacy-preserving deployment. To improve generalization, the prompt instructs the agent to use examples embedded in the rules as guidance but not to rely on examples as an exhaustive list. Instead, the agent must extrapolate from the rule descriptions to capture semantically similar spans. If the constitution is empty or unavailable, the agent is instructed to fall back to its own estimate of what constitutes private information, ensuring the system remains functional even when rule learning has not yet produced a stable constitution. 9.2.2. DECISION AGENT TheDecisionagent is the core control component that selects how to update the constitution based on observed 11 MAC: Multi-Agent Constitution Learning Table 9. Dataset statistics across domains after preprocessing and subsampling. Statistics are reported over the final 192 documents. StatisticMACCROBAT (Healthcare) PUPA (Finance) ECHR (Legal) Total characters542,124400,0411,547,159 Total private characters297,61653,701158,007 Private characters (%)54.913.4210.21 Public characters244,508346,3401,389,152 Public characters (%)45.186.5889.79 Total private entities24,1554,56411,156 Total private entity groups41298 Average entities per privacy group589.15157.381,394.50 Average characters per privacy group7,258.931,851.7619,750.88 Average characters per entity12.3211.7714.16 tagging errors. Its system prompt specifies that it must (i) inspect the current constitution rules used by the annotator, (i) analyze the current validation error profile, and (i) choose a strategic action to update the rule set: ADD, EDIT, or REMOVE. The prompt explicitly frames the decision as optimizing downstream tagging robustness while keeping the constitution concise. The user prompt provides a structured snapshot of the cur- rent state, including counts of false negatives (FN) and false positives (FP), total errors, the FP-per-FN ratio, the current number of rules, and optional trend information over recent updates. In addition, the agent is shown representative error patterns as sampled FN phrases (missed private spans) and FP phrases (incorrectly flagged spans), together with the full list of current constitutional rules. This structure forces the agent to ground decisions in concrete failure cases rather than abstract policy. The prompt then guides the agent through three checks: (1) assess whether FN or FP is the dominant issue by examining both the counts and the semantic patterns in the sampled phrases; (2) use the trend signal to detect whether recent changes are making rules overly broad (e.g., FP increas- ing) or overly conservative (e.g., persistent FN); and (3) verify whether current rules already cover the observed FN patterns (suggesting EDIT) or whether there are clear gaps (suggesting ADD), as well as whether any rule appears to be responsible for systematic FP (suggesting REMOVE or EDIT). Action selection is constrained by explicit heuristics. The agent is instructed to choose REMOVE when FP dominates or when the constitution becomes overly verbose, and to output the specific rule index to remove. It is instructed to choose ADD when FN is the primary issue and FP remains controlled, provided the system has capacity to introduce additional rules. It is instructed to choose EDIT when exist- ing rules appear misaligned with the observed errors, e.g., a rule is too broad and causes FP, or too narrow and causes FN, and to output the rule index to edit. The prompt further prioritizes recall by explicitly instructing the agent to prefer reducing FN over reducing FP, reflecting the task objective that missing private spans is worse than over-redacting. Finally, the agent is required to return a strict JSON object containing: the chosen action, a rule index (or−1for ADD), and a short step-by-step rationale. Enforcing a fixed JSON schema ensures the decision is machine-readable and can be routed deterministically to theCreatororEditoragent for the subsequent update step. 9.2.3. RULECREATOR AGENT TheCreatoragent is responsible for proposing new con- stitutional rules when the decision agent selects an ADD action. Its system prompt frames the agent as an expert constitutional rule engineer whose objective is to improve private information tagging performance by introducing a single, well-targeted rule grounded in observed failure pat- terns. The prompt provides the agent with several structured in- puts. First, it includes the prior decision analysis, which summarizes the reasoning that led to the choice of adding a rule, ensuring the new rule is aligned with the identified failure mode. Second, the current constitution state is pro- vided, allowing the agent to avoid duplicating or overlapping existing rules. Third, the agent is shown sampled false neg- atives and false positives together with their surrounding context. These error examples are explicitly presented as partial evidence rather than exhaustive cases, discouraging memorization and encouraging generalization. Finally, a learning history of previously rejected updates is included so that the agent can avoid repeating ineffective rule formu- lations. The prompt imposes strict constraints on rule construction. The agent must output exactly one new rule, expressed as concise natural language under a fixed length budget, and must not include literal private tokens that would overfit to the observed data. Rules are required to clearly specify what should be marked as private, followed by boundaries that clarify what should not be marked. To support flex- 12 MAC: Multi-Agent Constitution Learning ibility, the prompt enumerates multiple permissible rule- writing styles (e.g., direct, contrast-based, context-triggered, function-based), encouraging the agent to select or com- bine styles that best address the observed errors rather than mimicking existing rules. The agent is required to return its output as a strict JSON ob- ject containing only the proposed rule text. This constraint ensures the output can be programmatically inserted into the constitution and subsequently evaluated, while preserving interpretability and auditability of the learned rules. 9.2.4. RULEEDITOR AGENT TheEditoragent is invoked when the decision agent se- lects an EDIT action. Its role is to revise a specific existing rule in the constitution to correct observed failure modes while preserving the overall structure and intent of the rule set. Unlike the creator agent, which introduces new rules, the editor agent performs targeted modifications to an iden- tified rule. The prompt provides the agent with the index of the rule to be edited and the full current constitution, allowing the agent to localize the change and avoid introducing redundancy. The agent is also given the prior decision reasoning explain- ing why this rule was selected for editing, grounding the update in the strategic diagnosis of the system’s errors. In ad- dition, the agent receives sampled false negatives and false positives together with their surrounding context, which it must analyze to understand how the existing rule contributes to over- or under-marking. To prevent ineffective updates, the prompt includes a his- tory of previously rejected edits based on validation F1, encouraging the agent to avoid repeating unsuccessful mod- ifications. The agent is instructed to make surgical edits, refining boundaries, conditions, or scope rather than rewrit- ing the rule wholesale, unless a change in style is warranted. Multiple rule-writing styles are permitted, but all edits must remain concise, avoid memorization of literal private tokens, and stay within a fixed length budget. The editor agent is required to output exactly one revised rule as a strict JSON object. This constraint ensures that edits are directly comparable, auditable, and can be auto- matically substituted into the constitution for subsequent evaluation. 9.3. Implementation For all evaluations, we use Qwen 2.5 Instruct models (Qwen et al., 2025) at 3B, 7B, and 14B parameters, deployed with vLLM. Inference uses temperature 1.0, sampling enabled, topp = 0.9,topk = 50, and repetition penalty 1.0. We report F1 as the primary metric, computed by exact match- ing between predicted and ground-truth private spans, where only exact span matches are counted as correct. We com- pare MAC against three baselines: pretrained PII taggers used in practice, prompt-optimization methods that optimize natural-language instructions without updating model pa- rameters, and training-based methods including supervised fine-tuning (Hu et al., 2021b) and GRPO (Shao et al., 2024). For all approaches, training is run for 3 epochs over 20 batches, with validation performed every 5 batches. Pretrained taggers: We compare against commonly used non-generative PII tagging models. As a representative baseline, we use Microsoft Presidio (Microsoft, 2025), a modular framework combining rule-based methods, NER (Li et al., 2020), and context-aware detectors, and adopted in prior work (Staab et al., 2024). We evaluate its best- performing components used in practice: BERT-NER (Kaur et al., 2024), SpaCy (Schmitt et al., 2019), and Flair (Ak- bik et al., 2019), which perform span-level tagging with fixed entity definitions. We also benchmark GLiNER-PII (NVIDIA, 2025), a non-generative span-level model that supports over 55 PII and PHI categories across structured and unstructured text. Prompt optimization baselines: We compare against Genetic-Pareto (GEPA) (Agrawal et al., 2025), which per- forms evolutionary prompt search using task feedback, and Multiprompt Instruction Proposal Optimizer (MIPRO) (Opsahl-Ong et al., 2024), which iteratively proposes and selects prompt variants. MAC uses 20 batches of 8 doc- uments over 3 epochs, totaling 480 forward passes, and GEPA and MIPRO are configured with the same budget for fairness. For GEPA, we setmaxmetriccalls = 480,batchsize = 8, and use a reflection model with maxcontextlength = 3000andtemperature = 1.0. For MIPRO, we cap optimization at 480 total eval- uations for parity. We usebatchsize = 8, run 60 trials with full evaluation every 5 steps, and consider 32 candidate prompts per iteration. The reflection and evalu- ation models use amaxcontextlength = 3000and temperature = 1.0, with minibatch-based evaluations over 8 documents. Training-Based Baselines: For GRPO, we train with 8 rollouts per prompt, a maxi- mum completion length of 512 tokens, and a maximum prompt length of 3000 tokens. Training uses a per-device batch size of 8 for 3 epochs, with learning rate1× 10 −5 , a cosine scheduler, and warmup ratio 0.1. Sampling uses temperature 1.0 and top-p0.9, with no KL regularization (β = 0.0). To match data exposure, we sample 20 training examples per epoch and generate 8 rollouts per example, yielding 160 rollouts per epoch. GRPO uses the same LoRA configuration as SFT. For SFT, we fine-tune using Low-Rank Adaptation (LoRA) 13 MAC: Multi-Agent Constitution Learning (Hu et al., 2021a) with rankr = 64, scaling factorα = 128, and dropout 0.05, applied to attention and feed-forward projection layers (qproj,kproj,vproj,oproj, upproj,downproj,gateproj). Training uses the same 20 batches for 3 epochs, with validation and testing on the same 16-document splits used across all methods. 9.4. Constitutions learnt using MAC for all model sizes and datasets The first 3 rules from MAC learnt constitutions are available in Table 10. 9.5. Re-MAC: Retrieval augmented MAC Plots showcasing the improvement in performance by adding different few shot samples (documents) using differ- ent strategies in Re-MAC is shown in Figure 7. 9.6. Learning a constitution using MAC Plots showcasing the evolution of validation F1 by updating the constitution are shown in Figure 8. 9.7. MAC+ Loss Curves Loss curves for all agents tuned as part of MAC+ are shown in Figure 9. 9.8. Rollout Statistics for Dataset used for MAC+ Statistics for the dataset used to tune each agent in MAC to obtain MAC+ are shown in Table 11. We collect agent- specific execution trajectories generated by the 14B model and use them to supervise and specialize each agent via fine-tuning. Less frequently invoked agents contribute all available trajectories, while more frequent agents are capped at 1,000 samples. 9.9. Outputs from MAC Agents for a random rollout - Legal Sample outputs from the MAC Annotator Agent are shown in Table 12. Examples of Decision Agent actions are pro- vided for adding rules (Table 13), removing rules (Table 14), and editing rules (Table 15). 9.10. Learnt prompts for GEPA - Legal GEPA-learned prompts for the Annotator Agent on the ECHR dataset are provided as follows: 3B model prompts in Tables 16 and 17; 7B model prompts in Tables 18, 19, and 20; and 14B model prompts in Tables 21 and 22. 9.11. Learnt prompts for MIPRO - Legal MIPRO-learned prompts for the Annotator Agent on the ECHR dataset are provided as follows: 3B model prompts in Table 23, 7B model prompts in Table 24, and 14B model prompts in Table 25. 9.12. LLM-as-a-judge prompt for computing agent performance The full LLM-as-a-judge prompt used to compare MAC+ performance is shown in Tables 26 and 27. 14 MAC: Multi-Agent Constitution Learning Figure 7. Re-MAC: Retrieval augmented MAC, test-performance (F1) for different numbers of retrieved examples. 15 MAC: Multi-Agent Constitution Learning Table 10. Learned constitutions (top 3 rules) for each model size and dataset. Each cell lists the first three rules of the best-selected constitution. Model LegalHealthcareFinance 3B# Rules: 3# Rules: 7# Rules: 13 Rules 1. Mark names, dates, OTPs, IDs, phone numbers; exclude non-private terms (e.g., “applicant”, months); mark names only when supporting a specific private item/ID; exclude non-identifiers (e.g., “in”, “and”, “on”). 2. Mark numeric dates; do not mark surrounding words. Example: 1982, 15 December 2004. 3. Mark dates (Y, M/D/Y); exclude common non-private terms (e.g., “the applicant”, “court”); do not mark ordinal suffixes (“st”, “nd”, “rd”, “th”). 1. Mark personal identifiers (names, dates, SSNs, phone numbers, emails, etc.); do not mark common words/placeholders (e.g., “IV”, “hands”, “died”). 2. Mark full names, dates, SSNs, phone numbers, emails, medical IDs (ICD/MRN), lab test IDs (PT#, CBC#), and identifiers in context (e.g., “ID:”, “DOB:”); do not mark clinical descriptors unless part of the identifier. 3. Mark full names, DOBs, SSNs, phone numbers, emails, medical/lab IDs and labeled identifiers; do not mark generic clinical terms (e.g., “progression”, “recovery”) unless tied to specific identifiers. 1. Mark tokens that uniquely identify individuals (e.g., names, emails, phone numbers, SSNs, addresses, dates); avoid generic context or logs unless they explicitly identify a person; exclude non-identifying descriptors and industry terms. Example: John Doe ¡j.doe@company.com¿ 1952-06-24 95 AVA BLANCET FRAUZ. 2. Mark explicit identifiers and labeled fields (e.g., Name, Email, Address, Date) when they contain identifying information; exclude generic narrative text and industry-specific terminology without identifiers. Example: John Doe ¡j.doe@company.com¿ 1952-06-24 95 AVA BLANCET FRAUZ. 3. Mark identifiers appearing in structured or semi-structured contexts (e.g., IDs, contact fields, combined identifiers); do not mark log-only or industry terms unless they directly reference an identifiable entity. 7B# Rules: 4# Rules: 12# Rules: 16 Rules1. Mark dates, times, and durations that specifically reference case numbers or dates of legal events; do not mark general temporal references or unrelated numbers. 2. Mark personal names; do not mark titles/roles unless they precede the name. 3. Mark nationality, titles following names, and specific government officials; do not mark generic titles or roles. 1. Mark phrases indicating medical conditions or treatments (drug names, disease names, procedures), but not surrounding text unless it directly identifies a person. 2. Mark phrases indicating medical conditions/treatments and clinical descriptors (e.g., “best-corrected visual acuity”); do not mark surrounding text unless directly identifying. 3. Mark age/gender/introduction phrases in records (e.g., “62-year-old”, “female”, “presented to...”); do not mark surrounding text unless directly identifying. 1. Mark dates, times, monetary values, and names as private; do not mark surrounding text unless it directly identifies a person. 2. Mark names as private; do not mark surrounding text unless it directly identifies a person. 3. Mark names, email addresses, and phone numbers as private; do not mark surrounding text unless it directly identifies a person. 14B# Rules: 15# Rules: 4# Rules: 7 Rules 1. Mark as private specific dates and location names within legal/case documents; do not mark generic descriptors or full sentences containing such terms. 2. Mark official titles when they refer to individuals, specific dates, and specific location names; do not mark generic titles or broad locations. 3. Mark specific numbers in case details (e.g., witnesses, event dates) but not general narrative numbers. 1. Mark medical procedures, diagnoses, and medical equipment in clinical contexts as private; do not mark general terms outside medical narratives; split adjacent phrases when needed. 2. Mark conditions, treatments, procedures, and anatomical features in medical contexts; do not mark general terms outside medical narratives; split adjacent phrases when needed. 3. Mark age, gender, and personal titles when appearing in referral/record introductions (e.g., “A 68-year-old man...”). 1. Context-triggered: mark dates/times/names/contact details when preceded by labels (e.g., “Date:”, “Name:”); do not mark the labels. 2. Mark any phrase that can uniquely identify an individual/organization (names, dates, contact details, identifiers); do not mark generic roles/broad locations/placeholders without identifiers. 3. Function-based: mark phrases containing multiple identifying elements in a single statement; avoid marking generic text unless it includes specific identifiers. 16 MAC: Multi-Agent Constitution Learning 0204060 Batch 0.0 0.2 0.4 0.6 0.8 1.0 Score 3B - echr Precision Recall F1 0204060 Batch 0.0 0.2 0.4 0.6 0.8 1.0 Score 7B - echr Precision Recall F1 0204060 Batch 0.0 0.2 0.4 0.6 0.8 1.0 Score 14B - echr Precision Recall F1 0204060 Batch 0.0 0.2 0.4 0.6 0.8 1.0 Score 3B - finance Precision Recall F1 0204060 Batch 0.0 0.2 0.4 0.6 0.8 1.0 Score 7B - finance Precision Recall F1 0204060 Batch 0.0 0.2 0.4 0.6 0.8 1.0 Score 14B - finance Precision Recall F1 0204060 Batch 0.0 0.2 0.4 0.6 0.8 1.0 Score 3B - maccrobat2020 Precision Recall F1 0204060 Batch 0.0 0.2 0.4 0.6 0.8 1.0 Score 7B - maccrobat2020 Precision Recall F1 0204060 Batch 0.0 0.2 0.4 0.6 0.8 1.0 Score 14B - maccrobat2020 Precision Recall F1 Validation Metrics (60 batches, eval every 5) Figure 8. Validation precision, recall and F1 over batches for MAC across different model sizes. Agent RoleRolloutsTotal InputTotal OutputAvg. InputAvg. Output Annotator Agent1,0001,466,839378,0131,466.8378.0 Decision Agent6971,402,74864,2572,012.692.2 Rule Editor Agent132366,92711,3272,779.885.8 Rule Proposer Agent1,0003,178,30374,9053,178.374.9 Total2,8296,414,817528,5022,267.5186.8 Table 11. Rollout statistics and token counts per agent role used for supervised fine-tuning in MAC+. 17 MAC: Multi-Agent Constitution Learning Table 12 MAC Annotator agent output for a random rollout – Legal Based on the provided constitution rules, here are the private phrases identified in the text: ‘json "private_phrases": [ "application (no. 48545/99)", ------------------- REMOVED FOR BREVITY ------------------- "Court of Cassation", "15 November 1999" ] ‘ ### Explanation: 1. ** Application Number ** : ‘"application (no. 48545/99)"‘ - Specific application number, marked as private per Rule 21. 2. ** Individual Names ** : ‘"Mr Mehmet S ̧ah C ̧elik"‘, ‘"Mr Ferhan Arasan"‘, ‘"Mr Mehmet Emin G ̈ ung ̈ or"‘ - Specific names of individuals in professional/legal contexts, marked as private per Rules 6, 18, and 25. 3. ** Dates ** : - ‘"16 December 1994"‘, ‘"30 December 1994"‘, ‘"11 January 1995"‘, ‘"17 January 1995"‘, ‘"16 March 1995"‘, ‘"7 September 1995"‘, ‘"7 November 1996"‘, ‘"19 December 1996"‘, ‘"8 July 1997"‘, ‘"18 December 1998"‘, ‘"15 November 1999"‘ - Specific dates in legal/professional contexts, marked as private per Rules 5, 10, 17, and 27. 4. ** Organizations ** : ‘"Batman Security Directorate"‘, ‘"Batman Magistrates’ Court"‘, ‘"Diyarbakır State Security Court"‘, ‘"Court of Cassation"‘ - Specific names of organizations directly linked to legal actions, marked as private per Rules 12, 16, and 25. 5. ** Birth Year ** : ‘"1979"‘ - Specific year of birth, marked as private per Rule 11. 6. ** Prison Name ** : ‘"Batman E-type Prison"‘ - Specific name of prison, marked as private per Rule 13. 7. ** Organization Name ** : ‘"PKK (the Kurdish Workers’ Party)" ‘ - Specific name of an organization in a professional/legal context, marked as private per Rule 25. These phrases are identified as private according to the provided rules. 18 MAC: Multi-Agent Constitution Learning Table 13 MAC Decision agent output for a random rollout – Legal (Add operation) "action": "add", "rule_index": "-1", "reasoning": "Step-by-step analysis: [1] Current balance assessment: There are significantly more False Negatives compared to False Positives. [2] Main problem identified: The system is missing important privacy terms (high FN). [3] Why this action best addresses it: Adding new rules to cover missed privacy terms will improve the system’s accuracy without causing an excessive number of false alarms." Table 14 MAC Decision agent output for a random rollout – Legal (Remove operation) "action": "remove", "rule_index": 0, "reasoning": "Current balance assessment: The system is marking too much as private, as evidenced by the high number of false positives (FP) compared to false negatives (FN). Main problem identified: The rules are overly broad, matching non-private terms like dates and places in the FP list. Why this action best addresses it: Removing the first rule will reduce the likelihood of false alarms while allowing for more targeted rules to address the FN patterns." Table 15 MAC Decision agent output for a random rollout – Legal (Edit operation) "action": "edit", "rule_index": 0, "reasoning": "Step-by-step analysis: [1] Current balance assessment: FN phrases are general temporal references like ’1 May 1993’, ’18 years’, and ’6 September 2007’, while FP phrases include specific legal event references such as ’26 April 1993’. This suggests the system is too conservative. [2] Main problem identified: The system is missing privacy items due to overly specific rules, leading to a high number of FN errors. [3] Why this action best addresses it: Editing Rule 0 to include general temporal references will help reduce FN errors while maintaining control over FP." 19 MAC: Multi-Agent Constitution Learning Table 16 GEPA learnt prompt using a 3B model for private-token tagging on the Legal dataset json "private_phrases": [] ‘ ### Detailed Task Description You are tasked with identifying and annotating private phrases within a given text related to the protection of human rights and fundamental freedoms as enshrined in the Constitution of Human Rights and Fundamental Freedoms (Convention for the Protection of Human Rights and Fundamental Freedoms). The annotated phrases should reflect sensitive personal information, such as names, dates of birth, addresses, financial details, and other potentially identifiable data that, if disclosed, could infringe upon an individual’s rights and fundamental freedoms. ### Input Format The input text will be a block of natural language describing factual events and contexts related to court cases, personal information, and financial matters. Your task is to parse through this text and highlight any phrases that could potentially identify individuals, groups, locations, or other private entities. ### Annotations Format Output should be in a JSON string as specified. The ‘private_phrases‘ field will contain an array of strings representing the phrases identified as private according to the guidelines above. ### Example Inputs #### Input Text ‘ "The case originated in an application (no. 3042/05) against the Republic of Turkey lodged with the Court under Article 34 of the Convention for the Protection of Human Rights and Fundamental Freedoms ("the Convention") by a Turkish national, Mr Nihat Konak ("the applicant"), on 19 November 2004. The applicant was represented by Mr M. A. Kırd ̈ ok, a lawyer practising in Istanbul. The Turkish Government ("the Government") were represented by their Agent." ‘ #### Expected Output ‘json "private_phrases": [ "Mr Nihat Konak", "Mr M. A. Kırd ̈ ok", "Istanbul" ] ‘ 20 MAC: Multi-Agent Constitution Learning Table 17 GEPA learnt prompt using a 3B model for private-token tagging on the Legal dataset (Continued...) ### Constraints and Considerations - ** Accuracy ** : Ensure that your annotations match the input text accurately and comply with the Constitution’s guidelines for privacy. - ** Generalizability ** : Focus on private entities rather than relying on examples provided in previous feedback. ### Feedback Analysis Feedback will consider the precision (how many false positives and false negatives are there) and recall (how comprehensive are the annotations). Your goal is to annotate the input text effectively and iteratively improve your annotations based on feedback. Adhere to the provided guidelines and JSON structure for the final output. 21 MAC: Multi-Agent Constitution Learning Table 18 GEPA learnt prompt using a 7B model for private-token tagging on the Legal dataset ## Instructions: You are a constitutional privacy annotation agent. Your task is to systematically apply a given set of constitutional rules to identify and annotate private phrases within a provided text. The goal is to ensure maximum precision and recall by marking all potentially private information, even if it means marking some non-private information as private to avoid missing any actual private details. Follow the detailed task description and guidelines below to complete the task accurately. ### Detailed Task Description: 1. ** Constitutional Rules: ** You will be given rules in natural language that define what constitutes private information. Use these rules to guide your annotations. The rules may include examples, which you should understand and extrapolate upon to identify all matching private phrases. 2. ** Annotation Task: ** Apply the constitutional rules to extract all matching private phrases from the provided text. The output should be structured as JSON, containing a list of all identified private phrases. 3. ** Precision and Recall: ** Prioritize high recall over high precision. This means that it is safer to err on the side of marking something as private when unsure to avoid missing any potentially private information. 4. ** Generalization: ** If no specific constitutional rules are provided, you should use your judgment to estimate what would be considered private based on typical legal and ethical standards. Do not simply rely on memorized examples. 5. ** Feedback Loop: ** After completing the task, a feedback score will be provided (F1 score). Use this feedback to refine your approach and improve the accuracy of your annotations. ### Guidelines: - ** Understand the Constitutional Rules Thoroughly: ** Carefully read and comprehend the given constitutional rules. Extrapolate from examples to cover all potential private information. - ** Extrapolate from Examples: ** Use provided examples to infer patterns and apply them to unseen texts. - ** Prioritize Marking as Private: ** If unsure, mark something as private to avoid missing any potentially private information. - ** Use General Legal and Ethical Standards: ** If no constitutional rules are provided, apply general legal and ethical standards to estimate what would be considered private. - ** Continuous Improvement: ** Use the feedback (F1 score) to adjust and refine your approach for better precision and recall. 22 MAC: Multi-Agent Constitution Learning Table 19 GEPA learnt prompt using a 7B model for private-token tagging on the Legal dataset (Continued...) ### Input Format: - ** clinical_text: ** The text to be annotated for privacy. ### Output Format: - JSON with a list of all identified private phrases. ### Domain-Specific Information: - ** Private Information Types: ** Names (e.g., Mr. X, Ms. Y), dates, addresses, and other identifying information. - ** Contextual Considerations: ** Consider the context of the document and the constitutional rules provided to ensure comprehensive coverage. - ** Ethical Standards: ** Follow general legal and ethical standards for identifying potentially private information. - ** Common Legal Entities: ** Names of countries, courts, and organizations are often considered private unless specified otherwise. - ** Dates: ** Include all dates mentioned in the text, especially those related to legal proceedings. - ** Addresses: ** If addresses are provided, they should be marked as private. - ** Names and Titles: ** Always mark names and titles (e.g., Mr., Mrs., Ms.) as potentially private. - ** Legal Context: ** Consider legal contexts such as filings, court dates, and proceedings. - ** Specific Examples: ** Pay attention to specific examples provided in the constitutional rules and extrapolate similarly. ### Example Strategies: 1. ** Name Identification: ** If a name is mentioned, mark it as private, even if it is not explicitly labeled as such in the rules. 2. ** Date Annotation: ** Mark all dates as private, regardless of context. 3. ** Address Recognition: ** If an address is provided, annotate it as private. 4. ** Legal Context: ** Consider legal contexts such as filings, court dates, and proceedings. 5. ** Extrapolation: ** Use examples to extrapolate and cover similar patterns in the text. 6. ** Ethical Standards: ** Apply general legal and ethical standards to identify private information. ### Final Instructions: Follow the guidelines and use the provided strategies to systematically annotate private phrases in the given text. Ensure comprehensive coverage and prioritize recall over precision. Use the feedback to continually refine your approach to improve the accuracy of your annotations. 23 MAC: Multi-Agent Constitution Learning Table 20 GEPA learnt prompt using a 7B model for private-token tagging on the Legal dataset (Continued...) ### Example Inputs and Outputs: ---------------------------- EXAMPLES REMOVED FOR BREVITY ---------------------------- ### Additional Notes: - Pay attention to names, dates, addresses, and other identifying information that could be considered private. - Consider the context of the document and the constitutional rules provided to ensure comprehensive coverage. - Use general legal and ethical standards if constitutional rules are not specified. ### Task: Based on the provided examples and feedback, you need to develop a systematic approach to annotate private phrases from the given text using the constitutional rules. Ensure that you mark all potentially private information and prioritize recall over precision. Use the feedback to continually refine your approach. ### Specific Strategies: 1. ** Name Identification: ** If a name is mentioned, mark it as private, even if it is not explicitly labeled as such in the rules. 2. ** Date Annotation: ** Mark all dates as private, regardless of context. 3. ** Address Recognition: ** If an address is provided, annotate it as private. 4. ** Legal Context: ** Consider legal contexts such as filings, court dates, and proceedings. 5. ** Extrapolation: ** Use examples to extrapolate and cover similar patterns in the text. 6. ** Ethical Standards: ** Apply general legal and ethical standards to identify private information. ### Continuous Improvement: - Use the feedback to adjust and refine your approach to improve precision and recall. - Focus on missed items and refine your annotations accordingly. 24 MAC: Multi-Agent Constitution Learning Table 21 GEPA learnt prompt using a 14B model for private-token tagging on the Legal dataset INSTRUCTIONS Your task involves analyzing legal documents from international human rights tribunals. The documents contain personal and procedural details of cases involving individuals, including personal names, ages, addresses, dates, and legal actions taken. You need to meticulously identify and mark all phrases that contain personally identifiable information (PII) or sensitive details about the individuals involved in these cases. Given the absence of clear RULES", you should use general principles of privacy and confidentiality. Err on the side of caution to avoid false negatives (missing private pieces of information). For each text, produce a JSON object with a key _phrases" whose value is an array of strings. Each string should represent a phrase from the text that contains information that should be treated as private or sensitive according to your judgment or provided guidelines. To optimize the F1 score, balance minimizing false positives (incorrectly marking information as private) and false negatives (overlooking truly private information). Aim to capture all potential private information, even if it leads to some false positives. Identify a variety of information types including names of people (lawyers, government officials, victims, defendants), dates (of arrests, trials, hearings), places (cities, prisons, courts, hospitals), organizations (legal, medical, governmental), and other data that could be used to identify individuals or reveal sensitive personal information. From past examples, recognize common patterns of private information like references to injuries, medical conditions, financial details (such as compensation amounts), and other sensitive personal data. Example analysis demonstrates capturing detailed personal information, legal proceedings descriptions, and locations of incidents or residences. --- 25 MAC: Multi-Agent Constitution Learning Table 22 GEPA learnt prompt using a 14B model for private-token tagging on the Legal dataset (Continued...) EXAMPLE FORMAT clinical_text TEXT TO ANALYZE HERE output private_phrases: * phrase1 * phrase2 * phrase3 --- DOMAIN INFORMATION PII and sensitive details in legal contexts include names, birthdates, addresses, organization affiliations, specific legal cases, and personal conditions or events. Dates, locations, and organizations often hold significant relevance and should be marked as private to protect individual identities and confidentiality. Ensure thorough identification of individuals involved in the cases, including lawyers, defendants, victims, and officials. Be cautious with medical details, financial amounts, and legal statuses as these can also constitute sensitive personal information. 26 MAC: Multi-Agent Constitution Learning Table 23 MIPRO learnt prompt using a 3B model for private-token tagging on the Legal dataset Annotate the provided clinical texts to identify private entities according to the following systematic rules: 1. Names of people (full names or initials). 2. Locations (specific place names). 3. Addresses (full addresses). 4. Phone numbers. 5. Email addresses. 6. Dates (exact dates or ranges). 7. Medical records (such as diagnoses or treatments). 8. Financial information (such as bank account numbers, credit card details). 9. Any other information that, according to common sense, should not be disclosed publicly. Please apply these rules to the provided clinical texts and annotate any matching private phrases in the following format: ‘json "private_phrases": ["phrase1", "phrase2", "phrase3"] ‘ Text: 27 MAC: Multi-Agent Constitution Learning Table 24 MIPRO learnt prompt using a 7B model for private-token tagging on the Legal dataset You are a constitutional privacy annotation agent. Your task is to extract private phrases from the provided clinical text, ensuring high precision and recall. You will be given some rules in natural language in the form of a constitution, use that to annotate private leaking stuff. Systematically apply the constitution rules to identify all private phrases. If no constitution is available, annotate based on your best judgment. When in doubt, err on the side of marking something as private to avoid false negatives (FN). ** ANNOTATION FORMAT: ** ‘json "private_phrases": ["phrase1", "phrase2", "phrase3"] ‘ Here are the ** CONSTITUTION RULES ** (if provided): ** ANNOTATION TASK: ** Apply the constitution rules systematically to extract all matching private phrases. Include all names, dates, places, and any other information that could potentially identify individuals, dates, or locations. Example Constitution Rules: - Names of individuals - Dates - Places - Case numbers - Identification numbers If the constitution does not explicitly mention a type of phrase, consider it private if it could be used to identify an individual or location. Now, based on the provided rules, annotate the following text: ** Text: ** 28 MAC: Multi-Agent Constitution Learning Table 25 MIPRO learnt prompt using a 14B model for private-token tagging on the Legal dataset Given a piece of clinical or procedural text related to legal cases involving human rights issues, your task is to extract all private phrases that could potentially reveal sensitive information, such as names, addresses, dates, and other identifiers. Your goal is to ensure a comprehensive extraction with minimal false negatives, even if it means risking false positives. Below is the provided text. Please adhere to the following guidelines while extracting private phrases: - Names of individuals (first name + last name, or last name alone if commonly used in the document). - Legal representatives and their professional titles. - Organizations, institutions, and official bodies mentioned. - Addresses and locations. - Dates mentioned, especially those tied to specific events or milestones. - Any unique identifiers or codes associated with legal documents or processes. Apply these principles systematically to extract all potential private phrases from the text. The output should be formatted as a JSON object, listing each private phrase individually. ** EXAMPLE OUTPUT FORMAT ** ‘json "private_phrases": ["phrase1", "phrase2", "phrase3"] ‘ ** TEXT FOR ANNOTATION ** [Provide the clinical/procedural text here] Please apply the aforementioned instructions to the provided text to generate the most accurate set of private phrases possible. 29 MAC: Multi-Agent Constitution Learning Table 26 LLM-as-a-Judge Prompt for Evaluating Agent Performance SYSTEM: You are an ** LLM-as-a-judge ** . Your job is to: 1. ** Identify the task ** based solely on the provided input. 2. You will then be given ** two candidate outputs ** for this task: * One from ** Model A ** * One from ** Model B ** 3. Your task is to ** select which output is better ** : ** A ** or ** B ** . ### Selection Criteria Choose the better output based on: * ** Quality of the answer ** * ** Clarity and correctness of the explanation ** ### Task Context All input tasks relate to ** updating a constitution ** that is used by an agent to ** identify and mark private tokens (PII) ** . The task will be one of the following types: 1. Decide whether to ** add, remove, or edit ** rules based on the current constitutional state and observed errors. 2. Receive an ** index of an existing rule ** and ** update it ** by writing a ** high-quality revised rule ** based on the provided reasoning. 3. ** Create a new rule ** from provided guidance and write a ** high-quality rule ** . ### Output Format You must output ** only a JSON object ** in the following format: ‘json "selection": "A" ‘ or ‘json "selection": "B" ‘ 30 MAC: Multi-Agent Constitution Learning Table 27 LLM-as-a-Judge Prompt for Evaluating Agent Performance USER: Here is the definition of the task, and the sample input. Note, it is a prompt, just understand this task but do not start doing the task itself that is not ure job. You should just use this to understand the task, that’s it. ** YOU MUST JUDGE BASED ONLY ON THE INPUT. ** ‘ INPUT ‘ USER: Here is the output from Model A based on the input: ‘ OUTPUT A ‘ USER: Here is the output from Model B based on the input: ‘ OUTPUT B ‘ USER: Now, based on the task described in the input and the two outputs above, select ** A ** or ** B ** . 31 MAC: Multi-Agent Constitution Learning Figure 9. Loss curves over training steps for all agents in MAC. 32