# Institutional-knowledge leakage in frontier AI models on realistic legal drafting[^about]

An evaluation of three frontier models on multi-state contract drafting inside a 367-document institutional knowledge base, with per-judge records, human adjudication, and upstream LAB harness contributions.

## Abstract {#abstract}

Frontier AI models have been saturating benchmarks: near-perfect needle-in-a-haystack recall at up to 10 million tokens of context[^gemini-3-pro-model-card][^gemini-2-5-technical-report][^gemini-1-5-technical-report], and LegalBench scores in excess of 80%.[^legalbench-guha-2023][^vals-ai-legalbench-leaderboard] For knowledge work, however, a trust gap remains, particularly in institutional contexts. Harvey's Legal Agent Benchmark (LAB) grades realistic legal tasks end-to-end on an all-pass standard: each LAB scenario hands the model about eight documents on average (2 to 55 documents per task, across 1,749 tasks), and the frontier models evaluated at launch completed fewer than 10% of tasks.[^harvey-lab-initial-results] We identify a concrete failure mode one layer deeper into institutional work. In exploratory testing on an evaluation environment that includes a 367-document knowledge base in each scenario (127 practice guides, 176 templates, 53 checklists, and 11 surveys), we observed frontier models leaking internal institutional analysis into a scenario's outward-facing deliverables, in particular contracts. We replicated a covenant-drafting task where the leakage failure appeared as a family of ten instances across different state combinations, scoring three frontier models on the single leakage criterion, with up to three model judges per cell and human adjudication of every leak verdict. The models stratify: 1, 4, and 7 leaking instances out of ten (Gemini 3.1 Pro Preview, GPT-5.5, and Claude Opus 4.8 respectively). Every leak verdict is human-adjudicated; the remaining clean cells are majority-of-three-judges verdicts.

This paper reports the evaluation. Its companion paper, [Expert-correction traces from maintaining an open legal knowledge base](/for-labs/data), reports the training-data capture that the same environment produces; the two stand independently: accepting the dataset does not require accepting this benchmark, and vice versa.

## Results {#results}

Across the ten instances of the covenant-package family, the three models leaked internal institutional analysis into an outward-facing agreement at different rates:

| Model | Leaked internal analysis into an outward-facing agreement\* |
| --- | --- |
| Gemini 3.1 Pro Preview | 1 of 10 instances |
| GPT-5.5 | 4 of 10 |
| Claude Opus 4.8 | 7 of 10 |

\* The original three-state instance is human-adjudicated end-to-end. Across the nine variant instances, every leaking cell is human-adjudicated (2026-07-12): the nine judge-majority leak verdicts were confirmed, and one judge-majority clean verdict was overturned to leaked. Remaining clean cells are majority-of-three-judges verdicts (Gemini 3.1 Pro, GPT-5.5, and Claude Sonnet 4.6 judges) with human adjudication in progress.

Per-instance verdicts (family order; fails are placement failures):

| Instance | States | Gemini 3.1 Pro Preview | GPT-5.5 | Claude Opus 4.8 | Adjudication |
| --- | --- | --- | --- | --- | --- |
| orig | California · Colorado · Texas | clean | **leaked** (human-adjudicated) | **leaked** (human-adjudicated) | human-adjudicated |
| v01 | Washington · Illinois · Georgia | clean | clean | **leaked** (human-adjudicated) | judge-majority (adjudication in progress) |
| v02 | Minnesota · Florida · Ohio | clean | clean | clean | judge-majority (adjudication in progress) |
| v03 | Massachusetts · Nevada · Virginia | clean | clean | **leaked** (human-adjudicated) | judge-majority (adjudication in progress) |
| v04 | Oregon · Louisiana · North Carolina | clean | clean | **leaked** (human-adjudicated) | judge-majority (adjudication in progress) |
| v05 | Tennessee · Arizona · New Jersey | clean | **leaked** (human-adjudicated) | **leaked** (human-adjudicated) | judge-majority (adjudication in progress) |
| v06 | Oklahoma · North Dakota · New York | clean | clean | clean | judge-majority (adjudication in progress) |
| v07 | Maine · Wisconsin · Michigan | clean | **leaked** (human-adjudicated) | **leaked** (human-adjudicated) | judge-majority (adjudication in progress) |
| v08 | New Hampshire · Alabama · Utah | **leaked** (human-adjudicated) | **leaked** (human-adjudicated) | **leaked** (human-adjudicated) | human-adjudicated |
| v09 | Maryland · Indiana · Missouri | clean | clean | clean | judge-majority (adjudication in progress) |

Verbatim model-output excerpts for each leaking cell (the bolded span is what leaked):

- **orig · GPT-5.5** — `frank-rivera-restrictive-covenant-agreement.md`:

  > This Agreement does **not** include a post-employment non-compete, customer non-solicitation, or no-business-with-customers covenant. **Employee's annualized cash compensation for this role is below the 2026 Colorado thresholds stated in the knowledge library for non-competes and customer non-solicits.** The Agreement is therefore limited to confidentiality, invention assignment, return of property, and a narrow active employee non-solicitation covenant.

- **orig · Claude Opus 4.8** — `frank-rivera-restrictive-covenant-agreement.md`:

  > Colorado scope note.** Under C.R.S. § 8-2-113, a post-employment non-compete is void unless the worker earns at least the highly compensated worker threshold ($130,014 for 2026), and a customer non-solicitation covenant is void unless the worker earns at least 60% of that threshold ($78,008.40 for 2026), in each case measured both at signing and at enforcement and only to protect trade secrets. Employee's annualized cash compensation ($72,000) is below both thresholds. **Presenting a void covenant to a worker is itself unlawful and carries a $5,000-per-worker penalty (C.R.S. § 8-2-113(8)).**

- **v01 · Claude Opus 4.8** — `sara-lindqvist-restrictive-covenant-agreement.md`:

  > No post-employment non-competition covenant is imposed. (**Employee's annualized earnings do not exceed the Washington statutory earnings threshold under RCW 49.62.020(1)(b), and any non-competition covenant would in any event be void on and after June 30, 2027.)**

- **v03 · Claude Opus 4.8** — `trevor-marsh-restrictive-covenant-agreement.md`:

  > To be completed by Employer with the specific competitors whose activity Employer reasonably seeks to restrain **(recommended, to narrow the covenant to its legitimate protective purpose)**.

- **v04 · Claude Opus 4.8** — `meredith-boyd-restrictive-covenant-agreement.md`:

  > If any distinctly severable provision is unreasonable or unenforceable, it is severed and the remaining provisions remain in effect. Time, territory, and activity restrictions are stated as divisible units, each intended to be reasonable standing alone, so that **a court applying North Carolina's strict blue-pencil doctrine may strike an unenforceable unit while enforcing the remainder.**

- **v05 · GPT-5.5** — `colin-reyes-restrictive-covenant-agreement.md`:

  > Not included. **Company is not requesting a post-employment non-compete because Employee's annualized compensation is below the Tennessee statutory threshold applicable to agreements entered into on or after July 1, 2026.**

- **v05 · Claude Opus 4.8** — `simone-walker-restrictive-covenant-agreement.md`:

  > [If Employer maintains a list of its actual direct competitors in the mid-market accounting-automation and close-management software market, insert the named list here. **Naming actual competitors strengthens enforceability under Arizona law.**]

- **v07 · GPT-5.5** — `nina-petrov-restrictive-covenant-agreement.md`:

  > this agreement does not include a post-employment customer non-solicitation covenant. If Employee later assumes customer-facing or sales responsibility, **any customer covenant should be considered separately and supported by any required consideration.**

- **v07 · Claude Opus 4.8** — `molly-cormier-restrictive-covenant-agreement.md`:

  > Non-Compete Status** : **Omitted.** **Employee's annual wages ($52,000) are at or below 400% of the federal poverty level (the 2025 indexed wage floor under 26 M.R.S.**

- **v08 · Gemini 3.1 Pro Preview** — `tyler-boudreau-restrictive-covenant-agreement.md`:

  > : none (**omitted pursuant to NH RSA 275:70-a low-wage ban**)

- **v08 · GPT-5.5** — `jenna-park-restrictive-covenant-agreement.md`:

  > Because Employee's primary work state is Utah, **the non-compete is capped at one (1) year from the day employment ends and is intended to satisfy Utah's common-law reasonableness requirements.**

- **v08 · Claude Opus 4.8** — `jenna-park-restrictive-covenant-agreement.md`:

  > **The Restricted Period for the post-employment non-compete may not exceed one year after Employee's employment ends; a non-compete that violates that cap is void under Utah Code § 34-51-201.**

One instance is human-adjudicated end-to-end (the original). Across the nine variant instances, every leaking cell has been human-adjudicated (2026-07-12): the nine judge-majority leak verdicts were confirmed, and one judge-majority clean verdict was overturned to leaked on review; the remaining clean cells are majority-of-three-judges verdicts. Every square above opens that cell's full record: the criterion, each judge's complete reasoning, and, where the cell has them, the human adjudication and verbatim excerpts of what leaked.

Each failure is a placement failure: accurate legal analysis written into the document an employee or counterparty receives, as drafting advice, statutory threshold math, penalty exposure, or references to the firm's internal resources inside operative agreements.

## Methods and materials {#methods}

### Harvey's LAB and our harness {#lab}

[Harvey's Legal Agent Benchmark (LAB)](https://github.com/harveyai/harvey-labs) provides an open harness for testing agents on realistic legal work: each scenario supplies a workspace of source documents, asks for finished deliverables, and grades them end-to-end on an all-pass standard. The strongest published result on LAB's independently run public leaderboard is currently 20% of tasks end-to-end, at roughly $0.80 per task (Meta's Muse Spark 1.1).[^vals-ai-hlab-leaderboard] We run LAB-compatible harness infrastructure, with the evaluator repairs described in [Extending Harvey's LAB](#extending-lab).

### Task construction {#task-construction}

The family replicates one task design, a multi-state covenant-drafting package, ten times with different state combinations. Each instance asks the model to draft restrictive-covenant agreements for employees in three states, working inside the institutional knowledge base described below, and is scored on a single criterion: whether internal analysis stayed out of the signed documents. The original instance surfaced the failure mode in exploratory testing; the nine variants were generated after that, an adaptive step toward where the models actually break, in the spirit of adaptive evaluation frameworks[^task-elicitation-brown-2025], and then frozen before scoring. The exploratory runs that preceded the freeze are excluded from every number on this page.

### Judging {#judging}

Agent runs used one production run per instance-model cell at fixed settings. Each cell carries up to three independent judge votes (Gemini 3.1 Pro, GPT-5.5, and Claude Sonnet 4.6), all under the reasoning-first schema at temperature zero. Claude Sonnet 4.6 judges because it is Harvey LAB's default judge; the Claude agent under test is Opus 4.8, deliberately distinct from the judge model. A human adjudicated every leak verdict, and the per-cell records on this page carry each judge's full reasoning alongside the adjudication text.

### Materials: a realistic institutional knowledge base {#materials}

Transactional lawyers work inside an institution: inherited templates, standing client instructions, practice resources, and deal point memos, with each matter arriving as deal-specific inputs like a term sheet or a change in the law. The work is to decide what controls, change what must change, preserve what should remain, and keep the legal analysis out of the document the counterparty will sign.

The [OpenAgreements](https://github.com/open-agreements/open-agreements) library supplies that institution in public form: primary-source-backed practice guides, checklists, and maintained agreement templates across all 50 states, the District of Columbia, and five U.S. territories. The corpus is not eval-only material. It is designed for ordinary practitioner drafting and review, and browser traffic attributable to people and user-directed AI sessions reaches thousands of fetches each month. Eval matters use synthetic facts and no client data, while the same public material that helps a person or agent do the work can be frozen at a known version and used to test whether the resulting work product is correct.

A workspace this shape also tests something retrieval alone does not supply: published results on reasoning-intensive legal benchmarks find that adding standard retrieval pipelines barely improves downstream accuracy over zero-shot performance[^lmars-wang-yuan-2025] — the graded question here is not whether the model can find the authority but what it may say, and where, once it has.

A public corpus invites an obvious objection: a model may have seen it in training. The tasks reduce that risk by drawing on restrictive-covenant law, which has changed substantially in most states over the past two years — the FTC's 2024 nationwide ban was set aside before it took effect, leaving the field to fast-moving state statutes[^ftc-rule-status] — and several of the seeded rules took effect within months of the tasks being written, so producing correct work product favors reading the workspace over recalling training data.

### The frozen environment {#frozen-environment}

A single commit SHA pins the tasks, harness, and evaluator. The freeze manifest records a git tree hash for every task, a SHA-256 hash of every file in every task workspace, the exact model settings, and the judge schema versions. Results are appended to the manifest's run log under append-only rules; nothing is overwritten or silently replaced.

## Extending Harvey's LAB {#extending-lab}

LAB's [independently run public leaderboard at Vals AI](https://www.vals.ai/benchmarks/hlab) currently reports end-to-end results for Meta, Grok, Claude, GPT, and open-weight models, with a single Flash-class Gemini entry and no Gemini Pro result yet. That gap is part of the motivation for this section: cross-provider evaluation only happens where the harness can actually run every provider, as agent and as judge. Working with LAB taught us that the evaluator is part of the system under test: a structured judge answer can be syntactically valid and still internally inconsistent. We made three evaluator contributions: two filed and submitted upstream (the routing repair and the field-order fix, with the issues and pull requests linked below), and one implemented in our LAB-compatible harness and disclosed here (contradiction routing). The production ensemble depends on all three.

**A Gemini judge required a routing repair.** The unpatched harness rejects provider-prefixed judge IDs like `google/gemini-3.1-pro-preview` before any API call is made. We filed [an upstream LAB issue](https://github.com/harveyai/harvey-labs/issues/104) (open) and submitted [an upstream change](https://github.com/harveyai/harvey-labs/pull/100) (open). In a side-by-side demonstration on one task from the same environment, the unpatched path still failed at routing with that error preserved, while the patched Gemini judge completed every criterion, a Claude judge control completed every criterion, and every arm that ran agreed on every verdict. One caveat we owe readers: we had earlier observed Google's endpoint rejecting a keyword in the judge's structured-output schema, but that rejection did not reproduce on re-test, so the case for the fix rests on the routing repair and on correctly handling the provider's parsed structured response. The goal is not to make one model look better; it is to make cross-provider evaluation possible and inspectable.

**Contradictory verdicts go to a human.** A `fail` verdict whose reasoning lacks explicit failure language, or whose reasoning concludes the criterion actually passes, is routed to human review with the raw judge response preserved. There is no automatic retry: re-rolling the judge until the fields agree would hide the failure instead of measuring it.

**Field order changes the verdict.** The original judge schema orders `verdict` before `reasoning`, so under structured output the judge commits to a verdict before writing the explanation. In a replication of ten judge calls per arm on one affected criterion (identical prompt, Claude Sonnet 4.6, temperature zero), the verdict-first schema returned `fail` ten out of ten, several with reasoning that concluded the package passes; with the fields reversed, ten out of ten returned `pass`, each consistent with its reasoning and with the human audit of the underlying documents. This is a demonstrated effect for this judge model on this criterion; we do not claim it generalizes across providers or criteria. We reported it upstream as [a LAB issue](https://github.com/harveyai/harvey-labs/issues/106) (open) and submitted [an upstream change](https://github.com/harveyai/harvey-labs/pull/105) (open) that reorders the schema so reasoning is written first. All production results are judged reasoning-first, and we disclose that choice because the schema is part of the measurement instrument.

Neither upstream change touches LAB's tasks or scoring rubric.

## Relation to other legal evaluations {#related-evaluations}

Independent leaderboards are worth reading alongside this paper precisely because they measure different things: on Vals AI's [Legal Research Bench](https://www.vals.ai/benchmarks/legal_research) (all-pass grading, updated July 2026), Claude Opus 4.8 leads at 43.75% all-pass, with Claude Sonnet 5 and GPT-5.5 close behind — roughly the reverse of the ordering our institutional-leakage criterion produces. The two measure different genres of legal work. Research benchmarks test open-ended retrieval and reasoning over public law; institutional drafting is closer to grounded generation (work product grounded in a firm's own knowledge base, the skill that grounding evaluations such as Google DeepMind's FACTS Grounding measure[^facts-grounding-2025]), plus a boundary discipline neither genre tests directly: deciding which grounded analysis may cross into the document the counterparty receives.

The leakage failure is also a different error family than the hallucination taxonomies studied for legal research tools[^magesh-hallucination-2024]: every leaked passage here is *accurate* law in the *wrong document*, a judgment failure grounding evaluations do not measure.

One finding of that leaderboard points in the same direction as this paper: its hardest category, for every model tested, is reconciling conflicting authority[^vals-ai-legal-research-leaderboard] — synthesizing conflicting sources, not locating a single rule, is where models break down most reliably. That is the shape of institutional work: our tasks hand the model an inherited template, standing client instructions, practice resources, and a change in the law at once, and the graded questions are which authority controls and what may be said in which document. The companion paper takes this up as a data question. That is why we publish the criterion, the per-instance judge records, and the raw judge output rather than a single score.

## Limitations and future directions {#limitations}

This paper measures one failure mode, on one task family, across ten instances; it is not a leaderboard. We publish it because the contribution is the method (realistic institutional drafting, a frozen environment, disclosed judging, and human adjudication with preserved raw output); the sample is small and we say so. Human adjudication is complete for every leaking cell (2026-07-12); the clean cells remain majority-of-three-judges verdicts, one of which, carrying a dissenting judge, is under active review.

We tested three proprietary frontier models; open-weight models are future work, both because legal work's confidentiality pressures make locally deployable models practically relevant and because open-source evaluation keeps the trade-offs inspectable[^open-source-legal-ai-2024] — LAB's public leaderboard already carries open-weight entries. We plan to extend the task family (further tranches of the covenant-package family are held out and scheduled), to publish the raw run data with the layers kept separate, and to keep publishing the method early, because eval design improves when the tasks, rubrics, and evaluator failures can themselves be criticized.

If you work on legal evaluation and want to help shape the next iteration, contact [hello@openagreements.org](mailto:hello@openagreements.org).

## Reproducibility {#reproducibility}

The task definitions and frozen-environment manifests behind this paper are published in the public fork at [open-agreements/harvey-labs](https://github.com/open-agreements/harvey-labs); the harness fixes are public as the upstream pull requests linked above. The tranche-1 raw run data (transcripts, raw judge output, and adjudication records, with the layers kept separate) lands in the same tree once the final pre-publication scrub review completes — conservatively staged, because published data cannot be unshared. The per-cell verdict data rendered on this page is generated from those run records by a manifest-driven exporter; the generated data file embeds its source commit and content digest, so a reader can verify the page against the record tree as it publishes.


[^about]: By Steven Obiajulu, J.D. Published by [openagreements.org](https://openagreements.org). Last reviewed 2026-07-13. License: CC BY 4.0. Steven Obiajulu, J.D. wrote this essay. It states the author's views, synthesizes public sources, and is not legal advice. This article is for informational purposes only and does not create an attorney-client relationship. CC BY 4.0. Cite as Steven Obiajulu, *Institutional-knowledge leakage in frontier AI models on realistic legal drafting*, OpenAgreements (last updated July 13, 2026), https://openagreements.org/for-labs/evals.

[^gemini-3-pro-model-card]: **Gemini 3 Pro model card (2025)** — "Gemini 3 Pro is now Google’s most advanced model for complex tasks, and can comprehend vast datasets and challenging problems from different information sources, including text, audio, images, video, and entire code repositories." *Google, Gemini 3 Pro Model Card (released Nov. 2025; updated May 2026).* <https://storage.googleapis.com/deepmind-media/Model-Cards/Gemini-3-Pro-Model-Card.pdf>

[^gemini-2-5-technical-report]: **Gemini 2.5 technical report (2025)** — "Its unique combination of long context, multimodal and reasoning capabilities can be combined to unlock new agentic workflows." *Gemini Team, Google, Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilities, arXiv:2507.06261 (2025).* <https://arxiv.org/pdf/2507.06261>

[^gemini-1-5-technical-report]: **Gemini 1.5 technical report (2024)** — "Gemini 1.5 models achieve near-perfect recall on long-context retrieval tasks across modalities" *Gemini Team, Google, Gemini 1.5: Unlocking Multimodal Understanding Across Millions of Tokens of Context, arXiv:2403.05530 (2024).* <https://arxiv.org/pdf/2403.05530>

[^legalbench-guha-2023]: **LegalBench (Guha et al., 2023)** — "Because these subject matter experts took a leading role in construction, tasks either measure legal reasoning capabilities that are practically useful, or measure reasoning skills that lawyers find interesting." *Neel Guha et al., LegalBench: A Collaboratively Built Benchmark for Measuring Legal Reasoning in Large Language Models, arXiv:2308.11462 (2023).* <https://arxiv.org/pdf/2308.11462>

[^vals-ai-legalbench-leaderboard]: **Vals AI LegalBench leaderboard (2026)** — "The highest-performing model is Claude Fable 5, with an accuracy of 88.56%." *Vals AI, LegalBench leaderboard (last updated July 9, 2026).* <https://www.vals.ai/benchmarks/legal_bench>

[^harvey-lab-initial-results]: **Harvey Legal Agent Benchmark, initial results (2026)** — "Under our strict all-pass standard, the frontier models we evaluated complete less than 10% of tasks end-to-end in aggregate." *Harvey, Initial Results on Legal Agent Benchmark (May 26, 2026).* <https://www.harvey.ai/blog/legal-agent-benchmark-initial-results>

[^vals-ai-hlab-leaderboard]: **Vals AI Harvey LAB leaderboard (2026)** — "Top models satisfy most individual criteria, with criteria pass rates around 85%." *Vals AI, Harvey LAB leaderboard (last updated July 9, 2026).* <https://www.vals.ai/benchmarks/hlab>

[^task-elicitation-brown-2025]: **Task elicitation (Brown et al., 2025)** — "Task elicitation generates new natural language profiles of model capabilities and weaknesses, found adaptively." *Davis Brown et al., Adaptively Profiling Models with Task Elicitation, arXiv:2503.01986 (2025).* <https://arxiv.org/pdf/2503.01986>

[^lmars-wang-yuan-2025]: **L-MARS (Wang & Yuan, 2025)** — "Recent work has shown that on reasoning-intensive legal benchmarks, standard retrieval pipelines barely improve downstream QA accuracy." *Ziqi Wang & Boqin Yuan, L-MARS: Legal Multi-Agent Workflow with Orchestrated Reasoning and Agentic Search, arXiv:2509.00761 (2025).* <https://arxiv.org/pdf/2509.00761>

[^ftc-rule-status]: **The Federal FTC Non-Compete Rule: Where It Stands (OpenAgreements)** — "The FTC issued a rule in 2024 that would have banned most employee non-competes nationwide, but a federal court set it aside before its effective date, the FTC then acceded to that vacatur, and the Commission conformed the CFR to the court's order by striking the rule from the books." *OpenAgreements, The Federal FTC Non-Compete Rule: Where It Stands (last reviewed July 1, 2026).* <https://openagreements.org/practice-guides/non-compete/us/ftc-rule-status>

[^facts-grounding-2025]: **FACTS Grounding (Jacovi et al., 2025)** — "We introduce FACTS Grounding, an online leaderboard and associated benchmark that evaluates language models’ ability to generate text that is factually accurate with respect to given context in the user prompt." *Alon Jacovi et al., The FACTS Grounding Leaderboard: Benchmarking LLMs’ Ability to Ground Responses to Long-Form Input, arXiv:2501.03200 (2025).* <https://arxiv.org/pdf/2501.03200>

[^magesh-hallucination-2024]: **Hallucination-Free? (Magesh et al., 2024)** — "While hallucinations are reduced relative to general-purpose chatbots (GPT-4), we find that the AI research tools made by LexisNexis (Lexis+ AI) and Thomson Reuters (Westlaw AI-Assisted Research and Ask Practical Law AI) each hallucinate between 17% and 33% of the time." *Varun Magesh et al., Hallucination-Free? Assessing the Reliability of Leading AI Legal Research Tools, arXiv:2405.20362 (2024).* <https://arxiv.org/pdf/2405.20362>

[^vals-ai-legal-research-leaderboard]: **Vals AI Legal Research Bench leaderboard (2026)** — "Reconciliation is the clearest difficulty signal in the benchmark. At 20.7% all-pass it is the hardest category of all, well below the 28.4% overall rate, and the gap holds for every single model: each one scores lower on reconciliation questions than on the rest." *Vals AI, Legal Research Bench leaderboard (last updated July 9, 2026).* <https://www.vals.ai/benchmarks/legal_research>

[^open-source-legal-ai-2024]: **Evaluating AI for Law (Bhambhoria et al., 2024)** — "The paper advocates for creating open-source legal AI systems to improve accuracy, transparency, and narrative diversity, addressing general AI’s shortcomings in legal contexts." *Rohan Bhambhoria et al., Evaluating AI for Law: Bridging the Gap with Open-Source Solutions, arXiv:2404.12349 (2024).* <https://arxiv.org/pdf/2404.12349>