RCBSF: Risk-Constrained Bilevel Stackelberg Framework

• RCBSF is a risk-constrained hierarchical framework that uses a Stackelberg leader-follower model to enforce safety budgets and optimize automated contract revision.
• The framework integrates iterative local verification and global prescriptive control, ensuring provable safety guarantees and token-efficient outputs.
• Empirical evaluations show RCBSF's superior performance with enhanced risk resolution, contract quality, and token efficiency over conventional methods.

Risk-Constrained Bilevel Stackelberg Framework (RCBSF) denotes a class of hierarchical decision models in which a leader commits to risk-controlling decisions and a follower, or follower system, responds optimally under those constraints. In the specific formulation introduced for automated contract revision, RCBSF casts revision as a non-cooperative Stackelberg game with a Global Prescriptive Agent (GPA) as leader and a follower system composed of a Constrained Revision Agent (CRA) and a Local Verification Agent (LVA), with the stated aim of mitigating safety hallucinations and uncontrolled behavior in LLM pipelines for legal text revision (Xu et al., 12 Apr 2026). More broadly, related arXiv work uses risk-aware or risk-constrained bilevel Stackelberg structures to encode safety thresholds, stochastic risk measures, or implementation-risk diagnostics in autonomous driving, stochastic linear programming, infrastructure pricing, and ambiguity-sensitive bilevel analysis (Zheng et al., 2024).

1. Concept and motivating problem

RCBSF for automated contract revision is motivated by two failure modes of off-the-shelf LLMs: Safety hallucinations, where models “fix” clauses by inventing non-existent provisions or inserting irrelevant text, and Uncontrolled behavior, where a single LLM may drift away from user intent or over-correct low-risk items, wasting tokens and introducing new errors (Xu et al., 12 Apr 2026). The framework is explicitly patterned on a legal workflow in which “a senior auditor sets hard constraints, an associate drafts revisions, and a local reviewer checks conformity.” This organizational analogy is operationalized as a hierarchical Leader Follower structure.

Within that formulation, the leader commits to a global “risk-budget” strategy and the follower system optimizes the text under explicit risk constraints. The stated consequence is twofold: provable safety guarantees and token-efficient outputs. This places RCBSF at the intersection of Legal AI, multi-agent LLM systems, and bilevel game-theoretic control, with the contract-revision problem treated not as free-form generation but as constrained strategic optimization (Xu et al., 12 Apr 2026).

A broader interpretation of the term also appears across adjacent literatures. In safe multi-agent reinforcement learning, a bilevel Stackelberg model with risk or cost constraints is used to enforce discounted safety thresholds in autonomous driving (Zheng et al., 2024). In stochastic linear bilevel programming, the leader’s outcome is evaluated through law-invariant convex risk measures such as expectation, expected excess, upper semideviation, and Conditional Value-at-Risk, yielding either risk-averse objectives or explicit risk-budget constraints (Burtscheidt et al., 2019). These related usages suggest that RCBSF is best understood not only as a named legal-AI architecture, but also as a general modeling pattern for hierarchical optimization under explicit risk control.

2. Formal Stackelberg structure in automated contract revision

In the contract-revision setting, the revision process is modeled as a non-cooperative Stackelberg game

$$\mathcal{G}=\langle \{L,F\},\mathcal{S},\mathcal{A},(J_L,J_F)\rangle$$

on a semantic manifold $\mathcal{S}$ (Xu et al., 12 Apr 2026). The leader $L$, identified as the Global Prescriptive Agent, observes the current contract embedding $\mathbf{x}\in\mathcal{S}$ and extracts a set of $K$ risk instructions

$$\mathbf{h}=\bigl\{\mathbf{v}_k=\phi(c_k,l_k,e_k,i_k,s_k)\bigr\}_{k=1}^K\subset\mathcal{H},$$

where each $\mathbf{v}_k$ is a 5-dimensional tuple of Category $c_k$, Location $l_k$, Evidence $e_k$, Issue $\mathcal{S}$0, and Suggestion $\mathcal{S}$1. These instructions define the upper-level decision variable $\mathcal{S}$2, and a temperature-controlled softmax over quantized severities $\mathcal{S}$3 converts them into a “risk budget” distribution.

The follower $\mathcal{S}$4 is composite. The CRA generates a candidate revision $\mathcal{S}$5 by solving the lower-level problem

$\mathcal{S}$6

with an objective written in the source as

$\mathcal{S}$7

The LVA then computes residual risk feedback $\mathcal{S}$8 and issues gradient-like suggestions for the next CRA iteration.

At the upper level, the leader chooses $\mathcal{S}$9 to maximize

$L$0

where $L$1 is a residual-risk density, $L$2 are Q-score weights, and $L$3 caps audit token budget (Xu et al., 12 Apr 2026). The resulting architecture is explicitly bilevel: the leader controls global prescriptive constraints, while the follower performs constrained generation and verification as a best response.

3. Iterative mechanism and algorithmic realization

RCBSF is implemented as a multi-agent iterative revision process with outer Stackelberg rounds and an inner follower loop. The high-level procedure begins with an original contract $L$4, maximum rounds $L$5, budgets, and temperature $L$6. The leader computes initial Q-scores, applies softmax$L$7, and obtains the hint vector $L$8. For each outer round $L$9, the follower loop initializes from $\mathbf{x}\in\mathcal{S}$0, repeatedly invokes CRA generation and LVA audit, and returns an updated $\mathbf{x}\in\mathcal{S}$1; the leader then recomputes Q-scores and updates $\mathbf{x}\in\mathcal{S}$2 using the residual risk distribution (Xu et al., 12 Apr 2026).

Three operational features are central in the source description. First, risk budgets $\mathbf{x}\in\mathcal{S}$3 are updated by re-scoring residual risks with the GPA’s Q-score prompt and applying a temperature-controlled softmax. Second, the LVA enforces local constraints by flagging unresolved risks as “UNRESOLVED” and returning “gradient feedback” suggestions. Third, a “Force Rewrite” mechanism triggers when the CRA makes no substantive edits despite unresolved high-severity risks. These components collectively define the practical realization of the leader-follower decomposition.

The paper also introduces an iterative inner-loop approximation through a fusion operator $\mathbf{x}\in\mathcal{S}$4: $\mathbf{x}\in\mathcal{S}$5 where $\mathbf{x}\in\mathcal{S}$6 is an implicit “learning rate” controlled by prompt intensity and $\mathbf{x}\in\mathcal{S}$7 is described as a product-of-experts blend of global and local signals (Xu et al., 12 Apr 2026). This suggests that RCBSF occupies an intermediate position between prompt-engineered agent pipelines and optimization-inspired fixed-point schemes.

4. Theoretical guarantees

The contract-revision RCBSF paper states two main theorems. Theorem 1 (Strict Superiority of RCBSF) compares the leader’s utility at Stackelberg equilibrium, $\mathbf{x}\in\mathcal{S}$8, with the utility under unguided generation, $\mathbf{x}\in\mathcal{S}$9, and states that under mild nonconvexity of the risk manifold,

$K$0

The proof sketch given is that $K$1 is a feasible leader strategy, so the Stackelberg optimum cannot be worse, and strictness follows by constructing a hint that eliminates at least one high-severity risk missed by the unguided model (Xu et al., 12 Apr 2026).

Theorem 2 (Convergence of Fusion Operator) states that under $K$2-smoothness and local strong convexity of the fused risk loss, the inner-loop sequence satisfies a contraction

$K$3

so that, by the Banach fixed-point theorem, $K$4 and

$K$5

These results are presented as the formal basis for the claim that the bilevel formulation converges to an equilibrium yielding strictly superior utility over unguided configurations (Xu et al., 12 Apr 2026).

Related work uses similar, though context-specific, theoretical devices. In autonomous driving, constrained Stackelberg Bellman backups and contraction arguments yield convergence guarantees for tabular Constrained Stackelberg Q-learning under assumptions including infinite visitation, Robbins–Monro learning rates, and non-empty safe-action sets (Zheng et al., 2024). In stochastic linear bilevel programming, continuity, Lipschitz stability, and differentiability results are established for leader objectives evaluated by law-invariant convex risk measures under perturbations of the underlying probability distribution (Burtscheidt et al., 2019). A plausible implication is that RCBSF belongs to a larger analytical tradition in which leader-side risk control is justified by fixed-point, contraction, or stability arguments rather than by heuristic prompt design alone.

5. Empirical performance and ablation results

The empirical evaluation for contract revision uses a unified benchmark combining PrivacyQA (7 samples), ContractNLI (92), MAUD (150), and CUAD (462), yielding 711 anonymized and template-standardized financial and commercial contract clauses spanning 41 categories (Xu et al., 12 Apr 2026). The reported metrics are Risk Resolution Rate (RRR), defined as the fraction of ground-truth risks mitigated and verified by a GPT-5 judge; Contract Quality (CQ), a 0–100 composite over Clarity, Rigor, Balance, and Professionalism; and Token Efficiency Score (TES), measured as risks resolved per 1 000 tokens.

Method	RRR / TES	CQ
Standard zero-shot	70.81% / 74.31%	—
Chain-of-Thought refinement	73.26% / 76.28%	—
Retrieval-Augmented (RAG)	77.25% / 81.73%	—
Iterative no-leader	79.56% / 83.40%	—
RCBSF	84.21% / 87.29%	86.87

On a Qwen2.5-7B-Chat backbone, RCBSF is reported to achieve state-of-the-art performance, surpassing iterative baselines with an average Risk Resolution Rate of 84.21% while enhancing token efficiency (Xu et al., 12 Apr 2026). The ablation study attributes measurable contributions to several architectural elements: removing the 5-Dim constraints produces an RRR drop of 11.06%; removing the budget penalty by setting $K$6 lowers TES by 12.14% despite a slight RRR gain; removing iteration by setting $K$7 lowers RRR by 7.76%; and removing Q-score weighting lowers RRR by 4.86%.

These results define the framework’s empirical signature. Performance is not described solely in terms of risk reduction, but in the joint space of risk mitigation, semantic quality, and token economy. This is consistent with the design of the upper-level objective, where residual-risk reduction is penalized by an audit token budget (Xu et al., 12 Apr 2026).

6. Relation to adjacent Stackelberg and risk-aware frameworks

RCBSF in contract revision shares a structural family resemblance with several other arXiv formulations while differing in domain semantics and risk representation. In safe multi-agent reinforcement learning for autonomous driving, the leader and follower optimize discounted returns $K$8 subject to hard upper bounds $K$9 on discounted cumulative costs, and practical algorithms are instantiated as Constrained Stackelberg Q-learning and Constrained Stackelberg MADDPG (Zheng et al., 2024). There, risk is quantified by discounted cost-cumulants, and safe actions appear either through explicit enumeration or through Lagrangian penalties.

In stochastic linear bilevel programming under uncertainty, the leader acts “here-and-now” while the follower has complete information after realization of the random vector. The leader’s induced random outcome is then evaluated by a law-invariant convex risk measure, including expectation, expected excess, upper semideviation, or $$\mathbf{h}=\bigl\{\mathbf{v}_k=\phi(c_k,l_k,e_k,i_k,s_k)\bigr\}_{k=1}^K\subset\mathcal{H},$$0, and finite discrete distributions admit deterministic equivalent reformulations and regularization schemes (Burtscheidt et al., 2019). In that line of work, RCBSF is not a multi-agent LLM pipeline but a risk-sensitive bilevel optimization template.

A different variant appears in shared infrastructure investment and pricing with risk-aware take-or-pay contracts. There, the Infrastructure Provider is the leader choosing capacity $$\mathbf{h}=\bigl\{\mathbf{v}_k=\phi(c_k,l_k,e_k,i_k,s_k)\bigr\}_{k=1}^K\subset\mathcal{H},$$1 and price $$\mathbf{h}=\bigl\{\mathbf{v}_k=\phi(c_k,l_k,e_k,i_k,s_k)\bigr\}_{k=1}^K\subset\mathcal{H},$$2, while followers maximize a risk-aware utility that subtracts a $$\mathbf{h}=\bigl\{\mathbf{v}_k=\phi(c_k,l_k,e_k,i_k,s_k)\bigr\}_{k=1}^K\subset\mathcal{H},$$3-weighted $$\mathbf{h}=\bigl\{\mathbf{v}_k=\phi(c_k,l_k,e_k,i_k,s_k)\bigr\}_{k=1}^K\subset\mathcal{H},$$4 term from expected profit and also obey a CVaR-loss constraint and shared-capacity constraints (Sakr et al., 10 Jun 2026). Theoretical results include existence of followers’ variational equilibrium, uniqueness under a curvature condition, and existence of a Stackelberg equilibrium, with a polynomial-time algorithm for an $$\mathbf{h}=\bigl\{\mathbf{v}_k=\phi(c_k,l_k,e_k,i_k,s_k)\bigr\}_{k=1}^K\subset\mathcal{H},$$5-approximate equilibrium and a lower bound on followers’ Probability of Profit.

Implementation risk introduces yet another interpretation. In the ambiguity-premium framework for bilevel decision problems, the leader evaluates the optimistic and pessimistic upper-level values over the $$\mathbf{h}=\bigl\{\mathbf{v}_k=\phi(c_k,l_k,e_k,i_k,s_k)\bigr\}_{k=1}^K\subset\mathcal{H},$$6-optimal follower response set $$\mathbf{h}=\bigl\{\mathbf{v}_k=\phi(c_k,l_k,e_k,i_k,s_k)\bigr\}_{k=1}^K\subset\mathcal{H},$$7, and their difference

$$\mathbf{h}=\bigl\{\mathbf{v}_k=\phi(c_k,l_k,e_k,i_k,s_k)\bigr\}_{k=1}^K\subset\mathcal{H},$$8

is used as an implementation-risk diagnostic (Yu, 16 May 2026). This suggests a broader conceptual connection: RCBSF-type models may constrain risk not only through costs, budgets, or coherent risk measures, but also through exposure to nonunique or near-optimal follower responses.

7. Applications, limitations, and research directions

For automated contract revision, the stated applications are automated drafting and red-lining in due-diligence, M&A, software licensing, and privacy policy reviews; policy-compliant generation in regulated industries such as finance and healthcare; and transfer to other high-risk text domains including security policies and medical consent forms (Xu et al., 12 Apr 2026). These applications follow directly from the framework’s combination of hierarchical prescriptive control, iterative local verification, and token-aware revision.

The stated limitations are domain-specific. The benchmark “concentrates on structurally consistent clauses,” so “multi-clause interdependencies and deeply nested cross-references remain under-explored.” The experiments are “English/Common-Law centric,” and efficacy in Civil Law systems or other languages requires further study because of jurisdictional bias. The paper also notes that context-window limits can induce “lost-in-the-middle” hallucinations on very long contracts (Xu et al., 12 Apr 2026). These caveats delimit the present empirical scope of the framework.

The future-work directions listed in the source are to extend to multi-jurisdiction, multi-lingual settings via jurisdiction-aware hint vectors; incorporate external retrieval of statutes and regulations for grounded audit; integrate hybrid symbolic theorem or SMT solvers for cross-clause consistency; and learn equilibrium strategies via function approximation for large portfolios of contracts (Xu et al., 12 Apr 2026). In light of adjacent work, this trajectory is consistent with broader developments in risk-aware Stackelberg modeling, including convergence analysis in safe MARL, stochastic-risk reformulations under finite scenarios, and explicit diagnostics of follower-side implementation ambiguity (Zheng et al., 2024). A plausible implication is that future RCBSF research will increasingly couple LLM-based generation with formal verification, richer jurisdictional priors, and scalable equilibrium computation.