Deterministic Credit Decisioning with LLMs

An LLM assigns a probability to many possible next words and picks one. It predicts rather than follows fixed rules, so the same input can produce different outputs. That makes it great at reading messy documents and risky as a final decision-maker.

In the finance and accounting use case, where determinism is critical, the largest study of this ran LLMs on the same fifty inputs, generating more than 3.4 million distinct outputs.^[1] Narrow yes/no and sentiment tasks were nearly perfectly reproducible. Open-ended prediction and generation varied far more. And simple voting across three to five runs sharply increased consistency on the narrow tasks. In other words, asking whether a transaction is payroll behaves almost like a function, while the question of whether to lend to an applicant requires interpretation and deep reasoning.

The obvious response to foundation model's variance is to clamp it down, and almost every technique sold as “making LLMs deterministic” ( temperature 0, constrained decoding, prompt pinning, voting across runs, etc.) An answer that flips between runs cannot be audited at all. Whether the repeated answer is right is correctness, and no sampling knob touches it. And whether two identical applications must get the same decision, provably, months later, is decision determinism.

Temperature makes the distinction concrete. An LLM scores every candidate token, turns the scores into a probability distribution, and samples from it. Temperature divides the scores first: low sharpens the distribution, high flattens it. At temperature 0 the model always takes the top token, so the output repeats.

Making a model write down its facts and assumptions before deciding cut decision-flipping by 82%, without necessarily making the decisions more correct.

In a one-shot answer, the facts, assumptions, and weights a model used all live implicitly inside a single generation, and any of them can silently change on the next run. One study made models write them out in order (facts, then assumptions, then the decision) and flipping dropped.^[2]

For underwriting, the model should never hold private state. Everything it believes about the borrower gets documented in a chain of thought, and approved before downstream reasoning consumes it.

In other research leveraging language models out-of-the-box, a team gave a memo-writing model exactly the four factors behind one applicant’s score, with greedy decoding so the memo reproduces exactly.^[8] The score was driven mostly by loan size with false bias from the model itself. Generated credit memos in these tests reversed the direction of three factors, and cited the applicant’s age, which was not even in the prompt. Ultimately, generated text needs its own audit where every factor named must appear in the source, and no stated direction may contradict the measured one.

Constrained decoding can nearly eliminate malformed output while leaving the semantic errors intact, and in extraction benchmarks it made accuracy worse.

Constraining a model to only APPROVE, DECLINE, or REVIEW provide deterministic formatting, not deterministic judgment: the model still chooses among the legal answers probabilistically. Studies find grammar constraints nearly eliminate syntax errors while the semantic errors remain, and constraints can even hurt accuracy by forcing the model away from how it naturally reasons.^[3]

Extraction benchmarks make the gap concrete. Across thousands of hand-labeled document fields, frontier models got fewer than one field in twenty fully right, even though the well-formed JSON they returned looked mostly plausible.^[5] Constrained decoding made accuracy worse and failure scaled with how much was asked at once.

A recent experiment ran a classic risk-preference test on 98 LLMs.^[4] When the researchers simply told the models to embody different risk personas, their choices moved substantially meaning a model's inherent risk appetite is configurable, not an intrinsic stable preference.

So writing the credit policy into the prompt is not policy enforcement. The prompt is just more context shaping a movable boundary. The direct test comes from a study that gave the same model the same 13 workflow rules two ways, then counted the violations:^[6]

A rule stated in a prompt was broken hundreds of times. A line of code refusing the same action was broken zero times. Naturally, code wins on the standing rules and credit policy (exposure limits, verification order, etc).

Upstream probabilistic errors become deterministic downstream errors. Code does not remove AI risk. It relocates it into extraction. If the extractor reads $98,000 as $108,000, the engine reproducibly approves the wrong loan, and every audit of the engine passes.

Consistency can hide bias. A model that systematically misreads one category of applicant scores well on reproducibility while being reliably wrong for that group. LLMs scoring real loans gave explanations that contradicted their own measured behavior.^[9] Reasons instead must come from the scoring engine.

Model upgrades break reproducibility across time. A setup that is entirely repeatable today can decide differently after the provider ships a new version. Versioning of the model, prompt, parser, schema, and policy together, and logging everything, ensures any decision can be replayed.

References

1. [1]

   Assessing Consistency and Reproducibility in the Outputs of Large Language Models: Evidence Across Diverse Finance and Accounting Tasks

   50 runs per input across finance and accounting tasks, 3.4M+ outputs.

   arXiv:2503.16974
2. [2]

   Measuring and Improving Behavioral Consistency in Large Language Models through Fact-Heuristic-Emotion State Enforcement

   Explicit state externalization before deciding, an 82% reduction in decision flipping.

   arXiv:2607.24765
3. [3]

   Empirical Study for Structured Output Control in LLMs for Software Engineering

   Grammar and template constraints vs syntactic and semantic error rates.

   arXiv:2606.09395
4. [4]

   Rationality and Financial Risk Aversion in Large Language Models: Evidence from a Multi-Model Holt–Laury Experiment

   98 LLMs on financial risk decisions. Risk preferences shift under persona instructions.

   J. Behavioral & Experimental Finance, 2026
5. [5]

   ExtractBench: A Benchmark and Evaluation Methodology for Complex Structured Extraction

   35 documents, 12,867 hand-labeled fields, six frontier models.

   arXiv:2602.12247
6. [6]

   Blueprint First, Model Second: A Framework for Deterministic LLM Workflow

   Workflow rules compiled to code vs stated in prompts, over 1,000 tasks.

   arXiv:2508.02721
7. [7]

   Automatic Construction of Clinical Scoring Systems with LLM Agents

   LLM-proposed, code-validated scoring rules, plus an ablation without validation.

   arXiv:2601.22324
8. [8]

   Accurate Ensembles, Fragile Narratives: Multi-Scale Stacking and a Fidelity Audit of LLM-Generated Explanations for Credit Risk

   A 0.954-AUROC model whose generated memo contradicted its own attributions.

   arXiv:2608.08126
9. [9]

   Interpreting LLMs as Credit Risk Classifiers: Do Their Feature Explanations Align with Classical ML?

   396k LendingClub loans. LLM scorers vs LightGBM, and the faithfulness gap.

   arXiv:2510.25701

Frequently asked questions

Related reading

Kita · Literature review · August 2026