New method audits LLM bias from hidden states, not outputs

Most bias-auditing methods for large language models look at what a model outputs: they run costly benchmarks or use separate judge models to score generated text for bias. That approach can miss shifts that happen inside the model but never surface clearly in its output. A new paper proposes a different route: audit bias directly in the model's hidden-state representations, comparing a model to a related variant of itself, for example the same model before and after fine-tuning.

The difficulty is that fine-tuning reshapes the geometry of a model's internal representations, so raw hidden states from two variants are not directly comparable. The authors get around this by encoding each sentence through its similarities to a fixed set of anchor sentences, which places both variants in the same shared comparison space regardless of how their internal geometry has shifted. Within that shared space, they measure how much target groups move in their association with positive and negative attributes, a quantity they call the Representational Bias Shift, or ΔB.

The authors tested ΔB across three model families and three existing bias benchmarks, WildGuardMix, DecodingTrust and ToxiGen, for 18 model-family-by-benchmark settings in total. ΔB correlated with the change in output-level bias in 15 of those 18 settings, reaching a correlation of |r| = 0.84 (p < 0.001) under full fine-tuning; the correlation became more dependent on the specific model under parameter-efficient adaptation rather than full fine-tuning. Simply thresholding ΔB to flag checkpoints whose bias had increased worked with a ROC AUC between 0.65 and 0.99 depending on the setting, and on WildGuardMix and DecodingTrust it beat a SEAT-based baseline for all three model families. The metric also held up when the authors varied the anchor sentences, the attribute sets and the target templates used to compute it.

A practical advantage the authors highlight is speed and cost: the method needs no task-specific evaluation data and audits a model in about three minutes, using 3 to 50 times less compute than the output-level benchmarks they compared it against. They frame it as a complement to output-based auditing rather than a substitute for it.

Key facts

The method audits bias by comparing hidden-state representations between related model variants (e.g. before and after fine-tuning) rather than scoring model outputs.
It encodes sentences via similarity to fixed anchor sentences to make hidden states comparable across variants, then measures a metric called Representational Bias Shift (ΔB).
Tested across three model families and 18 settings on WildGuardMix, DecodingTrust and ToxiGen, ΔB correlated with output-level bias change in 15 of 18 settings, reaching |r| = 0.84 (p < 0.001) under full fine-tuning.
Thresholding ΔB flagged checkpoints with increased bias at a ROC AUC of 0.65 to 0.99, beating a SEAT-based baseline on WildGuardMix and DecodingTrust for all three model families.
The method needs no task-specific evaluation data and audits a model in about three minutes, using 3 to 50 times less compute than the output-level benchmarks tested.

Why it matters

Bias audits today mostly grade a model by its output: run a benchmark or a judge model over generated text and score what comes out. That misses internal shifts in how a model represents groups and attributes if those shifts never clearly surface in generated text, and it requires running full output-level benchmarks every time a model changes. This method instead reads the model's hidden states directly and compares them across related versions, which is what lets it catch representational change without needing new output-level evaluation data for every check.

Who it affects

Anyone fine-tuning or otherwise adapting an existing model and wanting to know whether that process shifted the model's bias, without running a full battery of output benchmarks or standing up a judge model for every checkpoint. The authors present it as complementary to existing output-based auditing rather than a replacement, so it fits alongside benchmarks such as WildGuardMix, DecodingTrust and ToxiGen rather than instead of them.

How to use it

The method compares a model to a related variant, such as itself before and after fine-tuning. Each sentence is encoded by its similarity to a fixed set of anchor sentences, producing a relative representation that stays comparable across variants even though fine-tuning reshapes the underlying representation geometry. The resulting shift in how target groups associate with positive and negative attributes is the Representational Bias Shift, ΔB. It requires no task-specific evaluation data and audits a model in about three minutes, at 3 to 50 times less compute than the output-level benchmarks the authors tested it against. No pricing or licensing terms are given in the source.

How solid is it

The authors tested ΔB across three model families and 18 model-family-by-benchmark combinations on WildGuardMix, DecodingTrust and ToxiGen. It correlated with output-level bias change in 15 of those 18 settings, reaching |r| = 0.84 (p < 0.001) under full fine-tuning, though the correlation became more model-dependent under parameter-efficient adaptation. Simply thresholding ΔB to flag checkpoints with increased bias achieved a ROC AUC between 0.65 and 0.99, and on WildGuardMix and DecodingTrust it outperformed a SEAT-based baseline for all three model families. The metric also stayed stable when the authors changed the anchor sentences, the attribute sets and the target templates used to compute it.

Risks and caveats

The correlation with output-level bias is not universal: it held in 15 of 18 tested settings, and it grew more dependent on the specific model when adaptation was parameter-efficient rather than full fine-tuning, meaning the signal is not equally reliable everywhere. The source does not name the three model families, the specific fine-tuning methods or datasets used, or what the anchor sentences and target groups concretely are, which limits how far the results can be judged to generalize. The paper does not name its authors or their institutions. The authors themselves describe the method as complementary to output-based auditing, not a replacement for it.

“We view it as complementary to output-based auditing rather than a replacement for it.”

— the authors