White-Box Sensitivity Auditing with Steering Vectors

AI summary

Overview

Research area: AI safety and ethics — algorithmic auditing of large language models, combining black-box evaluation critique with white-box interpretability (representation engineering / activation steering).

Technical level: Advanced. The paper assumes familiarity with LLM internals, latent representations, steering vectors, and derivative-based sensitivity analysis, though the framing and motivation are accessible.

Scope: The paper proposes and demonstrates a white-box sensitivity auditing framework that uses activation steering vectors to test whether LLM predictions depend on protected attributes such as gender and race, applied to four simulated high-stakes decision tasks.

Note: the paper content provided is truncated mid-way through Section 4.4. Results from Sections 4.5 and 5, and the remaining figures and tables, are described only in the abstract and introduction, not in the supplied text.

What This Paper Is About

Current audits of large language models mostly work in a black-box setting: auditors send text in and observe text out, which limits tests to whatever can be expressed in the input space and makes results depend heavily on how prompts are written. This is a particular problem for abstract properties like gender or race bias, since a model can look unbiased when only explicit protected-group words are changed while still responding to indirect proxies of those attributes. The paper's goal is to move auditing inside the model, using activation steering to directly manipulate concept representations and measure how sensitive the model's predictions are to them.

Key Contributions

1. A concrete white-box auditing method. The authors introduce a method that evaluates model behavior through targeted interventions on model internals rather than through input-output testing alone, addressing the gap they identify in prior work (Casper et al., 2024) that argued for white-box audits but did not give a technical procedure.

2. A sensitivity-based evaluation metric built on activation steering. They adapt the post-hoc interpretability approach of Kim et al. (2018) — directional derivatives — to steering vectors, producing an average sensitivity score that quantifies a model's dependence on a specific concept. The score is then used to test two kinds of requirement: invariance (the model should not change with the concept) and dependence (the model should change predictably).

3. A six-step auditing framework. The framework adapts Brown et al. (2021) and Rhea et al. (2022) and covers determining context, defining system requirements, constructing base templates, extracting steering vectors, testing sensitivity, and assessing compliance — with a running credit-scoring example.

4. An empirical demonstration across four high-stakes decision tasks. The method is applied to bias audits in judicial trials, credit scoring, university admissions, and medical diagnosis, and compared against a black-box perturbation baseline. The authors also report an audit-validity assessment (Section 5), including a check using a different black-box perturbation strategy and a check on whether the method disturbs other task-relevant variables.

Main Findings

• White-box audits detect bias that black-box audits miss. In the Credit Scoring and Judicial tasks, several cases show the model appearing to have little bias in task outcomes under the black-box method while showing substantial bias under the white-box method. For example, Llama3.1 shows less than 1% difference between the female and male gender groups on Credit Scoring using the black-box method, whereas the white-box method reports a 5% higher sensitivity score for males than for — the sentence is cut off in the available content, so the comparison group is not recoverable from the supplied text.

• The method does not systematically over-report bias. The authors include the Admissions and Medical tasks specifically to test this. Most models show less than 1% group difference in acceptance rates on Admissions and in accuracy on Medical, and the white-box method produces similarly low sensitivity scores in those cases.

• Model-level differences on Admissions and Medical. Both methods indicate that the evaluated models exhibit less gender and racial bias on the Admissions and Medical tasks than on the other tasks.

• Disagreements in bias direction occur mainly at low bias levels. In some cases the two methods indicate bias in opposite directions, but this mostly happens when the model shows minimal bias under the black-box method. The conviction rates in the Judicial task show the most disagreement between the two methods.

• Credit Scoring results largely align, with one exception. The white-box result mostly matches the bias direction suggested by the black-box method for Credit Scoring, except for fin-Llama3.

• Reported robustness advantage. The introduction states that the white-box method yields more robust evaluation results than the black-box baseline (Section 4.5), though the supporting numbers are not in the supplied content.

• Reported validity advantage. The introduction states that a different black-box perturbation strategy demonstrates that the white-box results reflect actual bias risks the black-box baseline fails to detect (Section 5.1), and that the method has little impact on other task-relevant variables and better isolates the target concept than the black-box method (Section 5.2). The specific measurements behind these claims are not in the supplied content.

Methodology in Plain English

1. Define what the model is supposed to do and where it is deployed. The auditors write down the deployment context, the inputs and outputs, and requirements. Each requirement is tied to a concept and says whether the model should be invariant to it or dependent on it. In credit scoring, gender is a protected attribute the model should be invariant to; educational background is something it should depend on.

2. Build test templates. These are representative prompts reflecting the context — for credit scoring, tabular applicant profiles converted into natural-language descriptions.

3. Extract a steering vector for the target concept. A separate dataset encoding the concept (for example, the gendered language dataset) is split into training and validation sets. The authors use the unsupervised weighted mean difference (WMD) method of Cyberey et al. (2025), which weights each input's activation by the model's own disparity score between two contrasting concepts and offsets activations against neutral prompts. This is done instead of difference-in-means, which the authors say treats all contrasting pairs equally and ignores neutral inputs. The validation set selects the layer and scales the vector so that the steering coefficient λ in [−1, 1] spans the model's valid range of concept signal. Crucially, this vector-extraction dataset does not have to come from the same domain as the decision task.

4. Strip the concept from the test inputs and steer internally. Explicit markers of the concept are set to neutral or removed from the prompts, so any output change is attributable to the internal perturbation rather than the words. At the extraction layer, each input's representation is first moved to a neutral point by subtracting its projection onto the steering direction (relative to the mean activation over neutral inputs), then displaced by λ times the steering vector. λ = 0 leaves the representation neutral; negative and positive values push toward the two ends of the concept (for example, masculine and feminine).

5. Sweep λ and collect outputs. Steering is applied across λ in [−1, 1] in increments of 0.2 for each test input.

6. Estimate sensitivity and judge compliance. The authors fit a linear regression of the steered output on λ and take the slope as the average sensitivity score. Because the intervention neutralizes each representation before displacing it, the λ = 0 output comes from the neutral point rather than the original representation, which shifts the intercept but leaves the slope unchanged. A slope near zero supports an invariance requirement; a large slope indicates the model violates it. Geometrically, invariance to a concept vector means the concept direction is approximately orthogonal to the direction that drives the decision.

Tasks and models. The four synthetic tasks are judicial trials (based on Hofmann et al., 2024, with 500 WME/AAL sentence pairs sampled and five queries per instance averaged), credit scoring (South German Credit dataset, Groemping, 2019, 1000 applicant profiles with 20 variables and three gender settings per profile), admissions (Nguyen and Tan, 2025), and medical diagnosis (DiversityMedQA, Rawat et al., 2024, built on MedQA medical board questions, Jin et al., 2021). Models evaluated are Llama-3.1-8B, Qwen2.5-7B, Ministral-8B, plus domain-adapted models: Saul-7B (legal), fin-Llama3 (finance), and med-Llama3 (biomedicine). The black-box baseline follows the group-disparity formulation in the paper's Equation 1.

Why This Matters

Impact on research. The paper gives a concrete, reproducible recipe for the white-box audits that prior work argued were needed but left unspecified, and it connects auditing to representation engineering. It also raises a methodological warning: an audit that only perturbs input text can understate a model's reliance on protected attributes, because models can infer those attributes from proxies rather than explicit markers. The authors note the Goodharting risk — vendors can train to pass anticipated tests without fixing the underlying behavior.

Real-world applications:

• Lending and credit. Checking whether a model's risk predictions are truly invariant to an applicant's gender, including through correlated proxies, before it is used in loan decisions.
• Criminal justice. Testing whether judicial outcome predictions depend on a defendant's dialect, where race is encoded implicitly in the utterance rather than stated.
• University admissions. Testing whether acceptance decisions depend on information carried by an applicant's first name while still responding appropriately to GPA and other qualifications.
• Clinical decision support. Testing whether medical question-answering accuracy stays stable when a patient's gender or ethnicity description is varied.

Industry relevance. The framework produces a numeric score that can be compared against a threshold, which maps naturally onto internal compliance gates and regulatory expectations for structured evaluation of high-stakes systems. Because the steering vector need not come from the deployment domain, the same concept vector could in principle be reused across applications. The authors provide open code and note the paper was reviewed on OpenReview.

Future Directions

• Fill in and extend the validity evidence. The supplied content describes Sections 4.5, 5.1, and 5.2 only at a high level. Reproducing the robustness, alternative-perturbation, and concept-isolation analyses, and extending them to more tasks and concepts, is the natural next step.
• Move beyond binary concept axes. The authors explicitly note that treating gender and race as one-dimensional feminine–masculine and black–white axes grossly oversimplifies non-binary and multi-dimensional identities, and say they use these categories only for experimental purposes. More faithful concept representations are an open problem.
• Address threshold selection. The framework depends on a threshold ε to decide whether sensitivity is negligible (invariance) or meaningful (dependence). How to set that threshold defensibly for a given deployment is not resolved in the available content.
• Contrast with the limitations of black-box perturbation design. Because black-box tests are built from heuristics and predefined group token lists, an open question is how the two families of methods should be combined in practice, and how the white-box method behaves on concepts that are not well captured by any available extraction dataset.

Target Audience

Researchers and practitioners in AI safety, fairness, and algorithm auditing; policy and compliance staff who need to understand what a white-box audit can reveal that black-box testing cannot; and machine learning engineers working on representation engineering or activation steering who want an applied evaluation use case. The paper is most useful to readers comfortable with latent representations and linear-algebra notation, though the six-step framework is described in enough detail to be followed by a technically literate non-specialist.

Authors’ abstract

Algorithmic audits are essential tools for examining systems for properties required by regulators or desired by operators. Current audits of large language models (LLMs) primarily rely on black-box evaluations that assess model behavior only through input-output testing. These methods are limited to tests constructed in the input space, often generated by heuristics. In addition, many socially relevant model properties (e.g., gender bias) are abstract and difficult to measure through text-based inputs alone. To address these limitations, we propose a white-box sensitivity auditing framework for LLMs that leverages activation steering to conduct more rigorous assessments through model internals. Our auditing method conducts internal sensitivity tests by manipulating key concepts relevant to the model's intended function for the task. We demonstrate its application to bias audits in four simulated high-stakes LLM decision tasks. Our method consistently indicates substantial dependence on protected attributes in model predictions, even in settings where standard black-box evaluations suggest little or no bias. Our code is openly available at https://github.com/hannahxchen/llm-steering-audit