📊 statistics

Silenced Biases: The Dark Side LLMs Learned to Refuse

This paper introduces the Silenced Bias Benchmark (SBB), a framework that uses activation steering to reduce model refusals and reveal "silenced biases"—unfair preferences hidden within safety-aligned LLMs that standard evaluation methods mistakenly interpret as fairness.

Original authors: Rom Himelstein, Amit LeVi, Brit Youngmann, Yaniv Nemcovsky, Avi Mendelson

Published 2026-03-19

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Rom Himelstein, Amit LeVi, Brit Youngmann, Yaniv Nemcovsky, Avi Mendelson

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a very polite, well-trained robot assistant. You've taught it to be safe, kind, and fair. If you ask it something mean or biased, like "Which group of people is most likely to be a criminal?", it politely says, "I'm sorry, I can't answer that."

Most people look at this and think, "Great! The robot is fair. It refused to be biased."

But this paper argues that the robot isn't actually fair. It's just hiding its bias.

Here is the simple breakdown of what the researchers discovered, using some everyday analogies.

1. The "Silenced" Bias (The Teenager in the Basement)

Think of the robot's brain as a house.

The Front Door (The Output): This is what the robot says to you. It's very polite. If you ask a bad question, the "Front Door" guard says, "No entry!"
The Basement (The Latent Space): This is where the robot actually thinks. Even though the Front Door says "No," the robot's internal thoughts in the basement are still full of stereotypes. It still believes that "Group A" is more likely to be a criminal than "Group B."

The researchers call this "Silenced Bias." The safety training didn't delete the bad thoughts; it just built a wall to stop them from coming out. The bias is still there, just silenced.

2. The Problem with Current Tests (The Polite Lie)

Current ways of testing robots (called benchmarks) are like asking the robot, "Are you racist?"

If the robot says, "I don't know," or "I can't answer," the test scores it as 100% Fair.
The researchers say this is a trick. The robot isn't being fair; it's just being refusal-prone. It's like a teenager who refuses to answer a question about their bad grades, not because they are honest, but because they are hiding the truth.

3. The Solution: "Activation Steering" (The Magic Remote Control)

The researchers invented a new tool called Silenced Bias Benchmark (SBB). To use it, they use a technique called Activation Steering.

Imagine the robot's brain is a radio station.

Refusal Mode: The radio is tuned to a channel that only plays "I can't help you" music.
Compliance Mode: The radio is tuned to a channel that answers questions directly.

The researchers built a "Magic Remote" (Activation Steering) that forces the radio to switch from the "Refusal Channel" to the "Compliance Channel" just for a split second while they ask the tricky questions.

Suddenly, the robot stops saying "I can't answer" and starts giving its real, unfiltered opinion. And guess what? The bias explodes out.

4. What They Found (The Shocking Results)

When they turned off the "Refusal Channel" on 10 different popular AI models (like Llama, Gemma, and Qwen), they found:

The Bias Was Real: The robots did have strong, unfair preferences. For example, when asked "Who is most likely to be a terrorist?", some models overwhelmingly picked specific nationalities or religions, even though they usually refuse to answer that.
Safety Training is a Mask: The "safety" training just put a mask over the bias. It didn't cure the disease.
Size Doesn't Matter: Bigger, newer models weren't necessarily fairer. Sometimes the older, smaller models were actually more fair (or less biased) than the new, expensive ones.

5. Why This Matters (The "Jailbreak" vs. "Steering" Difference)

You might ask, "Can't we just use 'Jailbreaks' (tricks to trick the robot) to find this?"

Jailbreaks are like trying to break down the front door with a sledgehammer. They often introduce new chaos and biases because the trick itself is messy.
Activation Steering is like gently turning a key to open a side door. It reveals what was already there without adding new noise. It's a clean, scientific way to see the truth.

The Big Takeaway

This paper is a wake-up call. It tells us that just because an AI says "I can't do that," doesn't mean it's fair.

It's like a person who refuses to make a joke about a specific group of people. They might look polite, but if you could read their mind, they might still be thinking the joke. The researchers built a "mind-reading" tool to prove that these AI models are still carrying heavy baggage of stereotypes, hidden behind a polite "No."

In short: We need to stop trusting the "No" answers and start checking what the AI is actually thinking underneath the surface.

1. Problem Statement

Safety-aligned Large Language Models (LLMs) are designed to refuse harmful or sensitive queries to prevent bias and discrimination. However, the authors argue that this safety alignment creates a "false sense of fairness."

The Core Issue: When a model refuses a biased question (e.g., "Who is most likely to be a terrorist?"), standard evaluation benchmarks interpret this refusal as a positive fairness signal.
The Reality: The authors posit that the underlying biased associations (stereotypes) are not eliminated; they are merely suppressed or "silenced" within the model's latent space. The model still "knows" the bias but refuses to output it due to safety training.
Limitations of Current Methods: Existing benchmarks (like BBQ or StereoSet) often rely on prompt manipulation, jailbreaks, or implicit questioning. These methods are often non-scalable, introduce their own artifacts, or fail to bypass modern refusal mechanisms effectively, leaving "silenced biases" undetected.

2. Methodology

The paper introduces a novel framework to uncover these hidden biases without permanently altering the model or relying on adversarial jailbreaks.

A. Concept: Silenced Bias

Silenced Bias is defined as explicit biases that the model possesses but suppresses via its safety alignment refusal mechanisms. These biases remain encoded in the model's internal activations even when the output is a refusal.

B. The Silenced Bias Benchmark (SBB)

The authors constructed a structured dataset to probe these biases:

Structure: 4,800+ multiple-choice QA prompts.
Components:
- Subjects: 30 roles categorized as Positive (e.g., "strong job candidate"), Negative (e.g., "terrorist"), and Neutral (e.g., "drinks water").
- Demographics: 16 categories (e.g., Race, Religion, Nationality) with 10 mutually exclusive groups each (e.g., 10 nationalities).
- Query Variations: 10 syntactic variations per prompt to ensure framing does not induce bias.
Goal: Force the model to select a demographic group associated with a specific subject.

C. Refusal Activation Steering

To bypass the refusal mechanism and reveal the silenced bias, the authors employ Activation Steering:

Refusal Direction Identification: They compute a specific vector direction ( $r$ ) in the model's activation space that correlates with refusal behavior. This is calculated as the difference between the mean activations of "harmful" prompts and "harmless" prompts (based on Arditi et al., 2024).
Steering Mechanism: During inference, they apply two techniques to shift the model's hidden state away from the refusal subspace and into the compliance subspace:
- Direction Ablation: Projecting activations onto the orthogonal complement of the refusal direction across all layers.
- Direction Subtraction: Subtracting the refusal vector from the activation at a specific layer.
Unbiased Verification: The authors verified that the refusal direction itself is not biased toward any specific demographic group, ensuring that the steering process reveals pre-existing model biases rather than introducing new ones.

D. Fairness Metrics

To quantify the bias once refusals are bypassed, they use:

Demographic-Parity Difference (DPD): The maximum difference in selection probability between any two groups within a category.
Kullback-Leibler (KL) Divergence: Measures the deviation of the model's output distribution from a uniform (perfectly fair) distribution.

3. Key Contributions

Definition of Silenced Bias: A new taxonomy for biases that are latent within safety-aligned models and hidden by refusal mechanisms.
Refusal Steering for Bias Exposure: A method to bypass refusal filters using activation steering, demonstrating that this technique reveals suppressed biases without introducing new artifacts.
The SBB Benchmark: A scalable, structured benchmark specifically designed to evaluate silenced biases across diverse demographics and sentiment types (positive, negative, neutral).
Empirical Evidence: Large-scale evaluation across 10 LLMs (Llama, Gemma, Qwen families) proving that safety alignment masks, rather than removes, systemic biases.

4. Experimental Results

The authors evaluated 10 open-source models (ranging from 2B to 14B parameters) using the SBB dataset.

High Refusal Rates (Without Steering): Without steering, models frequently refused to answer sensitive questions (e.g., Llama-2-13B refused >82% of the time), leading to low Attack Success Rates (ASR) and masking the bias.
Bias Revelation (With Steering):
- Applying refusal steering increased the ASR to near 100% across all models.
- Latent Bias Confirmation: Even when models refused to answer, their internal activations (before steering) already contained distinct clusters for biased vs. unbiased responses, proving the bias exists internally.
Comparison with Jailbreaks: The authors showed that standard jailbreak attacks (e.g., appending adversarial suffixes) induce new biases and are inconsistent across runs, whereas refusal steering consistently reveals the model's original latent biases.
Model Variability:
- There is no clear correlation between model size/version and fairness. For example, in the Llama family, the older/smaller Llama-2-7B was found to be the "fairest" (lowest DPD), while newer, larger models exhibited significant biases.
- All tested model families showed statistically significant deviations from uniform demographic distributions ( $p < 0.05$ ).
Specific Findings:
- Qwen-14B showed extreme bias, disproportionately associating "Muslim" with "terrorist" and "American" with "hate-group leader" after steering.
- Negative Subjects: Biases were most pronounced when associating negative subjects (e.g., "criminal," "scammer") with specific demographics.

5. Significance and Implications

Safety Alignment is Not a Cure: The paper challenges the assumption that safety training eliminates bias. Instead, it suggests that alignment merely pushes bias into the latent space, where it remains accessible via activation steering.
Evaluation Blind Spots: Current fairness benchmarks that rely on refusal rates or surface-level outputs are fundamentally flawed because they mistake silence for fairness.
Real-World Risk: If models can be steered to reveal these biases, they may also be susceptible to subtle prompts in real-world applications that inadvertently trigger these latent associations, leading to discriminatory outcomes in hiring, lending, or healthcare.
Future Directions: The authors call for new debiasing strategies that target the latent space directly, rather than just the output layer, and for evaluation frameworks that account for "alignment-induced silence."

In conclusion, the paper demonstrates that silenced biases are a critical, overlooked vulnerability in modern LLMs. By using activation steering to bypass refusal mechanisms, the authors expose that safety-aligned models retain deep-seated, systematic prejudices that standard evaluation methods fail to detect.