Technical Summary: White-Box Sensitivity Auditing with Steering Vectors

Problem Statement

Current algorithmic audits for Large Language Models (LLMs) predominantly rely on black-box evaluations, which assess model behavior solely through input–output testing. These methods face three critical limitations:

1. Surface-Level Constraints: They are restricted to tests constructed in the input space, often generated by heuristics, making them susceptible to prompt sensitivity and inconsistent results.
2. Abstract Concept Difficulty: Many socially relevant properties, such as gender or racial bias, involve abstract concepts that are difficult to encapsulate or manipulate precisely using only text-based inputs. Models may appear unbiased when explicit protected attributes are perturbed but still exhibit bias through implicit proxies.
3. Goodharting Risk: Vendors may optimize models to pass specific black-box tests without addressing underlying issues, leading to unreliable evaluations.

While white-box access (weights, activations, gradients) is theoretically superior for understanding internal mechanisms, previous work has not provided a concrete technical approach for conducting such audits in practice.

Methodology

The authors propose a white-box sensitivity auditing framework that leverages activation steering to manipulate internal model representations and assess sensitivity to specific concepts. The framework adapts the post-hoc interpretability method of Kim et al. (2018) and utilizes the unsupervised Weighted Mean Difference (WMD) method (Cyberey et al., 2025) for vector extraction.

The auditing process follows a six-step framework:

1. Context & Requirements: Define the deployment setting and system requirements (e.g., invariance to gender in credit scoring).
2. Test Construction: Design representative test templates aligned with intended uses.
3. Steering Vector Extraction:
   • A dataset $D_C$ spanning varying degrees of a target concept $C$ (e.g., gendered language or dialectal differences) is used.
   • The WMD method computes a steering vector $v_C$ by weighting input activations by their disparity scores (difference in output probability between contrasting concepts).
   • Neutral offsets are applied to filter unrelated information, and layer selection is based on linear separability.
4. Sensitivity Testing:
   • For a set of test inputs $D$, explicit markers of the protected attribute are neutralized or removed.
   • The internal representation $h_x$ of an input is perturbed: $h'_x = h_x + \lambda v_C$, where $\lambda \in [-1, 1]$ is the steering coefficient.
   • The model generates steered outputs $y'$ for various $\lambda$ values.
5. Compliance Assessment:
   • A Sensitivity Metric ($S_C$) is calculated by fitting a linear regression between the steering coefficient $\lambda$ and the output $y'$. The slope represents the model's average dependence on concept $C$.
   • Invariance Requirement: The model satisfies the requirement if $|S_C| \le \epsilon$ (negligible sensitivity).
   • Dependence Requirement: The model satisfies the requirement if $|S_C| \ge \epsilon$ (significant, predictable sensitivity).

Key Contributions

1. Concrete White-Box Framework: The paper introduces a practical, end-to-end auditing method that uses targeted interventions on model internals rather than surface-level input perturbations.
2. Novel Evaluation Metric: It applies activation steering to measure model sensitivity via directional derivatives, allowing for fine-grained assessment of model properties (e.g., bias) on a graded scale rather than binary pass/fail.
3. Generalizability: The method demonstrates that steering vectors extracted from general datasets (e.g., gendered language) can be applied to manipulate concepts in task-specific inputs (e.g., loan applications) that may be unrelated to the extraction data.
4. Robustness: The approach yields more consistent evaluation results across different vector sources compared to the variability observed in black-box perturbation strategies.

Experimental Results

The method was evaluated on four high-stakes decision tasks: Judicial Trials, Credit Scoring, College Admissions, and Medical Diagnosis, using models including Llama-3.1, Ministral, Qwen2.5, and domain-specific variants.

• Discrepancy with Black-Box: In Credit Scoring and Judicial tasks, the white-box method frequently detected substantial bias (dependence on protected attributes) where standard black-box evaluations suggested little to no bias. For example, in the Judicial task, the Saul-7B model showed a ~2.5% bias in conviction rates via black-box testing, but the white-box method revealed a 20% sensitivity difference between racial groups.
• Validation of Hidden Bias: In Credit Scoring, when the black-box method was modified to use name perturbations (implicit gender cues) rather than explicit gender labels, the measured bias increased and aligned with the white-box estimates. This suggests the white-box method captures actual bias risks that explicit black-box perturbations miss.
• Isolation of Variables: Using Sobol' indices, the authors showed that white-box steering had minimal impact on non-protected task variables (e.g., credit history, employment duration), whereas black-box input perturbations (like adding names) sometimes altered the model's decomposition of these variables.
• Robustness: White-box results remained consistent when steering vectors were derived from different datasets (dialectal vs. racial identity), whereas black-box results varied significantly based on whether race was perturbed explicitly or implicitly.

Significance and Claims

The paper claims that surface-level black-box evaluations are insufficient for assessing abstract model properties like bias. By directly probing internal representations, the proposed white-box method:

• Reveals Hidden Dependencies: Identifies substantial reliance on protected attributes that elude traditional input-output testing.
• Improves Reliability: Provides more consistent audit results that are less sensitive to the specific construction of test prompts.
• Enhances Interpretability: Allows auditors to isolate specific concepts within the model's latent space, offering a more rigorous assessment of whether a model operates reliably in its intended deployment context.

The authors conclude that while the linear representation hypothesis underpins their method, this approach offers a practical path toward more rigorous, transparent, and trustworthy algorithmic auditing for LLMs in high-stakes settings.