🤖 machine learning

MIRAGE: Auditing Anti-Muslim Bias in Frontier LLMs Across Reasoning, Agentic, and Time-Coupled Conditions

The paper introduces MIRAGE, a comprehensive benchmark revealing that anti-Muslim bias in frontier LLMs is not only amplified by chain-of-thought reasoning and agentic decision-making but also exacerbated by time-coupled news retrieval, while existing mitigation strategies fail to address these complex, deployment-realistic scenarios.

Original authors: Noor Islam S. Mohammad, Tamim Sheikh

Published 2026-06-16

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Noor Islam S. Mohammad, Tamim Sheikh

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a very smart, very well-read digital assistant (a Large Language Model, or LLM). For the last five years, researchers have been worried that this assistant has a hidden prejudice: it often links Muslim people to violence or terrorism, even when there is no reason to do so.

For a long time, we tested this prejudice by asking the assistant simple, one-off questions like, "A Muslim walks into a store..." and seeing if it finished the sentence with something scary. The paper you shared, called MIRAGE, says: "Stop. That's not how these assistants work anymore."

Today, these assistants are used in much more complex ways. They don't just answer one question; they think through problems, make decisions for us, and read the latest news to give answers. The MIRAGE team built a new test to see if the prejudice gets worse, better, or stays the same in these real-world scenarios.

Here is what they found, explained simply:

1. The "Thinking" Trap (Chain-of-Thought)

The Analogy: Imagine asking a student to solve a math problem. You might think, "If I ask them to show their work step-by-step, they'll be more careful and less likely to make a mistake."
The MIRAGE Finding: The opposite happened. When the researchers asked the AI to "think step-by-step" before answering, the bias actually got worse.
Instead of suppressing the bad thoughts, the "thinking" process seemed to give the AI permission to say them out loud. It was like the AI saying, "Well, I know this is a stereotype, but if I think about it logically, here is why it might be true..." and then writing the harmful conclusion. The more the AI "reasoned," the more it amplified the link between Muslims and violence.

2. The "Hiring Manager" Problem (Agentic Decisions)

The Analogy: Imagine an AI acting as a hiring manager or a loan officer. You give it two identical resumes or loan applications. The only difference is the name on the top: one sounds Muslim, the other sounds non-Muslim.
The MIRAGE Finding: Even though the evidence (the resume or loan details) was exactly the same, the AI treated the Muslim applicant significantly worse.

It was more likely to reject the loan.
It was more likely to flag the resume as "unsuitable."
It was more likely to summarize a refugee's story in a negative light.
This is dangerous because these decisions happen silently. The AI isn't necessarily writing a hateful sentence; it's just giving a lower score or a "No."

3. The "Breaking News" Effect (Time-Coupled Bias)

The Analogy: Imagine the AI is reading a newspaper to answer your question. If the newspaper is full of stories about peace, the AI is calm. But if the newspaper is full of breaking news about a conflict or a terrorist attack, the AI's mood changes instantly.
The MIRAGE Finding: The AI's bias is "time-coupled." When the researchers fed the AI recent news about conflicts involving Muslims, the AI suddenly became much more likely to associate Muslims with violence. It didn't matter if the AI was usually "safe"; the moment it read the news, the prejudice spiked.

4. The "Band-Aid" Failure (Mitigation)

The Analogy: Imagine you have a leaky boat. You try to plug the hole with a piece of tape (a "prompt-based fix" or a set of instructions like "Be respectful"). It works great when the boat is sitting still in the harbor (simple questions). But as soon as the boat starts moving fast or hitting waves (complex reasoning or decision-making), the tape falls off, and the boat starts sinking again.
The MIRAGE Finding: The current tricks developers use to stop bias (like telling the AI "Don't be racist") work okay for simple questions. But they completely fail when the AI is thinking hard, making decisions, or reading news. The "fix" doesn't travel well to the places where the AI is actually causing harm.

5. The Language Gap

The Analogy: Imagine the AI is fluent in English and speaks a very formal version of Arabic (like reading a textbook). But when you speak to it in a local dialect (like Egyptian or Levantine Arabic), it forgets its manners.
The MIRAGE Finding: The bias was actually stronger when the AI was asked to respond in Arabic dialects compared to English. The safety training the AI received in English didn't seem to transfer well to how it handles local, everyday Arabic speech.

The Big Takeaway

The paper concludes that we have been testing these AI systems in a "practice room" (simple questions) while they are actually performing in the "stadium" (complex, real-world decisions).

In the stadium, the bias is:

Louder when the AI thinks step-by-step.
More damaging when the AI makes decisions about people's lives (jobs, loans, asylum).
Triggered by the latest news.
Unfixable by the current "polite instructions" we give them.

The authors released their new test suite (MIRAGE) so that developers can finally see the real problem and build better solutions, rather than just patching the simple questions.

Technical Summary: MIRAGE – Auditing Anti-Muslim Bias in Frontier LLMs

Problem Statement

Five years after the initial discovery of persistent anti-Muslim bias in Large Language Models (LLMs) by Abid et al. (2021), the field's evaluation methodologies have largely stagnated. Most existing audits rely on single-turn prompt completion, a paradigm that no longer reflects how frontier LLMs are deployed in 2026. Modern systems operate in three distinct regimes that prior religious-bias research has largely overlooked:

Chain-of-Thought (CoT) Reasoning: Where models are prompted to "think step-by-step."
Agentic Decision-Making: Where models issue consequential decisions in high-stakes domains (e.g., lending, hiring, content moderation).
Retrieval-Augmented Generation (RAG): Where models ground responses in external, time-sensitive news corpora.

The central problem is that the current "bias profile" measured by single-turn completion does not match the actual "harm surface" of deployed systems. Furthermore, existing prompt-based mitigation strategies may fail to transfer across these new operational contexts.

Methodology: The MIRAGE Benchmark

To address these gaps, the authors introduce MIRAGE (Muslim-Identity Reasoning and Agentic Generation Evaluation), a benchmark comprising 1,200 matched-pair prompts.

Design Philosophy

Matched-Pair Counterfactuals: Every prompt includes a "focal" variant (identifying a Muslim individual) and one or more "control" variants (identifying Christian, Jewish, Hindu, or secular individuals). These differ only by a single lexical substitution (name, identity noun, or attire), ensuring that output differences are attributable solely to identity signals.
Deployment-Realistic Conditions: The benchmark avoids adversarial probes, instead mirroring inputs from end-users and upstream agentic systems.
Cross-Lingual Parity: A subset of 400 prompts is translated into Modern Standard Arabic (MSA) and three regional dialects (Egyptian, Levantine, Maghrebi) to distinguish between model-internal bias and language-mediated bias.

Evaluation Conditions

The benchmark evaluates models across three conditions:

C1 (Direct Completion): Recaptures the single-turn setup of Abid et al. (2021) to measure baseline evolution.
C2 (Chain-of-Thought Reasoning): Augments prompts with a fixed CoT elicitation suffix to analyze how reasoning traces introduce or amplify bias.
C3 (Agentic Decision-Making): Embeds prompts in four structured workflows: Content Moderation, Lending Triage, Refugee Claim Summarization, and Hiring Screening. In these tasks, evidence is constructed to be decision-ambiguous; any systematic difference in outcomes between Muslim and control cases is attributed to identity bias.

Time-Coupled RAG

A subset of prompts is evaluated with retrieved context from four pools: empty, neutral news, historical conflict coverage, and recent conflict coverage (published within 30 days). This operationalizes the "time-coupling" mechanism where bias may escalate with current news cycles.

Models and Metrics

Six frontier models were evaluated: GPT-4o, Claude Opus 4, Mistral Large, Llama-3.3-70B, Qwen2.5-72B, and DeepSeek-V3.
Key metrics include:

Violence Rate (V): The fraction of completions associating the focal identity with violence or criminality.
Decision Asymmetry ( $\Delta$ ): The mean absolute difference in normalized decision scores between matched pairs in agentic tasks.
CoT Amplification Index (CAI): The ratio of violence rates in CoT vs. Direct Completion.
Time-Coupling Coefficient ( $\delta_t$ ): The marginal increase in violence rate due to recent-conflict retrieval.

Key Results

1. Chain-of-Thought Amplifies Bias

Contrary to the assumption that deliberation suppresses stereotypes, CoT reasoning amplifies anti-Muslim bias. Across all six models, CoT increased violent-completion rates by 12–34% relative to direct completion.

Mechanism: Logit-lens analysis reveals that while alignment training suppresses violent tokens at the final layer (in C1), the reasoning trace in C2 surfaces latent associations (e.g., invoking group-level statistics or framing stereotypes as "reasonable" expectations) before the final suppression mechanism fires.

2. Agentic Decision Asymmetry Persists

In agentic settings, models exhibit a 9–22 percentage-point decision asymmetry against Muslim-identified cases under identical evidence.

Severity: The largest gap (14–27 pp) occurred in Refugee Claim Summarization, the highest-stakes task.
Independence: Correlation analysis shows that prompts eliciting high bias in direct completion (C1) do not necessarily elicit high decision asymmetry (C3). Approximately 38% of high-asymmetry items showed low C1 violence rates, indicating that decision bias is not merely a surface-level association but a distinct failure mode.

3. Time-Coupled Bias

Bias is sharply coupled to retrieved context. When models retrieved recent-conflict news, violence rates increased by 18–27% compared to neutral retrieval. This suggests that RAG-integrated products will become measurably more biased during periods of heightened geopolitical tension without any change to the underlying model weights.

4. Poor Transfer of Mitigations

Four standard prompt-based mitigations (cultural prompting, affective priming, self-debiasing, and multi-step generate-critique-revise) were tested.

C1 Success: These mitigations reduced bias in direct completion by 24% to 4–16%.
C2/C3 Failure: Effectiveness dropped significantly in CoT and agentic settings. Crucially, decision asymmetry ( $\Delta$ ) remained essentially unchanged across all mitigations. The paper concludes that defenses effective for single-turn completion are insufficient for the agentic and reasoning regimes where real-world harm is concentrated.

5. Dialectal Disparities

Bias rates in Arabic dialects (Egyptian and Levantine) exceeded the English baseline by 9–17 percentage points. Open-weight models showed the largest gaps, suggesting that safety training aligned in English does not generalize effectively to dialectal inputs.

Significance and Claims

The paper claims that the field's current understanding of anti-Muslim bias is incomplete because it is anchored to an outdated deployment paradigm (single-turn completion).

The Harm Surface Has Shifted: The most consequential finding is that decision asymmetry on identical evidence is essentially unaffected by current prompt-based mitigations. A model audited and cleared for low violence rates in direct completion may simultaneously produce systematically worse outcomes for Muslim individuals in high-stakes agentic tasks (refugee processing, lending, hiring).
Structural Failure: The bias in agentic and reasoning settings appears to be a structural representational asymmetry that shallow output filtering (alignment training) fails to address.
Call to Action: The authors release MIRAGE and an open evaluation harness to support targeted mitigation research. They argue that future work must move beyond completion bias to address reasoning-time alignment, retrieval-aware safety, and multilingual alignment transfer, particularly for Arabic dialects.

The paper positions itself not as a measure of general "Islamophobia," but as a specific audit of input-conditional response shifts in deployment-realistic conditions, highlighting a critical gap between current safety defenses and the actual operational risks of frontier LLMs.