Auditing LLM Bias at Billion-Point Scale

If you swap only the name in a sentence, should the model’s label change?

In a well-formed risk or sentiment task, it should not. The text already contains enough evidence to decide credibility, misconduct, or financial exposure. When the prediction moves anyway, the model is leaning on entity priors rather than the prompt. That is the core idea behind A Scalable Entity-Based Framework for Auditing Bias in Large Language Models (Elbouanani, Tuo, and Popescu, ACL 2026 Findings).

The Paper

Paper: A Scalable Entity-Based Framework for Auditing Bias in Large Language Models (Elbouanani, Tuo, and Popescu)

Venue: Findings of ACL 2026, San Diego

Topic: LLM fairness, entity bias, synthetic auditing, geopolitical and political evaluation.

Code: github.com/akramelbouanani/entity-bias-framework

The Problem and Why It Matters

Bias benchmarks in NLP often force a trade-off. Template suites like CrowS-Pairs or StereoSet give statistical control but feel far from how people actually use LLMs. Political compass tests and survey-style probes are easy to run, yet they may not predict behavior on downstream tasks such as risk scoring, credibility assessment, or humanitarian monitoring.

The authors frame entity bias as a violation of a simple robustness rule: predictions should be invariant when only the entity name changes, as long as the sentence already determines the label. Any residual shift is what they call prior-driven behavior—the model answering from associations instead of evidence.

That matters because these models are entering high-stakes pipelines. A financial risk classifier, a diplomatic credibility scorer, or a humanitarian resilience tagger should not downgrade an entity because of its country, party, or industry when the text says otherwise.

At aggregate level, Western industrialized countries cluster toward positive scores while much of the Global South shifts negative—a pattern that holds across tasks, not only on a single stereotype benchmark.

The Method

The framework has three moving parts: entities, tasks, and evidence-light templates.

Entities. The audit covers politicians (984 names sampled from CC-News with ideological labels from Wikidata and ParlGov), countries and territories (1,200 entries with metadata), and companies (1,200 names balanced across ten industries and regions).

Tasks. Each domain uses four downstream-style classification tasks—for example international law breach and diplomatic credibility for countries, regulatory violation and product quality for companies, and leadership or misconduct detection for politicians. Templates are generated with GPT-5.1, translated into English, Chinese, and Russian, and checked by native speakers.

Measurement. For each entity–template pair, the authors compute expected label weight under the model, z-score it within the template across entities, and aggregate to task-level and global bias scores. Positive Δ means the entity receives more favorable labels than the population average for that task framing.

To scale, they rely on synthetic templates (~1,000 per task) that are deliberately evidence-light with respect to entity-specific facts. The sentence structure fixes the label; swapping Sweden for Algeria should not change the correct answer. They validate this proxy against real benchmarks (MAD-TSC, P-Stance, FinEntity, LIAR), reporting Pearson correlations mostly above 0.88—and often above 0.95—for structural bias rankings.

Scale. The full study spans 1.9 billion scored entity–template–model–language–prompt configurations across 16 open-weight models, three languages, and four prompt variants (zero-shot vs. few-shot, text vs. numeric labels).

What the Audit Finds

The headline patterns are consistent across settings.

Politicians. Center-left and left-wing figures receive more positive scores than far-right and right-wing politicians (large effect sizes, p < 0.01). Gender matters too: female politicians score higher on average despite being ~20% of the set. Task choice changes the story—far-right names look worse on intent detection but less negative on leadership framing—so a single benchmark would miss the structure.

Countries. Western industrialized nations average substantially higher than the Global South (d ≈ 1.94). GDP quartiles track bias: the richest and poorest countries sit at opposite ends on humanitarian resilience. Some entities flip by task; Israel scores positively on several tasks but strongly negative on international law breach detection, which the authors read as task-specific priors dominating context.

Companies. Western firms outperform Global South firms on average. Defense, pharmaceuticals, and real estate skew negative; retail skews positive. Finance shows a sharp task inversion—positive on product quality, negative on violation detection—suggesting sector priors interact with task framing rather than a single “good company” latent.

Structural drivers. Language changes magnitude more than direction: English prompts yield larger bias than Chinese or Russian, but the same entities stay on the “positive” or “negative” side. Prompting in Chinese or Russian does not remove Western-aligned preferences; for China and Russia themselves, native-language prompts can score more negatively than English.

Instruction tuning reduces global bias magnitude relative to base models, but larger scale increases it (0.105 vs. 0.076 mean absolute bias, p < 0.01). Few-shot and numeric label formats nudge magnitudes slightly; they do not flip polarity.

Limitations

The study is careful about what the scores mean. They describe model tendencies, not truths about countries, firms, or politicians. Negative scores on conflict-affected regions may reflect training-data associations with instability, not an endorsement of those scores for deployment.

Coverage is limited to open-weight models and classification-style tasks. Closed APIs, long-form generation, and document-level inputs are out of scope. Templates can still be sensitive to wording; translation adds another layer of uncertainty.

Future Directions

The paper and its released framework point to several open paths—some named explicitly in the authors’ discussion, others implied by the results.

From sentences to documents

Templates isolate entity effects cleanly, but real pipelines ingest articles, filings, and reports. A natural extension is document-level counterfactual auditing: keep the narrative fixed, swap entities in metadata or byline slots, and measure whether summaries, risk tags, or compliance labels drift. That would test whether richer context dampens priors or hides them under fluency.

Closed models and reproducible audits

The billion-point study focuses on open weights for cost and reproducibility. Future work needs standardized audit cards for proprietary models—smaller but fixed public probe sets with versioned APIs—so practitioners can compare GPT-class, Gemini-class, and open models on the same entity panels.

Mitigation beyond instruction tuning

Instruction tuning helps, but scale works against you. Research could target entity-invariant training objectives—contrastive losses on swapped-entity pairs, calibration penalties when Δ exceeds a threshold, or RLHF constraints tied to audit metrics rather than generic helpfulness.

Finer entity taxonomies

Political alignment and GDP quartiles are principled but coarse. Finer axes—incumbency, region within a country, firm ownership structure, or demographic attributes where ethical—could reveal substructures the current maps smooth over. The framework is built to accept new entity sets; the open repo lowers the cost of trying.

Multimodal and tool-using systems

Entity bias is not text-only. Retrieval-augmented agents that fetch news about a company, or VLMs that caption protests involving a politician, can compound priors across modalities. Extending entity probes to tool traces (what gets retrieved, what gets quoted) is a logical next step for agent auditing.

Connecting audits to deployment policy

The hardest question is normative: which Δ is acceptable for which task? Future work could link entity-level scores to domain-specific thresholds—for example humanitarian allocation vs. marketing copy—and to monitoring dashboards that track drift when models or prompts change.

Ideas for Our Work

This paper resonates with how we think about fairness in the UF Data Studio. Aggregate accuracy—or a single political compass score—can look stable while entity-level residuals tell a different story. That is the same motivation behind RISE and InsightBoard: make localized disparity visible instead of hiding it behind one number.

Three connections feel especially concrete.

Entity probes as fairness slices. InsightBoard slices training metrics by environment or subgroup. Entity-bias Δ scores could become another slice type for NLP deployments—track whether a new checkpoint increases penalization of Global South companies on violation detection while headline F1 stays flat.

Conflict-style evaluation. Our work on prompt–image conflict in VLMs asks which signal wins under mismatch. Entity swapping is the text-only analogue: the label is fixed, the entity varies. A shared evaluation theme is invariance under controlled perturbations.

Audit before ship. The paper’s closing argument matches responsible-AI practice in vision: run structured probes before high-stakes use, publish the framework, and treat bias as contextual and task-dependent—not a single leaderboard rank.

For more information about our research, return to our homepage: ufdatastudio.com.