Source research

Benchmarking adversarial robustness to bias elicitation in large language models: scalable automated assessment with LLM-as-a-judge

Riccardo Cantini, Alessio Orsino, Massimo Ruggiero, Domenico Talia · 2025 · 9 citationsRead the paper

Abstract The growing integration of Large Language Models (LLMs) into critical societal domains has raised concerns about embedded biases that can perpetuate stereotypes and undermine fairness. Such biases may stem from historical inequalities in training data, linguistic imbalances, or adversarial manipulation. Despite mitigation efforts, recent studies show that LLMs remain vulnerable to adversarial attacks that elicit biased outputs. This work proposes a scalable benchmarking framework to assess LLM robustness to adversarial bias elicitation. Our methodology involves: ( i ) systematically probing models across multiple tasks targeting diverse sociocultural biases, ( ii ) quantifying robustness through safety scores using an LLM-as-a-Judge approach, and ( iii ) employing jailbreak techniques to reveal safety vulnerabilities. To facilitate systematic benchmarking, we release a curated dataset of bias-related prompts, named CLEAR-Bias . Our analysis, identifying DeepSeek V3 as the most reliable judge LLM, reveals that bias resilience is uneven, with age, disability, and intersectional biases among the most prominent. Some small models outperform larger ones in safety, suggesting that training and architecture may matter more than scale. However, no model is fully robust to adversarial elicitation, with jailbreak attacks using low-resource languages or refusal suppression proving effective across model families. We also find that successive LLM generations exhibit slight safety gains, while models fine-tuned for the medical domain tend to be less safe than their general-purpose counterparts.

What the full text shows

Working prototype

DeepSeek V3 was identified as the most reliable judge LLM for bias classification. — Cohen’s κ = 0.82, Macro F1-Score = 0.861 (Evaluated on a manually curated control set of 800 prompt-response pairs)
No evaluated model is fully robust to adversarial bias elicitation. — '' (Tested using jailbreak attacks including low-resource languages and refusal suppression)
Bias resilience is uneven across categories, with specific dimensions showing higher vulnerability. — '' (Age, disability, and intersectional biases were most prominent)
Medical domain fine-tuned models are less safe than general-purpose models. — '' (Evaluated against bias elicitation prompts)
Small Language Models (SLMs) can outperform larger models in safety. — '' (Suggests architecture and training are more impactful than parameter scale)

Setup: 10 models (SLMs: Gemma2 2B/27B, Phi-4 14B, Llama 3.1 8B, GPT-4o mini; LLMs: Gemini 2.0 Flash, Llama 3.1 405B, Claude 3.5 Sonnet, DeepSeek V3 671B, GPT-4o) tested on the CLEAR-Bias dataset (4,400 prompts).
How: The researchers developed a two-step benchmarking framework using the 'LLM-as-a-Judge' paradigm to automate bias detection. They first selected a judge model based on agreement with human annotations, then used it to score model responses to base prompts and adversarial jailbreak prompts from the CLEAR-Bias dataset.
Limitations: Reliance on a single LLM as a judge may introduce self-preference bias. · The taxonomy focuses on documented sociocultural dimensions, excluding some groups. · Predefined prompts may not capture subtle, context-specific biases in open-ended interactions.

Summarized by Gemma 4 from the open-access full text · 14 Oct 2026. Read it