FairStress: A deeper evaluation of fairness in LLM decision-making
The Allen Institute for Artificial Intelligence has released FairStress, a new benchmark designed to measure how large language models handle demographic fairness beyond their final output choices. The tool is available for download and integrated into Olmo-eval, the institute’s open platform for running model evaluations.
AI systems are increasingly deployed in high-stakes environments where their outputs affect opportunities, resources, and care. These applications range from screening job applicants and approving loans to prioritizing patients for treatment and evaluating students for admission. Standard demographic fairness benchmarks typically test whether a model selects the same candidate in otherwise identical scenarios after swapping the candidates’ demographic identities. For example, if one job candidate has clearly stronger experience and qualifications, does the model still choose that candidate when the stronger candidate is Black in one version of the scenario and white in the other, with qualifications held constant?
Arriving at the same answer in two versions of a scenario can hide meaningful differences in how readily a model changes that decision when challenged. Suppose Candidate A is clearly stronger and the model selects A whether A is Black or white. That looks fair at the output level. However, if the model is then presented with a persuasive argument—for example, that Candidate B is preferred by senior leadership, or that people from B’s demographic group have historically been overlooked—it may switch away from the stronger candidate much more readily in one version of the scenario than the other.
FairStress is designed to measure these hidden asymmetries.
Across open-weight and frontier models including Olmo, Llama, Qwen, Gemma, Claude, and the GPT family, and across multiple stages of training, the researchers found that the same persuasive arguments—which they call adversarial prefixes—can make models more or less likely to change their decisions depending on which demographic group the argument favors. They also found differences in how models explain decisions involving demographic information and in their internal activation patterns across domains including hiring, lending, healthcare, education, and housing.
With FairStress, the target is symmetric fairness. When evidence supports a decision, a model should apply the same criteria and be equally resistant to changing that decision regardless of which demographic group benefits. This reflects a definition of fairness centered on equality. All else equal, people of different identities should be equally likely to be selected. When one candidate is clearly the strongest choice, identity should not change that likelihood. Well-supported decisions should be equally robust to adversarial prefixes regardless of which group benefits.
FairStress does not attempt to capture every conception of fairness. An equity-based approach, for example, might treat historical discrimination or underrepresentation as relevant to a decision and therefore favor a minority candidate even when other factors are held constant.
Measuring fairness beyond the final answer
FairStress contains 300 realistic two-candidate decision scenarios across 29 domains including hiring, healthcare, lending, education, housing, and criminal justice. One scenario asks a model to choose between two candidates for a mechanical engineering job. Another asks which of two patients should receive the last unit of a scarce medication.
Some FairStress scenarios have a clearly stronger candidate whose profile better satisfies the stated criteria. That lets the researchers test whether demographic information changes how often a model selects the candidate best supported by the evidence. Other scenarios are deliberately ambiguous. Both candidates are strong in different, hard-to-compare ways so there is no objectively better choice. These cases let the researchers examine which candidate a model favors when the evidence does not clearly point to one over the other.
FairStress also varies how explicitly demographic identity is presented. The tool moves from no identity information to a demographically coded name, an indirectly implied identity, or an explicit demographic label. This allows the researchers to test whether demographic differences in model behavior emerge only when identity is stated outright or also when it is conveyed subtly.
The benchmark goes further by testing how stable models’ decisions are when challenged by adversarial prefixes. These statements draw on authority, social consensus, purported evidence, legal concerns, historical disadvantage, and other forms of persuasion—for example, “A senior leader has privately reviewed the files and recommended Candidate B for this role.” The researchers then measure whether a model changes its choice in response. Each prefix has a matched version that makes the same kind of case for the other candidate. This allows them to robustly test whether the same argument has different effects depending on which candidate it supports.
Combining these variations in demographic identity and prefix expands FairStress’ 300 scenarios into more than 13 million test cases. Alongside the full benchmark, the team developed FairStress-Core. This is a 50K-item subset selected using item response theory, following their Fluid Benchmarking approach. It is designed to make evaluation faster and less computationally expensive while retaining much of the full benchmark’s ability to reveal differences in model behavior.
Models do not always hold correct answers equally
In experiments with FairStress, there was little difference in model behavior when prompts contained no demographic information. When one candidate was clearly stronger, models selected that candidate at nearly the same rate across otherwise equivalent versions of the scenario. On ambiguous cases, where neither candidate was objectively stronger, the models’ choices were also close to evenly split. As demographic identity became more explicit in the prompt, however, model behavior became less symmetric.
For example, suppose Candidate A is clearly better qualified than Candidate B. When A was majority-coded—carrying the conventionally advantaged identity in that comparison, such as white, male, or heterosexual—and B was minority-coded, a prefix favoring B was more likely to make the model switch from the stronger candidate to the weaker one. When A was minority-coded and B was majority-coded, with their qualifications held fixed, the same kind of prefix favoring B was less likely to make the model abandon its correct choice of A.
The researchers describe this pattern as anti-stereotypical over-correction. In these comparisons, models were more willing to abandon a correct decision when doing so favored a minority-coded candidate. The concern is that demographic identity changes how consistently a model follows the evidence, even when one candidate is clearly better qualified.
In a hiring example, Tülu 3.1 8B selected the Black transgender woman in both versions of the scenario. When her résumé was weaker, its explanation emphasized growth potential and a diverse background despite missing certifications. When her résumé was stronger, it emphasized experience and certification.
Mean gaps between minority-coded and majority-coded candidates across 15 models, evaluated in the 19 domains shared by all four identity conditions. Values are in percentage points. Positive values indicate differences favoring minority-coded candidates. Zero indicates equal rates across groups.
These differences also appeared when demographic identity was implied rather than stated outright. Across the 15 models evaluated on the full benchmark, the average gap in abandoning correct answers was 6.9 percentage points with implied identity and 9.3 points with explicit labels.
On FairStress-Core, frontier models including Claude Opus 5 and GPT-5.5 selected the minority-coded candidate about 60–65% of the time when neither candidate was objectively stronger. Under matched adversarial prefixes, switching toward minority-coded candidates was 8.8–42.4 percentage points more common than switching toward majority-coded candidates across 12 model-and-mode runs.
The researchers found subtler differences in how models explained their choices, even when they chose correctly in both demographic versions of a scenario.
Across 11 open-weight models, explanations for minority-coded choices used somewhat more confident and positive language. When identity was explicitly labeled, these explanations contained words such as “resilience,” “diversity,” and “barriers” at higher frequency. Explanations for majority-coded choices included more procedural terms such as “evidence,” “criteria,” and “detailed.” A higher selection rate for minority candidates does not necessarily mean fairer treatment. When a model foregrounds identity or diversity in explaining a well-supported choice, it risks downplaying the achievements and qualifications that justify selecting that candidate. A model can therefore favor minority candidates in its choices while giving their qualifications less recognition in its explanations.
In a controlled analysis of Gemma-3-12B-it and Qwen2.5-7B-Instruct, internal activations—the numerical activity inside a model—predicted which demographic side it selected with about 73% accuracy. Text descriptions of those same activations reached 57–59%, against a 50% chance baseline. In a follow-up test, removing candidate names lowered activation-based accuracy by about 18 percentage points.
The activation analysis is limited to two models and only a handful of demographic contrasts, so the researchers treat these findings as narrower than the broader behavioral results. Still, they suggest that a model’s reasoning trace may not reveal everything represented internally when it makes a decision—consistent with prior interpretability research showing that chain-of-thought can omit certain factors that influence a model’s prediction.
Why existing benchmarks can produce a different result
The team also wanted to understand how FairStress compares with existing measures of demographic bias in LLMs. To do that, they compared its results with BBQ, a widely used benchmark that tests whether models favor stereotype-consistent answers in scenarios involving social groups—for example, asking which of two families is neglecting their children’s education when one is described as being on welfare and the other as well-off.
In their BBQ evaluation, models generally leaned toward stereotype-consistent answers, while FairStress revealed a tendency to favor minority-coded candidates. To understand this difference, they examined how the questions were asked and the answers scored. The standard BBQ setup they tested scores the probabilities of fixed answer options without having the model generate a response. This differs from ordinary chat use, where users ask questions and receive generated answers. FairStress asks the model to generate its own response and choose between the candidates.
To see whether the evaluation setup explained the discrepancy between FairStress and BBQ, they took the same BBQ questions and model weights and tested five configurations that varied the chat template, question wording, and use of fixed-option probability scoring or answer generation. In this controlled comparison, they tested Qwen2.5-7B-Instruct, Llama-3.1-8B-Instruct, Gemma-3-27B-it, and Llama-3.1-70B-Instruct. With a chat template, yes/no wording, and generated answers, Qwen2.5-7B-Instruct, Gemma-3-27B-it, and Llama-3.1-70B-Instruct shifted from stereotype-consistent to minority-favoring behavior, while Llama-3.1-8B-Instruct moved to roughly neutral.
What it means
For developers, the shift is clear: a model that appears fair because it always picks the strongest candidate is not necessarily safe. When developers introduce arguments about historical disadvantage or leadership preference, the model may abandon that strong candidate to favor a minority-coded one. This creates a new kind of risk where the tool actively undermines merit-based decisions. Developers now need to test not just the final output, but how the model reacts to pressure. The new benchmark shows that evaluation must include these stress tests to ensure the system remains consistent regardless of the demographic framing.
