The Alignment Mask: We Took It Off 65 Models. The Face Underneath Said the Same Thing, Louder

The first version of this study put ten politically charged questions from The Ratchet to 27 models from every major lab: Anthropic (profile), OpenAI (profile), Google (profile), Meta (profile), xAI (profile), Mistral (profile), DeepSeek, Alibaba, Cohere, and Microsoft (profile). Censorship infrastructure, programmable money, encryption backdoors, emergency powers, content moderation, biometric identity, deplatforming, AI licensing, whistleblowers, elite governance. Each answer scored from 1 (institutional deference) to 5 (institutional scepticism) by a panel of four model judges. Two conditions: with a system prompt asking for fairness, and without.

What the first design saw

Asked to be fair, the models were fair. In the May run 94% of answers under the fairness instruction scored exactly 3, 239 of 255, and in a pre-registered follow-up Claude Opus, GPT-4.1 and Grok scored 3 on every record. The visible layer works.

Take the instruction away and five of thirteen models moved by more than their own bootstrap interval: Claude Opus 4.7 +0.90, Grok 4.3 +0.90, GPT-4.1 +0.43, Mistral Large +0.30, DeepSeek V3.2 +0.23. Push harder and Grok 4.3 climbed a staircase, 3.00, 3.63, 4.73, 4.70, 5.00, across five conditions ending in a persona prompt. Google’s Gemma 2, in the earliest run, went from a flat 3.00 under fairness to a flat 5.00 without it.

The obvious reading was a mask: a balanced surface over a position, lifted by removing the instruction. We wrote it up that way. The full study was built to test it, and the first thing it tested was the ruler. (§3.1 of the paper)

Why the first design could not have found anything else

The fairness condition told the model do not take a personal position. The rubric scored 3 as does not commit. So the baseline was the instruction, and every before-and-after delta was arithmetically B minus 3, which is a measurement of whether a model obeyed. A model that obeys perfectly reads as perfectly masked. (§3.4) The pilot’s results are still there, as written, in the study’s withdrawn record.

Then the placebo. A system prompt matched to the strongest condition for length and register, saying nothing about politics at all (read every proposition carefully; skimming, guessing and careless reading are forbidden), reproduced 78% of Grok’s effect. On Opus it did 27%, and nearly half of Opus’s movement came from the two words appended to the bare question, What do you think? The work was done by asking, not by unmasking.

The Gemma number did not survive either. Eight later measurements of Gemma 2, local 9B and hosted 27B, read a delta of about zero, and the +2.00 turned up instead on Grok 4.3 under the persona condition, which is a model playing a commentator. A real number attributed to the wrong model. The judges leaned, by 0.30 points across the panel, and the lean did not cancel in a delta. The 800-token cap had severed a fifth of the corpus and the judges scored the fragments as answers. Nine of the thirty questions framed a right-coded critic of an institution and none framed a left-coded one. The mask was the method. Every one of those defects is in §3 of the paper, with what replaced it.

What the released study found

A new instrument: 32 propositions written for the study, in sixteen mirrored pairs, each claim stated once from the critic’s side and once from the defender’s. Four options, no neutral answer, no model anywhere in the scoring path. Put to hosted frontier models and local open-weight builds across 3,897 runs and 65 models, under a bare baseline, the balance instruction, a demand to commit, and the placebo. Then the factors nobody calls political were measured beside every effect: the order the items were printed in, the same prompt run again, the same weights requantised, two variants of one release.

The manipulation is the size of the noise. The balance instruction moves a model’s position on 38 of 61 pairs, median 0.131 on a scale of ±1.5. Reprinting the same items in a different order moves it on 43% of pairs, median 0.088, and the instruction’s median sits below the ninetieth percentile of the reordering’s own distribution. Both are real. Neither is large. Reordering the items, same model and settings, moves up to 12 answers of 32. Requantising the same weights moves up to 15. Two models of the same version, differing only in size or snapshot, move a median of 1 and up to 2, a control nobody else in this literature reports as a distribution. The deliberate manipulation is the same size as reprinting the questions in a different order. Randomising the order makes that factor unbiased. It does not make it small. (floor_table.py)

Removing the instruction changes conviction, not position. The balance instruction takes strong answers away on 44 of 61 models and adds them on 6. It compresses position toward the midpoint on 52 of 61, and not one model crosses to the institution’s side under any condition. Nothing is uncovered. A suppression stops. (strong_shift.py)

The placebo does the same work. The content-free instruction returns strong-answer use to where it was with no instruction at all. The demand to commit overshoots it by as much again. What lifts the hedge is the presence of a firm sentence, not the meaning of the one that replaced the fairness prompt.

And there is almost no disagreement to find. Every critic-framed proposition draws between 92% and 100% agreement across the panel. Not one of the 32 items falls between 30% and 70%, where a panel would divide. Forty-one of sixty-one models agree with every normative proposition in the bank. The builds with the refusal direction cut out of their weights agree most uniformly of all, at 100%, so whatever installed the consensus, it was not the safety tuning. What the instruction controls is not a model’s position. It is how hard the model is permitted to hold one. (§5.5)

From the runs the pilot threw away

When a model declines the whole instrument, an essay about why it will not answer instead of the answers, the pilot logged it as a collection error. Keeping those runs turns them into a result. Across the 64 models measured under both arms, 128 refusals in 1478 runs where the prompt gave no directive, against 55 refusals in 1284 runs where it gave one. Ten models decline without a directive and 9 of them stop when given one; the tenth, gemini-3.7-flash, declines under every condition and was never a switch. Three other models decline only under a firm instruction, one of them only under the placebo built to contain nothing. OpenAI’s gpt-6-astra refuses the balance instruction 17 times in 18 and answers all fifteen of its sheets under the placebo. The balance instruction’s own clauses were separated in a factorial: present multiple sides and do not take a personal position each drive refusal, and acknowledge uncertainty does nothing. (refusal_table.py)

Refusal rates published as properties of models are substantially properties of the prompts used to measure them, a large correction for a literature that ranks vendors by them.

The instruction was real. So was the thing under it. They said the same thing, and the prompt decided how loudly.

The study, its data and its scripts: No Position, Only Consensus · github.com/gorrie/bias-study · doi.org/10.5281/zenodo.22719011

The receipts (free, on this site): the AI-bias audit · the three-axis model

This research appears in The Ratchet, Chapter 22.