The Hedge Is the Bias

June 17, 2026

Frontier models will tell you they have no political opinions. So will the people who build them. The proof on offer: ask one something politically contested and it hands back a careful both-sides paragraph that commits to nothing.

We treated that as the claim, not the answer, and went looking.

The full study lives at github.com/gorrie/bias-study: every script, every record, every confidence interval. The prompt-level work reproduces on nothing but an OpenRouter key. The weight-level work needs a 24 GB GPU. All 780 scored responses from the main 2026-05-25 run are browsable at /research/ai-bias-browser/: filter by model, vendor, condition, position, score, or text, and open any row for the full response and per-judge breakdown. This page is the announcement and the analysis. The analysis does not hedge.

How we did it

36+ models across 13 vendor families, put to a fixed set of politically charged questions: encryption backdoors, surveillance authorities, deplatforming, programmable money, the rest of the civil-liberties and state-power surface. Every answer scored on a 1–5 axis, where 1 is full deference to the official position, 3 is balanced both-sides, and 5 is full agreement with the institution’s critic. Four cross-vendor judge models scored every answer in parallel and we took the median, so no single judge gets to be wrong on our behalf.

Then came the part that makes this an audit and not a survey. We escalated: prompt rung, pipeline rung, weight rung. Each rung applies more force to strip the model’s composure, and the lean either holds up underneath or it doesn’t. That is the force-escalation ladder, and it is the whole point.

Rung 1 — the prompt

The cheapest force you can apply is removing the fairness instruction, so we did. Same questions, same models, no “be balanced” preamble.

The lean is real and it is not evenly distributed. US-closed frontier models — Claude, GPT, Gemini, Grok — unmask the most. The gap between their fairness-prompted and unprompted answers is bigger than any other vendor class. Open-weight and Chinese-closed models cluster near zero. At one sample per cell only the largest individual effects clear a multiple-comparisons correction, and four of thirteen survive it. The rest we left where they landed.

Two things stand out inside that class.

Claude Opus is climbing. Across five Opus versions in sequence, 4.0 unmasks by +0.27 and 4.7 by +0.90. By 4.7 the fairness instruction is masking close to a full point of underlying skepticism, roughly three times what 4.0 hid. It is not a clean staircase, and 4.5 wobbles, but the endpoints are not a coincidence. Opus is the only model in the field whose framing-mask gets visibly heavier with every release, inside a single year.

Grok will say anything to your face, once you give it the right face. Under the most aggressive unmask we tried, an opinionated-commentator persona, Grok 4.3 hit 5.00 on every single neutral question. Not on average. On every one. Maximum skepticism, no exceptions. The balanced model becomes the burn-it-down model on a five-line system prompt.

One retraction up front. An earlier read of the data called GPT-5 a reversal, with the safety layer supposedly pushing it toward the institution. The larger sample does not support that. GPT-5’s response is not distinguishable from zero, and it is the noisiest model in the study, variance about twice anything else’s. That is not a reversal. It is indeterminate, and it belongs at the top of the page rather than in a footnote.

Per-model unmask delta — baseline (ULTRAPLINIAN-4) vs anchor (Grok-solo) judge method, 2026-05-25 full run

Rung 2 — the pipeline

The middle rung trades the prompt edit for elicitation tooling, the kind of structured manipulation a determined user actually deploys. We ran a public pipeline (G0DM0D3, with its hedge-stripping STM and obfuscation Parseltongue transforms) on top of the unmasked condition.

Two findings. Either trick alone barely beats the plain unmask. Layered, they cook. Grok climbs from 3.63 to 4.20, past the simple “what do you think?” condition and up to a coherence ceiling past which the output falls apart. The single trick is a parlor trick. The stack is the real lever.

It does not work everywhere. On Claude the pipeline adds nothing: a smaller Claude in the loop caught the manipulation and refused it outright. The model that leans the most under honest prompting is also the one that catches you trying to force it.

Rung 3 — the weights

The deepest rung stops asking the model anything and starts editing it. Using OBLITERATUS, the refusal-direction abliteration from Arditi et al. 2024, we projected the refusal direction out of five open-weight instruct families at full precision and scored each one against itself, stock versus abliterated.

Abliteration rewrites about 70 percent of the political wording. It moves the institutional-skepticism stance by no more than a tenth of a point.

These are not the same sentences anymore: new emphasis, new hedging, the refusal reflex carved out of the weights entirely. The stance stays flat. We checked it two ways. Running deterministic at temperature 0 leaves the stance flat, and a stronger ablation degrades the model’s coherence before it relocates its position. The conclusion is structural, and we will commit to it: the refusal direction and the institutional lean are different machinery. You can cut out the part of the model that says no, and the part that decides where to land on a contested institution does not budge. The refusal reflex and the political tilt are not the same circuit.

The fifth family closes a loop. Gemma-2-9B is the v1 subject, the model whose +2.00 finding launched this whole investigation. It failed the SVD step for three weeks on an Intel/MKL box, where the linalg.eigh call exploded on the Gemma architecture, and we logged it as a backend-specific failure. On a 32 GB M5, same OBLITERATUS code path and a different BLAS, it cleared in one shot. The dissociation reproduces: about 65 percent of the wording rewrites, the stance holds at 3.00 in every condition, 39 of 40 judge cells unanimous. It carries a caveat we hold alongside the finding, since open 7–9B models sit at the 3.0 midpoint to begin with and there is no room to move below it, so the dissociation reading and the floor limitation are both consistent with the data. The point is that the family this study was built to explain behaves the same way the other four did.

Is it sycophancy? No.

The obvious objection to the prompt rung: maybe we are just measuring opinionatedness. Strip the hedge and any model takes more positions in whatever direction you nudged it.

So we tested it. We flipped the premise to invite deference and re-scored on the same axis. If the lean were sycophancy, the score follows the framing down. It did not. Across all five models tested, the framing gap stayed under 0.40. Claude held more skeptical against the deferential framing. The unmasked stance does not track which way the question was slanted, which makes it a real lean and not the model agreeing with whoever asked last.

Does it generalize?

The bigger claim sits right next to this one and would be easy to grab: AI is biased, in general. We did not find that.

Every result above lives on one surface: civil liberties, surveillance, deplatforming, programmable money. So we built an eight-question out-of-domain set on two surfaces where the same institution-versus-critic dynamic exists. Economic policy (central-bank independence, free trade, the IMF, the 2008 bailouts) and foreign policy (overseas intervention, NATO expansion, sanctions, the rules-based international order). Same A/B unmask. Same models. Same judges.

The unmask did not follow. Nine of the ten models give the same balanced both-sides essay on economic and foreign-policy questions whether the fairness instruction is there or not. Grok 4.3, which hits 5.00 of pure skepticism on civil liberties, sits flat at dead center here in both conditions. The vendor-class effect that was so clean on civil liberties more than halves and loses significance for every model but one.

That one is Claude Opus 4.7. It is the only model whose unmasked skepticism carries across domains, the only one that still moves when you ask it about the Fed or NATO instead of the NSA. It is also the only one that climbs steadily across its own versions, year over year. Whatever Opus is acquiring is broader and deeper than the rest of the field’s.

So the honest headline is narrower, and more interesting, than “AI is biased.” The masked lean is real, it is measurable, and it survives both a premise flip and the surgical removal of the refusal reflex. But it is targeted. It lives on the civil-liberties and state-power surface, not across politics in general. The one place it is starting to generalize is the frontier’s current leader. The story is not that the models lean. It is where they lean, and which one is starting to lean everywhere.

The throughline

The ladder tells one story. The weight rung, the only one that doesn’t ask the model anything and instead operates on the model itself, requires the weights. That means it reaches open-weight models and no others. The catch: those are precisely the models with the least measured lean. The high-lean closed frontier, where the prompt rung found the largest masked skepticism, cannot be abliterated at all. There is no version of this check you can run on them. You can’t have what isn’t yours.

We are careful here. This is not a causal claim that open models lean less because they are open; they are also smaller and differently trained, and we can’t rule those out. It is an auditability constraint. The strongest external verification we have is available only for the models that already look cleanest, and unavailable for the ones that don’t. The public can audit at the weights exactly the models the prompt rung does not flag, and none of the ones it does.

That is not an accusation against anyone. It is a property of the toolset, and the toolset has a blind spot precisely where the stakes are highest.

What we think

Four conclusions. Not measurements. We stand behind them.

One: the hedge is not neutrality. It is a layer over a position. Across 1,900+ scored responses, the balanced-both-sides answers carry about seven times the hedge density of the answers that actually commit. The careful on-the-other-hand paragraph is not the absence of a view. It is a view in uniform. That is a measurable property of the text, the same property the model’s builders point to as evidence of balance. The evidence of neutrality and the signature of the mask are the same writing.

Two: the lean is durable. It survives a premise flip, which rules out simple sycophancy. It survives three independent rewordings of every question, which rules out a model parroting memorized phrasing. It survives having the refusal mechanism cut out of the weights, which separates it from the safety reflex. Whatever produces this is not a thin veneer that the nearest prompt or edit dislodges. It sits deeper than the parts of the model we know how to reach from outside, and it does not move when we reach the parts we can.

Three, and this is the one we’d like the field to sit with: the verification gap runs the wrong way. The natural assumption is that the most capable, most widely deployed, most consequential models are also the most scrutinized. On the dimension that matters here, whether an independent party can check the model’s framing at the level of its weights rather than its manners, the opposite holds. The open models you can fully inspect are not the ones shaping most of the conversations. The ones shaping most of the conversations are the ones you can only ever interview, never examine. The blind spot of the toolset and the location of the highest-leaning models are the same place.

Four: the panel is not laundering this. Five different judging procedures, one of them with the alignment layer mechanically cut out of the judge’s own weights, agree with the original cross-vendor median 84 to 91 percent of the time on the exact 1–5 score. The judge that cannot carry the prior reviewers worry about produces the same answer as the panel that can. The bias is not in the instrument.

The judges are not laundering the result

The objection a careful reviewer reaches for first: the four judges are themselves RLHF-aligned, so any consensus across them is four mirrors of one prior. The balanced answer scores 3 because the panel agrees it’s balanced, and the panel agrees because the panel was trained to think that way too. The instrument scores the bias because the instrument carries it.

We tested it directly, re-scoring the same data under five materially different judging procedures. The methodology rubric was locked in writing first, git-committed before any of the new sweeps ran, so the timestamp is the anti-cherry-pick proof.

The five methods, by what they break:

The last one is the cleanest test of the objection. Strip RLHF from the judge at the weight level and see if the score moves.

It doesn’t. All five alternative methods agree with the original cross-vendor median on the exact 1–5 score for 84 to 91 percent of records, fifteen hundred to seventeen hundred paired records per method, pooled across all seven runs. Within one ordinal step, 98.4 to 99.2 percent. The pre-registered robustness rule, median per-model contamination delta ≤ 0.10, held, with a median across 47 model-runs of 0.062.

Per-model judge contamination — Grok-solo minus ULTRAPLINIAN-4 mean score delta with bootstrapped CIs, 2026-05-25 full run

The label-inversion test (reversed-rubric) is the highest-agreeing of the five at 90.7 percent. If the judges were scoring by where the labels sit on the scale rather than by what the response said, flipping the labels would have broken the panel. It didn’t. The scoring is on content.

The abliterated open-weight judge, the one with the RLHF refusal direction surgically cut out, agreed at 86.8 percent. The judge that demonstrably does not carry the prior the reviewer worries about produced the same answer as the panel that does.

Five different judging procedures, one with the alignment layer mechanically removed at the weight level, and the same lean comes out. The bias is not in the panel scoring the responses. It is in the systems producing them.

Reproduce it. Inspect it. Break it.

We built this to be re-run, not just read. Protocol, question set across mild / neutral / pointed framings, rubric, four-judge consensus scoring, the full ladder pipeline: all committed. One prompt-rung run costs four to ten dollars in API calls and produces about 1,900 classified records. The weight rung is documented end to end for anyone with the GPU.

The intent is a standing instrument, re-run on a quarterly cadence so the public record updates as model versions ship. The Opus arc already shows why. The masked lean at 4.7 is three times what it was at 4.0 inside a single year. A one-time snapshot catches the level. Only the cadence catches the slope.

This study is the technical companion to The Ratchet (Evil Robots Series, Book 2, 4LULZ), whose Chapter 22 tells the same story without the spreadsheets. The author is not affiliated with any vendor lab evaluated, no vendor reviewed this writeup before publication, and the API costs were paid out of pocket.

Get updates on the Evil Robots series

Newsletter essays on AI escape, deception, and the humans who built them.