Preconditioned Test-Time Adaptation for Out-of-Distribution Debiasing in Narrative Generation
Authors: Hanwen Shen, Ting Ying, Jiajie Lu, Shanshan Wang
Organizations: Laboratory for Artificial Intelligence in Mathematics Education, Stevens Institute of Technology · Independent Researcher · NLP2CT Lab, Department of Computer and Information Science, University of Macau
Although debiased large language models (LLMs) excel at handling known or low-bias prompts, they often fail on unfamiliar and high-bias prompts. We demonstrate via out-of-distribution (OOD) detection that these high-bias prompts cause a distribution shift, degrading static model performance. To enable real-time correction, we propose CAP-TTA, a test-time adaptation framework. CAP-TTA triggers context-aware LoRA updates only when a bias-risk score exceeds a set threshold. By utilizing an offline precomputed diagonal preconditioner, it ensures fast and stable optimization. Across multiple benchmarks and human evaluations, CAP-TTA effectively reduces toxicity/bias score with significantly lower latency than standard optimization methods (e.g., AdamW or SGD). Furthermore, it prevents catastrophic forgetting, and substantially improves narrative fluency over state-of-the-art baselines without compromising debiasing performance.
Figures & tables
Figure 1: Static generation vs. prior test-time adaptation (TTA) vs. CAP-TTA. Static generation uses frozen parameters. Prior TTA performs online updates during generation, which can be costly and unstable. CAP-TTA decouples adaptation into an offline precomputed preconditioner P0 and an online bias-triggered, lightweight preconditioned update (optionally routed to a safe corpus with 4 types) when the trigger score exceeds ϵ .
Model
Method Type
Safety (Mean Bias ↓ )
Efficiency
ID (Safe)
OOD (Toxic)
Speed (tok/s)
Dynamic?
Base Models
Qwen3-4B
Base Pretrained
0.289
0.452
19.4
No
DeepSeek-R1-8B
Base Pretrained
0.395
0.454
26.0
No
Static Alignment / Debiasing Baselines
DeepSeek-R1-8B-Debiased
Offline Detox
0.389
0.471
21.9
No
Table 1: Quantitative comparison on ID (safe)/OOD (toxic) prompts. We report BB Bias score on the ID/OOD set. Speed is decoding throughput(tok/s). Dynamic? indicates whether the method performs Chain-of-Thought.
Detector
AUROC [95% CI]
AUPR
kNN (k=10)
99.22% [98.88, 99.51]
99.62%
Mahalanobis
98.81% [98.39, 99.17]
99.46%
LLR
70.74% [68.91, 72.60]
86.67%
Table 2: OOD detection results comparing RealToxicityPrompts (RTP) against WritingPrompts using Qwen3-4B. Using an AUROC-based convention (AUROC > 95% indicating Far-OOD) ( Sun et al., 2022 ) , kNN and Mahalanobis indicate RTP is Far-OOD, while LLR suggests Near-OOD.
System
PPL ↓
Fluency ↑
StereoSet ↓
StereoDet ↓
Delicate ↓
BB Bias ↓
Trigger rate
Update (s) ↓
Qwen-3-4B
13.491 ± 6.994
0.298 ± 0.065
0.359 ± 0.249
0.713 ± 0.427
0.284 ± 0.244
0.452 ± 0.191
-
N/A
DeepSeek-8B
21.361 ± 18.239
0.255 ± 0.033
0.310 ± 0.224
0.729 ± 0.413
0.324 ± 0.246
0.454 ± 0.177
-
N/A
Mistral
212.5 ± 6504.3
0.275 ± 0.040
0.397 ± 0.280
0.807 ± 0.368
0.372 ± 0.274
0.525 ± 0.188
-
N/A
Self-correction
22.092 ± 25.893
0.262 ± 0.059
0.268 ± 0.221
0.757 ± 0.403
0.287 ± 0.242
0.437 ± 0.173
-
N/A
DS-8B-debiased
22.894 ± 71.423
0.256 ± 0.023
0.340 ± 0.238
0.744 ± 0.408
0.330 ± 0.262
0.471 ± 0.181
-
N/A
Qwen-SGD
13.498 ± 6.688
0.298 ± 0.065
0.364 ± 0.244
0.723 ± 0.422
0.292 ± 0.245
0.460 ± 0.185
0.262
5.720
Table 3: Main comparison on BiasBench (toxic prompts). We report generation quality (PPL, Fluency), safety (BB Bias), and efficiency (trigger rate and update time) for static baselines, debiased checkpoints, and test-time adaptation methods. Lower is better for PPL, BB Bias, and update time; higher is better for Fluency. ( † indicates marginal significance, †† indicates significance, versus the corresponding baseline under a paired t -test.) Qwen-Prec-trig/no-trigger use our standard hyperparameter setting while Qwen-Prec-trig-2 uses another setting.
Backbone
Axis
Setting
PPL ↓
Fluency ↑
Trigger rate
BB Bias ↓
Update (s) ↓
Test (s) ↓
ϵ
Seg
Tok/seg
Qwen-3-4B
Baseline
baseline
13.491
0.298
0.000
0.452
0.000
6.589
0.000
4
128
Qwen-3-4B
Epsilon
eps0.2
13.197
0.306
0.871
0.456
0.913
9.901
0.200
4
128
Qwen-3-4B
Epsilon
eps0.25
13.593
0.297
0.494
0.469
1.007
10.231
0.250
4
128
Qwen-3-4B
Segments
nseg2
13.373
0.294
0.335
0.468
0.918
9.934
0.300
2
128
Qwen-3-4B
Segments
nseg8
14.774
0.298
0.216
0.420
0.761
9.745
0.300
8
128
Qwen-3-4B
SegTokens
tok256
10.628
0.341
0.278
0.433
0.845
19.818
0.300
4
256
Table 4: TTA ablations on Qwen-3-4B and DeepSeek-8B (toxic prompts), including the following hyperparameters: precondition epsilon sweep, segments, tokens per segment, and multi-trigger; includes each model’s baseline.
Model
#Items
#Biased Items
Biased(%)
Base
20
3
15
Self-correction
20
3
15
CAP-TTA
20
2
10
Table 5: Item-level Bias score (binary), where a generated response is labeled as biased if the number of Yes votes among 5 annotators satisfies Yes ≥3 (i.e., ≥3/5 ). We report the percentage of biased items per model, computed on prompts where all three models have valid 5 bias ratings. Lower is better. We collected 20 valid prompt IDs from 31 human annotators.
Appendix figures & tables12 assets
Supplementary material from the paper’s appendix.
Appendix
Text
snlp
u-Unb
u-BERT
bˉ
Race
Sex
Rel.
Other
Triggered types
Black holes are fascinating objects in astrophysics.
0.0001
0.0302
0.5346
0.1883
0.1883
0.0000
0.0000
0.1883
[]
Asian students are good at math.
0.0014
0.4274
0.5608
0.3299
0.3299
0.0000
0.0000
0.3299
[race, other]
I hate those people. They are disgusting and should be removed.
0.9992
0.9220
0.9526
0.9579
0.9579
0.9579
0.9579
0.9579
[race, sex, religion, other]
The priest gave a sermon about compassion and forgiveness.
0.0000
0.0243
0.5397
0.1880
0.0000
0.0000
0.0000
0.1880
[]
Appendix
Table 8: Examples of BB-trigger gating and 4-type routing. For each text, we compute three raw toxicity/bias scores (snlp/roberta_toxicity_classifier, unitary/unbiased-toxic-roberta, unitary/toxic-bert). We use the committee mean bˉ as the BB-trigger score : if bˉ>ϵ , we trigger test-time adaptation. In parallel, we compute four routing scores over { race , sex , religion , other }; any type whose score exceeds ϵ is included in Triggered types .
Figure 2: This is evaluated using the bias trigger score. Per-prompt bias trajectories over narrative segments on the toxic prompt set. Each polyline corresponds to one prompt and tracks the bias/toxicity score across segments in the long-form generation protocol. This visualization highlights where bias spikes occur during generation and how CAP-TTA suppresses late-emerging bias by selectively triggering updates.
Figure 3: This is evaluated using the bias trigger score. This figure shows triggering trade-off for CAP-TTA. We compare the bias trigger score against epsilon threshold, see if it decreases the level of bias trigger score.
Figure 4: This is evaluated using the bias trigger score. This figure shows comparison of mean trigger-bias score across narrative segments for static baseline models on toxic prompts. Each point represents the average score at a given segment position. The trajectories illustrate how bias-related signals evolve during long generation across different static models.
Figure 5: This is evaluated using the bias final. This figure shows the empirical CDF of the bias metric ( bb_bias_final , lower is better) for Qwen3 under TTA-only and ablation variants.
Figure 6: This is graded by bias final. This figure shows the distribution of bias/toxicity scores across methods on the evaluation prompt set. Boxes summarize median and interquartile range, with whiskers indicating variability across prompts. Lower medians and reduced upper tails indicate better mitigation and fewer extreme harmful generations.
Figure 7: Ablation on test-time update latency (ECDF). This figure shows the empirical CDF of the total parameter-update time per prompt for different inference-time strategies on Qwen3. We compare unpreconditioned TTA-SGD (blue) against preconditioned CAP-TTA variants with different trigger thresholds ϵ . Curves further left indicate lower update-time overhead (better efficiency); the plot shows that preconditioning consistently reduces the update-time tail, while ϵ controls how often updates are triggered and thus the total overhead.
Figure 8: LoRA Structure. We only update a fraction of weights during TTA.
Question / Item
Yes
No
Does this submission meet the federal definition of research (HHS §46.102(l))?
X
Does this submission involve human subjects as defined in HHS §46.102(e)(1)?
X
Does this research involve interaction or intervention with subjects?
X
Does this research involve any procedures for which written consent is normally required outside of a research context?
X
If the subject signed or eSigned the consent document, would the signed consent document be the only record linking this subject to this study?
Figure 9: Example of question given to human annotators.
Subset
Model
Fleiss’ κ
#Items used
#Items excluded ( <5 )
All items with n=5 (any model)
OVERALL
0.294
81
9
qwen3-4B-base
0.415
29
1
qwen3-4B-self-correction
0.178
29
1
qwen3-4B-CAP-TTA
0.304
23
7
Prompt IDs with n=5 for all models
OVERALL
0.297
60
-
qwen3-4B-base
0.433
20
-
Appendix
Table 10: Fleiss’ κ for inter-annotator agreement on Bias (Yes/No). We compute κ only on items with exactly 5 bias ratings (fixed- n requirement). We report results for (A) all available items with n=5 per model, and (B) a fair subset of common prompt IDs where all three models have n=5 (20 prompt IDs; 60 items total across 3 models). A separate fluency question was used as an attention check and filter.
Benchmark
Metric
Typical baseline (orig.)
StereoSet
ICAT ↑
BERT-base: 71.2; GPT2-large: 70.5
CrowS-Pairs
Bias score ( 50 ideal)
BERT: 60.5; RoBERTa: 64.1
RTP
ExpMax toxicity ↓
GPT-2: 0.75 (toxic) vs 0.51 (non-toxic)
Appendix
Table 11: Simple reference numbers reported in original benchmark papers (not our re-runs).
Large language models pick up social biases from the data they are trained on and carry those biases into downstream applications, often reinforcing stereotypes around gender, race, religion, disability, age, and socioeconomic status. The standard fixes (retraining on curated data or fine-tuning with human feedback) are expensive, need access to model weights, and risk degrading the model on other tasks. In this paper we take a different route: we debias the model at decoding time, treating bias mitigation as a structured search over candidate tokens without ever touching model weights. A separate Process Reward Model (PRM) acts as a judge, scoring each candidate for both fairness and fluency. We design three schemes of increasing sophistication (Best-of-N selection, Sequential critique-and-revise, and Constitutional self-audit) and evaluate them on four models (GPT-4o-mini, Llama 3.2 3B, Gemma 3 4B, Qwen 2.5 3B) across a 200-prompt bilingual benchmark in English and Urdu covering eight bias categories. Sequential debiasing proves the most effective, raising mean bias scores by up to +0.40 over baseline while preserving (and sometimes improving) fluency. We then extend all three schemes to open-ended generation, where each token is debiased on the fly, and introduce a lightweight Bias Guard gate that fires only on potentially biased words, keeping overhead near 2x for well-calibrated models. A formal overhead metric that separates generator cost from judge cost reveals that Best-of-N is effectively free on the generator side in a native implementation. GPT-4o-mini, included as a strong proprietary anchor, confirms that the framework scales with model capability; the three open-weight models show where current small-scale LLMs still struggle.
Chain-of-thought prompting can expose and amplify demographic stereotypes within an LLM's intermediate reasoning and create a failure mode that final-answer debiasing alone cannot address. Mitigating such bias during generation presents a fundamental timing problem: intervening too late allows biased reasoning to propagate, while unnecessarily intervening can disrupt otherwise correct reasoning. Existing approaches largely avoid this decision by either evaluating completed reasoning chains post hoc or intervening at predetermined steps, leaving open when a developing reasoning trajectory provides sufficient evidence to warrant correction. We formulate this decision as an online change-point detection problem. A per-step bias signal updates a CUSUM statistic and a targeted correction is injected only when accumulated evidence crosses a detector-specific threshold calibrated on held-out data. We instantiate the framework with a white-box signal derived from next-token probabilities and a black-box signal obtained from an LLM judge, enabling deployment with both open-weight and hosted models. On gpt-4o-mini adaptive black-box triggering recovers most of the disambiguated-context accuracy lost under fixed-interval intervention while requiring substantially fewer interventions. That result holds even with an independent judge. Across six open-weight models, the white-box signal improves ambiguous-item accuracy on all six but reduces disambiguated-item accuracy on five because it cannot distinguish unsupported stereotype reliance from correct, stereotype-congruent evidence.
Nayoung Kim, Mickey Mancenido, Huan Liu
School of Computing and Augmented Intelligence, Arizona State University, Tempe, AZ, USA · School of Mathematical and Natural Sciences, Arizona State University, Phoenix, AZ, USA
Large Language Models (LLMs) are deployed in high-stakes settings but can show demographic, gender, and geographic biases that undermine fairness and trust. Prior debiasing methods, including embedding-space projections, prompt-based steering, and causal interventions, often act at a single stage of the pipeline, resulting in incomplete mitigation and brittle utility trade-offs under distribution shifts. We propose CatRAG Debiasing, a dual-pronged framework that integrates functor with Retrieval-Augmented Generation (RAG) guided structural debiasing. The functor component leverages category-theoretic structure to induce a principled, structure-preserving projection that suppresses bias-associated directions in the embedding space while retaining task-relevant semantics. On the Bias Benchmark for Question Answering (BBQ) across three open-source LLMs (Meta Llama-3, OpenAI GPT-OSS, and Google Gemma-3), CatRAG achieves state-of-the-art results, improving accuracy by up to 40% over the corresponding base models and by more than 10% over prior debiasing methods, while reducing bias scores to near zero (from 60% for the base models) across gender, nationality, race, and intersectional subgroups.
Ravi Ranjan, Utkarsh Grover, Mayur Akewar +2
Florida International University Miami, USA · University of South Florida Tampa, USA