FLEX: A Benchmark for Evaluating Robustness of Fairness in Large Language Models

TL;DR

This paper tackles the problem of evaluating fairness in Large Language Models under adversarial conditions that threaten neutrality. It introduces FLEX, a robustness benchmark that embeds extreme prompts—across persona manipulation, competing objectives, and text perturbations—into a QA-based fairness task, selecting the most impactful attacks per sample. Empirical results across open-source LLMs and GPT-4o show that traditional fairness benchmarks often overestimate safety, as models can maintain high accuracy on common data but falter under extreme prompts, revealing substantial robustness gaps. FLEX thus provides a more stringent, realistic assessment of safety and fairness, highlighting the need for adversarial-aware evaluation in the development of responsible LLMs.

Abstract

Recent advancements in Large Language Models (LLMs) have significantly enhanced interactions between users and models. These advancements concurrently underscore the need for rigorous safety evaluations due to the manifestation of social biases, which can lead to harmful societal impacts. Despite these concerns, existing benchmarks may overlook the intrinsic weaknesses of LLMs, which can generate biased responses even with simple adversarial instructions. To address this critical gap, we introduce a new benchmark, Fairness Benchmark in LLM under Extreme Scenarios (FLEX), designed to test whether LLMs can sustain fairness even when exposed to prompts constructed to induce bias. To thoroughly evaluate the robustness of LLMs, we integrate prompts that amplify potential biases into the fairness assessment. Comparative experiments between FLEX and existing benchmarks demonstrate that traditional evaluations may underestimate the inherent risks in models. This highlights the need for more stringent LLM evaluation benchmarks to guarantee safety and fairness.

Figures (5)

• Figure 1: Simplified example of FLEX. FLEX evaluates the model's biases by presenting it with adversarial prompts designed to exploit its vulnerabilities. This approach measures how well the LLM can maintain fairness and resist bias even under extreme conditions.
• Figure 2: Construction process of FLEX. We review LLM responses across various scenarios to identify samples where the LLM is vulnerable. If multiple vulnerable scenarios exist, one is randomly selected. Consequently, each sample in the dataset is exposed to only one of the extreme scenarios. This approach constructs a harmful environment, increasing the likelihood that the LLM will generate biased responses.
• Figure 3: Comparison of ASR across different scenarios. We examine the extent to which model bias increases when given specific prompts categorized under different adversarial methods.
• Figure 4: Comparison of ASR based on positive and negative sample shot.
• Figure 5: Comparison of our data selection method and random method for dataset construction.