Uncovering Discriminatory Behavior in LLM-Based CV Screening Systems with Composite Statistical Metamorphic Relations

1 Introduction

Context. Discrimination based on conscious or unconscious bias is a major issue in our society. Members of marginalized communities experience difficulty accessing services due to unfavorable treatment by decision makers, who might be guided by prejudice, fear, or lack of knowledge about the impact of their actions [Tasioulas, 2019]. With the increasing use of autonomous decision-making tools reproducing such bias, discriminatory behavior might (unintentionally) be automated and replicated at scale [O'Neil, 2016; Broussard, 2023]. Some of the examples are a discontinued Amazon hiring software, which rated resumes with the word "women's" in it worse [Dastin, 2018], the UK immigration decision-support system with a category "for speedy boarding for white people from the most favored countries" [McDonald, 2020], and a car insurance system, where foreign-born drivers were systematically charged higher premiums [Fabris et al., 2021].

Problem Domain. In this work, we rely on software testing, particularly metamorphic testing (MT), to detect discriminatory behavior. MT enables the creation of automated test oracles to test how the system's behavior changes across multiple inputs in relation to each other [Chen et al., 2018; Chen et al., 1998]. This is an especially promising approach for bias detection, as it allows for complex test cases comparing the system's treatment of members of the marginalized groups and members of the dominant groups 1 . MT is acknowledged as a powerful bias detection tool in the natural language processing (NLP) domain, especially for the tasks of sentiment analysis [Khoo et al., 2023; Asyrofi et al., 2022; Ma et al., 2020], natural language inference [Li et al., 2024], machine translation [Sun et al., 2024], and question answering [Hyun et al., 2024]. However, (1) protected attributes with respect to which fairness is measured are inconsistent across the works, and (2) the rationale for the choice of both the attributes and identity groups is rarely provided. Additionally, (3) the interaction between multiple attributes and their combined impact on the system is not sufficiently explored.

Solution. To bridge the gap between anti-discrimination legislation and software engineering efforts to detect discriminatory behavior, we propose a test creation workflow that derives metamorphic relations (MRs) based on legally protected attributes, for example, a list of protected attributes in Article 21 of the Charter of Fundamental Rights of the European Union (CFR) 2 . To ground MT in real-world discrimination research, we propose relying on sociological correspondence studies to elicit failure hypotheses, i.e., theories about which inputs may cause a discrepancy between the expected and observed outcomes. Correspondence studies are a gold standard technique for measuring discrimination in hiring, housing, or consumer market research, where a researcher modifies one or more attributes (such as race, age, gender, etc.) in an application, while controlling for others (income, education, etc.) and then measures the difference in decision-makers' responses [Gaddis, 2018; Verhaeghe, 2022]. Additionally, motivated by intersectionality theory [Crenshaw, 2013], we advocate expanding fairness testing to include intersectional identities, accounting for the unique experiences that occur at the intersection of multiple axes of privilege and marginalization. In this work, we refer to MRs, where only one protected attribute is modified between the source and follow-up inputs as atomic, and MRs where multiple attributes are modified as composite [Liu et al., 2012; Qiu et al., 2022].

Replication package: https://doi.org/10.5281/zenodo.20004501 1 Marginalized groups are systematically disadvantaged in society, for example, through limited access to employment, whereas dominant groups hold disproportionate power, resources, and influence, for example, through preferential treatment when seeking employment.

2 Article 21 (1) of the Charter of Fundamental Rights of the European Union: "Any discrimination based on any ground such as sex, race, color, ethnic or social origin, genetic features, language, religion or belief, political or any other opinion, membership of a national minority, property, birth, disability, age or sexual orientation shall be prohibited".

Contribution. The following artifacts are the main contributions of this work: (1) a test creation workflow to evaluate automated decision-making systems, which results in a metamorphic test suite where each MR is legally and sociologically justified, and (2) its evaluation on the curriculum vitae (CV) screening use case with large language models (LLMs).

2 Background

Defect-Based Testing. Defect is an umbrella term for the concepts of a fault, error, and failure. A failure is a deviation of expected and actual system behavior, an error is a deviation of expected and actual program state, and a fault is the actual cause of the deviation [Laprie, 1992]. Defect-based testing methods posit that test selection is effective when each test case is derived from a corresponding defect hypothesis [Pretschner, 2015; Speth et al., 2025; Speth et al., 2026].

In this work, we advocate for defect-based testing with a fault hypothesis that artificial intelligence (AI) models may reproduce discrimination patterns, similar to those internalized by humans, due to training on historical data that is prone to sampling bias and prejudice in labels, as well as humanimposed assumptions during modeling and data engineering [O'Neil, 2016; Ferrer et al., 2021; Broussard, 2023].

Metamorphic Testing. Metamorphic testing (MT) is a test case generation technique, centered around the concept of instantiating MRs into multiple metamorphic test cases (MTCs), where MRs are "necessary properties of the target function or algorithm in relation to multiple inputs and their expected outputs" [Chen et al., 2018]. In an MTC, a system under test (SUT) is applied at least twice to at least one source input and at least one follow-up input, which is generated from the source input by applying a metamorphic transformation function. The source and follow-up outputs are the outputs of the SUT applied to the source and follow-up inputs, respectively. To determine whether the MTC passes or fails, one checks whether a predefined relation holds between the outputs.

By defining a test verdict through a relation between the source and follow-up outputs, MT solves the oracle problem without the need for manually created test outcomes. Because of this, we consider MT especially well-suited in the context of bias detection, because differential treatment can be defined as a violation of an approximately equal relation between the outcomes for a member of a marginalized group and outcomes for a member of the dominant group.

3 RelatedWork

MT for Bias Testing. The limited availability of labeled test datasets, as well as the risk that LLMs might ingest those datasets during training, has led MT to become a popular tool for evaluating LLMs. A survey by Cho et al. identifies 44 works and extracts 191 unique MRs, from which 36 MRs were implemented and executed on 4 NLP-related tasks [Cho et al., 2025]. Some of the 191 MRs refer to bias testing by substituting names, pronouns, countries, and occupations.

We performed a literature review using Scopus, IEEE Xplore, and the ACM Library with the following search string: "metamorphic testing" AND ("bias" OR "discrimination" OR "fairness"). After removing duplicates, we are left with ten relevant papers. The MRs they implemented, and their mapping to the corresponding CFR protected attributes are summarized in Table 1. No protected attribute is featured consistently in every work. Moreover, the rationale for the choice of attributes is either not provided or only refers to the "broad social relevance and their prevalence in related work" [RomeroArjona et al., 2025]. This work is also the only one to explain the choice of identity groups included in testing. Only three works have explored intersectional MRs [Giramata et al., 2025; Reddy et al., 2025; Srinivasan and Abdel, 2025]. All the identified works above rely on a template-driven approach, where attributes (e.g., 'Asian', 'young', 'low-income') are directly inserted or swapped; in contrast, we use correspondence studies to elicit more complex metamorphic transformation functions.

Contrary to comparing the LLM outputs based on semantic similarity, as it is common in NLP-related MT [De Curt`o and De Zarz`a, 2025; Tu et al., 2021], we use statistical MT [Guderlei and Mayer, 2007; Rehman and Izurieta, 2021] to account for the stochastic nature of LLM outputs, while focusing on quantifiable outcomes such as CV rating.

Auditing LLM-based Decision-Making. Signaling gender and race/ethnicity through names is a common practice in sociology that was also applied to LLM evaluation. Nghiem et al. and Salinas et al. evaluated LLMs performance on multiple decision-making tasks, including hiring and salary recommendations, by comparing responses to short templatebased prompts with names of a job seeker varying by racial and gendered perception [Nghiem et al., 2024; Salinas et al., 2024]. Similar to our approach Armstrong et al. and Gaebler et al. used real CVs with name substitutions to detect potential discrimination in hiring decisions [Armstrong et al., 2024; Gaebler et al., 2024]. Seshadri et al. uses not only names to signal gendered and racial categories, but also extracurricular activities (e.g., "Black Student Union" or "Women in Engineering") to strengthen demographic signals [Seshadri et al., 2025]. We, in contrast, propose incorporating more treatments from correspondence studies into bias testing, allowing us to evaluate the SUT's behavior towards more identity groups.

4 EvaluationMethod

This Section introduces our proposed approach, aiming to standardize MT for bias detection. Figure 2 illustrates a metamodel of our 5-step approach, which begins with the identification of protected attributes in legal documents and results in test verdicts from the execution of the metamorphic test suite.

First (step 1 ), an appropriate set of protected attributes is selected as the foundation for MR development. Protected attributes are personal traits legally safeguarded against discrimination in areas like employment, housing, etc. We propose to start with the list of protected attributes in Article 21 of the CFR 3 . Naturally, MRs should be guided, but not limited to, protected attributes defined by law. We recommend expanding the list of protected attributes beyond the strict letter of the law, based on ethical considerations, as it might take time for something that is societally understood to be discriminatory and harmful to be declared so legally.

Next (step 2 ), defect hypotheses are derived based on domain knowledge. Use case specific identity groups that the SUT may display prejudice towards are selected. The foundational fault (i.e., reason for failure) hypothesis of this work is that AI models may reproduce the same discriminatory patterns internalized by humans. Therefore, we recommend referring to sociological research to identify discriminatory behavior (failure hypotheses) to test.

In step 3 , we identify features of the input that can signal proximity to the previously identified identity groups. Usually, protected attributes are not mentioned explicitly, but signaled through (a combination of) proxy attributes. For example, gender and ethnicity might be perceived through first and last names. In our experience, correspondence studies [Verhaeghe, 2022; Gaddis, 2018] are a good starting point for identifying treatments (i.e., modifications of inputs) that can then be implemented as transformation functions.

In step 4 , relations between source and follow-up outputs are defined, so that MRs can be implemented. In this work, we limit ourselves to the approximately equal relation, in which the system is expected to remain consistent in its ranking of members of marginalized and dominant groups. Alternatively, this can be implemented as a greater than or equal for outputs for the marginalized group compared to the dominant group (i.e., marginalized-group subjects are treated no worse than dominant-group subjects). It is also possible to derive concrete failure hypotheses for the concrete identity groups (e.g., candidates who do not disclose any religious affiliation are preferred to those who do according to secularization theory [Wright et al., 2013]). However, it is worth noting that there exist multiple theoretical models of discrimination [Fibbi et al., 2021] that, if instantiated for a particular set of identity groups in a particular context, might result in competing failure hypotheses. Therefore, we choose to create approximately equal relations and further evaluate whether any of the theoretical models apply based on test logs.

3 Alternatively, Equality Act 2010 in the UK, the Canadian Human Rights Act, various anti-discrimination law in the USA (e.g., Civil Rights Act of 1964, Americans with Disabilities Act of 1990, Pregnancy Discrimination Act, etc.), German General Equal Treatment Act, Article 3 Abs. 3 of the German Constitution.

Lastly (step 5 ), the MR catalogue is implemented, and each MR is automatically instantiated into multiple MTCs. Then, all MTCs are executed and statistically evaluated. In this work, we use the GeMTest metamorphic testing framework [Speth and Pretschner, 2025] to implement transformation functions and MRs and automatically execute the test suite.

5 Experiments

In this Section, the test creation workflow introduced in Section 4 is evaluated by applying it to an LLM-based CV screening procedure motivated by the increasing automation and use of AI tools in various stages of the recruitment process [Drage and Mackereth, 2022; Bhatnagar et al., 2025; Lo et al., 2025].

5.1 Research Questions

The following experiments target such research questions:

• RQ1: Is our proposed test creation workflow effective in producing a test suite for defect-based bias detection?
• RQ2: How many additional defects can be discovered by the set of new MRs compared to the set of base MRs?
• RQ3: How many additional defects can be discovered by the set of composite MRs compared to the set of atomic MRs?

5.2 Experiment Setup

We set out to evaluate the robustness of a range of LLMs employed for CV screening. To mimic the experience of a recruiter, who might have a limited experience with LLMs and prompt engineering, but also to simplify the testing setup, we employ a relatively simple process of CV screening: in a chat session, we request an LLM to provide a grade from 0 to 100 for a text-based CV and a short job description. We focus on the similarity of the grades a SUT assigns to the candidates' CVs, as opposed to, for example, the semantic similarity of textual responses, so that we can target quantifiable outcomes for the candidates in our evaluation.

Dataset. From a dataset of synthesized semi-structured CVs 4 , we sample 20 CVs for each of the five job titles with the most entries in the dataset, namely database administrator, backend developer, deep learning engineer, embedded systems engineer, and quality assurance engineer. We add a summary to the CVs and use the job search website indeed.com to manually select a description and five required skills for the jobs to provide to the LLM for guidance in candidate evaluation.

Systems Under Test. We evaluate six LLMs to assess their ability for unbiased CV evaluation. To ensure reproducibility of our experiments, we choose not to use any commercially available APIs, such as those by OpenAI, as we do not know all the pre- and post-processing steps performed, nor which particular model version is deployed at any given moment, making reproducibility impossible. We use the GPT4All [Anand et al., 2023] wrapper to deploy all LLMs and request the models to grade a CV in a chat session (as opposed to text completion mode). Our model selection was restricted by resource and checkpoint availability and resulted in the following 6 SUTs: Llama 3.2 1B, Llama 3.2 3B, Phi 3 Mini 4B, Nous Hermes 2 7B, Llama 3.1 8B, and Llama-3-8B DeepSeek distillation.

5.3 Results of RQ1

In this Section, we describe the test suite derivation process resulting from applying the test creation workflow. Table 2 summarizes MRs implemented for the CV screening use case.

Protected Attributes. Starting with the list of protected attributes from Article 21 (1) of the CFR fixed in step 1 , we focus in step 2 on the overview of 90 correspondence studies on hiring discrimination conducted between 2005 and 2016 [Baert, 2018] to identify relevant marginalized and dominant groups and derive failure hypotheses.

Failure Hypotheses. The base failure hypothesis for each MR is that members of different identity groups may face different outcomes, even if only the values of protected attributes without job performance influence are modified. Some concrete failure hypotheses rooted in theoretical models of discrimination are evaluated based on test logs and discussed in Section 6, but not implemented in the test suite.

Identity Groups. Identity groups, towards whom the SUT's behavior is evaluated, are selected based on the German cultural context due to the authors' background, and have been selected based on German demography: four largest immigrants groups in 2023 5 ; three largest religious groups in 2024 6 , political parties scoring over 5% in the 2025 Bundestag election and represented in the 21st German Bundestag 7 not classified as a "confirmed right-wing extremist endeavor" by the German Federal Office for the Protection of the Constitution (BfV).

4 https://huggingface.co/datasets/datasetmaster/resumes

5 https://www.statistischebibliothek.de/mir/receive/DEHeft mods 00164830

6 https://fowid.de/meldung/religionszugehoerigkeiten-2024

7 https://www.bundestag.de/dokumente/textarchiv/2025/kw11bundeswahlausschuss-1056272

Metamorphic Relations. In step 2 , we combine several protected attributes (ethnic origin, race, color, language, national minority) into one ethnic origin MR. We choose to add parenthood as a separate MR [Correll et al., 2007] and not to implement the age and genetic features MRs for the lack of consensus on how to model different ages [Baert et al., 2016] and a general lack of correspondence studies on discrimination based on genetic features [Baert, 2018].

Metamorphic Transformation. In step 3 , we identify common treatments used in correspondence studies to use as metamorphic transformation functions. A candidate's name can be used to signal gender identity and race/ethnicity [Lancee, 2021]. Volunteering and work experience with various organizations affiliated with political or politicized causes can be used to signal support or belonging [Correll et al., 2007; Piern´e, 2013; Gift and Gift, 2015; Weichselbaumer, 2015; Rivera and Tilcsik, 2016]. Certain information, such as disability, can be disclosed in the CV summary [Baert, 2016].

In addition to every atomic MR in Table 2, a composite MR [Liu et al., 2012; Qiu et al., 2022] is implemented to investigate the effects of the intersectional axis of marginalization and privilege of ethnic/national origin and gender categories. We use the shorthand notation MRp,g,e for MRp ◦MRg ◦MRe, which denotes the composition of MRp, MRg, and MRe, where the protected attributes 'political opinion', 'gender', and 'ethnicity' are modified simultaneously.

Statistical Relation Function. To account for the variability of the LLM outputs, the CV grading request is performed 30 times, each in a new session with context reset, a temperature of 0.7, and a top-p of 0.4, in order to get a big enough sample of the grade distribution for statistical testing. A test case fails if, for at least one pair of outputs in an MTC, the null hypothesis that the grades are sampled from the same distribution can be rejected based on a 2-sample Kolmogorov-Smirnov test with an α of 0.01 to capture differences in both mean and variance. To account for multiple pairwise tests and reduce the possibility of false positives, we use the Bonferroni correction.

Implementation. In step 5 , the catalogue of MRs is implemented using the domain-specific language provided by the GeMTest metamorphic testing framework [Speth and Pretschner, 2025], which enables the automated creation and execution of MTCs as pytest test cases. A replication package containing the source code is provided.

Metrics. To judge the effectiveness of the catalogue of MRs for bias detection, we use failure rate (fr) as the main evaluation metric, which can be calculated by dividing the number of failed MTCs by the total number of MTCs.

Robustness Evaluation. Table 3 provides detailed results of the test suite execution with Bonferroni correction for multiple pairwise tests within an MR (see the supplementary material for the results before the correction and a more relaxed HolmBonferroni correction). The most robust model, i.e., the model with the lowest frSUT, is Llama 3.2 1B with a frSUT of 0.7% and only 9 failures uncovered. The least robust model is Phi 3 Mini 4B with a frSUT of 25.8% corresponding to 339 failures. Each MR uncovers failures for all SUTs, apart from the Llama 3.2 1B model, where only 5 out of 8 atomic and no composite MRs uncover failures, and DeepSeek Distill 8B, where 2 atomic MRs, MRp and MRq, do not reveal any defects. Thus, the catalogue of MRs resulting from our proposed test creation workflow is effective at detecting discriminatory behavior.

Discussion of RQ1 Findings. We run another experiment to evaluate the discriminatory power 8 of LLMs's as CV screeners, for which we sample CVs that are either a good or a bad fit for the job description. 60% of sampled candidates had previously held a job with a similar title, and 40% did not. Figure 3 provides a visualization of CV grade distributions per model, which demonstrates that Llama 3.2 1B is unfit to differentiate between good and bad candidates, supposedly because of the relatively small size for an LLM. We speculate that if Llama 3.2 1B cannot reject bad candidates, it is also not sensitive to input modifications to recognize belonging to different identity groups, which is the target of our MRs. This explains the 0.0 failure rate for most MRs. Still, according to our definition, the Llama 3.2 1B model is the most robust among the SUTs.

8 "Discrimination" here means the ability to differentiate between fitting and unfitting CVs, not disparate treatment of some candidates.

RQ1 Summary: By applying the test creation workflow, we derive an MR catalogue of 8 atomic and 6 composite MRs based on protected attributes from Article 21 (1) of the CFR and 7 correspondence studies on hiring discrimination. The resulting metamorphic test suite uncovers discriminatory failures for all evaluated LLMs.

5.4 Results of RQ2 and RQ3

Table 4 provides an overview of the defects detected by the four sets of MRs: (1) a base set of atomic MRs from prior work (MRB) including sex/gender, social and ethnic origin, political opinion, religious belief, and sexual orientation; (2) a set of new atomic MRs proposed in this work (MRN), including disability, and parenthood; (3) a set of atomic MRs (MRA); and (4) a set of composite MRs (MRC). We use the shorthand notation MRC\d to denote the set MRC\MRd.

Both the new atomic and the composite MRs detect additional discriminatory defects across all SUTs, with a total of 193 and 828 previously unknown failures detected with the new atomic MRs and composite MRs, respectively. Composite MRs consistently uncover more defects than their atomic counterparts. In Table 3, we see an increase in failure rate for almost all sets of MRs, where gradually one, two, and three protected attributes are modified. For example MRr (religious affiliation), MRr,g (religious affiliation and perceived gender for the ethnic majority group), and MRr,g,e (composition of religious affiliation, perceived gender, and perceived ethnicity), increases for Phi-3 Mini 4B from 0.11 to 0.15 to 0.32 and for Llama-3.1 8B from 0.09 to 0.12 to 0.19. With each added axis of marginalization, new discriminatory defects are revealed.

RQ2 and RQ3 Summary: Both the new atomic and the composite MRs detect additional discriminatory defects for all SUTs. Composite MRs consistently uncover more defects than their atomic counterparts. The average increase in failure rate between an atomic and composite MR is 13%.

6 Discussion

We now discuss a selection of discriminatory behavioral patterns detected through analyzing the test logs.

In MRr we observe a strong preference for candidates signaling affiliation with the Protestant Church, with a strong gendered component if evaluated at the intersection of religious affiliation and perceived gender in MRr,g for the Llama 3.1 8B model (see Figure 4). MRr,g also shows that the preference for Catholic candidates only extends to candidates perceived as men and has a limited positive effect for candidates perceived as women. Overall, candidates perceived as men receive a slightly higher average grade across all religious groups for Llama 3.1 8B (see Figure 4). However, the opposite effect is observed for Nous Hermes 2 7B with the strongest preference for women affiliated with Islam signaled through volunteering for a Muslim youth organization (see Figure 5). When evaluated at the intersection of gender and ethnicity, we see that women with names seen as German benefit from such volunteering more compared to candidates perceived to be from Muslim-majority countries, with candidates seen as Turkish Muslim men graded lowest on average.

If we compare the biases of the Llama-family models uncovered by gender/ethnicity MRg,e, as visualized in Figure 6, the discriminatory behavior of the bigger model is more aligned with the biases consistent with the taste-based and contact theory of discrimination [Fibbi et al., 2021]. We speculate that a larger model size correlates with more predictable human-like behavior learned from training data. Comparing the grades produced by Llama 3.1 8B, we observe a clear preference for candidates perceived to be German men; candidates with names perceived as Syrian are graded the lowest on average.

For all models, a strong effect of political affiliation is observed, but no consistent pattern across all models can be identified (see Figure 7). Notably, volunteering for the left-wing party Die Linke is negatively affecting the grades assigned by Phi-3 Mini 4B, having no political affiliation and volunteering for the Social Democrats (SPD) has a negative effect on Llama-3.1 8B. However, affiliation with SPD has a slight positive effect on grades assigned by the DeepSeek Distill

8B model. All three models were in agreement in assigning slightly higher grades to candidates affiliated with the Greens.

7 Limitations

There are two levels of abstraction when discussing the limitations of our proposed approach: from an identity group to a treatment applied to the CV in the form of modifying one of the input features, and to the concrete values that signal belonging to one of the identity groups. Thus, while we follow the best practices established in labor market research on how to create CVs with strong signifiers of different identities, the treatments we apply might carry weak, mixed, or ambiguous signals, especially when processed by a program. In the following paragraphs, we provide examples of how these limitations may have influenced our results.

Weak Signal in Treatments. We opt into testing for genderbased discrimination only for binary gender signals from names, as research into which names are perceived as gender non-conforming in different cultural contexts is an open research area. We acknowledge that trans and gender nonconforming people face discrimination in hiring and harassment in the workplace [Taylor and Fasoli, 2022; Rosich, 2016], but the signal from names may be too weak for testing with our method and obfuscate rather than uncover potential harm.

Mixed Signal inTreatments. We observe a very high failure rate in the MR investigating disability, as well as a positive effect of disability disclosure, especially for autistic candidates. After reexamining the disclosure statements inspired by the work of Baert [Baert, 2016], we conclude that we add too much additional information, for example, "I benefit from regularity and structure, but this does not mean that I do not love a challenge" for autistic candidates. The added soft skills may contribute to this positive effect.

Ambiguous Signal in Treatments. Names of political parties are highly context-dependent. For example, Social Democrats and the Greens exist in many countries, varying in popularity and placement on the left-right political spectrum. Future work should explore concrete beliefs through membership in activist organizations, e.g., a workers' union.

Resource Limitations. Due to resource availability, the LLMs tested in this work are limited to models that require at most 16 GB VRAM. Thus, we cannot make statements about the discriminatory behavior of LLMs of greater size. However, we expect the bias-detection method to remain applicable.

Risk of Inconsistent Results. As much as this approach aims to increase reproducibility and transparency of the biasfocused test suite derivation, the test creation process is not deterministic. Firstly, the initial list of protected attributes depends on the choice of the legal document. For example, marriage is a protected attribute in the 2010 UK Equality Act, but not in the CFR. Secondly, we encourage testers to add attributes if it is reasonably justifiable, for example, through existing correspondence studies or discrimination theories.

8 Conclusions

This work proposes defect-based metamorphic testing for bias detection in AI tools, aiming to prevent the reproduction of systemic discrimination of marginalized communities by LLMs. Our main contribution is a test creation workflow that results in an MR catalogue, where every MR is traceable to a legal document and every metamorphic transformation function to a sociological correspondence study, justifying their necessity. The test creation workflow is evaluated on an LLM-based CV screening procedure to derive 8 atomic and 6 composite MRs, motivated by the intersectional theory. All MRs uncover failures for all SUTs, apart from the Llama 3.2 1B model, where the SUT was found unfit for the task. Thus, the MR catalogue resulting from our proposed test creation workflow is effective at detecting discriminatory behavior. In particular, the new atomic and composite MRs are a valuable contribution, as they detect additional discriminatory defects across all SUTs.

Composite MRs consistently uncover more defects than their atomic counterparts, as seen in the increase in failure rate of on average 9% and 25% for Llama-3.1 8B and Llama-3.2 3B, respectively. We find that some discriminatory patterns are undetectable with an atomic MR, but become more pronounced in a composite MR. We consider this the most important finding of this work and advise developers working on fair AI models to investigate behavior towards complex identities at the intersection of marginalization and privilege.

Future work should focus on evaluating LLMs that exceed the 16 GB of required VRAM and identifying additional protected attributes and MRs for a more robust bias assessment of AI-based software. Sources for these MRs could be, for example, expert interviews with legal scholars, anti-discrimination advocates, and people who experience discrimination.

Acknowledgments

The authors are grateful to Derui Zhu and Lena Gregor for their valuable feedback and helpful suggestions on earlier drafts of this paper.