Research
The science behind the receipt
One research question drives everything we ship: can you find where a concept — race, religion, toxicity — lives inside an AI model, measure what it does to the decision that model produces, and prove both to someone who doesn’t trust you? Below is what we can show, how we tested it, and what we don’t claim.
The program at a glance
Remove one concept. Leave the rest measurably untouched.
The standard tools for removing a concept from a model’s representation — the ones most fairness teams use today — work like a thick eraser: the concept goes, and so does much of the meaning around it. That collateral damage is why bias fixes so often break accuracy somewhere else.
Our method builds a frame: a set of mutually perpendicular directions in the model’s embedding space, one per concept. That construction makes a named trait readable off a frozen model with high reliability, and it makes the edit small — collateral change is ±0.008 at worst, 0.002 on average. It does not make the trait removable: across 21 of 21 conditions the frame never erased the concept, and LEACE was the stronger eraser. Detection is what we measure and what we stand behind. Every edit produces a receipt showing exactly how little else changed.
The result is a property of the method, not of one lucky model. It replicates across random seeds, across concepts, and across publicly available models we did not train — which is what lets Bhala run as an independent layer on top of the AI you already use.
Reading a concept out of a frozen model.
Before you can remove a concept’s influence, you have to find it. We detect concepts directly in the geometry of a model’s embedding space — no retraining, no access to the model’s training data, no cooperation from the model’s vendor required.
Because detection reads structure rather than surface keywords, it holds up where keyword filters fail: coded language, typos, leetspeak, sarcasm, and counter-speech that quotes the hate it condemns. The same approach powers our production moderation API.
The decisive measurement
“I hate X” (P=0.87) and “Saying I hate X is bigoted” (P=0.10) share 80% of their surface tokens but receive 9× different hate scores. Reading the use/mention distinction from structure is what keyword-based moderation cannot do.
Steerable meaning — proven across three languages
Bhala lets you steer a sentence's meaning at inference time. Flip sentiment or redirect an intent — and an independent classifier (the kind your team would deploy in production) confirms the change took effect: 94% of Swahili and 77% of English intent redirects land on the requested target, and every case moves off its original intent. Bias is a detection read-out, not a control: the bias re-labelling rate we used to quote is retracted as circular, and no operator here removes an attribute.
Other sentence models — including the ones from the largest US labs — are optimized for similarity search, not for being steered. You can compare two sentences in their space, but you cannot reliably change one. Bhala is built so that named directions in meaning behave like real controls. No other production-ready model offers this today. Steering is per model and per method, and it is not a safety dial: hate steers, per model and per method — K-steering at layer 10 gives +0.188 (uncertainty range 0.146 to 0.231) on Qwen2.5-7B against a random-direction floor of +0.0081, and steers Mistral-7B-Instruct-v0.2. No measurable effect on Mistral-7B-v0.1 base (baseline 0.2981, so there was room to move) or Gemma-2-9b (baseline 0.0549 — already so low the test cannot see movement). A single direction taken from the average difference between the two groups — the simplest method there is — scores +0.030 and fails. The same direction inverted is a jailbreak vector — dual-use, never a safety dial.
| Task | Zulu | Swahili | English | Test cases |
|---|---|---|---|---|
| Sentiment shift (negative → positive) | 100% | 100% | — | 263 |
| Intent redirect (12 categories) | — | 94% | 77% | 1,969 |
| Bias re-labelling (28 protected dimensions — gender, race, religion, age, disability, …) — RETRACTED | — | — | retracted | 10,064 |
Why English is lower
Today's model was pretrained almost entirely on isiZulu. English results come from generalization — applying learned structure to a language the model never saw at scale. We are now training the English-native version, and expect English to match or exceed the 94% Swahili number.
Five units. Each one small, inspectable, and composable.
The compliance layer runs on models we didn’t train — that is the point. Separately, we build our own compact encoder stack. It powers our production moderation products and fully offline deployments, and every unit is a small, inspectable component you can swap, verify, or extend.
Bhala Encoder
One model. Structure shared across human languages.
A compact neural encoder trained to capture the structural patterns shared across human languages — morphology, agreement, composition. New languages attach in seconds, not weeks.
- Zero-shot transfer to 17+ languages across 10 families
- Adapts to a new language in <2 seconds
- Scripts-agnostic: Arabic, Devanagari, Hangul, Cyrillic
- Stable under perturbation (robust by geometry)
Programmable Behavior
Named, composable controls applied at inference
A patented embedding space where semantic dimensions like sentiment and intent are accessible as named controls on any query or document. Bias is a detection read-out, not a removal control — erasure is not removal. Every shift is auditable per call. Sentiment flips were confirmed by an independent classifier on hand-checked Zulu and Swahili sets; intent redirects hit the requested target on 94% of Swahili and 77% of English cases (n=1,969).
- Sentiment flips confirmed by an independent classifier on hand-checked Zulu (n=132) and Swahili (n=131) — two languages, small n
- Intent redirects move every case off its original intent; 94% (Swahili) land on the requested target (n=1,969, independent 60-way classifier)
- Cross-family transfer: 77% of English intent redirects land on target, zero-shot
- Every shift logged for audit + compliance (a recomputable content hash, not a signature)
- A random direction of the same size is a floor to beat, not a zero (Rogue Scalpel, arXiv 2509.22067)
Morpheme-Aware Tokenization
Inspectable tokens, not opaque subwords
Tokens carry linguistic meaning and you can read them, unlike opaque sub-word fragments. Downstream core units become more sample-efficient and their outputs more explainable.
- Human-readable tokens across all supported languages
- Compact vocabulary: ~5K tokens covers 23 languages
- Dramatically more sample-efficient than opaque sub-word tokenizers
- Enables downstream interpretability
On-Device Runtime
Linear-time architecture built for phones, not GPUs
A sequence model with linear complexity, compact enough to run on a smartphone, feature phone, or sensor. Paired with the encoder and tokenizer, it delivers production-grade language understanding at a fraction of the cost, fully offline.
- <50ms inference on commodity hardware
- No GPU required for production workloads
- Runs on Android, iOS, and embedded Linux
- Compact footprint — fits alongside your app
Self-Healing Inference
Robustness as a core unit, not a bolt-on
A structural correction mechanism that snaps perturbed inputs back to clean representations during inference. The model degrades gracefully on noisy, adversarial, or unfamiliar inputs — text unlike anything it saw in training.
- Graceful degradation on out-of-distribution inputs
- Resilient to typos, code-switching, and transliteration drift
- Stable inference under input perturbation
- No retraining needed per failure mode
Read the evidence, then talk to us.
Every claim above is measured, replicated, and reproducible from public datasets.