RESPONSIBILITY

Ethics and Safety

The series ends where the engineering runs out. Bias is not a bug introduced late, alignment is a choice about whose judgement counts, and guardrails are a layer rather than a solution — the questions here do not have settled answers, but shipping without asking them is itself an answer.

Where Bias Comes From

Not one source but a chain, and each link compounds the last.

The corpus

Pretraining data is a snapshot of what people published, weighted by who published most. Over-represented languages, viewpoints and demographics are over-represented in what the model treats as ordinary.

Stage 1

The filters

Cleaning the corpus is itself editorial. Blocklists tuned to remove slurs also strip reclaimed language and whole dialects, quietly removing the communities that use them.

Stage 1

The annotators

Preference tuning encodes the judgement of a particular group of raters working to a particular set of guidelines. Their assumptions about what is helpful, polite or unsafe become the model's defaults.

Stage 3

The feedback loop

Model output becomes tomorrow's training data. Skew that is not corrected is not merely preserved — it is amplified with each generation of models trained on a web that models increasingly wrote.

Ongoing
“Just use unbiased data” is not available. There is no view from nowhere to collect a corpus from, and every filtering choice is a value judgement about what belongs. The achievable goal is not neutrality but legibility: knowing which way your system leans, on which topics, and telling the people who depend on it.

Alignment: Whose Values?

Alignment is a technical process with a political core, and the technical part is the easier half.

Aligning a model means making its behaviour match an intent. The methods are well understood — collect preferences, fit a reward, optimise against it. The question the methods cannot answer is whose intent, adjudicated by whom, and with what recourse when someone disagrees.

These are not abstract. A model that refuses medical questions protects a company from liability and fails a nurse. One that answers freely serves the nurse and occasionally harms someone acting on bad advice. There is no setting that is simply correct; there is a choice about who bears the residual risk, and that choice is usually made by whoever wrote the guidelines, not the person affected.

Tension

Helpful vs harmless

The two objectives conflict directly. Every refusal boundary is a point on that trade-off, chosen by someone.

Tension

Universal vs local

One global model meets wildly different legal and cultural norms. Aligning to all of them at once is not coherent.

Tension

Stated vs revealed

Raters reward answers that sound good. Optimising for approval produces confident, agreeable, fluent output — which is not the same as correct.

Failure Modes Worth Designing Against

Concrete harms, ordered by how often they actually turn up in production rather than how dramatic they sound.

FailureWhat it looks likeWho it lands on
Confident errorA fabricated fact delivered with no hedging, acted on by someone with no way to checkThe end user, usually the least expert one
Over-refusalLegitimate questions declined because they pattern-match to something sensitivePeople whose ordinary needs look unusual to a rater
Unequal qualityNoticeably worse output in some languages, dialects or name conventionsExactly the groups already under-served
Privacy leakageMemorised training data, or user input logged into the next training setPeople who never used the product
Automation biasA confident answer overriding a human's correct judgementWhoever the decision was about
Scaled persuasionFluent, cheap, targeted text produced faster than anyone can review itThe information commons
Automation bias deserves more attention than it gets. The risk is rarely that the model is wrong — it is that being wrong fluently, inside a workflow that treats output as a default to approve, quietly removes the human check the design assumed was there. Interface decisions matter as much as model choice here.

Guardrails and Their Limits

Each layer catches something the others miss. None is sufficient, and stacking them is the whole strategy.

Training-time alignment

Refusals and tone learned during preference tuning. Deep and general.

Cannot be changed without retraining, and encodes one set of values for every deployment.

System prompt

Instructions setting role and boundaries at the top of every conversation.

Sits in the same token stream as user input, so it competes with it rather than overriding it. Long conversations erode it.

Input and output filters

Classifiers on the way in and the way out, independent of the model.

Blunt. Both false positives and false negatives, and they add latency to every call.

Capability limits

What the surrounding system can actually do — which tools exist, what they can reach, what requires confirmation.

The most reliable layer, because it does not depend on the model behaving. Underused.

Human review

A person in the loop before anything consequential happens.

Does not scale, and degrades into rubber-stamping precisely when volume rises.

Prompt injection has no clean fix. A model reading a web page or a document cannot reliably tell instructions from data, because to a transformer both are just tokens in the context. This is why agents that read untrusted content and hold real credentials are the sharpest edge in the field: the durable mitigation is to limit what the tools can do, not to ask the model to be careful.

Questions Worth Asking Before You Ship

Not a compliance checklist. Six questions where not having an answer is the finding.

Who is harmed when it is confidently wrong?

Name them. If the answer is a user with less expertise than you, the interface needs to communicate uncertainty that the model itself does not express.

Does it work as well for everyone it serves?

Run your eval set across the languages, dialects and name conventions your users actually have. Unequal quality is invisible until it is measured.

Can a user tell they are talking to a model?

And can they reach a person? Undisclosed automation is a design choice that gets made by omission.

Where does user input end up?

Logged, retained, used for training? People type things into a chat box they would never put in a form.

What happens when it is manipulated?

Assume the input is hostile and the retrieved document is poisoned. What is the worst the tools you granted can do?

How would you know it had degraded?

A model update, a quantization change or a prompt edit can shift behaviour silently. Without monitoring, the first report comes from a user.

These questions have no final answers, which is not a reason to skip them. The teams that handle this well are not the ones with the best policy document — they are the ones who wrote down what they decided, why, and what would change their minds.

Back to the start

What is an LLM?

You have come full circle — from what a model is to the protocol that gives it hands