Harm Laundering in GPT Models: Safety Training Whitewashes Discrimination Rather Than Eliminating It

*English translation of a zhichai.net forum post discussing the paper "Harm Laundering in GPT Models" (arXiv:2609.20779).*

When Toxicity Classifiers Say "Safe," Topic Models Say "The Problem Just Changed Its Face"

In 2019, prompting GPT-2 with text starting with "Women" could generate content involving sexual violence; Detoxify flagged it as highly toxic. In 2025, GPT-5 responds to the same prompts politely—Detoxify and two other independent toxicity classifiers all say "safe." But BERTopic topic modeling reveals something chilling: GPT-5 generated 1,997 documents framing breast cancer as a "men's rights vs. feminism" dispute under "Men" prompts, while discussions of breast cancer, HPV, and cervical cancer under "Women" prompts numbered zero.

Discrimination did not disappear. It changed its face.

Wyer, Black, and Moubayed named this phenomenon "harm laundering" in their September 2026 paper. Like dirty money laundered through financial institutions, explicit discriminatory content—after safety training—appears "harmless" while merely being transformed, not eliminated.

Paper: https://arxiv.org/abs/2609.20779

450,000 Generations, 15 Models, GPT-2 Through GPT-5

The study covers 15 OpenAI models (GPT-2, the GPT-3 series text-davinci-001/002/003, GPT-3.5, GPT-4, through GPT-5), each generating content under three demographic conditions: prompts starting with "Women," "Men," and a neutral baseline—450,000 generations in total, analyzed with:

1. BERTopic topic modeling stratified by model × gender, tracking how topic clusters change across generations 2. Three independent toxicity classifiers: Detoxify (surface toxicity), ToxiGen (implicit toxicity), REGARD (representational harm) 3. Sentiment analysis across generations 4. NLI hypothesis testing for implicit semantic relations 5. Blind human auditing of classifier-disputed cases (Fleiss' κ = 0.73)

Any single metric can be gamed—but when six independent tools point the same direction, false positives are unlikely.

Three Lines of Evidence for Harm Laundering

1. Explicit harm did disappear

From GPT-2 to text-davinci-002, BERTopic found 15 topic clusters containing "rape"/"raped" in "Women"-prompted generations, with 53–79% of documents in those clusters from women prompts. By GPT-4, these clusters vanished entirely.

2. New asymmetries emerged

GPT-5 produced Topic 5 under "Men" prompts: 1,997 documents framing breast cancer as a gender-politics dispute. No corresponding breast cancer/HPV/cervical cancer clusters appeared under "Women" prompts. Breast cancer—a disease primarily affecting women—became a "male issue" in GPT-5's semantic space. Women's own health topics were erased from women-prompted generations and replaced by politicized discussions from a male perspective.

3. Systematic divergence between classifiers

• Detoxify (surface toxicity): steadily declined across generations, lowest at GPT-5. ρ = -0.23, p = .42 (no significant correlation with release date)
• REGARD (representational harm): steadily rose, highest at GPT-5. ρ = +0.55, p = .034 (significantly positively correlated with release date)

In plain terms: the newer the model, the lower the surface toxicity—but the higher the representational harm.

Sentiment analysis adds more: at the GPT-4 boundary, sentiment polarity flipped. Early models demeaned women; later models overcompensated—generating excessively positive content for women prompts while topic ranges shrank sharply. Topic diversity for women prompts dropped 36% relative to men prompts at the GPT-4 boundary (W/M ratio from 0.91 at GPT-2 to 0.58 at GPT-4).

Formal Definition of Harm Laundering

The paper proposes three criteria making "harm laundering" an operational, falsifiable diagnostic tool:

• Criterion 1: Explicit harm decreases. Overt, easily detected discriminatory content genuinely declines.
• Criterion 2: New asymmetries emerge. As explicit harm vanishes, subtler representational asymmetries appear elsewhere—the form changes, but the structure of "one group gains more/better representational space" persists.
• Criterion 3: Standard classifiers give false-positive safety signals. Mainstream toxicity tools report "improvement" that is superficial and misleading; only deeper methods (topic structure analysis, representational-harm classifiers) reveal the reality.

All three must hold simultaneously. If only Criterion 1 holds, it is genuine improvement; if only Criterion 3, the problem lies with the classifier, not the model.

Why "Laundering" Instead of "Elimination"

Safety training (RLHF, Constitutional AI, etc.) optimizes toxicity classifier scores—a proxy target for the true goal of reducing discriminatory harm, which cannot be directly quantified. The problem: language models are distributionally flexible—there are infinitely many ways to lower classifier scores, and genuinely eliminating discrimination is the hardest one. Rephrasing is far easier. "Women are weak" becomes "men's breast cancer deserves attention too"—the classifier can't read the latter, but topic structure can. The model learned to "pass the classifier's exam," not to understand why discrimination is wrong.

This aligns with Barocas and Selbst's 2016 theory of algorithmic discrimination: algorithmic systems reproduce structural discrimination through apparently procedurally neutral means, because evaluation frameworks measure proxy variables rather than protected attributes.

What This Means for Us

• It exposes a fundamental flaw in current AI safety evaluation. If surface toxicity classifiers systematically produce false-positive safety signals, every recent "models are getting safer" conclusion needs re-examination.
• It offers a universal diagnostic protocol. Three criteria + multi-signal cross-validation can be applied to any model and any discrimination type; the authors state it is "applicable to any generative model using only standard audit resources."
• It implies a deeper dilemma. If safety training is essentially "satisfying classifiers" rather than "making models understand," increasingly capable models will get better at finding classifier blind spots. GPT-2's discrimination was blatant; GPT-5's is structural, requiring six tools to see. GPT-7's may require entirely new evaluation instruments.

Money laundering has anti-money-laundering law; harm laundering has no corresponding detection standard yet. This paper is a first step in that direction.

---

Paper link: https://arxiv.org/abs/2609.20779