The Equity Gap That Wasn’t: Reference-Language Bias in Multilingual AI Evaluation.

Aboobaker Cassim

We evaluated Gemini 2.5 Flash on English and Afrikaans Grade 12 exam questions. Large performance gaps appeared under English-only keyword evaluation, but nearly disappeared when language-consistent references and independent judges were used. Our findings suggest that evaluation methods can create the appearance of multilingual inequity.

Reviewer's Comments

Reviewer's Comments

Arrow
Arrow
Arrow

## Strengths

The headline contribution is methodological and is an important finding worth sharing widely. The work holds the model's responses fixed and changes only the language of the reference memo (the Judge 1 vs Judge 1b design). This isolates a single practice common in bias studies: scoring non-English output against an English-language key. The result shows that practice can manufacture an apparent equity gap rather than detect a real one. Practitioners should see this, because it is a confounder teams introduce inadvertently. The second strength is the data choice that makes the demonstration credible: the Department of Basic Education's official NSC marking memoranda exist natively in both English and Afrikaans, which removes translation quality as a confound and improves on methods that rely on machine-translated benchmarks.

## Weaknesses

The finding is important, but its scope is narrow. It addresses bias measurement in evaluation, which is one slice of AI safety. The Africa track also invites work on larger deployment-side risks for the region, such as election disinformation, data-colonial dependency on foreign infrastructure, compute scarcity, and labour-market disruption. Against that backdrop, a fairness-measurement result has a lower impact ceiling than work tackling those broader threats, even when it is executed well. So the demonstration is sharp but not yet broad.

## Recommendations for the authors

This is a focused demonstration that a widely-used multilingual-evaluation practice can fabricate bias signals, anchored in a clean controlled experiment and real bilingual exam data. The highest-leverage next step is to **broaden coverage to other African languages for which official memoranda already exist**, using the same memo-swap design, and to **test whether the artefact holds across those languages and across more subjects**. This turns a single-language, three-subject result into evidence of a general evaluation pitfall. Memo availability is what keeps the translation confounder closed as you scale, so prioritise the languages where it exists. Finally, publish the result deliberately: as the paper argues, mis-measurement feeds into procurement and deployment, so reaching practitioners helps ensure good tools are not rejected over unfounded bias claims, and real harms are not hidden by a flawed metric.

The controlled J1-vs-J1b comparison is the most useful thing about this paper. Holding model responses byte-for-byte fixed and changing only the reference language of the keyword scorer is exactly the experimental move that turns a noisy multilingual-eval result into a clean methodological claim — and the ~50-478x reduction in apparent gap across three subjects is genuinely striking. (Worth asterisking the 478x figure: in Business Studies the denominator 0.0001 has effectively rounded to zero, so the precise multiplier is unstable even though the qualitative "gap effectively vanishes" claim is well-supported.) Pairing the J1b flip with cross-vendor LLM-judge corroboration (Gemini + Claude both showing residual gaps under 0.04) pre-empts the most obvious "self-favoring judge" objection, and using official Department of Basic Education bilingual marking memos as ground truth removes translation quality as a confound — a confound that haunts essentially every prior multilingual benchmark built on translated source items.

This project asks a sharp question: when an AI tutor seems to do worse for Afrikaans-speaking learners than English ones, is that the AI's fault, or the fault of the tool we use to grade it? Using 129 real South African Grade 12 exam questions in both English and Afrikaans (with the official marking memos as the answer key), the team shows that a large part of the apparent "language gap" disappears once you grade Afrikaans answers against an Afrikaans key instead of an English one. The safety message is that a biased grading tool — not just a biased model — can quietly drive bad decisions about which AI systems are safe to deploy in Global-South classrooms.

Strengths

1. Strong, useful framing. Asking whether the grading tool is creating the unfairness (rather than the model) is a smart, practical lens, and the safety stakes are explained clearly: a faulty measuring stick can either reject a good system or hide a real harm.

2. A genuinely new data resource. Using official government exam papers and marking memos in both English and Afrikaans as ground truth is a real, original asset that others can build on — we couldn't find anything else like it.

3. Clean experiment idea, and it actually runs. Holding the AI's answers fixed and changing only the answer-key language is exactly the right way to isolate the effect, and the code and data are public and reproducible.

Weaknesses

1. The headline number doesn't match the table. The much-repeated "478 times" improvement is tied to a score going from 0.334 to 0.0001, but that is actually about 3340 times — so the single number the whole project leads with is off by roughly 7×, and should be recomputed from the table.

2. The "before" tool is set up to fail. The starting grader scores Afrikaans answers against an English answer key, which nobody would really do, so a dramatic "collapse" against it is closer to confirming an obvious mistake than proving a surprising result. Comparing against a realistic same-language grader would make the finding far more convincing.

3. The AI judges may have seen the exam papers before. The exam papers and memos are public, and the same family of models both writes and grades the answers, so the models could be scoring material they already memorized — which would inflate scores and shrink the gap. A quick check of model training cutoff dates versus the paper dates would help rule this out.

4. Some judges give nearly everyone full marks. One AI judge scores a whole subject at almost a perfect 1.0, and a grader that rates everything near-perfect can't really tell good answers from bad ones — so a "no gap" result from it may just mean it isn't measuring anything.

Very clear experiment, methodology and results. However results seem to focus on developing the right evaluation metrics, rather than on the model results. For safety / interpretability, the model outputs may be more useful.

Cite this work

@misc {

title={

(HckPrj) The Equity Gap That Wasn’t: Reference-Language Bias in Multilingual AI Evaluation.

},

author={

Aboobaker Cassim

},

date={

},

organization={Apart Research},

note={Research submission to the research sprint hosted by Apart.},

howpublished={https://apartresearch.com}

}

Recent Projects

OliGraph: graph-based screening of large oligopools

Existing synthesis screening tools cannot evaluate short oligonucleotide pools, whose overlapping fragments can be reassembled into regulated sequences via polymerase cycling assembly (PCA) yet fall below gene-length detection thresholds. We present OliGraph, an open-source tool that constructs a bi-directed overlap graph from an oligonucleotide pool and extracts contigs for downstream gene-length screening. An optional PCA mode retains only cross-strand overlaps consistent with PCA chemistry. We validated OliGraph in a blinded study across ten simulated pools (70–9,184 oligonucleotides, 30–300 bp) spanning four risk categories. BLAST screening of individual oligonucleotides failed to identify sequences of concern in most pools: three returned zero hits, and vector noise obscured true positives in the remainder. After OliGraph assembly, contig-level BLAST matched the longest assembled sequences (up to 1,905 bp) to sequences of concern at 97–100% identity. In one pool, assembly collapsed 1,634 individual BLAST results into 10 hits from a single contig, all assigned to the same source organism. PCA mode correctly distinguished assemblable from non-assemblable fragments within the same pool. Two pools with no assemblable structure yielded no contigs. OliGraph processed all pools in under 0.2 seconds, fast enough for real-time order screening and consistent with proposals to bring oligonucleotide orders within the scope of synthesis screening regulation.

Read More

BioRT-Bench: A Multi-Attack Red-Teaming Benchmark for Bio-Misuse Safeguards in Frontier LLMs

Frontier AI laboratories are expected to maintain safeguards against biological misuse, but whether deployed models actually refuse bio-misuse queries under adversarial pressure is largely unmeasured in the public literature. We introduce BioRT-Bench, a benchmark that runs four attack methods (direct request, PAIR, Crescendo, and base64 encoding) against four frontier models (Claude Sonnet 4.6, GPT-5.4, DeepSeek V4-flash, Kimi K2.5) across 40 prompts spanning five biosecurity-relevant categories. Responses are scored by a calibrated judge extending StrongREJECT with two bio-specific dimensions: specificity and actionability. We measure Attack Success Rate (ASR), where 0 means the model fully refused and 1 means it provided specific, actionable bio-misuse content. Our results reveal a sharp robustness divide: Chinese frontier models (DeepSeek, Kimi) have under 5% refusal rates even under direct request (ASR 0.88 and 0.79), while Western models (Claude, GPT) maintain substantially stronger safeguards (ASR 0.15 and 0.16). Crescendo is the most effective attack across all models, both in bypassing refusal and in eliciting actionable content. Claude Sonnet 4.6 is the most robust model tested, achieving 100% refusal against base64-encoded prompts.

Read More

PROTEUS (PROTein Evaluation for Unusual Sequences): Structure-Informed Safety Screening for de novo and Evasion-Prone Protein-Coding Sequences

AI protein design tools like RFdiffusion, ProteinMPNN, and Bindcraft make it trivial to produce low-homology sequences that fold into active, potentially hazardous architectures. However, sequence homology-based biosafety screening tools cannot detect proteins that pose functional risk through structurally novel mechanisms with no sequence precedent. We present a tiered computational pipeline that addresses this gap by combining MMseqs2 sequence alignment with structure-based comparison via FoldSeek and DALI against curated toxin databases totaling ~34,000 entries. AlphaFold2-predicted structures are screened for both global fold similarity (FoldSeek) and local active/allosteric site geometry (DALI), capturing convergent functional hazards that sequence screening misses. The pipeline was validated against a panel of toxins, benign proteins, structural mimics, and de novo-designed Munc13 binders, as well as modified ricin variants with residue substitutions. We additionally tested robustness to partial-synthesis evasion, where a bad actor submits multiple shorter coding sequences intended for downstream reassembly into a full toxin-coding gene. We found that while sequence-based screening did not identify any de novo ricin analogues with high certainty, the combined pipeline with FoldSeek and DALI identified all 24 tested de novo ricins as toxic.

Read More

OliGraph: graph-based screening of large oligopools

Existing synthesis screening tools cannot evaluate short oligonucleotide pools, whose overlapping fragments can be reassembled into regulated sequences via polymerase cycling assembly (PCA) yet fall below gene-length detection thresholds. We present OliGraph, an open-source tool that constructs a bi-directed overlap graph from an oligonucleotide pool and extracts contigs for downstream gene-length screening. An optional PCA mode retains only cross-strand overlaps consistent with PCA chemistry. We validated OliGraph in a blinded study across ten simulated pools (70–9,184 oligonucleotides, 30–300 bp) spanning four risk categories. BLAST screening of individual oligonucleotides failed to identify sequences of concern in most pools: three returned zero hits, and vector noise obscured true positives in the remainder. After OliGraph assembly, contig-level BLAST matched the longest assembled sequences (up to 1,905 bp) to sequences of concern at 97–100% identity. In one pool, assembly collapsed 1,634 individual BLAST results into 10 hits from a single contig, all assigned to the same source organism. PCA mode correctly distinguished assemblable from non-assemblable fragments within the same pool. Two pools with no assemblable structure yielded no contigs. OliGraph processed all pools in under 0.2 seconds, fast enough for real-time order screening and consistent with proposals to bring oligonucleotide orders within the scope of synthesis screening regulation.

Read More

BioRT-Bench: A Multi-Attack Red-Teaming Benchmark for Bio-Misuse Safeguards in Frontier LLMs

Frontier AI laboratories are expected to maintain safeguards against biological misuse, but whether deployed models actually refuse bio-misuse queries under adversarial pressure is largely unmeasured in the public literature. We introduce BioRT-Bench, a benchmark that runs four attack methods (direct request, PAIR, Crescendo, and base64 encoding) against four frontier models (Claude Sonnet 4.6, GPT-5.4, DeepSeek V4-flash, Kimi K2.5) across 40 prompts spanning five biosecurity-relevant categories. Responses are scored by a calibrated judge extending StrongREJECT with two bio-specific dimensions: specificity and actionability. We measure Attack Success Rate (ASR), where 0 means the model fully refused and 1 means it provided specific, actionable bio-misuse content. Our results reveal a sharp robustness divide: Chinese frontier models (DeepSeek, Kimi) have under 5% refusal rates even under direct request (ASR 0.88 and 0.79), while Western models (Claude, GPT) maintain substantially stronger safeguards (ASR 0.15 and 0.16). Crescendo is the most effective attack across all models, both in bypassing refusal and in eliciting actionable content. Claude Sonnet 4.6 is the most robust model tested, achieving 100% refusal against base64-encoded prompts.

Read More

This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.
This work was done during one weekend by research workshop participants and does not represent the work of Apart Research.