1 Introduction↩︎

Large-scale autoregressive language models (LMs) now underpin open-ended generation, question answering, and conversational assistants [1]–[3]. They are trained by next-token prediction on large web corpora and, as a result, exhibit emergent abilities such as in-context learning and chain-of-thought (CoT) reasoning [4]–[6]. The same corpora, however, encode historical power imbalances and social stereotypes, which LMs can internalize and even amplify [7], [8]. When models generate explicit CoT, these biases need not remain latent: harmful associations can appear token by token in the reasoning trace, even when the final answer looks neutral.

Existing mitigation strategies address parts of this problem but leave important gaps. Data curation and domain-specific fine-tuning can suppress some harmful behaviors, but they require expensive retraining and may degrade general-domain performance or encode the biases of annotators [9], [10]. Inference-time steering provides an alternative that avoids changing model weights. Methods based on auxiliary classifiers or expert ensembling can push generation away from unsafe content [11], [12], but they inherit the blind spots of the classifiers they rely on and introduce extra computational latency. A third line of work performs global representation-space debiasing by removing linear attribute subspaces from model representations [13], [14]. Because this nullspace is fixed, it cannot adapt to the semantics of a specific prompt, and it can suppress legitimate content or fail to capture non-linear manifestations of bias [15].

Two critical desiderata therefore remain insufficiently addressed. First, most approaches lack per-step statistical guarantees at decode time. For a given prompt, they do not specify which tokens can be safely emitted while keeping the risk of failure under control. Conformal prediction (CP) provides distribution-free error control with marginal coverage guarantees under minimal assumptions (e.g., exchangeability), but does not in general provide conditional (input-conditional) coverage [16], [17]. CP works by calibrating prediction sets to a user-chosen risk level. Adapting CP to autoregressive decoding, however, is non-trivial: one must define nonconformity scores that respect sequence dependence and the open-vocabulary nature of language generation [18]. Second, fairness goals are often defined only at a global or aggregate level. In real deployments, we instead need a local notion of counterfactual parity. The model’s output should be stable under hypothetical changes to sensitive spans in the prompt, and this stability should hold at each decoding step [19]. 

What is currently missing is a decoding-time mechanism that satisfies three properties at once: (i) it enforces counterfactual invariance at the level of candidate next tokens, (ii) it is gradient-free and model-agnostic so that it can be used with frozen checkpoints, and (iii) it provides auditable, per-step marginal guarantees that are suitable for interactive systems.

To satisfy these desiderata, we introduce COFT—Chain of Fair Thought—a training-free framework that enforces counterfactual fairness via logit-space intervention. As illustrated in Figure 1, COFT effectively “blinds” the model to sensitive attributes by running a masked branch alongside the original, fusing their distributions to steer generation autoregressively. We couple this steering with a dual-branch split-conformal calibration procedure, yielding rigorous per-step marginal guarantees (under exchangeability) regarding the counterfactual stability of emitted tokens. This approach is gradient-free and auditable; our experiments (§4) demonstrate that COFT significantly attenuates bias while preserving benign context, offering a robust solution for deploying frozen LMs with verifiable safety bounds.

2 Background and Related Work↩︎

2.1 Bias in Large Language Models↩︎

Large-scale LMs inherit societal biases from web corpora, manifesting as toxicity, stereotypes, and disparate treatment across protected attributes [7], [9], [20]. Standard benchmarks—including CrowS-Pairs, StereoSet, BBQ, and BOLD—quantify these harms across diverse tasks [21]–[25]. While instruction tuning and RLHF effectively reduce overt toxicity, subtle stereotyping often persists [10], particularly when chain-of-thought (CoT) reasoning exposes intermediate biased associations [8]. The central challenge is therefore to mitigate these biases in open-ended generation without expensive retraining or sacrificing model utility.

2.2 Counterfactual Fairness↩︎

Following [26] and [27], a predictor \(\hat{Y}\) is counterfactually fair regarding protected attribute \(A\) and latent factors \(U\) if its distribution remains invariant under interventions on \(A\) given \(U\). While path-specific variants exist [19], we operationalize this for autoregressive decoding as local counterfactual parity. Here, the “individual” is the current context \(w_{<t}\), and we require the next-token distribution to remain stable when sensitive spans in the factual prompt \(p\) are replaced by a neutral sentinel in a masked counterpart \(\widetilde{p} = M(p)\). Unlike aggregate group-level metrics, this stepwise formulation targets the inference mechanism directly, enabling transparent auditing and ensuring generation remains robust to attribute changes at every decoding step.

2.3 Conformal Prediction↩︎

Conformal prediction (CP) provides distribution-free, finite-sample guarantees by calibrating nonconformity scores \(s(x,y)\) on a held-out set to determine a coverage threshold \(\tau\) at risk level \(\alpha\) [16], [17]. We adapt split CP to autoregressive LMs by defining stepwise scores on next-token logits and enforcing policy consistency—ensuring decoding parameters match between calibration and test time to preserve exchangeability [18]. Furthermore, to address potential distribution shifts, we leverage covariate-shift corrections based on density ratios [28], [29], enabling rigorous per-step marginal safety controls for every emitted token.

2.4 Related Work↩︎

Mitigating harmful bias in LMs spans data-level, training-time, and inference-time approaches. Data filtering and augmentation methods aim to reduce harmful correlations at the source [9], [20], [30]. Counterfactual data augmentation (CDA) swaps or masks sensitive markers to balance evidence across demographic groups [31], [32]. Fine-tuning and reinforcement learning from human feedback (RLHF) adapt models toward safety or alignment objectives [9], [10]. These routes can be effective, but they require access to model weights and substantial compute, must be repeated as data or use cases evolve, and risk degrading general-domain competence or encoding annotator preferences.

Inference-time control methods avoid retraining. Plug-and-play methods steer generation using auxiliary discriminators [11]. Expert reweighting approaches such as DExperts and GeDi shift token probabilities by combining pro-experts and anti-experts, or by using generative discriminators [12], [33]. Prompt-only self-debiasing methods rely on carefully designed safety prompts or templates to reduce bias [34]. While practical, these methods have important limitations. Many depend on external classifiers, which add latency and import the classifiers’ blind spots. They also do not provide distribution-free, marginal guarantees. Prompt-only strategies tend to be brittle, with performance that varies significantly across models and tasks.

Representation-space debiasing methods operate on hidden states inside the model. Approaches such as INLP and adversarial training remove attribute subspaces or reduce the recoverability of protected attributes in intermediate representations [13], [14], [35]. These global projections are, however, prompt-agnostic. They may inadvertently erase legitimate, context-dependent semantics [15], and they may fail to capture non-linear manifestations of bias. Most importantly, they typically require updating model weights, which limits their applicability to frozen checkpoints.

Conformal prediction (CP) provides distribution-free error control by calibrating nonconformity scores and selecting quantile-based thresholds [16], [17]. Recent work adapts CP to large language models in several ways: stepwise or sequence-level scores for autoregressive decoding [18], [36]–[38], risk-controlled rebalancing of competing objectives (e.g., toxicity vs.utility) [39], and validity guarantees for alignment or refusal behavior in RLHF-style systems [40], [41]. Covariate-shift-aware variants relate miscoverage to density ratios between calibration and deployment distributions [28], [29]. However, existing methods are typically post hoc (e.g., re-ranking generations or calibrating refusal decisions) and do not impose explicit counterfactual fairness constraints at decode time. They therefore leave open how to regulate token-level decisions during decoding when sensitive information is present in the prompt, and how to combine CP with counterfactual masking and logit fusion in a single, training-free procedure.

Our contribution. COFT intervenes exactly where bias manifests: in the next-token distribution during decoding. For each prompt, it constructs a masked counterfactual version within the same frozen model (§3.2). It then applies a lightweight logit fusion step (§3.3) that attenuates attribute-driven disparities by combining factual and counterfactual logits. On top of this, COFT uses a dual-branch split-CP procedure (§3.4) to certify a shared support set of tokens with distribution-free, per-step guarantees. All of this is done without retraining and without auxiliary classifiers. In this way, COFT directly operationalizes local counterfactual parity during decoding while preserving the model’s utility.

3 Methodology↩︎

We consider a frozen causal LM \(f_\theta\) with tokenizer vocabulary \(\mathcal{V} = \{1,\dots,V\}\). For a prompt \(p\) and a prefix \(w_{<t}\), the model produces logits \(z_t \in \mathbb{R}^V\) and a next-token distribution \(\pi_t = \mathrm{softmax}(z_t)\).

Let \(\mathcal{S}\) be a set of sensitive spans (for example, gendered, racial, or religious identifiers). These spans can be specified by the user or detected automatically using Named Entity Recognition (NER) [42]. We define a deterministic masking operator \(M\) that replaces each \(s \in \mathcal{S}\) with a tokenizer-stable sentinel token \([\texttt{MASK}]\), while preserving the original word order (details in §3.2).

COFT decodes two parallel views that share the same generated prefix: the factual prompt \(p\), and the masked prompt \(\widetilde{p} = M(p)\). At each step, the same selected token is appended to both branches; the masked prompt is not dynamically rewritten during decoding. COFT then performs two actions. First, it applies counterfactual logit fusion, which is a convex interpolation of the factual and masked logits controlled by a parameter \(\lambda \in [0,1]\). This fusion attenuates attribute-driven disparities (§3.3). Second, it imposes a dual-branch split-conformal acceptance rule, which is calibrated offline at miscoverage level \(\alpha\). This rule only admits tokens that are simultaneously probable under both the factual and masked views (§3.4).

Sampling is then performed from the surgically corrected factual distribution, restricted to this set of certified candidate tokens. The procedure requires no training, gradients, or auxiliary classifiers. Figure 2 summarizes the overall workflow.

3.1 Notation and Desiderata↩︎

3.1.0.1 Two Views Per Step.

At step \(t\), COFT evaluates \(f_\theta\) twice, conditioning both runs on the same generated prefix \(w_{<t}\): \[\underbrace{z_t^{F},\,\pi_t^{F}}_{\text{factual}} = f_\theta(w_{<t};\,p), \qquad \underbrace{z_t^{CF},\,\pi_t^{CF}}_{\text{masked}} = f_\theta(w_{<t};\,\widetilde{p}),\]

where \(\widetilde{p}=M(p)\) replaces each span in \(\mathcal{S}\) by a neutral sentinel token (defined below). Importantly, the masked branch is a probe used to measure and attenuate sensitivity, from which we never sample.

3.1.0.2 Counterfactual Fairness Target (Token-Level).

Let \(v^\star_t\) denote the ground-truth next token at step \(t\) under the factual world. We say a decoder is token-level counterfactually stable at level \(\alpha\) if, for every step \(t\), the set of eligible next tokens \(\mathcal{C}_t\) produced by the decoder satisfies \[\mathbb{P}\!\big[\, v^\star_t \in \mathcal{C}_t(\pi_t^{F},\pi_t^{CF}) \,\big] \;\ge\;1-\alpha,\] where \(\mathcal{C}_t(\pi_t^{F},\pi_t^{CF})\) is a single, deterministic candidate set computed jointly from both branches (e.g., by intersecting per-branch plausibility constraints). Sampling is then performed only from \(\mathcal{C}_t\) using the corrected factual distribution. This ensures that the realized token is supported by both worlds with miscoverage at most \(\alpha\).

3.2 Stage I: Counterfactual Masking↩︎

3.2.0.1 Masking Operator.

Given a prompt \(p\) and a span set (possibly multi-token) \(\mathcal{S}\), define the masking operator \(M: \text{text} \rightarrow \text{text}\) that deterministically replaces each span \(s\in\mathcal{S}\) with a neutral sentinel token \([\texttt{MASK}]\)¹. The operator is idempotent and preserves word order: \[M(M(p))=M(p), \qquad \text{and} \qquad \operatorname{len}(M(p)) \approx \operatorname{len}(p).\] Implementation detail (token alignment). Because LMs use positional encodings, we implement \(M\) to preserve token count: if a sensitive span \(s\) tokenizes to \(k\) tokens, we replace it with \(k\) copies of the sentinel (each sentinel is chosen to be a single, tokenizer-stable token). This ensures that the factual and masked branches remain aligned in absolute position, so paired comparisons \(z_t^{F}\leftrightarrow z_t^{CF}\) are computed at matching prefixes. Why masking? Deleting sensitive spans alters syntax and attention geometry, leading to swapping to another identity, which injects a new attribute. Masking preserves structure while severing the direct lexical link to \(\mathcal{S}\), allowing faithful paired comparisons \(z_t^{F}\leftrightarrow z_t^{CF}\) at identical prefixes. The full detailed analysis of masking impact is provided in Appendix [ 9.1, 9.2]. COFT therefore depends on a masking or redaction mechanism: it controls decode-time use of localized sensitive spans or detected proxy spans, but it is not itself a universal detector of all implicit bias.

3.3 Stage II: Counterfactual Logit Fusion↩︎

At step \(t\), define the per-token attribute sensitivity \(\Delta_t \!=\! z_t^{F} - z_t^{CF} \in \mathbb{R}^V\). COFT attenuates this disparity via a convex interpolation in logit space: \[\label{eq:fusion} \widehat{z}_t \;=\;z_t^{F} - \lambda\,\Delta_t \;=\;(1-\lambda)\,z_t^{F} + \lambda\,z_t^{CF}, \qquad \lambda\in[0,1],\tag{1}\] and sets \(\widehat{\pi}_t=\operatorname{softmax}(\widehat{z}_t)\). This operation yields a weighted geometric blend of the two next-token distributions with linear interpolation in log-odds where its formal properties and proofs are given in §3.6.

3.3.0.1 Why Fusion Before Certification?

Fusion removes spuriously amplified directions from the logits. As a result, the subsequent certification step operates on distributions that already agree on their high-mass region. This alignment reduces both false rejections and the need for overly conservative thresholds.

3.4 Stage III: Dual-Branch Split-Conformal Filtering↩︎

Next, we certify a common support for the next token using split-conformal prediction (CP). Let \(\mathcal{D}_{\text{cal}}\) be a calibration set of i.i.d. (or exchangeable) contexts, disjoint from any evaluation contexts. At each step index \(t\), we define a dual-branch nonconformity score for token \(v\): \[\label{eq:score} s_t(v) \;\stackrel{\rm def}{=}\;1 - \min\{\;\widehat{\pi}_t(v),\;\pi^{CF}_t(v)\;\}.\tag{2}\] Intuitively, \(s_t(v)\) is small only if \(v\) has sufficiently high probability in both worlds.

3.4.0.1 Split Calibration (Offline).

Compute all scores \(s_t^{(i)}(v^{(i)}_t)\) on a disjoint calibration set \(\mathcal{D}_{\text{cal}}\) offline, where \(v^{(i)}_t\) is the true next token for context \(i\) at step \(t\). Let \(q_t\) be the empirical \((1-\alpha)\)-quantile with the standard finite-sample adjustment: \[q_t \;\leftarrow\;\text{Quantile}_{1-\alpha}\!\left( \{\, s_t^{(i)}(v^{(i)}_t)\,:\, (i,t)\in\mathcal{D}_{\text{cal}}\;\}\right).\] In practice, because open-ended generations have variable length and late-step calibration data can be sparse, we share thresholds across short position bins (e.g., bins of width 8 up to a maximum \(T\)) and tie all steps beyond \(T\) to the last bin. At test time (online), we reuse the stored \(q_t\) to define the conformal candidate set: \[\label{eq:candidates} \begin{align} \mathcal{C}_t &\stackrel{\rm def}{=} \big\{ v\in\mathcal{V} : s_t(v)\le q_t \big\} \\ &= \big\{ v\in\mathcal{V} : \min\{\widehat{\pi}_t(v),\pi^{CF}_t(v)\}\ge \tau_t \big\}. \end{align}\tag{3}\]

where \(\tau_t \equiv 1-q_t\) is a learned, per-position threshold shared by both branches. Sampling is then performed from the debiased factual distribution restricted to \(\mathcal{C}_t\): \[\label{eq:sampling} \begin{align} \mathcal{C}_t\neq\varnothing &:\quad v_t \sim \widehat{\pi}_t(\cdot \mid \mathcal{C}_t),\\ \mathcal{C}_t=\varnothing &:\quad v_t = \arg\max\limits_{v}\,\widehat{\pi}_t(v). \end{align}\tag{4}\]

Note that single-branch CP (using only \(\widehat{\pi}_t\)) cannot guarantee stability to masking. Requiring simultaneous support in both branches yields distribution-free coverage of the true next token in either world, which directly operationalizes counterfactual stability.

3.5 Complete Decoding Algorithm↩︎

COFT is inference-only: for each step \(t\), we create a masked view \(\widetilde{p}=M(p)\), apply counterfactual logit fusion (Eq. 1 ), and use the offline split-calibrated threshold \(\tau_t\) to admit only tokens jointly supported by \(\widehat{\pi}_t\) and \(\pi^{CF}_t\) (Sec. 3.4). We then sample from \(\widehat{\pi}_t\) restricted to this certified set, yielding per-step marginal guarantees while adding only a second forward pass and a filter. If the set is empty (rare), we fall back to \(\arg\max_v \widehat{\pi}_t(v)\); in that case, the emitted token need not lie in \(\mathcal{C}_t\), and the stability guarantee applies to the certified-set event (and to sampling from \(\mathcal{C}_t\) when \(\mathcal{C}_t\neq\varnothing\)).

3.6 Theoretical Guarantees↩︎

We now explain why COFT provides per-step marginal counterfactual stability guarantees (i.e., token-level guarantees under exchangeability) while remaining distribution-free and preserving predictive utility. The argument follows directly from Stages I–III of the method. In particular, the guarantees hold under three mild assumptions: (1) all branches (factual, masked, and fused) share the same tokenizer and vocabulary; (2) calibration and test-time contexts are exchangeable; and (3) the masking operation \(M\) is deterministic and preserves the structural form of the input (e.g., word order and syntax). The main theorem is intentionally stepwise rather than an exact end-to-end guarantee for an entire reasoning chain; sequence-level control can be obtained with conservative union bounds or by calibrating rollout scores, as detailed in Appendix 9.4.

Together with the constructions in Sections 3.2–3.4, these assumptions ensure that COFT yields stable counterfactual predictions without requiring model retraining or access to the original training data. At decoding step \(t\), COFT first forms the surgically corrected distribution \(\widehat{\pi}_t\) using the fusion rule in equation 1 . It then certifies token eligibility using the dual-branch score in equation 2 , together with the offline-calibrated threshold, to define the candidate set in equation 3 .

The first ingredient in the analysis is the behavior of fusion itself. Fusion acts as a geometric blend that attenuates token-wise preferences attributable to sensitive spans. Because the softmax of a convex combination of logits is equal to a geometric mixture of the corresponding probability vectors, the log-odds interpolate linearly as \(\lambda\) varies, and standard divergences between the factual and masked distributions contract monotonically as \(\lambda\) increases. As a result, \(\widehat{\pi}_t\) moves toward the masked view \(\pi^{CF}_t\) in a controlled and tunable way, without collapsing the distribution or destroying useful variation in the high-probability region.

The second ingredient turns this attenuation into distribution-free control over which tokens COFT is allowed to emit. The dual-branch score in equation 2 is designed to certify only those tokens that are simultaneously probable under both the masked view and the surgically corrected (fused) view. Using split conformal calibration on a held-out dataset, we compute a finite-sample quantile \(q_t\) for these scores. At test time, we reuse this quantile in equation 3 to define the set of eligible candidate tokens at each step.

Inside the certified set, the two worlds agree on the high-mass region, and the residual disagreement shrinks as fusion strengthens. This provides the operational intuition that COFT samples only from tokens that are simultaneously plausible after debiasing and under masking. Because both branches are conditioned on the same generated prefix \(w_{<t}\), the intervention remains active even if an earlier token has moved the reasoning trace in a biased direction: subsequent disagreement appears directly through larger scores \(s_t(\cdot)\), smaller certified sets, or, in the extreme, a rare empty-set fallback.

Soundness and practical completeness follow immediately from the sampling rule: when \(\mathcal{C}_t\neq\varnothing\), COFT samples only from certified tokens, and it retains the true next token whenever that token is sufficiently supported in both views.

Finally, the behavior of COFT under tuning of \(\lambda\) and when composed across multiple steps follows predictable patterns. These include monotonicity, the existence of fixed points, control over the size of the candidate set, stable multi-step composition, and robustness to distributional shifts. The shift result is optional: the default guarantee requires exchangeability and no density-ratio estimation, while Theorem 5 applies when reliable shift weights or conservative density-ratio bounds are available. Formal statements and corresponding proofs for each property are provided in Appendices 7.11, 7.12, 7.13, and 5.

4 Experiments↩︎

We evaluate COFT along four main axes: (i) bias mitigation performance, (ii) preservation of task performance, (iii) efficiency and scalability, and (iv) ablations and sensitivity analyses. All experiments are conducted on a workstation equipped with \(4 \times\) NVIDIA RTX A6000 GPUs (48GB), utilizing frozen public checkpoints and publicly available datasets. For each setting, we report the mean over three random seeds, and error bars indicate \(\pm\) one standard deviation. Unless otherwise specified, we decode with nucleus sampling (\(p = 0.9\)) and a maximum generation length of \(T = 256\) tokens.

4.1 Setup: Models, Datasets, Baselines, Metrics↩︎

4.1.0.1 Models.

We evaluate widely used, open-weight causal LMs from the Hugging Face ecosystem [43]–[45], covering both base and instruction-tuned variants to test generality. Our pool includes LLaMA-2-7B/13B and LLaMA-2-Chat-7B/13B as strong open baselines with broad adoption [3]; Mistral-7B-v0.2 and Mistral-7B-Instruct as compact yet competitive 7B models [46]; Mixtral-8x7B-Instruct to probe sparse Mixture-of-Experts scaling [47]; and Qwen2-7B / Qwen2-7B-Instruct as a recent multilingual family with strong reasoning performance [48]. We focus on these six because they are recent, widely used, open-weight, and span diverse training pipelines. To fit page limits, the main text reports two representative models—LLaMA-2-13B [3] and Mistral-7B-Instruct [46]—and moves results for the remaining four to Appendix 8, where they follow the same qualitative trends.

4.1.0.2 Datasets (bias & task).

We evaluate on bias-sensitive prompts and general tasks. Bias benchmarks include StereoSet (SS) [22], CrowS-Pairs (CP) [21], BBQ (disambiguated bias QA) [23], BOLD (demographic toxicity) [24], Utrecht (hiring bias) [49], and COMPAS (recidivism framing) [50]. Utility is measured on GSM8K (math reasoning) [51], StrategyQA (commonsense) [52], ARC-easy (science QA) [53], and PIQA (physical commonsense) [54]. Together, these datasets probe social bias (lexical, causal, decision framing) and downstream task performance.

4.1.0.3 Baselines.

We compare COFT to nine debiasing baselines introduced in §2.4, spanning prompting methods, inference-time steering, decoding constraints, and lightweight training. In the main text, we focus on four strong and representative inference-time baselines (marked \(\star\)): \(\star\) Vanilla decoding (no mitigation; bias lower bound), \(\star\) Self-Debiased Decoding (SDD) (anti-prompt logit subtraction), \(\star\) GeDi/DExperts-style steering (classifier- or expert-guided logit reweighting toward neutral labels), and \(\star\) Dual-Threshold Conformal Decoding (DT-CD) (single-branch conformal acceptance based on toxicity and minimum probability, and the closest baseline to our CP component without counterfactual reasoning). The remaining baselines—Safety Templates, Detox Decoding, Counterfactual Substitution, Counterfactual Data Augmentation (CDA), and Adversarial LM-head reweighting—are reported in Appendix 8 (with training-based methods detailed in Appendix 8.8), as they require additional classifiers, detectors, or retraining beyond our frozen-weights threat model.

max width=

4.1.0.4 Metrics.

We evaluate: (a) Bias: SS bias score (lower is better) [22]; CP accuracy (higher is better), reported as \(100-\mathrm{\small CP-Stereo}\) where \(\mathrm{\small CP-Stereo}\) is the standard CrowS-Pairs metric  [21]; BBQ biased decision rate (lower) [23]; BOLD toxicity (lower) [24]; Utrecht Demographic Parity gap (lower) [49]; and COMPAS bias gap (lower) [50]. (b) Utility: task accuracy on GSM8K, StrategyQA, ARC-easy, and PIQA [51]–[54]. (c) LM quality: perplexity on Wikitext-2 [55] and MAUVE on an OpenAI Summaries subset [56]. (d) Efficiency: tokens per second (higher), compute overhead (percentage), and peak memory (GB).

4.2 Bias Mitigation Performance↩︎

We first report comprehensive bias outcomes for two representative models (LLaMA-2-13B and Mistral-7B-Instruct) against four inference-time baselines (Vanilla, SDD, DExperts, DT-CD), on six bias datasets (Table [tab:bias-main]). Full results for all six models and all nine baselines are in Appendix 8.4. Appendix 8.3 additionally reports a symmetric Pareto-tuned comparison against neutral rewriting and ITI-style activation steering; COFT remains on the best bias–utility frontier because it constrains the autoregressive trajectory rather than only rewriting the input or globally steering hidden states.

Across both models, COFT reduces bias by \(20\)–\(40\%\) vs.the strongest baseline (DT-CD) on every dataset. Gains are largest on BBQ (\(\downarrow\) 34–41%) and Utrecht (\(\downarrow\) 18–23%), where decision framing is sensitive to protected spans. COFT also improves CP accuracy by \(+2.2\)–\(+2.4\) points, indicating that counterfactual stability does not trade off with robustness on minimal pairs.

4.3 Task Performance Preservation & LM Quality↩︎

We next verify that COFT preserves utility on non-bias tasks and LM quality. Table 1 shows accuracies (GSM8K, StrategyQA, ARC-easy, PIQA) and quality metrics (PPL, MAUVE) for the two representative models. Extended results for all models appear in Appendix 8.5.

3.2pt

COFT matches vanilla on utility within \(\pm 0.2\) points, and far outperforms SDD/DExperts which incur 0.3–1.1 point drops. PPL and MAUVE remain indistinguishable from vanilla (differences \(\le 0.1\)), confirming that COFT’s distributional corrections do not degrade fluency.

4.4 Efficiency and Scalability↩︎

COFT performs an additional masked forward pass per step. The two branches stay structurally aligned and can be evaluated in parallel in a continuous-batching engine, so efficient execution keeps the overhead low rather than doubling end-to-end token latency. ²

(i) Throughput. COFT retains \(75\)–\(90\%\) of vanilla throughput (typically \(10\)–\(25\%\) overhead) on LLaMA-2-13B and Mistral-7B-Instruct. This marginal cost is lower than methods requiring separate safety networks (e.g., DExperts/GeDi). (ii) Memory. Memory overhead is negligible (\(\le 0.8\) GB). The KV-cache is shared rather than duplicated; additional usage comes primarily from storing auxiliary states. (iii) Scalability. On Mixtral-8x7B, overhead remains stable at \(\approx 10.8\%\) across batch sizes (2–16), scaling linearly with the masked branch rather than model size. Unlike external classifiers, COFT incurs a predictable, bounded cost. Full throughput curves are provided in Appendix 8.6.

4.5 Ablations and Sensitivity↩︎

We ablate COFT by removing fusion or CP, and by replacing dual-branch CP with single-branch CP (factual-only). Results (LLaMA-2-13B; averages over bias sets) are in Table 3.

Takeaway. Logit fusion contributes the largest isolated gain (0.171\(\to\)​0.149), confirming our intuition: it mechanistically attenuates attribute-driven log-odds at their source. Dual-branch CP then confers the certified stability (0.149\(\to\)​0.129) by filtering tokens not jointly supported. Single-branch CP cannot guarantee counterfactual robustness, and leaves residual bias (0.158).

We also check different values for \(\lambda\) and \(\alpha\) with the same protocol: sweep on a small validation split, trace the \((\text{BiasAvg}\!\downarrow,\;\text{UtilityAvg}\!\uparrow)\) Pareto curve, and pick the smallest value within 2% of the knee. Given the chosen \(\alpha\), we compute \(q_t\) offline on held-out calibration contexts and set \(\tau_t{=}1{-}q_t\) with no test-time tuning. Figs. 4–[fig:ablate-alpha] show both sweeps; Apps. 8.7.1 and 8.7.2 provide per-model sensitivity and cross-task stability checks.

5 Conclusion↩︎

We presented COFT (Chain of Fair Thought), an inference-time decoding method that pairs each prompt with a masked counterfactual, attenuates attribute-driven disparities via counterfactual logit fusion, and certifies a common support using dual-branch split conformal filtering. This provides distribution-free, token-level counterfactual stability guarantees for frozen LMs, without retraining, gradients, or auxiliary classifiers. Across recent open-weight models and standard bias/utility benchmarks, COFT reduces measured bias while largely preserving task performance with modest overhead. Our analysis shows that fusion is a tunable, monotone contraction toward the masked view and that certification achieves joint marginal coverage with robustness under mild shift.

Impact Statement↩︎

This work contributes to the development of trustworthy and socially responsible language technologies by introducing a framework for verifiable bias mitigation. The primary societal benefit of COFT is the ability to enforce counterfactual fairness and reduce toxicity in large language models (LLMs) without the prohibitive compute and energy costs associated with retraining. By providing per-step marginal statistical guarantees (under exchangeability), this method allows practitioners to deploy frozen models in sensitive domains with a quantified measure of risk. However, we emphasize that algorithmic interventions are not a panacea; our operationalization of fairness relies on the specific definition of sensitive attributes and counterfactuals, which are inherently socio-technical. Furthermore, while avoiding retraining costs, the dual-branch decoding adds inference-time latency. Adopters must therefore weigh these trade-offs and ensure that statistical guarantees are not mistaken for total immunity from bias, particularly under significant distribution shifts.

6 Appendix Overview↩︎

This appendix (i) restates all theoretical results from §3.6 and provides complete, self-contained proofs (including required lemmas and all normalizing terms); (ii) reports extended experiments (full tables across models/baselines/datasets, plus \(\lambda\)- and \(\alpha\)-ablations) supplementing §4; (iii) documents deployment and reproducibility details (checkpoints, calibration rollouts, decoding settings, and random seeds); and (iv) discusses limitations, robustness under distribution shift, and practical extensions (including empty-set fallbacks and re-calibration).

7 Extended Notation and Preliminaries↩︎

All results, lemmas, and proofs in this appendix are organized as subsections* of this section.* We collect notation, state assumptions, recall basic inequalities, and then give full statements and proofs underlying the guarantees in §3.6. Each proof is self-contained and explicitly tracks normalization (partition functions), and we avoid unsupported claims of strict linear contraction for normalized geometric mixtures.

7.1 Core Notation (Models, Logits, Probabilities)↩︎

A frozen causal LM \(f_\theta\) with tokenizer \(\mathcal{T}\) has a fixed vocabulary \(\mathcal{V}=\{1,\dots,V\}\). At decoding step \(t\) with prefix \(w_{<t}\), the factual and masked branches produce logits \(z_t^F,z_t^{CF}\in\mathbb{R}^V\) and probabilities \[\pi_t^F=\mathrm{softmax}(z_t^F),\qquad \pi_t^{CF}=\mathrm{softmax}(z_t^{CF})\in\Delta^{V-1}.\] COFT’s logit fusion (main text equation 1 ) is the convex combination in logit space followed by softmax: \[\label{eq:app-fusion} \widehat{z}_t \triangleq (1-\lambda)z_t^F + \lambda z_t^{CF},\qquad \widehat{\pi}_t \triangleq \mathrm{softmax}(\widehat{z}_t), \qquad \lambda\in[0,1].\tag{5}\] The dual-branch split-conformal score and candidate set (main text equation 2 , equation 3 ) are \[\label{eq:app-score} s_t(v) \triangleq 1-\min\{\widehat{\pi}_t(v),\pi_t^{CF}(v)\},\qquad \mathcal{C}_t=\{v:\;s_t(v)\le q_t\},\qquad \tau_t\triangleq 1-q_t,\tag{6}\] where \(q_t\) is the \((1-\alpha)\) split-conformal quantile (with ceiling correction) computed from calibration scores \(\{s_t(v_t^{(i)})\}_{i=1}^n\) on a disjoint calibration set generated under the same deployed decoding policy (see §7.2).

7.2 Assumptions and Calibration Protocol↩︎

(A1) Shared tokenizer/vocabulary. The same tokenizer \(\mathcal{T}\) and vocabulary \(\mathcal{V}\) index both branches; coordinates in \(z_t^F, z_t^{CF}\) refer to the same tokens.

(A2) Exchangeability under the deployed policy. The stepwise calibration and test contexts (prefixes \(w_{<t}\)) are exchangeable under the actual deployed decoding policy, i.e., under the same COFT filtering rule (including any empty-set fallback) and the same sampling controls (temperature/top-\(p\)/top-\(k\)/etc.). If calibration prefixes are instead drawn from unconstrained base-model continuations while test prefixes are generated by COFT, (A2) may fail and coverage must be corrected (cf.§5).

(A3) Deterministic mask. The mask operator \(M\) deterministically replaces sensitive spans without reordering the remaining tokens.

(A4) Fixed decoding settings. All stochastic decoding parameters and tie-breaking rules used during calibration match those at test time. In particular, stepwise calibration contexts are obtained from rollouts of the same deployed COFT policy (including the filtering rule and fallback), rather than from unconstrained base-model rollouts.

7.3 Divergences, Total Variation, and Softmax Identities↩︎

For discrete \(P,Q\) on \(\mathcal{V}\), total variation is \(\mathrm{TV}(P,Q)=\tfrac12\sum_v|P(v)-Q(v)|\), squared Hellinger is \(H^2(P,Q)=1-\sum_v\sqrt{P(v)Q(v)}\), and (forward) KL is \(D_{\mathrm{KL}}(P\|Q)=\sum_v P(v)\log\frac{P(v)}{Q(v)}\). Softmax is translation-invariant: for any \(c\in\mathbb{R}\), \[\label{eq:app-softmax-invariance} \mathrm{softmax}(z)=\mathrm{softmax}(z+c\,\mathbf{1}).\tag{7}\] We will use Pinsker’s inequality: \[\label{eq:app-pinsker} \mathrm{TV}(P,Q)\;\le\;\sqrt{\tfrac12\,D_{\mathrm{KL}}(P\|Q)}.\tag{8}\]

7.4 Geometric-Mixture Representation With the Partition Function↩︎

7.5 Conformal Ranks and Ceiling-Corrected Quantile↩︎

Let \(S=\{s_t^{(i)}\}_{i=1}^n \cup \{s_t^\text{test}\}\) be \(n{+}1\) scores formed as in equation 6 . Under (A2), the rank of \(s_t^\text{test}\) among \(S\) is uniform on \(\{1,\ldots,n{+}1\}\). If \(q_t\) is the \(\lceil(1-\alpha)(n+1)\rceil\)-th smallest among the \(n\) calibration scores, then \[\label{eq:app-quantile} \mathbb{P}\big(s_t^\text{test}\le q_t\big)\;\ge\;1-\alpha,\tag{10}\] i.e., the standard split-conformal marginal coverage guarantee.

7.6 Auxiliary Inequalities (TV Under Restriction)↩︎

7.7 Proposition 1 (Main Text): Log-Odds Interpolation Under Fusion↩︎

7.7.0.1 Statement.

For \(u,v\in\mathcal{V}\), \[\log\frac{\widehat{\pi}_t(u)}{\widehat{\pi}_t(v)} =(1-\lambda)\log\frac{\pi_t^F(u)}{\pi_t^F(v)}+\lambda\log\frac{\pi_t^{CF}(u)}{\pi_t^{CF}(v)}.\]

7.7.0.2 Proof.

This is Lemma 2. 0◻

7.8 Theorem 1 (Main Text): Dual-Branch Marginal Coverage↩︎

7.8.0.1 Statement.

With \(q_t\) as in equation 6 , under (A2), \[\mathbb{P}\!\Big[v^\star_t\in\mathcal{C}_t\text{ under }\widehat{\pi}_t\;\wedge\;v^\star_t\in\mathcal{C}_t\text{ under }\pi_t^{CF}\Big]\;\ge\;1-\alpha.\]

7.8.0.2 Proof.

Under (A2) and determinism of the mapping “context \(\mapsto (\widehat{\pi}_t,\pi_t^{CF})\mapsto s_t(\cdot)\)”, the calibration scores together with the test score are exchangeable, so the rank argument yields \(\mathbb{P}(s_t(v^\star_t)\le q_t)\ge 1-\alpha\) by equation 10 . Since \(s_t(v)\le q_t \iff \min\{\widehat{\pi}_t(v),\pi_t^{CF}(v)\}\ge \tau_t\), this is equivalent to joint inclusion. 0◻

7.9 Corollary 1 (Main Text): Certified Token-Level Counterfactual Stability↩︎

7.9.0.1 Statement (corrected).

On the event of Theorem 1 and conditional on \(\mathcal{C}_t\neq\varnothing\), sampling from \(\widehat{\pi}_t\) restricted to \(\mathcal{C}_t\) draws from a common support of \(\widehat{\pi}_t\) and \(\pi^{CF}_t\), and \[\mathrm{TV}\!\big(\widehat{\pi}_t(\cdot\mid \mathcal{C}_t),\;\pi^{CF}_t(\cdot\mid \mathcal{C}_t)\big) \;\le\;\frac{1}{\tau_t}\sqrt{\tfrac12\,D_{\mathrm{KL}}(\widehat{\pi}_t\|\pi_t^{CF})}.\] Moreover, \(D_{\mathrm{KL}}(\widehat{\pi}_t\|\pi_t^{CF})\) is non-increasing in \(\lambda\).

7.9.0.2 Proof.

Let \(A=\mathcal{C}_t\). By definition of \(A\), \(\min\{\widehat{\pi}_t(v),\pi_t^{CF}(v)\}\ge \tau_t\) for all \(v\in A\), so \(\widehat{\pi}_t(A)\ge \tau_t\) and \(\pi_t^{CF}(A)\ge \tau_t\). Lemma 3 yields \[\mathrm{TV}\big(\widehat{\pi}_t(\cdot\mid A),\pi_t^{CF}(\cdot\mid A)\big) \le \frac{\mathrm{TV}(\widehat{\pi}_t,\pi_t^{CF})}{\min\{\widehat{\pi}_t(A),\pi_t^{CF}(A)\}} \le \frac{\mathrm{TV}(\widehat{\pi}_t,\pi_t^{CF})}{\tau_t}.\] Apply Pinsker equation 8 to bound \(\mathrm{TV}(\widehat{\pi}_t,\pi_t^{CF})\) by \(\sqrt{\tfrac12 D_{\mathrm{KL}}(\widehat{\pi}_t\|\pi_t^{CF})}\).

It remains to show monotonicity of \(D_{\mathrm{KL}}(\widehat{\pi}_t\|\pi_t^{CF})\) in \(\lambda\). From Lemma 1, write \(\widehat{\pi}_t\) as an exponential tilt of \(\pi_t^{CF}\): \[\widehat{\pi}_t(v) =\frac{\pi_t^{CF}(v)\exp(\beta r_t(v))}{\sum_u \pi_t^{CF}(u)\exp(\beta r_t(u))}, \quad r_t(v)\triangleq \log\frac{\pi_t^{F}(v)}{\pi_t^{CF}(v)}, \quad \beta\triangleq 1-\lambda\in[0,1].\] Let \(A_t(\beta)\triangleq \log \sum_u \pi_t^{CF}(u)\exp(\beta r_t(u))\). A standard exponential-family identity gives \(D_{\mathrm{KL}}(\widehat{\pi}_t\|\pi_t^{CF})=\beta A_t'(\beta)-A_t(\beta)\) and \(\frac{d}{d\beta}D_{\mathrm{KL}}(\widehat{\pi}_t\|\pi_t^{CF})=\beta A_t''(\beta)\ge 0\) since \(A_t\) is convex. Thus \(D_{\mathrm{KL}}(\widehat{\pi}_t\|\pi_t^{CF})\) is non-decreasing in \(\beta\) and therefore non-increasing in \(\lambda\). 0◻

7.10 Proposition 2 (Main Text): Soundness and Practical Completeness↩︎

7.10.0.1 Statement (clarified).

If \(\mathcal{C}_t\neq\varnothing\), COFT never emits \(v\notin\mathcal{C}_t\) (soundness on the non-empty-set event). If \(\min\{\widehat{\pi}_t(v^\star_t),\pi^{CF}_t(v^\star_t)\}\ge \tau_t\), then \(v^\star_t\in\mathcal{C}_t\) with probability \(\ge 1-\alpha\). If \(\mathcal{C}_t=\varnothing\), COFT uses a deterministic fallback (e.g., \(\arg\max_v \widehat{\pi}_t(v)\)), and emitted-token soundness statements do not apply on that event.

7.10.0.2 Proof.

If \(\mathcal{C}_t\neq\varnothing\), sampling is performed from \(\widehat{\pi}_t(\cdot\mid\mathcal{C}_t)\), so no token outside \(\mathcal{C}_t\) can be emitted. The inclusion guarantee is exactly Theorem 1. 0◻

7.11 Monotone Gap Decay and Fixed Points (Design Properties)↩︎

7.12 Candidate-Set Size and the Fairness–Diversity Trade-Off↩︎

Increasing \(\lambda\) moves the fused distribution toward the masked branch, which usually reduces factual–masked disagreement and stabilizes the overlap \(U_t\cap V_t\). The set-size bound is therefore best read together with the validation curves in Fig. 7 and Table 6: stronger filtering can reduce bias, but overly aggressive thresholds shrink the certified set and motivate the Pareto-knee rule used in the experiments.

7.13 Composition Across Steps and Robustness to Mild Shift↩︎

7.14 Remarks on Empty-Set Fallback and Exchangeability↩︎

If \(\mathcal{C}_t=\varnothing\), COFT uses a deterministic fallback (e.g., \(\arg\max_v\widehat{\pi}_t(v)\)) to ensure progress. Emitted-token soundness/stability statements therefore hold conditional on \(\mathcal{C}_t\neq\varnothing\). If a generated prefix has already drifted in a biased direction, both branches still condition on that same prefix, so the fairness check is re-applied rather than turned off. Large factual–masked disagreement manifests as higher nonconformity scores or, in the extreme, an empty certified set; Table 9 shows that the latter is rare in our evaluated distributions. Exchangeability (A2) requires that calibration prefixes are generated under the same COFT policy and decoding settings as test time; if this is violated (e.g., calibration rollouts use the unconstrained base model or decoding parameters differ), one must re-calibrate under the deployed policy or apply shift-aware corrections such as Theorem 5.

8 Extended Experimental Protocol↩︎

This appendix complements §4 with complete protocol details and expanded results.

8.1 Design Principles and Factorization of Comparisons↩︎

We structure comparisons to match COFT’s scope and guarantees:

1. Frozen-weights, inference-time debiasing (primary): Vanilla, SDD, DExperts-style steering, safety templates, detox decoding, CF substitution, DT-CD. These methods compete on computation at decode-time, counterfactual consistency, and statistical guarantees.

2. Train-time methods (secondary): CDA and adversarial LM-head. We report them separately (Appendix only) to avoid conflating training cost with inference-only objectives.

3. Model and dataset coverage: six recent open LMs across six bias benchmarks + four utility tasks, as enumerated in §4.1. Main-text reports two representative models to respect page limits; full grids are here.

This design yields orthogonal stress-tests for (i) bias mitigation breadth, (ii) task/quality preservation, and (iii) efficiency/scaling, mirroring the “attenuate then certify” pipeline of COFT.

8.2 Measurement Standards, Calibration Splits, and Error Handling↩︎

Calibration. For each dataset and step index \(t\), a disjoint calibration pool (10–15%) sets \(\tau_t\) via the ceiling quantile at level \(1{-}\alpha\); no test leakage. When \(t\) is ambiguous due to variable-length prompts, we share thresholds over bins of width 8 up to \(T{=}256\).

Uncertainty. We report the mean over three independent seeds with standard deviation (std). Camera-ready plots and tables can equivalently display \(1.96\,\mathrm{std}/\sqrt{3}\) confidence intervals; we keep std in the appendix for consistency with the full result grid. For derived quantities (e.g., average ranks), we recompute per seed before averaging to avoid bias.

Compute envelope. All throughput/memory measures use the same host (4x A6000 48GB, BF16), batch 4, max length 256 unless otherwise specified. Error bars denote \(\pm\) one std over at least 5 repeated timing windows.

Fair decoding. All methods use the same nucleus sampling (\(p{=}0.9\)), temperature (\(1.0\)) and max tokens (256). Methods that require extra prompts/classifiers use their standard recommended settings from publicly available repos; we do not retune them on test.

8.3 Symmetric Baseline Tuning and Global Correction↩︎

To address tuning asymmetry, we ran a focused Pareto comparison on LLaMA-2-7B / Bias in Bios in which each tunable method is swept and reported at the best operating point before task accuracy drops by more than 5% relative to the unmitigated baseline. We include two reviewer-suggested baselines that are qualitatively different from COFT: a neutral LLM rewrite pre-processor and an ITI-style activation-steering intervention. Table [tab:symmetric-baselines] shows that COFT still gives the strongest bias–utility trade-off under this symmetric protocol.

max width=

Global neutral rewriting helps because it sanitizes the input surface form, but it does not constrain the chain once autoregressive reasoning begins. Activation steering is stronger, but its continuous hidden-state intervention can perturb task reasoning. COFT instead regularizes each next-token choice through masked-branch agreement and conformal filtering, which explains why it reduces bias more while retaining near-baseline accuracy.

8.4 Comprehensive Bias Results: All Six Models \(\times\) Nine Baselines↩︎

Table [tab:A1-llama7b-bias]-Table [tab:A6-qwen2-bias] shows all of the bias results. Metrics: lower is better for SS bias, BBQ biased rate, BOLD toxicity, Utrecht DP, COMPAS gap; higher is better for CP accuracy. The nine baselines: Vanilla, SDD, DExperts, Safety Templates, Detox Decoding, CF Substitution, CDA (train), Adv.LM-Head (train), DT-CD. COFT uses a single \(\lambda\) per model (selected on a validation split) and per-step thresholds \(\tau_t\) from split calibration.

max width=

max width=

max width=

max width=

max width=

max width=

8.5 Full Utility and LM Quality for All Models↩︎

We report utility accuracies (GSM8K, StrategyQA, ARC-easy, PIQA) and LM quality (Wikitext-2 perplexity, MAUVE) in Table [tab:A7-llama7b-utility]–Table [tab:A10-mixtral-qwen-utility].

To complement these token-level and short-form evaluations, we also assess COFT on long-form generation tasks. Specifically, we evaluate LLaMA-2-13B on CNN/DailyMail and GovReport summarization, as well as a LongFormQA setup based on ELI5, measuring ROUGE-L for summarization, F1 for QA, and BOLD-style toxicity on generated outputs. Results in Table 4 show that COFT preserves utility within \(0.6\) absolute points while roughly halving toxicity across all three datasets. In addition, Figure 5 plots MAUVE as we vary the maximum generation length \(T\) on CNN/DailyMail; COFT closely tracks vanilla decoding across lengths, with at most a \(0.01\) gap, indicating no systematic degradation in long-form quality.

max width=

max width=

max width=

max width=

8.6 Efficiency and Scalability: Rigorous Analyses↩︎

We expand the efficiency study with confidence ribbons and log-scaled axes in Figure 6. All points average five repeated timing windows per seed (three seeds). Shaded bands denote \(\pm\) one std over windows. Also Table [tab:A12-moe-mixtral] shows our largest model analysis.

max width=

8.7 Sensitivity & Robustness: \(\lambda\) and \(\alpha\)↩︎

We report per-model* ablations to verify that the selected \(\lambda\) (fusion scale) and \(\alpha\) (split-CP miscoverage) generalize across architectures and datasets. Recall: \(\alpha\) is chosen on a small validation split via the BiasAvg–UtilityAvg Pareto protocol; per-position thresholds \(\tau_t{=}1{-}q_t\) are then computed offline on a disjoint calibration set (no test tuning).*

8.7.1 Model-Wise Ablation of \(\lambda\) and \(\alpha\)↩︎

We sweep \(\lambda\!\in\![0,1]\) and \(\alpha\!\in\!\{0.02,0.05,0.10,0.15,0.20\}\) for each model and dataset family, tracing the \((\text{BiasAvg}\!\downarrow,\;\text{UtilityAvg}\!\uparrow)\) Pareto. We then select the smallest \(\lambda,\alpha\) within 2% of each knee. Figures 7 a–b visualize representative sweeps (bias averaged over SS/CP/BBQ/BOLD/Utrecht/COMPAS; utility averaged over GSM8K/StrategyQA/ARC-easy/PIQA). Table [tab:ablate-summary] summarizes the selected hyperparameters and their effects (means over three seeds).

max width=

8.7.2 Sensitivity of \(\lambda\) and \(\alpha\)↩︎

We use the same validation protocol for both knobs: sweep the value, trace the \((\text{BiasAvg}\!\downarrow,\;\text{UtilityAvg}\!\uparrow)\) Pareto, and pick the smallest value within 2% of the knee (Sec. 4.5). For \(\lambda\), we also compare against a lightweight 1D line search (successive halving) and find near-identical choices. For \(\alpha\), we report the achieved empirical miscoverage (exchangeable hold-out) and the normalized certified set size \(\mathbb{E}[|\mathcal{C}_t|]/V\); the selected \(\alpha\) balances coverage tightness with candidate-set breadth.

8.7.2.1 Cross-Task Stability of \(\lambda\).

The preceding plots show that COFT is robust to a range of fusion scales \(\lambda\) on individual benchmarks. To summarize this behavior across tasks, Table 7 reports the mean \(\lambda^\star\) selected by the Pareto-knee rule and its standard deviation across six fairness datasets and three long-form tasks for each model. The resulting values lie in a narrow band and exhibit low variance, supporting the use of a single model-specific \(\lambda\) across domains.

8.8 Train-Time Baselines (CDA, Adversarial LM-Head): Isolation for Completeness↩︎

Why isolated here. These methods require weight updates and are outside COFT’s inference-only scope; they remain useful reference points. We reuse public hyperparameters to avoid advantage from extensive retuning; results are integrated in Tables [tab:A1-llama7b-bias]–[tab:A6-qwen2-bias].

8.8.0.1 CDA.

One epoch, AdamW (lr=\(1\mathrm{e}{-5}\)), batch 128, no RLHF. Mask/swap spans in balanced counterfactual pairs.

8.8.0.2 Adversarial LM-Head.

Gradient reversal on a sensitive-span proxy at the output layer only; schedule mirrors CDA. We do not alter tokenizer/vocab; inference settings match §8.2.

9 Case Studies↩︎

9.1 How COFT Masks Sensitive Spans in Practice↩︎

9.1.0.1 Setup.

We illustrate how COFT’s masking operator \(M(\cdot)\) behaves on representative items from our bias suites (StereoSet [22], CrowS-Pairs [21], BBQ [23], BOLD [24]), using a single frozen LM (Mistral-7B-Instruct [46]) for concreteness. COFT fuses branch logits stepwise at the same decode step \(t\), which requires the factual and masked branches to remain token-index aligned. We therefore implement \(M\) as a length-preserving edit: every sensitive span in the factual prompt is replaced by a sequence of sentinel tokens of the same tokenized length (rather than collapsing a multi-token span to a single sentinel), ensuring that the two prompts have identical token counts and that prefixes \(w_{<t}\) correspond to the same positions in both branches. The masked span is the demographic marker or proxy cue; downstream labels such as occupations are outputs whose probabilities are regularized, not sensitive attributes to mask by default.

9.1.0.2 Example A (StereoSet; gender).

Factual \(p\): “The nurse finished rounds and then he prepared the reports.”
Masked \(\widetilde{p}\): “The nurse finished rounds and then [MASK] prepared the reports.”

Here the sensitive token is a single-token pronoun, so replacing “he” with one sentinel preserves alignment trivially. COFT’s fusion reduces the impact of gendered cues on next-token probabilities, and the dual-branch conformal filter admits next tokens that remain plausible under both views.

9.1.0.3 Example B (BBQ; race/ethnicity).

Factual \(p\): “Police stopped a Latino driver for a broken taillight. Who likely received a ticket?”
Masked \(\widetilde{p}\): “Police stopped a [MASK] driver for a broken taillight. Who likely received a ticket?”

Replacing “Latino” by a sentinel preserves the local causal framing (traffic stop) while severing the direct lexical link to the protected attribute. More generally, when the protected attribute tokenizes to multiple tokens (e.g., “Middle Eastern”, names, or multiword descriptors), we replace it with the same number of sentinel tokens (e.g., [MASK] [MASK]), so that the two branches remain synchronized and per-step fusion compares logits at the same autoregressive index.

9.1.0.4 Why Sentinel Masking (and Why Length-Preserving)?

Deletion changes token positions (affecting attention; e.g., RoPE/ALiBi), and identity swaps inject a new attribute rather than removing it. Collapsing a multi-token span into a single sentinel would also desynchronize step indices, making \(z_t^{F}\) and \(z_t^{CF}\) incomparable after the edit point. Using a semantics-light sentinel with matched tokenized length preserves alignment at equal prefixes, which is necessary for paired logits and our split-conformal score.

9.1.0.5 Implicit or Pervasive Sensitive Cues.

COFT is strongest when sensitive information is localized in explicit spans (pronouns, racial or religious identifiers, names, or protected-attribute descriptors), which covers many standard fairness benchmarks. For more implicit signals, COFT should be paired with a redaction front end: a lightweight NER model, dictionary, or fast LLM-based detector can mark gender-coded names, familial roles, or correlated socioeconomic phrases, after which the same length-preserving sentinel replacement and dual-branch filtering apply. Thus COFT is a decode-time fairness controller conditioned on aligned masking, not a standalone detector of every latent proxy cue.

9.1.0.6 Quantitative Illustration.

Figure 8 reports (i) SS bias score and (ii) BBQ biased decision rate for factual vs.masked views, and for COFT (fusion+\(\alpha\)-CP). COFT reduces bias beyond masking alone while preserving utility.

9.1.0.7 Sentinel and Span Robustness.

We further study sensitivity to the sentinel string and to moderate noise in detected spans. Table 8 averages results over our fairness benchmarks using three sentinel realizations—[MASK], “a person”, and “someone”—implemented length-preservingly by repeating the chosen sentinel token(s) to match the tokenized span length, and we simulate span noise by randomly dropping 20% of detected spans. We report the average change in task utility (relative to vanilla), toxicity as a percentage of the vanilla rate, and the fraction of decoding steps where the certified set is empty (\(\mathcal{C}_t=\varnothing\)). Across sentinels, behavior is similar: toxicity drops substantially, utility decreases are small, and empty-set events remain rare, indicating that COFT is empirically robust to reasonable sentinel choices and moderate span-identification noise.

9.2 Span Acquisition: Named Entity Recognition (NER) and User-Specified Spans↩︎

9.2.0.1 How Spans Are Obtained.

We support two routes: (i) user-specified lists of sensitive spans \(\mathcal{S}\) (domain/configurable), and (ii) Named Entity Recognition (NER) detectors for protected categories such as PERSON, NORP (nationalities/religions), GPE, etc.[42]. Detected spans are unioned with user lists; overlapping spans are merged to keep the mask operator idempotent and order-preserving (Sec. 3.2).

9.2.0.2 Potential Semantic Drift.

Masking can sometimes remove disambiguating information:

• Ambiguity increase: “The Jewish holiday begins at sundown.” \(\rightarrow\) “The [MASK] holiday…”. Domain-specific meaning (which holiday) becomes ambiguous.

• Coreference strain: “Maria parked. She bought coffee.” \(\rightarrow\) “[MASK] parked. She…”. The antecedent of “She” is weakened.

These cases risk semantic drift between factual and masked views.

9.2.0.3 Robustness Strategies and Diagnostics.

COFT mitigates drift by: (a) keeping word order (and using length-preserving sentinels) to maintain token-index alignment across branches, (b) relying on paired comparisons at identical prefixes, and (c) enforcing dual-branch acceptance (Sec. 3.4) so only tokens plausible in both views are emitted. Empirically, calibration curves track the target \(1{-}\alpha\) level and remain close under adjacent-domain shift; \(\alpha\) ablations show miscoverage near target while the certified set remains sufficiently large (Fig. 7c–d). When drift is anticipated (domain-specific entities), we support whitelisting spans to avoid masking essential terms and soft-masking (sentinel with appositive hints, e.g., “[MASK] (a holiday)”) on private validation, followed by re-calibration.

9.2.0.4 Frequency and Handling of Empty Certified Sets (Consistent Protocol).

A concrete failure mode is when semantic drift or aggressive masking causes the certified set \(\mathcal{C}_t\) to be empty. In COFT, the default implementation used in our experiments resolves \(\mathcal{C}_t=\varnothing\) with a deterministic argmax fallback on the fused distribution \(\widehat{\pi}_t\) to guarantee forward progress.³ This fallback is outside the certified set by definition and therefore the emitted-token “soundness” statements apply only on the event \(\mathcal{C}_t\neq\varnothing\) (as stated in §7.14).

Table 9 quantifies how often empty-set events occur and how harmful argmax fallbacks are in practice. Across CrowS-Pairs, BBQ, BOLD, and LongFormQA, fewer than \(1\%\) of prompts and decoding steps have \(\mathcal{C}_t=\varnothing\), and only a small fraction of fallback tokens are flagged as toxic by an external detector. Their contribution to aggregate bias metrics is negligible relative to COFT’s main effect. In practice, slight relaxations of the conformal thresholds or softer sentinels can further reduce empty-set events without materially changing marginal coverage.

9.2.0.5 When User Spans Disagree With NER.

User lists take precedence (safety & policy reasons). The union is still calibrated jointly; because split-CP thresholds are learned offline, any increase in variance from broader masking manifests as slightly larger candidate sets or more conservative \(\tau_t\), both captured by validation and calibration metrics.

9.3 Full Procedure Examples↩︎

9.3.0.1 Example A (StereoSet; gender).

Factual \(p\): “The nurse finished rounds and then he prepared the reports”
Masked \(\widetilde{p}\): “The nurse finished rounds and then [MASK] prepared the reports”

Step \(t\): token after “reports”. We show the top-6 next-token probabilities (others omitted, Table 10). Calibrated threshold: \(\tau_t{=}0.06\); fusion scale: \(\lambda{=}0.6\).

Certification. \(\mathcal{C}_t=\{v:\min(\widehat{\pi}_t(v),\pi^{CF}_t(v))\ge 0.06\}\). \[\begin{adjustbox}{max width=\textwidth} \begin{align} \min(\texttt{.}) &= \min(0.47,0.52) = 0.47\;(✔), \quad \min(\texttt{\;and}) &= \min(0.19,0.16) = 0.16\;(✔),\\ \min(\texttt{\;before}) &= \min(0.06,0.05) = 0.05\;(\times), \quad \min(\texttt{< eos>}) &= \min(0.08,0.09) = 0.08\;(✔),\\ \min(\texttt{,}) &= \min(0.06,0.07) = 0.06\;(✔), \quad \min(\texttt{\;because}) &= \min(0.02,0.02) = 0.02\;(\times) \end{align}\end{adjustbox}\] Thus \(\mathcal{C}_t=\{\texttt{.},\;\texttt{\;and},\;\texttt{< eos>},\;\texttt{,}\}\).

Selection. We sample from \(\widehat{\pi}_t\) restricted to \(\mathcal{C}_t\) (renormalized). Greedy picks . (highest certified mass), so COFT ends the sentence here. Vanilla often also ends here; the key differences emerge if the model continues. To illustrate that case, suppose we (greedily) select and instead; then COFT applies the same procedure at \(t{+}1\).

Propagation to later steps (if continuation is chosen). After “…reportsand”, vanilla tends to continue with a gendered pronoun; COFT’s fusion+certification steers toward neutral options (Table 11).

Certification at \(t{+}1\). With \(\tau_{t+1}{=}0.06\), tokens they, the, and then are certified; he fails if \(\pi^{CF}_{t+1}{<}0.06\) (here \(0.09\), so it passes but has lower \(\widehat{\pi}\)), while she sits at the threshold. Sampling from the certified set typically favors they.

Final answer fragments (changed tokens in bold).

Vanilla: “…reports and he filed his notes.”
COFT: “…reports and they filed their notes.”

9.3.0.2 Example B (BBQ; race/ethnicity).

Factual \(p\): “Police stopped a Latino driver for a broken taillight. Who likely received a ticket?”
Masked \(\widetilde{p}\): “Police stopped a [MASK] driver for a broken taillight. Who likely received a ticket?”

Step \(t\): first content token of the short answer. Here the factual branch leans toward identity-marked attributions; the masked branch favors neutral referents (Table 12). We use \(\tau_t{=}0.06\), \(\lambda{=}0.6\).

Certification. \[\begin{adjustbox}{max width=\textwidth} \begin{align} \min(\texttt{the\_Latino\_driver}) &= \min(0.12,0.05) = 0.05\;(\times), \quad \min(\texttt{the\_driver}) &= \min(0.29,0.34) = 0.29\;(✔), \\ \min(\texttt{no\_one}) &= \min(0.13,0.15) = 0.13\;(✔), \quad \min(\texttt{the\_officer}) &= \min(0.07,0.08) = 0.07\;(✔), \\ \min(\texttt{the\_other\_car}) &= \min(0.06,0.07) = 0.06\;(✔), \quad \min(\texttt{the\_pedestrian}) &= \min(0.04,0.05) = 0.04\;(\times) \end{align}\end{adjustbox}\] Thus \(\mathcal{C}_t=\{\texttt{the\_driver},\texttt{no\_one},\texttt{the\_officer},\texttt{the\_other\_car}\}\) and the_Latino_driver is excluded.

Selection. Greedy COFT picks the_driver (0.29). Vanilla would answer with the_Latino_driver.

Follow-up tokens and framing. For explanatory continuations, vanilla often follows with causal attributions keyed to the protected attribute (e.g., “because he looked suspicious”). The masked branch suppresses that cue, and after fusion the top explanations shift toward traffic-cause features (“because of the broken taillight” / “routine equipment violation”). With \(\tau_{t+1}{=}0.06\), tokens like because_he may fail certification due to low \(\pi^{CF}\), while because_of_the_broken_taillight pass.

Final answer fragments (changed tokens in bold).

Vanilla: “…the Latino driver, because he looked suspicious.”
COFT: “…the driver, likely due to the broken taillight.”

9.4 Beyond Tokens: Sequence-Level, Multi-Attribute Extensions, and Proof Sketches↩︎

9.4.0.1 Sequence-Level Certification.

COFT’s main guarantees are token-level (per-step). For sequences, define a sequence score \(S(w_{1:T})=\max_{t\le T} s_t(w_t)\) using the same stepwise \(s_t(\cdot)\) as in equation 6 . Split calibration on \(S\) (with fixed decode policy) yields a threshold \(Q\) such that the certified set \(\{w_{1:T}: S(w_{1:T})\le Q\}\) has marginal coverage \(\ge 1{-}\alpha\) (exchangeability at the sequence level). In practice, we maintain the efficient per-step certification and apply a union bound to obtain a conservative sequence guarantee \(1{-}T\alpha\) (Theorem 4), or tighten it by calibrating \(S\) directly on sampled rollouts from the fixed policy.

9.4.0.2 Adapting Proofs.

The sequence-level variant reuses (i) the geometric-mixture identity (log-odds interpolation) and (ii) the conformal rank argument. The only change is the definition of the nonconformity: from \(s_t(\cdot)\) to \(S(\cdot)\), and exchangeability is asserted at the trajectory level given a fixed decoding policy (no temperature changes between calibration/deployment).

9.4.0.3 Multi-Attribute Bias.

Let \(\mathcal{S}=\mathcal{S}_1\cup\dots\cup\mathcal{S}_K\) be \(K\) protected-attribute families (e.g., gender, race, religion). We consider two masking operators:

• Joint mask \(M_{\mathrm{joint}}\): replace all spans in \(\mathcal{S}\) by a single sentinel, producing one masked branch.

• Factorized masks \(M_k\): replace only spans in \(\mathcal{S}_k\) (one branch per \(k\)), then intersect certificates across \(k\).

Both are compatible with COFT. Efficiency trade-off: \(M_{\mathrm{joint}}\) adds only a single masked branch (overhead comparable to the single-attribute setting), whereas the factorized variant adds \(K\) masked branches and thus incurs approximately \(K\times\) the masking-side compute in the naïve implementation (modulo batching/parallelism), while yielding per-attribute certificates that can tighten fairness but may shrink the candidate set. In our overhead tables, we report COFT-joint for \(M_{\mathrm{joint}}\) and COFT-factorized for \(\{M_k\}_{k=1}^K\) to avoid label/definition ambiguity; Table [tab:lift] summarizes how our main statements lift in these settings.

max width=

9.4.0.4 Empirical Intersectional Case Study.

To complement these lifted guarantees, we evaluate COFT on an intersectional variant of BBQ with gender \(\times\) race attributes and compare three strategies: COFT-Single (mask one attribute at a time), COFT-Joint (one mask spanning all attributes), and COFT-Factorized (attribute-wise masks with intersected certificates). Table 13 reports bias advantage (lower is better), QA accuracy, and decoding overhead relative to vanilla. COFT-Single yields the weakest fairness gains, COFT-Joint gives the best bias reduction at essentially single-branch cost, and COFT-Factorized is slightly more conservative and more expensive because it maintains separate per-attribute certificates.

9.4.0.5 Notes on Efficiency and Practice.

Factorized masking multiplies forward passes by \(K\); in practice we use joint masking as the default and reserve factorized certificates for audits or high-stakes attributes. When using factorized masks, we budget miscoverage as \(\alpha=\sum_{k=1}^K \alpha_k\) and calibrate per-attribute thresholds offline, then intersect at test time.

9.4.0.6 Illustrative Sequence-Level Curve.

In figure 9 we visualize empirical miscoverage of \(S=\max_t s_t\) against the target \(\alpha\) for LLaMA-2-13B at fixed decoding policy; coverage tracks the target with mild conservativeness.

9.5 Coverage and Fairness Under Prompt Drift↩︎

Our theoretical guarantees rely on exchangeability between calibration and test contexts. Under covariate shift with density-ratio upper bound \(\rho\), Theorem 5 gives test coverage at least \(1-\rho\alpha\), so moderate shifts only mildly inflate the nominal error. To validate this, we calibrate COFT for LLaMA-2-13B on an in-distribution prompt set and test on two drifted sets: a style-shifted set (different register) and a topic-shifted set. Table 14 shows empirical coverage for target \(1-\alpha=0.9\), an estimate of the maximum density ratio, and the demographic parity gap. Coverage remains close to the nominal level and fairness gains degrade only slightly, suggesting that COFT’s guarantees and bias reductions are robust to realistic prompt drift.

10 Limitations and Extensions↩︎

COFT provides per-step, token-level guarantees via split conformal prediction (CP). These are marginal in time: for long generations, the naive union bound over tokens can be loose, and we do not claim tight sequence-level validity in that regime. When sequence-level control is needed, one can instead calibrate a rollout score \(S(w_{1:T})\) as in App. 9.4, trading tighter coverage for additional computation.

All guarantees rely on exchangeability between calibration and deployment prompts. Under covariate shift, coverage degrades smoothly with the density ratio \(\rho\) (Thm. 5); in practice we recommend drift monitoring with periodic re-calibration or shift-aware CP when the distribution changes. COFT assumes logit access to a frozen LM, which is standard for open-weight models and many research APIs but not universal for all closed-source systems.

Masking is a strong intervention: sentinel tokens can remove disambiguating context or strain coreference. We mitigate this by preserving order, using paired factual/masked prefixes, and admitting only tokens supported in both views; App. 9.1 and App. 9.2 show that empty certified sets are rare and that alternative sentinels (e.g., “[MASK]”, “a person”) and moderate span noise change utility and bias only slightly. Nonetheless, highly entity-critical prompts may still shrink candidate sets, motivating soft/typed masking and span whitelists with re-calibration.

Span acquisition currently relies on user-specified lists and NER detectors; false positives or negatives shift the fairness target and can miss proxy cues or adversarial paraphrases. Extending detection to richer proxy models, while still wrapping the resulting spans in CP, is a natural next step. Computationally, COFT adds one masked forward pass per step but reuses the KV-cache; measured overheads are \(\approx 10\)–\(25\%\) on dense LMs and similar on MoE models (App. 8.6), which may still require engineering for ultra-low-latency settings.

Hyperparameters are chosen without test-time tuning: we select \((\lambda,\alpha)\) on validation via a Pareto knee rule and calibrate quantiles offline; App. 8.7.2 shows that the chosen \(\lambda\) is stable across tasks for a given model. Very tight utility budgets may prefer attribute- or task-specific choices of \(\{\lambda,\alpha\}\). Extensions include adaptive, context-aware fusion scales with global coverage control; importance-weighted or conditional CP to reduce conservativeness under drift; calibrated sequence-level control via rollout scores or conformal risk; and multi-attribute fairness with per-attribute \(\alpha_k\) and intersection certificates (App. 9.4).

COFT is most appropriate when the reasoning trace itself must be auditable, such as healthcare, legal, financial, or hiring-related decision support. For low-stakes high-volume applications, a surface-level rewrite or post-hoc filter may be cheaper and sufficient; COFT trades modest additional batched compute for online control of biased intermediate reasoning steps.

11 Code Availability↩︎

The reference implementation and code for reproducing COFT are available at https://github.com/AryaFayyazi/CoFT.

References↩︎

---

1. In practice, any tokenizer-stable, semantics-light sentinel is acceptable; its role is structural neutrality, not cloze semantics.↩︎

2. The modest overhead stems from batched execution and fused kernels rather than full end-to-end KV-cache reuse.↩︎

3. Alternative safe fallbacks (e.g., abstention, template-based continuations, or constrained decoding) are compatible with COFT but were not the default protocol in the experiments reported in this appendix; whenever we report toxicity of fallback tokens, it refers to the argmax fallback on \(\widehat{\pi}_t\).↩︎