Auditing large language models: a three-layered approach
Not on the map. Why?
Abstract (arXiv)
Large language models (LLMs) represent a major advance in artificial intelligence (AI) research. However, the widespread use of LLMs is also coupled with significant ethical and social challenges. Previous research has pointed towards auditing as a promising governance mechanism to help ensure that AI systems are designed and deployed in ways that are ethical, legal, and technically robust. However, existing auditing procedures fail to address the governance challenges posed by LLMs, which display emergent capabilities and are adaptable to a wide range of downstream tasks. In this article, we address that gap by outlining a novel blueprint for how to audit LLMs. Specifically, we propose a three-layered approach, whereby governance audits (of technology providers that design and disseminate LLMs), model audits (of LLMs after pre-training but prior to their release), and application audits (of applications based on LLMs) complement and inform each other. We show how audits, when conducted in a structured and coordinated manner on all three levels, can be a feasible and effective mechanism for identifying and managing some of the ethical and social risks posed by LLMs. However, it is important to remain realistic about what auditing can reasonably be expected to achieve. Therefore, we discuss the limitations not only of our three-layered approach but also of the prospect of auditing LLMs at all. Ultimately, this article seeks to expand the methodological toolkit available to technology providers and policymakers who wish to analyse and evaluate LLMs from technical, ethical, and legal perspectives.
Key facts. Cited by 135 papers in the map (data through 7 Oct 2026). Builds on 127 of its 294 references that are in the map. First posted on arXiv 16 Feb 2023.
Builds on
127 of 294 references.
References · 127
- 2017Attention Is All You Needcited by 59,932
- 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
- 2020Language Models are Few-Shot Learnerscited by 32,199
- 2022Training language models to follow instructions with human feedbackcited by 15,712
- 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
- 2021Evaluating Large Language Models Trained on Codecited by 8,053
- 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,539
- 2020Scaling Laws for Neural Language Modelscited by 6,411
- 2022PaLM: Scaling Language Modeling with Pathwayscited by 5,304
- 2018GLUE: A Multi-Task Benchmark and Analysis Platform for Natural Language Understandingcited by 4,854
- 2022Flamingo: a Visual Language Model for Few-Shot Learningcited by 4,337
- 2022Large Language Models are Zero-Shot Reasonerscited by 4,323
38 more
- 2021On the Opportunities and Risks of Foundation Modelscited by 3,961
- 2017Deep reinforcement learning from human preferencescited by 3,846
- 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,634
- 2022OPT: Open Pre-trained Transformer Language Modelscited by 3,464
- 2022Training Compute-Optimal Large Language Modelscited by 2,927
- 2021TruthfulQA: Measuring How Models Mimic Human Falsehoodscited by 2,919
- 2020Learning to summarize from human feedbackcited by 2,562
- 2022Emergent Abilities of Large Language Modelscited by 2,483
- 2020Extracting Training Data from Large Language Modelscited by 2,144
- 2022Beyond the Imitation Game: Quantifying and extrapolating the capabilities of language modelscited by 1,970
- 2019A Survey on Bias and Fairness in Machine Learningcited by 1,911
- 2022Challenging BIG-Bench Tasks and Whether Chain-of-Thought Can Solve Themcited by 1,767
- 2019SuperGLUE: A Stickier Benchmark for General-Purpose Language Understanding Systemscited by 1,718
- 2020Don't Stop Pretraining: Adapt Language Models to Domains and Taskscited by 1,548
- 2022Rethinking the Role of Demonstrations: What Makes In-Context Learning Work?cited by 1,413
- 2018Datasheets for Datasetscited by 1,371
- 2020RealToxicityPrompts: Evaluating Neural Toxic Degeneration in Language Modelscited by 1,235
- 2022LaMDA: Language Models for Dialog Applicationscited by 1,218
- 2021Scaling Language Models: Methods, Analysis & Insights from Training Gophercited by 1,199
- 2018Model Cards for Model Reportingcited by 1,068
- 2022Red Teaming Language Models with Language Modelscited by 983
- 2021Ethical and social risks of harm from Language Modelscited by 957
- 2020Language (Technology) is Power: A Critical Survey of "Bias" in NLPcited by 951
- 2020StereoSet: Measuring stereotypical bias in pretrained language modelscited by 911
- 2016Semantics derived automatically from language corpora contain human-like biasescited by 894
- 2021CodeT5: Identifier-aware Unified Pre-trained Encoder-Decoder Models for Code Understanding and Generationcited by 890
- 2018The Secret Sharer: Evaluating and Testing Unintended Memorization in Neural Networkscited by 847
- 2017Counterfactual Fairnesscited by 802
- 2019Adversarial NLI: A New Benchmark for Natural Language Understandingcited by 798
- 2020CrowS-Pairs: A Challenge Dataset for Measuring Social Biases in Masked Language Modelscited by 703
- 2022Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learnedcited by 702
- 2023A Watermark for Large Language Modelscited by 667
- 2021Prompt Programming for Large Language Models: Beyond the Few-Shot Paradigmcited by 599
- 2019The Woman Worked as a Babysitter: On Biases in Language Generationcited by 540
- 2020BERT-ATTACK: Adversarial Attack Against BERT Using BERTcited by 488
- 2021Documenting Large Webtext Corpora: A Case Study on the Colossal Clean Crawled Corpuscited by 481
- 2020Towards a Human-like Open-Domain Chatbotcited by 467
- 2021Dynabench: Rethinking Benchmarking in NLPcited by 447
50 most cited of 127 All 127 (JSON)
Built on by
Citing papers per year: 2023: 35; 2024: 40; 2025: 28; 2026: 32.
135 papers.
Sort:
By area:
- 2023Open Problems and Fundamental Limitations of Reinforcement Learning from Human Feedbackcited by 743
- 2023A Comprehensive Overview of Large Language Modelscited by 639
- 2023Model evaluation for extreme riskscited by 167
- 2023Personality Traits in Large Language Modelscited by 166
- 2023A Survey of Large Language Models in Medicine: Progress, Application, and Challengecited by 123
- 2024Black-Box Access is Insufficient for Rigorous AI Auditscited by 123
- 2023AI Transparency in the Age of LLMs: A Human-Centered Research Roadmapcited by 119
- 2023Frontier AI Regulation: Managing Emerging Risks to Public Safetycited by 95
- 2023Personalisation within bounds: A risk taxonomy and policy framework for the alignment of large language models with personalised feedbackcited by 86
- 2024Visibility into AI Agentscited by 77
- 2024Nicer Than Humans: How do Large Language Models Behave in the Prisoner's Dilemma?cited by 62
- 2023Do LLMs Possess a Personality? Making the MBTI Test an Amazing Evaluation for Large Language Modelscited by 54
38 more
- 2025A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasurescited by 54
- 2024Language Models Resist Alignment: Evidence From Data Compressioncited by 50
- 2023Managing extreme AI risks amid rapid progresscited by 48
- 2023Training Data Extraction From Pre-trained Language Models: A Surveycited by 43
- 2025Multilingual != Multicultural: Evaluating Gaps Between Multilingual Capabilities and Cultural Alignment in LLMscited by 39
- 2024Logits of API-Protected LLMs Leak Proprietary Informationcited by 38
- 2023SoK: Memorization in General-Purpose Large Language Modelscited by 36
- 2024Automatic Pseudo-Harmful Prompt Generation for Evaluating False Refusals in Large Language Modelscited by 35
- 2023Using Large Language Models to Generate, Validate, and Apply User Intent Taxonomiescited by 34
- 2024Accelerating Greedy Coordinate Gradient and General Prompt Optimization via Probe Samplingcited by 33
- 2023Open-Sourcing Highly Capable Foundation Models: An evaluation of risks, benefits, and alternative methods for pursuing open-source objectivescited by 31
- 2023Assessing Language Model Deployment with Risk Cardscited by 30
- 2024Navigating LLM Ethics: Advancements, Challenges, and Future Directionscited by 28
- 2025Exploring the Roles of Large Language Models in Reshaping Transportation Systems: A Survey, Framework, and Roadmapcited by 26
- 2023Accuracy and Political Bias of News Source Credibility Ratings by Large Language Modelscited by 25
- 2024Causality for Large Language Modelscited by 24
- 2024The Model Openness Framework: Promoting Completeness and Openness for Reproducibility, Transparency, and Usability in Artificial Intelligencecited by 21
- 2024Towards Trustworthy AI: A Review of Ethical and Robust Large Language Modelscited by 21
- 2023Bias and Fairness in Chatbots: An Overviewcited by 20
- 2024LLM-Assisted Crisis Management: Building Advanced LLM Platforms for Effective Emergency Response and Public Collaborationcited by 20
- 2024Adversarial Nibbler: An Open Red-Teaming Method for Identifying Diverse Harms in Text-to-Image Generationcited by 20
- 2023Trustworthy and Synergistic Artificial Intelligence for Software Engineering: Vision and Roadmapscited by 19
- 2024Mapping the Ethics of Generative AI: A Comprehensive Scoping Reviewcited by 19
- 2024Holistic Safety and Responsibility Evaluations of Advanced AI Modelscited by 18
- 2024The Open Source Advantage in Large Language Models (LLMs)cited by 18
- 2023Rethinking Large Language Models in Mental Health Applicationscited by 16
- 2023Challenges of Large Language Models for Mental Health Counselingcited by 16
- 2026Auditable Agentscited by 14
- 2023Auditing and Generating Synthetic Data with Controllable Trust Trade-offscited by 13
- 2024Near to Mid-term Risks and Opportunities of Open-Source Generative AIcited by 13
- 2024Swiss Cheese Model for AI Safety: A Taxonomy and Reference Architecture for Multi-Layered Guardrails of Foundation Model Based Agentscited by 13
- 2023Can ChatGPT Perform Reasoning Using the IRAC Method in Analyzing Legal Scenarios Like a Lawyer?cited by 12
- 2024From Prompt Engineering to Prompt Science With Human in the Loopcited by 12
- 2023Towards Publicly Accountable Frontier LLMs: Building an External Scrutiny Ecosystem under the ASPIRE Frameworkcited by 11
- 2024AuditLLM: A Tool for Auditing Large Language Models Using Multiprobe Approachcited by 11
- 2024Risks and Opportunities of Open-Source Generative AIcited by 11
- 2023Decolonial AI Alignment: Openness, Vi'sedsa-Dharma, and Including Excluded Knowledgescited by 10
- 2024Responsible Reporting for Frontier AI Developmentcited by 10
50 most cited of 135 All 135 (JSON)
- 2026Who Audits Whom, on What Substrate, with What Evidence? An Independence-Graded Audit Protocol for Agentic AI16 Sep 2026
- 2026Causal Evidentiary Governance for High-Risk Machine Learning Systems1 Sep 2026
- 2026LAAF: A Layered Accountability Architecture Framework for LLM Applications27 Aug 2026
- 2026On the missing benchmarks layer and a potential solution4 Aug 2026
- 2026Scaling, Lock-In, and Proxy Compliance: A Political Economy of Responsible AI30 Jul 2026
- 2026Post-Training at the Edge of Detectability: A Game-Theoretic Approach to Fine-Tuning29 Jul 2026
- 2026HindsightBench: A Black-Box Behavioral Audit Protocol for Parametric Hindsight in Time-Indexed LLM Decision Tasks21 Jul 2026
- 2026Governing Well in the Algorithmic Age: The Foundations of Digital Statecraft20 Jul 2026
- 2026Traccia: An OpenTelemetry-Based Governance Platform for AI Systems15 Jul 2026
- 2026From Stochastic to Stable: Rank Stability and Structural Sufficiency in AI Visibility Measurement11 Jul 2026
- 2026From Prompts to Contracts: Harness Engineering for Auditable Enterprise LLM Agents9 Jul 2026
- 2026Black-Box Inference of LLM Architectural Properties with Restrictive API Access1 Jul 2026
38 more
- 2026Mod-Guide: An LLM-based Content Moderation Feedback System to Address Insensitive Speech toward Indigenous Ethnic and Religious Minority Communities11 Jun 2026
- 2026Parthenon Law: A Self-Evolving Legal-Agent Framework3 Jun 2026
- 2026From Control Boundary to Insurance Claim: Reconstructing AI-Mediated Losses Through the CER Framework2 Jun 2026
- 2026Position: Generative Engine Optimization Creates Underexamined Risks, Governance Must Target Concentration, Disclosure, and Academic Blind Spots18 May 2026
- 2026Formal Methods Meet LLMs: Auditing, Monitoring, and Intervention for Compliance of Advanced AI Systems15 May 2026
- 2026Position: Behavioural Assurance Cannot Verify the Safety Claims Governance Now Demands14 May 2026
- 2026NeurIPS Should Require Reproducibility Standards for Frontier AI Safety Claims5 May 2026
- 2026Spontaneous Persuasion: An Audit of Model Persuasiveness in Everyday Conversations23 Apr 2026
- 2026High-Risk AI Systems and the Problem of Identity in the European AI Act17 Apr 2026
- 2026Post-Deployment Accountability in AI Governance: A Cross-Regulatory Empirical Analysis of AI Incidents10 Apr 2026
- 2026Auditable Agents7 Apr 2026
- 2026Cognitive Agency Surrender: Defending Epistemic Sovereignty via Scaffolded AI Friction23 Mar 2026
- 2026Trustworthy AI Posture (TAIP): A Framework for Continuous AI Assurance of Agentic Systems at Horizontal and Vertical scale15 Feb 2026
- 2026Framing Instability in LLM Ethical Stance: Auditing Negation Sensitivity in Moral Dilemmas29 Jan 2026
- 2026Agent Benchmarks Fail Public Sector Requirements28 Jan 2026
- 2026White-Box Sensitivity Auditing with Steering Vectors23 Jan 2026
- 2026The Fake Friend Dilemma: Relational Trust and the Political Economy of Conversational AI6 Jan 2026
- 2026Audit Me If You Can: Query-Efficient Active Fairness Auditing of Black-Box LLMs6 Jan 2026
- 2026Refinement Provenance Inference: Detecting LLM-Refined Training Prompts from Model Behavior5 Jan 2026
- 2026Mapping Human Anti-collusion Mechanisms to Multi-agent AI Systems1 Jan 2026
- 2025Evaluation of AI Ethics Tools in Language Models: A Developers' Perspective Case Study16 Dec 2025
- 2025Towards AI epidemiology: a measurement standardisation framework for prospective risk detection15 Dec 2025
- 2025Provably Safe Model Updates1 Dec 2025
- 2025All You Need is One: Capsule Prompt Tuning with a Single Vector19 Oct 2025
- 2025Red-Bandit: Test-Time Adaptation for LLM Red-Teaming via Bandit-Guided LoRA Experts8 Oct 2025
- 2025Cost Efficient Fairness Audit Under Partial Feedback4 Oct 2025
- 2025Emergent evaluation hubs in a decentralizing large language model ecosystem30 Sep 2025
- 2025Optimizing Privacy-Preserving Primitives to Support LLM-Scale Applications29 Sep 2025
- 2025A five-layer framework for AI governance: integrating regulation, standards, and certification14 Sep 2025
- 2025Getting In Contract with Large Language Models -- An Agency Theory Perspective On Large Language Model Alignment9 Sep 2025
- 2025Embodied AI: Emerging Risks and Opportunities for Policy Action28 Aug 2025
- 2025Attestable Audits: Verifiable AI Safety Benchmarks Using Trusted Execution Environments30 Jun 2025
- 2025A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures24 Jun 2025
- 2025A Conceptual Framework for AI Capability Evaluations23 Jun 2025
- 2025Alignment Quality Index (AQI) : Beyond Refusals: AQI as an Intrinsic Alignment Diagnostic via Latent Geometry, Cluster Divergence, and Layer wise Pooled Representations16 Jun 2025
- 2025Malicious LLM-Based Conversational AI Makes Users Reveal Personal Information13 Jun 2025
- 2025How do datasets, developers, and models affect biases in a low-resourced language?: The Case of the Bengali Language7 Jun 2025
- 2025Oversight Structures for Agentic AI in Public-Sector Organizations5 Jun 2025
50 newest of 135 All 135 (JSON)
- 2025A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasurescited by 54
- 2026Auditable Agentscited by 14
- 2024Swiss Cheese Model for AI Safety: A Taxonomy and Reference Architecture for Multi-Layered Guardrails of Foundation Model Based Agentscited by 13
- 2025Towards Adaptive Categories: Dimensional Governance for Agentic AIcited by 3
- 2026From Prompts to Contracts: Harness Engineering for Auditable Enterprise LLM Agentscited by 3
- 2026Agent Benchmarks Fail Public Sector Requirementscited by 2
- 2026Trustworthy AI Posture (TAIP): A Framework for Continuous AI Assurance of Agentic Systems at Horizontal and Vertical scalecited by 1
- 2026Parthenon Law: A Self-Evolving Legal-Agent Frameworkcited by 1
- 2026From Control Boundary to Insurance Claim: Reconstructing AI-Mediated Losses Through the CER Frameworkcited by 0
- 2026Who Audits Whom, on What Substrate, with What Evidence? An Independence-Graded Audit Protocol for Agentic AIcited by 0
- 2026Who Audits Whom, on What Substrate, with What Evidence? An Independence-Graded Audit Protocol for Agentic AI16 Sep 2026
- 2026From Prompts to Contracts: Harness Engineering for Auditable Enterprise LLM Agents9 Jul 2026
- 2026Parthenon Law: A Self-Evolving Legal-Agent Framework3 Jun 2026
- 2026From Control Boundary to Insurance Claim: Reconstructing AI-Mediated Losses Through the CER Framework2 Jun 2026
- 2026Auditable Agents7 Apr 2026
- 2026Trustworthy AI Posture (TAIP): A Framework for Continuous AI Assurance of Agentic Systems at Horizontal and Vertical scale15 Feb 2026
- 2026Agent Benchmarks Fail Public Sector Requirements28 Jan 2026
- 2025A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasures24 Jun 2025
- 2025Towards Adaptive Categories: Dimensional Governance for Agentic AI16 May 2025
- 2024Swiss Cheese Model for AI Safety: A Taxonomy and Reference Architecture for Multi-Layered Guardrails of Foundation Model Based Agents5 Aug 2024
- 2023Open Problems and Fundamental Limitations of Reinforcement Learning from Human Feedbackcited by 743
- 2023Personalisation within bounds: A risk taxonomy and policy framework for the alignment of large language models with personalised feedbackcited by 86
- 2024Automatic Pseudo-Harmful Prompt Generation for Evaluating False Refusals in Large Language Modelscited by 35
- 2024More RLHF, More Trust? On The Impact of Preference Alignment On Trustworthinesscited by 9
- 2025Alignment Quality Index (AQI) : Beyond Refusals: AQI as an Intrinsic Alignment Diagnostic via Latent Geometry, Cluster Divergence, and Layer wise Pooled Representationscited by 7
- 2025Getting In Contract with Large Language Models -- An Agency Theory Perspective On Large Language Model Alignmentcited by 0
- 2025Getting In Contract with Large Language Models -- An Agency Theory Perspective On Large Language Model Alignment9 Sep 2025
- 2025Alignment Quality Index (AQI) : Beyond Refusals: AQI as an Intrinsic Alignment Diagnostic via Latent Geometry, Cluster Divergence, and Layer wise Pooled Representations16 Jun 2025
- 2024Automatic Pseudo-Harmful Prompt Generation for Evaluating False Refusals in Large Language Models1 Sep 2024
- 2024More RLHF, More Trust? On The Impact of Preference Alignment On Trustworthiness29 Apr 2024
- 2023Open Problems and Fundamental Limitations of Reinforcement Learning from Human Feedback27 Jul 2023
- 2023Personalisation within bounds: A risk taxonomy and policy framework for the alignment of large language models with personalised feedback9 Mar 2023
- 2024Accelerating Greedy Coordinate Gradient and General Prompt Optimization via Probe Samplingcited by 33
- 2024Adversarial Nibbler: An Open Red-Teaming Method for Identifying Diverse Harms in Text-to-Image Generationcited by 20
- 2025Red-Bandit: Test-Time Adaptation for LLM Red-Teaming via Bandit-Guided LoRA Expertscited by 3
- 2024JailbreakHunter: A Visual Analytics Approach for Jailbreak Prompts Discovery from Large-Scale Human-LLM Conversational Datasetscited by 1
- 2025Red-Bandit: Test-Time Adaptation for LLM Red-Teaming via Bandit-Guided LoRA Experts8 Oct 2025
- 2024JailbreakHunter: A Visual Analytics Approach for Jailbreak Prompts Discovery from Large-Scale Human-LLM Conversational Datasets3 Jul 2024
- 2024Accelerating Greedy Coordinate Gradient and General Prompt Optimization via Probe Sampling2 Mar 2024
- 2024Adversarial Nibbler: An Open Red-Teaming Method for Identifying Diverse Harms in Text-to-Image Generation14 Feb 2024
- 2023A Comprehensive Overview of Large Language Modelscited by 639
- 2023Model evaluation for extreme riskscited by 167
- 2023Personality Traits in Large Language Modelscited by 166
- 2023A Survey of Large Language Models in Medicine: Progress, Application, and Challengecited by 123
- 2024Black-Box Access is Insufficient for Rigorous AI Auditscited by 123
- 2023AI Transparency in the Age of LLMs: A Human-Centered Research Roadmapcited by 119
- 2023Frontier AI Regulation: Managing Emerging Risks to Public Safetycited by 95
- 2024Visibility into AI Agentscited by 77
- 2024Nicer Than Humans: How do Large Language Models Behave in the Prisoner's Dilemma?cited by 62
- 2023Do LLMs Possess a Personality? Making the MBTI Test an Amazing Evaluation for Large Language Modelscited by 54
- 2024Language Models Resist Alignment: Evidence From Data Compressioncited by 50
- 2023Managing extreme AI risks amid rapid progresscited by 48
12 most cited of 113 All 113 (JSON)
- 2026Causal Evidentiary Governance for High-Risk Machine Learning Systems1 Sep 2026
- 2026LAAF: A Layered Accountability Architecture Framework for LLM Applications27 Aug 2026
- 2026On the missing benchmarks layer and a potential solution4 Aug 2026
- 2026Scaling, Lock-In, and Proxy Compliance: A Political Economy of Responsible AI30 Jul 2026
- 2026Post-Training at the Edge of Detectability: A Game-Theoretic Approach to Fine-Tuning29 Jul 2026
- 2026HindsightBench: A Black-Box Behavioral Audit Protocol for Parametric Hindsight in Time-Indexed LLM Decision Tasks21 Jul 2026
- 2026Governing Well in the Algorithmic Age: The Foundations of Digital Statecraft20 Jul 2026
- 2026Traccia: An OpenTelemetry-Based Governance Platform for AI Systems15 Jul 2026
- 2026From Stochastic to Stable: Rank Stability and Structural Sufficiency in AI Visibility Measurement11 Jul 2026
- 2026Black-Box Inference of LLM Architectural Properties with Restrictive API Access1 Jul 2026
- 2026Mod-Guide: An LLM-based Content Moderation Feedback System to Address Insensitive Speech toward Indigenous Ethnic and Religious Minority Communities11 Jun 2026
- 2026Position: Generative Engine Optimization Creates Underexamined Risks, Governance Must Target Concentration, Disclosure, and Academic Blind Spots18 May 2026
12 newest of 113 All 113 (JSON)