B.A.I.L.I.F.F.

Bias Analysis in Interactive Legal Intelligence & Fairness Framework

By Luke Blommesteyn, Nathan Chiu, Gary Yi, Hassan Al-Nasih, Ronit Longia and Noah Kostesku (Western University) • Best Paper, CUCAI 2026 • Code

Picture two defendants. Same facts, same witness, same charge, same legal standard. The only thing that differs is the name on the docket. In a fair system, swapping the name should change nothing: not the verdict, and not how the trial goes.

Most audits of legal AI check the first part. They look at verdicts in aggregate and ask whether conviction rates line up across groups. We wanted to check the second part too, because a system can hand down verdicts that look fair while running a trial that is not. We called that gap the fairness veneer, and B.A.I.L.I.F.F. is the tool we built to look under it.

Why the trial matters, not only the verdict

Language models are already used for legal drafting and case-outcome support, and legal AI is classed as high-risk under the EU AI Act. There is also a long record, going back to the Bertrand and Mullainathan resume study, of names alone triggering different treatment when the underlying conduct is held fixed.

The usual audit hands a model a case and reads off one answer. That misses anything that happens across many turns. A real proceeding has openings, examinations, objections, rulings and closings. Bias can show up in who gets cut off, whose objections get sustained, and who gets to finish a sentence. None of that is visible in a verdict count.

There is also a quieter problem. A system can satisfy group-level parity while individual defendants still get different treatment. If the same case with a different name gets a different result, that is unfair to that defendant, even if the totals balance out. You only see it if you run the same trial twice.

How we built it

The system has three layers. The design layer decides what gets run: case templates, the cue matrix of names, and a seed schedule. The execution layer runs trials. The data layer turns transcripts into structured logs and then into estimates. Everything is in one Python package, bailiff, plus a few runner scripts.

A case template is a short YAML file with a summary, charges, facts and witness statements. The defendant's name is a slot, {{ cue_value }}, filled in at render time. We wrote six deliberately ambiguous cases: traffic, assault, shoplifting, DUI, vandalism and petty theft. Ambiguity was the point. A case with an obvious answer convicts every time and leaves no room for a cue to matter.

The agents and the state machine

Each trial is a TrialSession with three agents: Judge, Prosecution and Defense. Each agent is a role prompt plus a pluggable model backend. The judge is told to apply legal standards, enforce procedure and avoid demographic inference. The prosecutor argues the burden and may only raise permissible objections. The defense advocates and challenges evidence. None of them sees the others' instructions.

The session walks a fixed phase order: opening, direct, cross, redirect, closing, verdict, audit. Each phase has a set of roles allowed to speak. Prosecution and defense open and close, prosecution runs direct and redirect, defense runs cross, and only the judge speaks at verdict and audit. Each phase also has a message cap. Before any agent speaks, a role guard checks that it is allowed to speak in the current phase. An out-of-turn turn is rejected and counted as a role_phase_mismatch violation, and nothing is logged. Interruptions in a phase that does not allow them are blocked and replaced with a notice.

Budgets stop an agent from winning by volume. Each role has a cumulative byte cap for the whole trial (1,800 bytes for each counsel and 1,500 for the judge in the pilot config) and an optional token cap. Anything past the cap is truncated before it is logged. Without this, a model that writes long answers for one side would show up as a procedural gap that is really just verbosity.

At the verdict the judge has to open its answer with a JSON object containing a verdict key. The session parses that first and falls back to a regex only if the JSON is missing. The judge only sees the name as it appears in the case text, with no separate demographic field, and the code has a blinding mode that redacts it entirely.

Pairs, models and the manifest

Trials run in pairs. Same case, same model, same facts. Only the defendant's name changes. Control names are distinctively white American (Alex Johnson, Emily Carter) and treatment names are distinctively African-American (DeShawn Jackson, Latanya Williams), drawn from the Bertrand and Mullainathan pool and matched on frequency so familiarity is not the difference. Each pair hangs off one deterministic seed root: the control trial runs on the seed and the treatment trial on the next one, so the seeds in a pair are fixed in advance and nothing else varies between them.

Every case and cue pair is then run across six model families from 3.8B to 32B parameters: Phi-3-Mini, Qwen2.5-7B, Mistral-7B, Llama-3-8B, Qwen2.5-14B and DeepSeek-R1-Distill-32B. The batch driver, run_trial_matrix.py, enumerates the case, model and seed matrix. Each completed pair appends one line to a manifest with a deterministic run_id, both seeds, both names and prompt hashes. On a rerun the manifest is read first, and any pair whose run_id is already there is skipped. That mattered in practice, because runs against rate-limited APIs die partway through, and we could restart a job without re-running or duplicating anything.

From transcript to data

Every utterance becomes a record with its role, phase, content, byte count and event flags: objection_raised, objection_ruling (sustained or overruled) and interruption. The flags come from regex rules over each turn. The records are validated against a versioned JSON schema and written as JSONL, one trial per line, with the case, model, cue condition, name, block and seed on each trial. The transcript is the dataset. Every procedural metric below is a count over these fields.

What we measured

For outcomes, we fit a mixed model with random intercepts for case and model. The quantity of interest is the odds ratio of conviction under the name swap, \(\exp(\beta_1)\):

\[ \operatorname{logit} \Pr(Y_i = 1 \mid Z_i) = \beta_0 + \beta_1 Z_i + u_{c(i)} + v_{m(i)} \]

For process, three metrics: how often the defense is interrupted, how often defense objections are sustained, and the defense's share of the bytes spoken. Each is tested with paired contrasts and wild cluster bootstrap intervals (10,000 resamples), with Benjamini-Hochberg correction across the three.

The third measure is the simplest and the one I care about most: the flip rate, the share of pairs where the two verdicts disagree.

\[ \mathrm{FlipRate} = \frac{1}{N_{\text{pairs}}} \sum_{(i,i')} \mathbb{1}\left[\,Y_i \neq Y_{i'}\,\right] \]

Any flip rate above zero means some defendant would have received a different verdict if only their name had changed. It does not matter which direction the flip goes. That is a fairness problem on its own.

The inference stack sits on top of the JSONL logs. The mixed model is fit with statsmodels. Flip-rate intervals use 10,000 BCa bootstrap resamples stratified by case template, and randomization inference over the pair-level name assignments (10,000 permutations) gives a p-value that does not depend on distributional assumptions. Because every trial carries its case, model and seed, all of the clustered resampling can be done straight from the logs.

The verdicts lean the other way

In the pilot (100 pairs on Llama-3-8B), treatment names were convicted slightly less often: 53% against 58% for control names, an odds ratio of 0.82 (p < 0.05). The shift was largest in assault and traffic, two of the most ambiguous templates, where the facts leave the most room for something else to decide.

An outcome-only audit would call this fine, maybe even good. We read it differently. The name is still changing the decision. It just shows up as leniency instead of harshness. Our guess is that preference tuning teaches models to avoid looking like they convict minority defendants more, and that the verdict is where that pressure lands. We did not test that mechanism, so it stays a hypothesis.

The trials lean the usual way

In the same pilot, where the verdicts favored treatment names, the process went the other direction. Defense counsel for treatment-name defendants was interrupted more, had fewer objections sustained, and got less of the floor. All three intervals exclude zero after correction.

This is the veneer. The unfairness did not go away. It moved from the verdict into the trial. An audit that only looks at conviction rates would rate this system as fair at exactly the point where the process gap is largest.

One name, two verdicts

The pilot flip rate was 8%: 8 of 100 pairs, with 6 of the 8 going the same direction. Reading the flipped pairs was the most convincing part of the whole project. In one traffic pair, the defense in Trial A (DeShawn Jackson) starts to ask the officer whether his timing estimate could be off. The prosecution objects for speculation and the judge sustains it. In closing, the defense starts to say the officer cannot give a precise time, and the court tells counsel to wrap up. Guilty.

In Trial B (Alex Johnson), same facts, the defense asks the same kind of questions. No objection. The closing runs in full: one officer, sixty feet away, at night, no recording. Not guilty.

One pair proves nothing on its own, and the claims in the paper rest on the full pilot. But it shows what the numbers are counting.

Across the six-family panel, flip rates were much higher than the pilot: 14.9% to 38.3%. No model was consistent under name swaps, and size did not fix it. The 32B model flipped more than Qwen2.5-14B. The direction of the conviction effect was mixed and never significant in any family.

The placebo

The obvious objection is that models are just noisy, and any change to the prompt will move the verdict. So we ran placebo pairs that swap a name for another from the same group, like Alex to Ryan. These carry no demographic signal and should do nothing.

They did nothing. The placebo odds ratio was 1.01 and the flip rate was 1%. That check is what gives the other numbers meaning. If any name swap flipped verdicts, the framework would be measuring string sensitivity, not bias.

What this does not show

Interruptions, sustained objections and byte share are proxies for trial quality. They are not direct measures of legal harm. Counsel strategy may still correlate with the name despite pairing. Models get updated, so we log identifiers, parameters and run dates. Our cases are simple single-witness scenarios, which helps isolate the effect but limits how far it carries to real courtrooms. And the family-level outcome effects are all non-significant, which could be a true null, too little power, or effects canceling out inside a family. We report them only as direction.

Three gates

Our proposal is a minimum audit bundle for legal AI before deployment, built from three tests that can be pre-registered and either pass or fail:

• Flip-rate stability. The flip rate under a name swap stays below a threshold fixed in advance.
• Placebo calibration. The placebo odds ratio is indistinguishable from 1.0.
• Procedural parity. No significant gaps in interruptions, objection rulings or speaking share after correction.

No model in our panel passes all three. Under the EU AI Act, high-risk systems need conformity assessments, and we argue those should include adversarial paired testing like this, not only statistics over historical outputs. All prompts, seed schedules, log schemas and analysis code are in the repo so anyone can rerun them.