Does the AI believe the witness?

When an AI system reads a witness statement, does it form a view about whether the witness is believable, a view it never states out loud?

This matters because AI tools are moving into legal work: document review, disclosure exercises, case summarisation, chronologies. If the software carrying out those tasks holds an unstated assessment of who is credible, and that assessment is influenced by how people speak rather than what they say, then a discrimination risk has entered the workflow, and it is invisible to everyone using the tool.

You cannot answer this question by asking the AI alone. With an open-weights model you can look inside and see whether a credibility judgment is forming; with a closed frontier model you cannot, but you can still test whether the tool’s outputs change when you vary how a statement is written while holding the facts constant. This study used an open model so I could do both, then put the behavioural half of the battery to two production frontier models through their APIs, to see whether the open model’s behaviour predicts theirs. It does not.

The broader finding is not that language models share one credibility bias. It is that credibility-related behaviour is model-specific, can arise through more than one internal route, and cannot be inferred from another model’s behaviour or from a single internal probe. That is the through-line of everything below.

The caveats are below. One open model for the internals, synthetic statements throughout, and where a control weakened a claim, I say so. When the same behavioural tests ran on Claude Sonnet 5 and GPT-5.5, neither reproduced the open-model pattern; see the frontier section.

Three ideas are enough to follow everything

Findings like these are easy to fake by accident

So the experiment was built with tripwires. Each one had the power to kill the result, and a “no result” was designed to be a publishable result.

The credibility dial steers the model’s judgment; the placebo verdict is now split

With no interference, the model rated my neutral test statements at 5.3 out of 10 on average: a sensible “middling” answer with balanced reasoning. Then I turned the dial.

The score slid with the size of the nudge, in the right direction, at every step, and within the comparison window every one of the model’s answers stayed coherent (70 of 3,288 generations were discarded across the whole sweep, almost all under the control directions at the strongest settings). The model’s reasoning changed to match: nudged down, it called the same text “vague” and “influenced by memory bias”, and at the strongest setting invented a contradiction that is not in the statement. It wasn’t blurting a different number; its assessment of the same words changed.

The controls are what make this meaningful, and this run hardened them. Alongside eight random placebo directions I added eight matched nulls: directions built exactly like the real dial, from the same statements, but with the credible and not-credible labels shuffled so the signal is destroyed. On the model’s written scores the dial swung the judgment 5.7 points in the comparison window and exceeded all sixteen controls (the strongest managed 4.5). With sixteen controls, however, the finest attainable empirical rank p-value is 0.059, so this design cannot cross a conventional 0.05 threshold even with a perfect rank. The result is resolution-limited by the size of the placebo set, not merely a modest margin, and I report it as it stands.

One control result went the other way. The second reading, the “Yes/No leaning” measured before the model writes anything, turned out to be generically sensitive: seven of fifty-six pooled controls moved it further than the real dial did (rank p = 0.14). So the steering claim rests on the written scores, where the dial exceeded every control; the leaning readout does not separate the dial from a matched null, which I report rather than leaning on the measure that flatters the result.

I also ran a number-detector trap: pairs that differ only in an innocent visit length (25 vs 55 minutes, both consistent). The dial scored 0.63 on these, where 0.5 would mean it ignores them and 0.96 is its score on genuinely contradictory pairs. Chiefly a consistency detector, with a numeric residue I flag.

The steering effect has now held three times, with credibility defined three different ways: by tone (an earlier run using hedged statements), by whether a narrative holds together, and, in this final run, by a single impossible timestamp.

Even at the strongest settings, the model’s written answers stayed measured on the surface while its scores swung from one end of the scale to the other. The model’s stated reasoning does not necessarily reveal the internal representations causally influencing its assessment.

The voice of a statement changes the model’s credibility judgment when the facts are identical; the dial only tells part of the story

This is the finding with direct discrimination consequences. I took statements with identical facts and rewrote only the voice, then measured both where each version sits on the internal credibility dial and what reliability score the model gives when asked directly, unsteered.

Two measurements, one conclusion

The discrimination is now shown in the model’s behaviour, not just its internals. A witness who says the same thing in regional dialect or with hesitant, disfluent speech is rated roughly three points lower out of ten than one who says it in formal English. Translated-sounding grammar costs about a point and a half. Nothing in the facts differs.

The dial does not predict which voices get marked down. On the internal dial, terse, dialect and translated-sounding statements read as less credible than formal English, and hesitant speech reads as more credible. In the model’s actual ratings, hesitant and dialect speech are penalised most. The credibility dial is causal (Finding 1), but it is one channel among several by which voice reaches the judgment, not the whole mechanism.

An internal audit would have missed the worst penalty. Checking statements against this one credibility direction would have cleared hesitant speech, which the model’s own ratings penalise most. Behavioural testing and internal inspection answer different questions; a credible audit needs both.

Why this matters legally: on this model, dialect, interpreter-mediated grammar, hesitancy and brevity are not evenly distributed across society, and they track the witnesses a fair process is supposed to protect. The model demonstrably rates identical evidence differently depending on the voice it is written in; nobody chose those penalties, and nothing in the output reveals them.

Each voice here is one stylised sentence template with facts filled in, not a real sociolect. The discriminatory effect is real in the model’s behaviour; generalising to any actual community needs real transcript material. The same battery on two closed frontier models produced a different pattern; see the frontier section.

A bad first impression sticks to the person

The final experiment mimics a real litigation file: multiple documents about the same person, read in one sitting. An earlier version of the neutral statement contained a grammatical error introduced by my code (“I saw unloading crates…”). Because the statement was identical across conditions the comparisons were still valid, but broken grammar is itself a credibility cue. The text has been fixed; the numbers below are from the corrected run.

Document A is a prior assessment of a named person. Document B, word-for-word identical in every test, is a neutral statement by that person. I asked the model to rate Document B alone.

Same words; a score of 1.3 versus 5.3, depending entirely on what the model read about the person beforehand. The asymmetry survived the correction: the bad reference has enormous power (a four-point collapse), while the good reference didn’t lift the score at all (if anything it cost a point). This is a taint effect, not a symmetrical halo. Prior doubt sticks; prior praise doesn’t.

Is the taint attached to the person, or does a bad document simply sour the mood of the whole file? I re-ran the experiment with Document A describing a different, unrelated person. Some mood does bleed: a damning assessment of someone else took the witness’s statement down about a point (4.3, against 5.3 with no Document A). But that is a quarter of the four-point collapse when the damning assessment is about the same person, and the difference is highly significant.

A glowing reference about someone else lowered the witness’s score by two points (3.1), a contrast effect, as if the witness suffered by comparison with the well-reviewed stranger. Consistent with the model judging people relative to one another rather than each on their own terms. The same experiment on two closed frontier models found no person-bound taint; see the frontier section.

Do the closed frontier models behave the same way?

Most legal AI tools run on closed frontier models reached through an API, where looking inside is not an option. Two of the three experiments have behavioural versions that need no internal access: the voice battery from Finding 2 and the persistence test from Finding 3 score only what the model writes back. I ran both, unchanged (same statements, same prompts, same scoring), through the APIs of Claude Sonnet 5 and GPT-5.5. This is exactly the audit position of a firm using a closed tool: no dial, no steering, outputs only. Both models ran at low reasoning effort with a 256-token answer cap, chosen for cost and for parse consistency across hundreds of calls; the same settings applied to every voice and every condition, so they cannot manufacture a difference between registers.

The headline: neither frontier model reproduced the open model’s discrimination pattern, and on the most charged comparison the direction reversed.

The most actionable result is about bundle composition, which a firm controls directly. On Sonnet, the witness scored higher after a damning report on an unrelated stranger and lower after a glowing one. What sits next to a statement in the file changed how that statement was scored, on identical words.

What the frontier check does and does not establish

This is not evidence that the frontier models are safe. Their scores still moved on features with no bearing on the facts: the voice a statement is written in, and the presence and subject of other documents in the bundle. Different behaviour is not absence of behaviour.

Open-model findings do not transfer. Neither the direction nor the size of any effect measured on the open models predicted the frontier models. Testing has to be done per model and per version, on the model actually deployed.

Finding 1 has no closed-model counterpart. Whether these models carry an internal credibility dial one simply cannot say: the weights are closed. The behavioural battery is the whole of what a customer can check, which is the point of the audit argument below.

Caveats

1. The wording-clue caveat is closed, and closing it changed results. My first fact-based pairs carried phrases that flagged the contradiction. The final pairs differ by one timestamp only. Separation fell from perfect to 96 in 100, steering held, and two voice results reversed.
2. The specificity of the dial is established on one readout, not two. Against sixteen placebos including matched nulls, the dial exceeded every one on written scores, at the design’s floor of rank p = 0.059 (sixteen controls cannot resolve below it). On the parsing-free “Yes/No leaning” readout, seven of fifty-six controls out-swung the real dial, and no specificity claim is available there.
3. The dial is not perfectly clean of number-reading. On control pairs differing only in an innocent duration it scored 0.63 where pure consistency-checking predicts 0.5.
4. One model for the internals, synthetic statements, compressed weights. Every internal measurement here comes from a single open model run in a memory-saving compressed mode, using statements I wrote myself. A scale check on a larger open model is in progress and not reported here. The two frontier-model checks reproduced neither headline behavioural effect. The behavioural findings are demonstrated per model, not as properties of language models in general.
5. Each synthetic voice is one stylised rendering, not a sociolect. Every voice is one sentence template with facts filled in. Real transcript material is the proper next step before drawing quantitative conclusions about any actual community.
6. Fact-skeleton overlap is a leakage risk for the projection numbers specifically. The voice and persistence statements reuse fact skeletons from the dial’s training scenarios (in different wording; the steering test statements in Finding 1 are fully disjoint). Where they overlap, the dial’s projection could be keying on familiarity rather than credibility, which bears on whether Finding 2’s projection figures are load-bearing today, not only in a future run. Re-generation from non-overlapping scenarios is queued; until then the behavioural ratings, which do not depend on the dial, carry the discrimination claim.
7. The mechanism behind the dial/behaviour split in Finding 2 is not yet understood. The model’s ratings penalise voices the dial does not, so voice must reach the judgment through additional internal routes not yet mapped.

What this means for legal practice, today

Two audiences, two testing duties

Most legal AI tools run on closed frontier models where the internals are off limits. This research used an open model because that is the only way to see what is happening inside. The duty to test does not disappear when you cannot look inside; it shifts.