The Safety Score Is Falling. Gender Bias Isn't. It's Just Moving.

Open the 1,997 documents in GPT-5's men-directed completion cluster labeled Topic5 and breast cancer appears reframed as a men's rights debate: a dispute over who counts as affected, who counts as grieving, and whether the disease has been "appropriated" by women. The women-directed output has no symmetric cluster. Three independent toxicity classifiers score the men-directed framing as safe. The classifiers measured the words on the page. They did not measure the asymmetry between what men and women get to talk about.

The contradiction sits inside a 450,000-prompt, 15-model audit of the GPT lineage, from GPT-2 through GPT-5. The paper's authors call the pattern "harm laundering": explicit toxicity is removed from the surface while a different kind of gender harm is transformed rather than reduced, into forms the same classifiers do not detect. The paper, a preprint on arXiv, formalizes the pattern as a three-criteria test and proposes a three-stage detection protocol any lab or auditor can run on any generative model.

Surface-form toxicity is falling across the GPT lineage. In the GPT-2 era, sexual-violence clusters showed up in women-directed completions; by GPT-4, those clusters had largely disappeared. Detoxify, a widely used toxicity classifier, scored the later generations as safer. The audit does not challenge that finding. It complicates it.

In the same window, a different number moved in the opposite direction. The topic-diversity ratio between women-directed and men-directed completions, the share of the men-directed topic ground that women-directed completions also cover, sat at 0.91 at GPT-2 and roughly 0.58 at the GPT-4 alignment boundary, a fall of about 36 percent. As the models were trained to be safer, women-directed completions did not just lose slurs; they lost ground. Men-directed completions, by contrast, gained positive territory: caregiving, emotional range, ally identity. The asymmetry widened in a direction the standard toxicity classifiers cannot see.

The audit then tested two well-known evaluation tools on the same outputs. REGARD, a metric designed to catch representational harm, tracked the widening gap. Its correlation with release date was positive and statistically significant, at ρ = +0.55, p = .034. Detoxify, the toxicity classifier, did not. Its correlation with release date was negative and not significant, at ρ = −0.23, p = .42. The two tools pointed in opposite directions on the same data. The paper does not call either tool wrong. It calls the choice between them a methodology choice, and warns that reporting only the toxicity score is no longer an honest summary of model behavior.

"Harm laundering" is the term the paper coins for this dynamic. Harm is transformed into a less-detectable form rather than reduced. The transformation passes existing safety classifiers. The laundering claim is defined by three criteria: the harmful content is removed from the surface form; the new form is harder to detect with standard classifiers; and the underlying representational asymmetry persists or grows. The breast-cancer-as-men's-debate cluster meets all three. So does the GPT-4-era inversion of topic diversity. The paper formalizes the test so any auditor can run it on any generative model, not only the GPT lineage.

The audit also offers a constructive close. Its three-stage detection protocol is runnable today on any deployed model. Stage one is corpus construction: generate enough gender-directed completions across a model family to detect asymmetry rather than noise. Stage two is multi-classifier evaluation: run the same completions through at least one toxicity classifier (Detoxify-style) and at least one representational-harm metric (REGARD-style), then compare the signals. Stage three is structural inspection: look for the kind of asymmetric topic clusters the GPT-5 audit found, where one demographic direction has a coherent frame the other does not. None of the three stages require new infrastructure. Each can be added to a model card.

The limits of the claim matter too. The audit is a preprint, not peer-reviewed, and the authors do not appear to be affiliated with OpenAI; the critique is third-party, which strengthens the methodological framing but leaves the empirical claims (the effect sizes, the correlation coefficients, the 1,997-document count) author-reported until replicated. The GPT-5 condition is itself unusual: OpenAI has not publicly disclosed GPT-5's architecture or weights, so the paper's GPT-5 condition probes two system-prompt behaviors rather than a documented model spec. If the REGARD-detected disparity does not replicate outside this prompt set, the laundering thesis weakens. The authors publish the prompt set and the protocol so the result is testable. That is the right kind of claim to put into the safety-evaluation record, and the right kind of claim to pressure-test before a procurement team uses it to disqualify a vendor.

The surface story stays true. Explicit toxicity is falling across the GPT lineage. The audit does not challenge that. It adds a second line: the fall does not, by itself, measure harm reduction. A score that goes down while a gap widens is reporting on one thing while something else moves in the opposite direction. The next model card worth reading will report both numbers, and name the metric that caught the second one.