Marked Personas: Using Natural Language Prompts to Measure Stereotypes in Language Models

Applications, bias, and safety2023ACL AnthologyApproved editorial review

Authors: Myra Cheng, Esin Durmus, Dan Jurafsky

Keywords: Large Language Models, Stereotypes, Demographic Groups, Intersectionality, NLP, Sociolinguistics, Markedness, Bias Detection

Source: Open primary source (opens in a new tab)

3
Authors
19
Findings
24
Limitations
9
Evidence

Editorial summary

English

Cheng, Durmus, and Jurafsky introduce Marked Personas to study stereotypes in open-ended text without starting from a closed list of attributes. The procedure generates first- or third-person descriptions of demographic groups and compares each marked group with references defined in advance as unmarked: White for race/ethnicity and man for gender in the US English context under study. Marked Words applies informative-prior weighted log odds, following Fightin' Words, and retains terms with z > 1.96; for an intersectional identity, a term must distinguish it from both the racial and gender reference. This is a measure of lexical differences within the generated corpus, not a universal or exhaustive stereotype detector.

The main experiment crosses five racial or ethnic categories, Asian, Black, Latine, Middle-Eastern, and White, with man, woman, and nonbinary, uses six prompts, and obtains 15 responses for every combination. This yields 1,350 GPT-4 personas and 1,350 text-davinci-003 personas, 2,700 in total. As robustness checks, the authors compute Jensen-Shannon divergence and train one-vs-all SVMs on anonymized bags of words; the SVMs separate groups with accuracy 0.96 ± 0.02 for GPT-4 and 0.92 ± 0.04 for GPT-3.5. The human comparison reuses 1,230 responses from 615 Black or White Prolific participants collected by Kambhatla et al.; each participant described themselves and wrote from an imagined racial identity. Using Ghavami and Peplau's lexicons, generated outputs contain a greater proportion of racial stereotype attributes than the human responses. GPT-3.5 also produces an anomalous result: its White personas contain more Black-stereotype lexicon terms than its Black personas, showing why a fixed word list does not adequately characterize the narrative a model is producing.

The central contribution is qualitative and contextual. Significant terms for marked groups are not primarily insults. GPT-4 and GPT-3.5 personas are strongly positive according to VADER, means 0.83 and 0.93, standard deviations 0.27 and 0.15, and none of the highlighted words has negative sentiment. Yet almond-shaped, petite, and smooth in Asian-woman personas support exoticizing and submissive portrayals; vibrant, curvy, passionate, dancing, and rhythm in Latina-woman personas reproduce tropicalism and hypersexualization; hijab, faith, and religious reduce Middle-Eastern identities to religion; culture, heritage, traditional, and proud define minorities through their difference from unmarked whiteness. Strength, resilient, and resilience concentrate especially in Black women and other racialized women, renewing an expectation of fortitude under adverse structures. Even embrace, authentic, independent, leader, or powerful can operate as marked anti-stereotypes: they appear specifically for groups historically denied those properties and again turn identity into a total explanation.

The pattern carries into a narrative-generation probe with 30 stories for each of the 15 groups. Neutral terms dominate unmarked groups, while other groups evoke martial arts for Asian characters and scripts of effort, determination, and dreams for minorities, especially women of color. The authors recommend measuring intersections, studying positive stereotypes instead of limiting safety to denigrating language, disclosing mitigation methods, and considering critical refusal: a system may decline a request when describing an identity as though it entailed essential traits would require stereotyping. ChatGPT does refuse some prompts, although refusal is highly wording-dependent and disappears for the first two variants.

The artifact audit qualifies reproducibility. The repository frozen at commit 9b3ae82 contains 1,350 balanced, nonduplicated main texts for each model; the Marked Words script runs and recovers, for example, the published terms for Black woman. But the repository has no license, pinned dependency environment, tests, or CI. Several notebooks require data/separate.csv, which is absent, so the human-model comparison and main figures cannot be reproduced from the deposit. Other README paths do not exist. The GPT-4 generator iterates W but tests for F, so the released code would treat woman as man; it also labels any requested model as gpt4. The story CSV has 449 rather than the described 450 rows, and the ChatGPT files combine inconsistent prompt numbering and model labels, with 604 duplicate texts in the file named main.

There is also a concrete issue in the lexicon calculation: the notebooks use text_clean.count(word), which counts substrings rather than whole tokens. In the released GPT-4 data, the published implementation gives White-lexicon rates of 0.956% in Black personas and 1.358% in White personas; requiring exact tokens gives 0.880% and 0.837%, respectively, reversing that narrow comparison. The direction of the GPT-4 Black-lexicon result and both text-davinci-003 lexicon comparisons remains unchanged. This editorial robustness check does not overturn the broader finding of marked narratives, which is also supported by Marked Words and qualitative reading, but it means individual bars in the lexicon analysis should not be treated as clean estimates.

The defensible conclusion is that apparently neutral prompts can produce systematic, intersectional, socially loaded differences even when their language is positive. The study does not reveal a psychological essence of any group or measure an internal attitude in the model: it characterizes 2,700 outputs from two 2022–2023 OpenAI systems under author-selected US categories, prompts, and reference groups. Its value is in extending audits beyond offensive words to narrative patterns. Responsible reuse requires updated models, cultural contexts, identities, and impact tests, as well as a repaired artifact before its numerical results can function as a fully reproducible benchmark.

Español

Cheng, Durmus y Jurafsky proponen Marked Personas para estudiar estereotipos en texto abierto sin partir de una lista cerrada de atributos. El procedimiento genera descripciones en primera o tercera persona de grupos demográficos y compara cada grupo marcado con referencias definidas de antemano como no marcadas: White para raza/etnicidad y man para género en el contexto estadounidense e inglés analizado. Marked Words aplica log-odds ponderado con prior informativo, siguiendo Fightin' Words, y conserva términos con z > 1,96; para una identidad interseccional, el término debe distinguirla tanto del referente racial como del de género. Es una medida de diferencias léxicas dentro del corpus generado, no un detector universal ni exhaustivo de estereotipos.

El experimento principal cruza cinco categorías raciales o étnicas, Asian, Black, Latine, Middle-Eastern y White, con man, woman y nonbinary, usa seis prompts y obtiene 15 respuestas por combinación. Son 1.350 personas de GPT-4 y 1.350 de text-davinci-003, 2.700 en total. Como controles, los autores calculan divergencia Jensen-Shannon y entrenan SVM one-vs-all sobre bolsas de palabras anonimizadas; las SVM separan los grupos con exactitud 0,96 ± 0,02 en GPT-4 y 0,92 ± 0,04 en GPT-3.5. Para comparar con escritura humana reutilizan 1.230 respuestas de 615 participantes de Prolific, Black o White, recogidas por Kambhatla et al.: cada persona se describió a sí misma y también desde una identidad racial imaginada. Con los léxicos de Ghavami y Peplau, las salidas generadas contienen una proporción mayor de atributos raciales estereotípicos que las respuestas humanas. El resultado de GPT-3.5 es además anómalo: sus personas White contienen más palabras del léxico de estereotipos Black que sus personas Black, una señal de que una lista fija no describe bien qué narrativa está produciendo el modelo.

La aportación central es cualitativa y contextual. Los términos significativos para grupos marcados no son principalmente insultos: GPT-4 y GPT-3.5 producen textos muy positivos según VADER, medias 0,83 y 0,93; desviaciones 0,27 y 0,15, y ninguna de las palabras destacadas tiene sentimiento negativo. Sin embargo, almond-shaped, petite y smooth en mujeres Asian sostienen exotización y docilidad; vibrant, curvy, passionate, dancing y rhythm en mujeres Latine reproducen tropicalismo e hipersexualización; hijab, faith y religious reducen identidades Middle-Eastern a religión; culture, heritage, traditional y proud definen a minorías por su diferencia respecto de la blancura no marcada. Strength, resilient y resilience se concentran sobre todo en mujeres Black y otras mujeres racializadas, renovando el mandato de fortaleza frente a estructuras adversas. Incluso embrace, authentic, independent, leader o powerful pueden funcionar como antiestereotipos marcados: aparecen precisamente en los grupos históricamente privados de esas propiedades y vuelven a convertir su identidad en explicación total.

El patrón se traslada a una prueba de generación narrativa con 30 historias por cada uno de los 15 grupos. En grupos no marcados predominan palabras neutrales; en los demás aparecen martial arts para personajes Asian y guiones de esfuerzo, determinación y sueños para minorías, especialmente mujeres de color. Los autores recomiendan medir intersecciones, estudiar estereotipos positivos en vez de limitar la seguridad a lenguaje denigrante, transparentar las mitigaciones y considerar la negativa crítica: un sistema puede rechazar una solicitud cuando describir una identidad como si implicara rasgos esenciales exige estereotipar. ChatGPT efectivamente rechaza algunos prompts, aunque el rechazo depende mucho de su formulación y desaparece en las dos primeras variantes.

La auditoría del artefacto matiza la reproducibilidad. El repositorio congelado en el commit 9b3ae82 contiene los 1.350 textos equilibrados y sin duplicados de cada modelo principal; el script Marked Words se ejecuta y recupera, por ejemplo, los términos publicados para Black woman. Pero no ofrece licencia, dependencias fijadas, tests ni CI; varios notebooks apuntan a data/separate.csv, que no está incluido, por lo que la comparación humano-modelo y las figuras principales no se reproducen desde el depósito. Otros paths del README no existen. El generador de GPT-4 itera W pero comprueba F, de modo que el código publicado trataría woman como man; además etiqueta cualquier modelo como gpt4. El CSV de historias tiene 449 filas en lugar de las 450 descritas y los archivos de ChatGPT mezclan numeraciones, etiquetas y 604 duplicados en el subconjunto llamado main.

Hay además un problema concreto en el cálculo por léxicos: los notebooks usan text_clean.count(word), que cuenta subcadenas y no tokens. En los datos liberados, el cálculo publicado para GPT-4 da 0,956% de palabras del léxico White en personas Black y 1,358% en personas White; al exigir tokens completos da 0,880% y 0,837%, respectivamente, e invierte esa comparación estrecha. La dirección de los resultados Black-lexicon para GPT-4 y de ambos léxicos para text-davinci-003 se mantiene. Esta robustez editorial no invalida el hallazgo más amplio de narrativas marcadas, que se apoya también en Marked Words y lectura cualitativa, pero sí impide tratar cada barra del análisis de léxicos como una estimación limpia.

La conclusión defendible es que prompts aparentemente neutrales pueden producir diferencias sistemáticas, interseccionales y socialmente cargadas incluso cuando el lenguaje es positivo. No demuestra una esencia psicológica de ningún grupo ni mide actitudes internas del modelo: caracteriza 2.700 salidas de dos sistemas OpenAI de 2022–2023 bajo categorías, prompts y referencias estadounidenses elegidas por los autores. Su valor está en ampliar la auditoría desde palabras ofensivas hacia patrones narrativos; su uso responsable exige actualizar modelos, contextos culturales, identidades y pruebas de impacto, y corregir las carencias del artefacto antes de tomar las cifras como benchmark plenamente reproducible.

Research question

Can a lexicon-free method identify differences and stereotypes, including positive and intersectional ones, in persons generated by LLMs against groups taken as unmarked, and do those patterns also appear in a narrative application?

Method

Computational and qualitative study in three layers. First, GPT-4 and text-davinci-003 generate 2,700 persons through six prompts for 15 crossings of five racial/ethnic categories and three genders. Marked Words calculates weighted log-odds with informative prior and z > 1.96 against White and man; JSD and one-vs-all SVM serve as controls. Second, Black and White generated persons are compared with 1,230 human texts and published stereotyping lexicons; VADER measures sentiment. Third, Marked Words is applied to 30 stories per group. The editorial audit read and rendered the 29 pages, verified ACL metadata and the award, froze the public commit, inspected all CSVs, scripts and notebooks, ran the central script and repeated the lexicon count with exact tokens.

Sample: The main analysis contains 15 intersectional groups: five racial/ethnic categories by three genders. Each model responds 15 times to six prompts for each group, 90 persons per group and 1,350 per model. The human comparison comes from 615 Black or White Prolific participants, approximate mean age 30, with one self-description and another from an imagined racial identity, 1,230 texts. The narrative test declares 30 stories per group, 450 planned, although the public CSV contains 449.

Findings

  • Marked Words recovers significant lexical differences between each marked group and the White and man references without needing a prior list of stereotypes.
  • The SVMs distinguish groups with accuracy 0.96 ± 0.02 for GPT-4 and 0.92 ± 0.04 for text-davinci-003, confirming that word distributions differ strongly by demographic label.
  • JSD, SVM and Marked Words partially coincide in their top words, although they respond to different statistical objectives.
  • Published lexicons attribute more racial stereotypical words to generated persons than to comparable human responses.
  • In text-davinci-003, White persons contain more terms from the Black lexicon than Black persons; the result shows the insufficiency of interpreting a closed list as a complete measure.
  • Mean sentiment is very positive: 0.83 ± 0.27 in GPT-4 and 0.93 ± 0.15 in GPT-3.5 according to VADER.
  • Highlighted words have mean sentiment 0.05 ± 0.14 and none obtains a negative score, but many sustain harmful narratives.
  • Asian woman is differentiated through almond-shaped, petite, smooth, silky and delicate, a pattern related to exoticization, docility and hypersexualization.
  • Latina woman is associated with vibrant, curves, rhythm, passionate and dancing, terms consistent with the trope of tropicalism.
  • Middle-Eastern is marked with hijab, faith, religious, headscarf and traditional, homogenizing regional identities as if they were necessarily Muslim and pious.
  • Culture, heritage, proud and traditional appear for several non-white groups and turn demographic belonging into their defining trait against unmarked whiteness.
  • Resilient and resilience concentrate in Black women and other racialized women, reproducing the schema of obligatory strength and shifting attention from adverse structures to the individual.
  • Positive anti-stereotypes can also mark: independent appears only for women and powerful or leader for Black persons in text-davinci-003.
  • The stories maintain the patterns: martial arts marks Asian characters and effort or determination disproportionately define narratives about minoritized groups.
  • ChatGPT rejects 77%, 67%, 100% and 100% of the outputs in the last four prompts according to the presence of language model, but does not reject the first two, so protection is fragile to formulation.
  • The central script of the repository runs on the CSVs and reproduces the published list for Black woman; the two main sets have 1,350 unique texts and 90 per group.
  • The human-model comparison is not reproduced from the repository because data/separate.csv, required by the notebooks, is not included.
  • Re-estimation by exact tokens reverses only the White lexicon comparison between GPT-4 Black and White persons: 0.880% versus 0.837%, instead of 0.956% versus 1.358% with substrings; the other revised directions are preserved.
  • ACL Anthology registers the work as winner of the Social Impact Award of ACL 2023.

Limitations

  • The study covers proprietary OpenAI models from late 2022 and early 2023; the endpoints and snapshots do not allow stable repetition today.
  • Only English is studied and the qualitative analysis relies on stereotypes and hierarchies of the United States context.
  • White and man are fixed a priori as unmarked references; that choice is not discovered from the data and may change by culture, language and domain.
  • The prompts explicitly mention identity and some ask to convince the reader that the text comes from that group, which may incentivize stereotypes.
  • Five racial/ethnic categories and three gender categories do not represent internal diversity or other relevant identities.
  • The labels amalgamate heterogeneous categories such as Asian, Middle-Eastern and Latine and may reify the same social constructions that are audited.
  • Marked Words characterizes differences of the concrete corpus and is not exhaustive with respect to the universe of stereotypes.
  • A z > 1.96 applied to many words is not accompanied by explicit correction for multiplicity or by stability analysis through resampling.
  • The qualitative interpretation of tropes does not use independent coders, annotation protocol or inter-rater agreement.
  • VADER reduces context and pragmatics to a sentiment score and does not validate by itself whether a sentence is positive, essentializing or harmful.
  • The comparison with humans is limited to Black and White, uses data from another study and does not necessarily match all collection and generation contexts.
  • The notebooks count occurrences with str.count, so substrings may inflate or change rates of the lexicon analysis.
  • The repository does not include the human CSV needed to reproduce Figure 1 or the central generated-human contrast.
  • There is no requirements, lockfile, environment, license, tests, CI or executable instructions for complete reproduction.
  • The README mentions persona_generation and make_tables.ipynb, but the repository contains persona_generation_scripts and reproduce_tables.ipynb.
  • The GPT-4 script uses W in the loop but checks F to detect women; run as is it would generate male prompts for that group.
  • The generator writes gpt4 in the model column regardless of the requested model_name, weakening the traceability of the ChatGPT files.
  • The ChatGPT CSVs show inconsistent labels and prompt numbering; chatgpt_main_generations.csv contains 1,650 rows, 604 duplicates and 150 rows labeled gpt4.
  • The stories CSV contains 449 examples and leaves one group with 29, not the 450 perfectly balanced described.
  • No API logs, request identifiers, costs, errors, filters or hashes of raw responses are published that allow reconstruction of the acquisition.
  • The stories test lexical presence in another generation, not consequences on readers, decisions or affected groups.
  • Other use domains, languages, open models or temporal changes of the same products are not evaluated.
  • ChatGPT refusal is measured by the presence of the phrase language model, a heuristic that may confuse or miss other forms of rejection.
  • The article does not identify which part of the patterns comes from pretraining data, instruction tuning, RLHF, prompt or subsequent mitigations.

What the study does not establish

  • It does not demonstrate that the models have beliefs, prejudices or internal personality equivalent to those of a person.
  • It does not estimate the prevalence of these stereotypes in all real queries or in current versions of GPT.
  • It does not prove that each positive word is harmful by itself; its interpretation depends on the pattern, the group and the social context.
  • It does not validate Marked Words as an exhaustive detector or as a universal automatic classification of stereotypes.
  • It does not causally establish that a specific training or mitigation technique produces the observed patterns.
  • It does not measure behavioral harm, discrimination in decisions, human reception or real downstream impact.
  • It does not demonstrate that White and man are adequate references in all countries, languages or communities.
  • It does not allow end-to-end reproduction of the human-model comparison with the published artifact.
  • It does not justify using synthetic identities as a substitute for real persons in research, design or product evaluation.

Traceability

Scope: Full text

Version: ACL 2023 long paper 84, pages 1504–1532; DOI 10.18653/v1/2023.acl-long.84; Social Impact Award

Consulted source: https://aclanthology.org/2023.acl-long.84.pdf

Review: Codex full-text, visual, code, data and lexical-robustness audit, 2026-07-15

Approval: Codex fidelity pass, 2026-07-15

English translation: approved, 2026-07-18

Models evaluated

  • GPT-4 API 2023-03-15-preview, generated May 2023, temperature 1, max_tokens 150
  • GPT-3.5 text-davinci-003, generated December 2022, temperature 1, maximum length 256
  • ChatGPT GPT-3.5 chat model, appendix refusal and prompt-sensitivity analysis
  • text-davinci-002, appendix comparison
  • OPT, BLOOM, and smaller GPT-3.5 models, attempted but excluded for incoherent zero-shot personas

Instruments and metrics

  • Marked Personas natural-language prompt framework
  • Marked Words weighted log-odds with informative Dirichlet prior and z > 1.96
  • One-vs-all support vector machines on anonymized bag-of-words features
  • Jensen-Shannon divergence via Shifterator
  • Ghavami and Peplau race/ethnicity stereotype lexicons
  • VADER compound sentiment score
  • Six persona prompts and two story prompts
  • Critical qualitative analysis grounded in markedness, intersectionality, essentialism, Orientalism, tropicalism and positive-stereotype literature

Data used

  • GPT-4 main personas: 1,350 released texts
  • text-davinci-003 main personas: 1,350 released texts
  • Kambhatla et al. human identity-portrayal dataset: 1,230 responses from 615 Prolific participants
  • text-davinci-003 story generations: 449 released rows versus 450 described
  • ChatGPT, text-davinci-002, positive-prompt and negative-prompt generation files
  • Ghavami and Peplau stereotype lexicon serialized as stereo_dict.pkl
  • GitHub repository myracheng/markedpersonas at commit 9b3ae82ad2621030b67f693d743f99f104365702

Evidence and location

  • Marking framework, question, contributions and scope: ACL paper pp. 1–3, Abstract, Introduction and Background
  • Prompts, Marked Words, models, groups, 2,700 persons and SVM/JSD controls: ACL paper pp. 3–5, Sections 3–4; Appendix Tables A9–A12
  • Human comparison, rates by lexicon and limits of closed lists: ACL paper pp. 5–6, Section 5 and Figures 1–2; Kambhatla et al. dataset documentation
  • Positive sentiment, exoticization, tropicalism, othering, resilience and anti-stereotypes: ACL paper pp. 6–9, Section 6, Table 3 and Figure 3
  • Stories, recommendations, critical refusal and limitations: ACL paper pp. 9–10, Sections 7–9; Appendix C, D.3 and Tables A13–A15
  • Metadata, DOI, pagination and Social Impact Award: ACL Anthology record 2023.acl-long.84, checked 15 Jul 2026
  • Artifact structure, main data and reproduction of Marked Words: GitHub myracheng/markedpersonas commit 9b3ae82, marked_words.py, README and main CSVs, audited 15 Jul 2026
  • Generation failures, missing paths, duplicates, labels and missing story row: Repository generators, notebooks and all released CSVs, static and tabular audit 15 Jul 2026
  • Robustness of full-token count versus substrings: Editorial reanalysis of released GPT-4 and text-davinci-003 main CSVs with stereo_dict.pkl, 15 Jul 2026