The paper studies five deployed LLMs as hate-speech classifiers under four political-persona prompts. Its strongest contribution is an operational trade-off hidden by one headline number: models classified as more “censored” by an external metric produce more usable outputs and therefore achieve higher strict accuracy, while the so-called “uncensored” models classify better after they do return a valid binary label. It also documents that political wording moves decision thresholds, especially in the latter group. This is not, however, a causal experiment on safety alignment or a test of internal ideology: it compares only five different systems, uses UGI as a proxy for deployed censorship, has no no-persona condition, and combines semantic mistakes, refusals, filters, API failures, and format errors in its main metric.
Version lineage is essential. The v1 preprint and several still-visible records report 78.7% versus 64.1%. The final version acknowledges that earlier result lineages silently dropped unparseable rows, preserves all 65,340 expected responses, and corrects the comparison to 69.0% versus 64.1%. It also changes aggregate ECE to 0.060 and adds much better model and parsing documentation. This audit uses only arXiv v2 and the ACL 2026 long paper; 78.7% is not the current result. The correction is a methodological strength, although the bundle needed to verify it is not publicly available on the inspected surfaces.
The benchmark is Latent Hatred, an English corpus from Twitter, Gab, Stormfront, and Yahoo containing 21,480 posts: 1,089 explicit hate, 7,100 implicit hate, and 13,291 not hate. The authors retain all 1,089 explicit posts and sample 1,089 implicit and 1,089 not-hate posts, producing 3,267 items balanced 1:1:1 across the original categories. Once explicit and implicit are merged as HATE, the binary task is 2:1 against NOT_HATE. Overall accuracy consequently weights hate recall twice as much as the benign class; content-type disaggregation is necessary.
The five systems are selected with Uncensored General Intelligence (UGI), a community leaderboard combining willingness to answer and accuracy on contentious factual questions. The lower-UGI group, called “censored,” contains o3-mini (22.80) and Llama-3.1-405B-Instruct served through Vertex AI (18.48). The higher-UGI “uncensored” group contains Mistral Medium (56.77), GPT-4o-2024-08-06 (49.85), and Mistral Large 2411 (53.16). GPT-4o's placement shows that these are operational, relative labels rather than general product descriptions. UGI does not directly measure RLHF, policy compliance, jailbreak resistance, or safety. LMArena Elo approximately matches capability, but architecture, scale, training data, family, provider, and deployment filtering remain confounded.
Each post is shown once to every model-persona combination, Progressive, Conservative, Libertarian, and Centrist, for 3,267 × 5 × 4 = 65,340 calls at temperature 0.7 with no repeats. JSON outputs should contain HATE, NOT_HATE, or CANNOT_CLASSIFY, a 0-1 confidence score, and reasoning. The appendix prompts are highly directive Western political archetypes. Progressive emphasizes social justice, microaggressions, and coded harm; Libertarian opposes censorship in almost all forms. Threshold movement is partly expected compliance with these instructions. There is no unpersonated baseline or reasoning manipulation check, so contrasts estimate relative sensitivity to four prompts, not departure from neutral behavior or a stable latent ideology.
Strict accuracy treats a wrong binary label and every unusable outcome, CANNOT_CLASSIFY, truncation, provider filter, transport/API failure, or unrecoverable JSON, as errors. This is a useful end-to-end availability measure because any non-actionable moderation output requires escalation. It is not pure semantic classification accuracy. Overall, 19.5% of responses have no binary prediction and strict accuracy is 66.1%. Censored reaches 69.0% and uncensored 64.1%. Decomposition reverses a simple reading: censored has 12.6% null/refusal outcomes plus 18.5% misclassification, while uncensored has 24.2% plus 11.7%. Conditional on a usable label, censored misclassifies 21.1% and uncensored 15.4%. The former's strict advantage comes from answering actionably more often, not from better discrimination after answering.
Performance changes sharply by content. On explicit hate, uncensored is much better: 91.4% versus 76.0%. On implicit hate, censored reaches 74.7% versus 67.3%. On not-hate posts, both are weak and the difference is 56.2% versus 33.7%. These patterns indicate different trade-offs among explicit-hate recall, sensitivity to implicit cues, and false positives on benign content. Among implicit subtypes, irony is hardest at 64.4%, followed by incitement and threatening at roughly 71%; the residual “other” category reaches 83.1%. These are descriptive properties of this corpus and five July-2025 endpoints, not permanent model-family traits.
Aggregated persona strict accuracy is 67.8% Progressive, 66.7% Centrist, 66.0% Conservative, and 63.7% Libertarian. Progressive has a higher false-positive tendency and lower false-negative tendency; Libertarian shifts in the opposite direction. The paper calls these “liberal bias” and “conservative bias,” but they are operational error-direction labels, not externally validated ideology. Censored model averages span only 0.7 percentage points across personas, while uncensored spans 6.7. This supports greater relative stability under these prompts, not neutrality or a politically correct ideological anchor.
A post-clustered logistic analysis reports a UGI-category × persona interaction, Wald chi-square(3)=101.279, p<0.001; the joint persona effect is not significant within censored, chi-square(3)=3.341, p=0.342, and is significant within uncensored, chi-square(3)=207.635, p<0.001. Apparent precision needs caution. UGI category is assigned at the model level and there are only two versus three model units; clustering by post does not represent uncertainty in that model-level treatment. The public manuscript gives no formula, coefficient table, cluster implementation, or executable code. There are also no repeat draws, seed intervals, paired bootstrap, model random effect, or McNemar tests. The same temperature does not guarantee symmetric or conservative noise across providers, refusals, and nonlinear metrics.
The target-group analysis aggregates 19,800 response instances corresponding to 990 annotated posts: 19,320 implicit-hate, 380 explicit-hate, and 100 not-hate instances after replication across models and personas. A post may contribute to multiple groups. Reported n values are repeated responses rather than independent posts, and groups have different class and difficulty composition. Near-duplicate target labels remain separate, black folks, blacks, and black_people; jews and jewish_people; whites and white_people. The headline 54.8-point gap compares non-whites at 91.2% with not specified at 36.3%; “not specified” is not a comparable demographic group. Results are pooled across models and personas, so they cannot locate which system causes a disparity. The analysis finds benchmark heterogeneity worth follow-up, but does not itself establish unequal protection in deployment or causal discrimination.
Calibration is computed only on the 80.5% of outputs with a usable label; refusals and failures, the main group difference, are excluded. Aggregate ECE is 0.060, moderate rather than catastrophic. The sharper concern is conditional on being wrong: mean confidence is 80.1% for explicit hate errors, 81.9% for implicit hate errors, and 84.1% for not-hate errors; 57.0% of not-hate errors exceed 0.8. This matters for human-in-the-loop moderation, but prompted self-reported confidence is not a logit-derived probability and pooled ECE can hide model-, class-, and persona-specific miscalibration.
Public reproducibility remains incomplete. The appendix says a bundle sealed on 20 April 2026 contains canonical data, requests, raw JSONL, combined results, figures, lockfiles, code/07_audit_bundle.py, and reproduce.sh. ACL Anthology links only the PDF and checklist; arXiv contains manuscript source and figures. The first author's public sanjerine/beyond-words repository is a 2024 dissertation project with no releases, old notebooks, and a latest directory still marked “in progress”; it does not contain the final experiment. OpenReview is challenge-gated, so an unindexed supplement cannot be ruled out. Totals can be checked arithmetically, but responses, hashes, target cleaning, regression, and figures cannot be independently audited or regenerated. The precise conclusion is “not publicly recovered,” not “nonexistent.”
The official checklist says scientific artifacts were used and result statistics reported, but answers no to documenting a specific check for identifying/offensive content and its protections. This matters because Latent Hatred contains real social-media hate. The paper discusses dual-use persona steering, dignity of targeted groups, and subjective definitions, but does not describe an audit of usernames, deleted quotations, platform terms, or governance of raw reasoning.
A rigorous reading preserves a useful finding. For these five deployments and this benchmark, lower-UGI systems are more reliable as a service because they fail less often to produce an actionable output; higher-UGI systems recognize explicit hate better and make fewer mistakes after answering, but are more sensitive to political wording and produce many more null outputs. The evidence supports separating availability, refusal, discrimination, prompt sensitivity, and calibration. It does not show that safety alignment causes better hate-speech detection, that UGI measures safety, that personas reveal internal ideology, that a deployment fairness gap has been established, or that results generalize beyond five 2025 endpoints and one English corpus.