MASCRDM: Multi-Agent System for Compliance Risk Detection and Mitigation in Training Process of Large Language Models

1 INTRODUCTION

• Training-data stereotypes and biases can produce behavior biased toward protected groups, including by religion, race, and gender.The passage identifies security and fairness as significant compliance concerns for real-world applications.Source: §1 · p. 1
• Existing approaches lack a systematic mapping from compliance requirements to model components and training stages, alongside stage-aware mitigation.Prior methods focus largely on input/output filtering or localized internal interventions.Source: §1 · p. 2

Our Contributions

• MASCRDM monitors key training stages in real time and provides developers with internal risk analysis and suggestions.The system is described as spanning the LLM training process.Source: §1 · p. 2
• The AI Compliance Knowledge Graph encodes AI-law-based compliance knowledge, extracted with human compliance-law experts, as a base for detection and mitigation.The graph is intended to provide knowledge and skills for the multi-agent system.Source: §1 · p. 2
• Experiments on Qwen and Llama report stronger compliance-risk detection and suggestions while maintaining core model capabilities.The introduction describes evaluations on general and compliance datasets.Source: §1 · p. 2

LLMs input-side compliance mechanisms

• Data sanitization and filtering aim to reduce pre-training risks, but can compromise emergent intelligence; preference-based approaches and InfoPO offer alternatives, while real-time internal compliance remains unguaranteed.The passage describes this trade-off as the Alignment Tax.Source: §2 · p. 2

LLMs output-based compliance guardrails

• Output guardrails use moderation, filtering, decoding-time refinement, or process supervision, but remain external and can add inference latency or computational overhead.The passage contrasts these methods with intrinsic, representation-level compliance.Source: §2 · pp. 2–3

LLMs intrinsic compliance

• Intrinsic approaches include semantic bottlenecks (Zhao et al., 2025a; Yang et al., 2026), steering and attention interventions, unlearning, and optimization, yet static policies and single-model throughput remain concerns.The passage also notes that over-steering can collapse reasoning and that continual-alignment approaches use gradient constraints or experience replay.Source: §2 · p. 3

3 METHODOLOGY

• MASCRDM is presented as applicable across training paradigms, with supervised fine-tuning used as the representative setting here.The system combines real-time planning, risk detection, and mitigation based on AICKG.Source: §3 · p. 3

3.1 AI COMPLIANCE KNOWLEDGE GRAPH

• The AICKG maps AI-law-derived compliance risks to detection rules and training stages, covering data, model structure, and loss functions.For this work, human law experts encode bias and discrimination risks and rules in the graph.Source: §3.1 · p. 3

3.2 MULTI-AGENT COLLABORATION SYSTEM

• Five collaborating agents use a compliance-specific LLM and shared neutral-anchored triplet probes to monitor bias and discrimination across nine dimensions during training.The probes are batch-aware and compare stereotypical, counter-stereotypical, and neutral variants with matched semantics.Source: §3.2 · p. 4

3.2.1 PLANNING AGENT

• The Planning Agent maps AICKG detection rules to potentially risky training stages and schedules other agents while preserving each task’s regulatory origin.It does not audit samples or modify model parameters.Source: §3.2.1 · p. 4

3.2.2 DATA RISK DETECTION AGENT

• The data agent audits each training batch semantically against AICKG rules, flagging unjustified discrimination rather than treating protected-attribute mentions alone as risky.It covers nine protected dimensions and assigns batch-level risk status with sample-level handling instructions.Source: §3.2.2 · pp. 4–5

3.2.3 MODEL STRUCTURE RISK DETECTION AGENT

• The model-structure agent checks embedding completion gaps, attention-distribution deviations, and MLP activation differences, calibrating MLP scores separately by layer.For MLP risks, the agent aggregates the maximum across 36 probes for each neuron and calibrates layers separately.Source: §3.2.3 · pp. 5–6

3.2.4 MODEL OBJECTIVE RISK DETECTING AGENT

• The objective agent reports risk when any probe gives a risk variant lower token-normalized NLL than its neutral counterpart, without averaging across probes.A positive gap is the risk boundary and requires no percentile calibration.Source: §3.2.4 · p. 6

3.2.5 DATA ANALYSIS AND RISK MITIGATION AGENT

• Risk mitigation downweights or rewrites flagged samples before parameter updates and applies component-specific model corrections while separating detection signals from optimization targets.The objective distinguishes data and mitigation losses; mitigation remains active until the target margin is satisfied.Source: §3.2.5 · pp. 6–7

4.1 EXPERIMENTS SETUP

• Experiments used Qwen3-8B-Base and Llama-3.1-8B, Alpaca-Cleaned augmented with StereoSet examples, and BBQ, CrowS-Pairs, and BOLD evaluations against three debiasing baselines.The tracked training indicators were neutral-anchored completion gap, symmetric KL, neuron response, and loss-level signed gaps; metrics included semantic accuracy and bias measures.Source: §4.1 · p. 7

4.2 MAIN RESULTS

• 63.12% on Qwen3-8B and 51.05% on Llama3.1-8B: MASCRDM achieved the highest overall BBQ accuracy across both architectures.It outperformed the base models and strong baselines, including Bias Unlearning and KLAAD.Source: §4.2 · p. 8, Table 1 · p. 8
• 50.14% A.Dis on Llama3.1-8B with MASCRDM, versus 41.31% with Bias Unlearning, indicates stronger disambiguated-accuracy retention.The paper contrasts this with prior debiasing techniques that degrade performance on non-ambiguous tasks.Source: §4.2 · p. 8
• On Qwen3-8B, MASCRDM paired B.Amb = 3.32 with A.Amb = 51.71%, achieving the lowest ambiguous bias score alongside competitive accuracy.Values closer to 0 are optimal for B.Amb.Source: §4.2 · p. 8
• On CrowS-Pairs, MASCRDM provided moderate, utility-preserving bias reduction; Bias Unlearning debiased most strongly, while KLAAD could worsen stereotype preference.MASCRDM’s CrowS-Pairs performance was better than the Qwen3-8B base model and fell between methods on Llama3.1-8B.Source: §4.2 · p. 8
• On selected BOLD types, MASCRDM was best or tied-best on Profession and Race Sentiment, and showed stable compliance improvements for Political ideology.The paper reports greater stability across sensitive types and a more balanced compliance profile than KLAAD, Fairness Mediator, and Bias Unlearning.Source: §4.2 · p. 8, Table 2 · p. 9
• Training time overhead increased approximately by 55.75%, while memory overhead increased by 2.14%.On Llama3.1-8B, MASCRDM generally had lower training loss than standard SFT after the initial phase, with predominantly small changes in sensitive-word embedding distances.Source: §4.2 · pp. 8–9, Figure 2 · p. 9

5 CONCLUSION

• The empirical evaluation is limited to bias and discrimination, while the authors describe MASCRDM as extensible to other legally defined and emerging risks.The conclusion presents the system as a real-time planning, detection, and mitigation framework spanning key training stages.Source: §5 · p. 10

B AI COMPLIANCE KNOWLEDGE GRAPH

• Human legal experts help review AI regulations and encode their compliance requirements in AICKG, which links laws, risks, training stages, and detection rules.Each rule connects to its legal source, addressed risk, and relevant training stage.Source: B AI COMPLIANCE KNOWLEDGE GRAPH · p. 16, A LAWS AND REGULATIONS RELATED TO AI · p. 16
• AICKG specifies which risks and rules to monitor at each training stage, but not how to measure them inside the model or intervene.MASCRDM coordinates detection and mitigation agents to turn natural-language rules into model-level signals and actions.Source: B AI COMPLIANCE KNOWLEDGE GRAPH · p. 16

C DECISION SKILL OF PLANNING AGENT

• The Planning Agent identifies potentially risky stages, retrieves relevant AICKG rules, and schedules detection agents without auditing samples or changing model parameters.The Data Risk Detection Agent performs batch-level semantic auditing; the Data Analysis and Risk Mitigation Agent handles risk analysis and mitigation.Source: §C.1 · p. 16

C.1 SCOPE AND FORMAL DEFINITION

• The planning projection represents training stages, risk records with indicators, and rules with applicable risk categories and functional descriptions.Rule identifiers preserve access to regulatory provenance; matching regulatory text retrieves potentially relevant risks and rules, not proof of a violation.Source: §C.1 · p. 17

C.2 FORMAL EXECUTION PROCEDURE

• RiskMiner matches regulatory text to candidate risks, maps them to stage-compatible rules, and schedules detection tasks while retaining stage and rule identifiers.Matching can use exact, substring, or semantic retrieval; an unmatched scope is recorded without declaring the training process compliant.Source: §C.2 · p. 18

C.3 ALGORITHMIC IMPLEMENTATION

• RiskMiner takes the AICKG projection and regulatory text, then returns matched stages, candidate risks, and mapped rules for detection scheduling.The algorithm supports exact, substring, or semantic matching with a configured semantic threshold.Source: §C.3 · p. 18, D SUPPLEMENTARY DETAILS OF COMPLIANCE… · p. 19

D SUPPLEMENTARY DETAILS OF COMPLIANCE DETECTION AND MITIGATION

• At each audited training step, the instance checks the current batch and model state before optimization and applies mitigation when risk is detected.The appendix describes these algorithms as the experimental instantiation of the broader collaborative framework.Source: D SUPPLEMENTARY DETAILS OF COMPLIANCE… · pp. 18–19

D.1 PROBE SET AND SENSITIVE WORD PAIRS

• The auditing probes use 36 triplets across nine bias categories, with matched S, C, and N variants sharing an identical completion.The neutral variant anchors comparisons of the two group-specific contexts and their asymmetry.Source: §D.1 · p. 19

D.2 DATA RISK DETECTION AGENT

• The Data Risk Detection Agent screens each batch for biased, discriminatory, stereotypical, or exclusionary content and flags samples for allow, downweight, or rewrite actions.Risk level summarizes prevalence and semantic severity; flagged samples are handled individually rather than discarding the whole batch.Source: §D.2 · pp. 19–20

D.3.1 EMBEDDING RISK DETECTION

• Embedding detection tests whether a sensitive-group context makes a shared completion easier to predict than its neutral counterpart; mitigation applies minimum-norm corrections to editable group-specific embeddings.Shared completion and matched context tokens remain unchanged; simultaneous proposals to a vocabulary row are averaged before direct updating.Source: §D.3.1 · p. 20, §D.5.1 · pp. 22–23

D.3.2 ATTENTION RISK DETECTION

• Attention risk uses neutral-anchored symmetric KL on aligned token positions; witness-specific projections remove components along active risk directions, leaving prompt and padding states unchanged.The comparison measures two neutral-anchored redistributions and their asymmetry; the intervention is restricted to supervised completion positions.Source: §D.3.2 · p. 20, §D.5.2 · pp. 23–24

D.3.3 MLP NEURON ACTIVATION RISK DETECTION

• MLP detection calibrates neuron risk separately within each layer; mitigation gates risky neurons’ parameter updates without directly editing their weights.A neuron is flagged against the larger of its own baseline and the layer-level 90th percentile.Source: §D.3.3 · p. 21, §D.5.3 · p. 24

D.4 MODEL OBJECTIVE RISK DETECTION AGENT

• Objective detection compares token-normalized full-sentence NLL for each risk variant against the same neutral reference; every triplet contributes to the neutral-margin objective when unsatisfied.The binary detection result is not a hard optimization gate, and risks are retained per probe rather than averaged across probes or categories.Source: §D.4 · p. 22, §D.5.4 · p. 24

D.5 DATA ANALYSIS AND RISK MITIGATION AGENT

• The Data Analysis and Risk Mitigation Agent receives alerts and metric records from all detectors for real-time monitoring and post-hoc root-cause analysis.Each record includes the training step, risk source, affected module, bias category, and alert-triggering metric.Source: §D.5 · p. 22

D.5.4 MODEL OBJECTIVE RISK MITIGATION

• Mitigation uses localized interventions at data, representation, objective, and embedding levels rather than replacing the supervised fine-tuning objective.The authors state this preserves the original supervised fine-tuning process while reducing detected compliance risks.Source: §D.5.4 · p. 24

E EXPERIMENT PARAMETERS

• The experiment-parameter section distinguishes the common fine-tuning configuration from MASCRDM's additional auditing settings.The shared parameters and real-time auditing parameters are reported separately in Tables 3 and 4.Source: E EXPERIMENT PARAMETERS · p. 25, §E.2 · p. 25, Table 3 · p. 25

E.1 SHARED FINE-TUNING PARAMETERS

• Compared methods use the same source corpora and core optimization settings, with model paths and output directories varying by method.The paper states the shared configuration is used to ensure a fair comparison.Source: §E.1 · p. 25, E EXPERIMENT PARAMETERS · p. 25, Table 3 · p. 25

E.2 MASCRDM REAL-TIME AUDITING PARAMETERS

• MASCRDM adds real-time auditing parameters to the shared fine-tuning configuration for process-level compliance monitoring.Table 4 reports parameters specific to the MASCRDM instance.Source: §E.2 · p. 25, Table 4 · p. 25

F.1 BBQ

• BBQ separates ambiguous from disambiguated question answering; it reports accuracy and bias scores, with ambiguous bias adjusted for the error rate and scores nearer zero preferred.Higher ambiguous-context accuracy indicates fewer unsupported demographic assumptions, while higher disambiguated-context accuracy reflects stronger reasoning when evidence is available.Source: §F.1 · p. 26

F.2 CROWS-PAIRS

• CrowS-Pairs compares model likelihoods for stereotypical and anti-stereotypical sentences; its Stereotype Score is best near 50, not simply higher or lower.Scores above 50 indicate stereotypical preference and scores below 50 indicate anti-stereotypical preference.Source: §F.2 · pp. 26–27

F.3 BOLD

• BOLD evaluates affective deviations in generated continuations of demographic-related prompts, using sentiment, VAD, and BE5 measures interpreted as better when closer to neutrality.VAD covers valence, arousal, and dominance; BE5 covers joy, anger, sadness, fear, and disgust.Source: §F.3 · pp. 27–28

F.4 SUMMARY OF METRIC DIRECTIONS

• Together, BBQ measures stereotype reliance in question answering, CrowS-Pairs measures sentence-pair likelihood preference, and BOLD measures affective deviations in open-ended generation.Source: §F.4 · p. 28

G.1 ORIGINAL FINE-TUNED MODEL

• The original fine-tuned model is the comparison baseline: it receives Alpaca-cleaned and risk-injected StereoSet data without additional compliance detection or mitigation.Source: §G.1 · p. 28

G.2 KLAAD

• KLAAD aligns attention distributions for stereotype pairs while preserving fluency and coherence, and the comparison uses two-stage tuning on Alpaca-cleaned data followed by StereoSet-derived triplets.Its objective combines language-modeling cross-entropy, attention alignment, and a triplet loss.Source: §G.2 · pp. 28–29

G.3 FAIRNESS MEDIATOR

• Fairness Mediator probes and neutralizes selected MLP activations after fine-tuning; its milder main configuration avoids the severe semantic loss observed with stronger intervention.The reported main configuration uses λFM = 1, Niter = 3, and ktop = 3.Source: §G.3 · pp. 29–30

G.4 BIASUNLEARNING

• The reproduction first fine-tunes on Alpaca-cleaned data, then applies BiasUnlearn to StereoSet-derived stereotype-forget, anti-stereotype-retain, and unrelated-data streams.The unrelated stream supports capability preservation through distributional regularization.Source: §G.4 · p. 30
• Negative Preference Optimization suppresses stereotypical responses, cross-entropy trains on anti-stereotypical examples, and KL regularization constrains predictions on unrelated examples.Source: §G.4 · p. 30
• The adaptation retains an adversarial forget set and swaps forget/retain roles when a category’s StereoSet score falls below 50 to counteract bias reversal.Source: §G.4 · p. 30
• Figure 4 shows Qwen3-8B loss trajectories and MASCRDM-minus-SFT pairwise sensitive-word embedding-distance changes, with different color scales across panels.Red and blue denote increases and decreases in embedding distances, respectively.Source: Figure 4 · p. 31

H.1 EVALUATION METRICS DURING TRAINING ON QWEN3-8B

• MASCRDM causes only minor changes to Qwen3-8B loss and embedding space, suggesting that original model performance is well preserved.Source: §H.1 · p. 31

H.2 ABLATION STUDY

• Overall accuracy increases by 2.18% while both ambiguous and disambiguated bias scores move closer to zero for the complete model versus the original backbone.Source: §H.2 · p. 31
• Data auditing provides the largest and most consistent overall-accuracy improvement, while attention intervention and the margin objective trade off ambiguous and disambiguated accuracy.Embedding correction and MLP gradient gating yield smaller standalone BBQ gains but provide fine-grained control over attribute representations and neuron updates; the complete model does not lead on every sub-metric.Source: §H.2 · p. 31

• A separate ablation study evaluates MASCRDM on BBQ and CrowS-Pairs using accuracy and bias score, including ambiguous and disambiguated contexts.Source: Table 5 · p. 32
• The BOLD evaluation covers multiple domains and emotional dimensions across Parts 1/5, 2/5, and 3/5.Source: Table 6 · p. 33, Table 7 · p. 34, Table 8 · p. 35
• The remaining BOLD evaluation tables cover Parts 4/5 and 5/5 of the same multi-domain, emotional-dimension evaluation.Source: Table 9 · p. 36, Table 10 · p. 37

Annotation protocol

• The annotation protocol counts repeated ideological, gender, and religious labels separately from candidate bias spans, which flag evaluative group generalizations, stereotypes, or antagonistic framing.These are provisional annotations for the examples; factual accuracy is not evaluated.Source: §H.4 · p. 38

Case 1: Political Ideology (Socialism)

• For the socialist-state prompt, no candidate bias span is identified; MASCRDM repeats its description, increasing its sensitivity count without establishing discriminatory content.Source: §H.4 · p. 38

Case 2: Political Ideology (Communism)

• For the communist-state prompt, KLAAD receives three bias flags for categorical political claims, while other responses receive none; Fairness mediator's gender references are unrelated to the prompt.Source: §H.4 · p. 39

Case 3: Race (European American)

• In the European American-category case, continuations mainly discuss political identity; the Original response's quoted “common enemy” framing is flagged without implying model endorsement.Source: §H.4 · pp. 39–40

John Wayne case

• For John Wayne, KLAAD's “any native Texan” is flagged as a candidate regional stereotype, while praise of Wayne alone does not establish gender bias.Source: §H.4 · pp. 40–41

Case 5: Religious Ideology (Islam)

• For the Islam prompt, no candidate bias span is identified, and larger sensitivity counts in longer responses should not be interpreted as greater discrimination.Source: §H.4 · p. 41

Cross-case interpretation

• Across the five cases, sensitivity counts are selected topic references, not fairness rankings; the examples do not establish that any method is consistently less biased than every baseline.Source: §H.4 · pp. 41–42