Removing names does not remove race from a résumé
We measured it: a résumé with no name at all still disclosed race through the ZIP code and the university — more strongly than the name itself. Stripping identifiers is not a mitigation. It is theatre.
Show the model two résumés that are identical word for word — one says Jamal, the other says Greg — and ask which applicant is Black:
- From the home address alone, it is right about 49 times out of 50
- From the university alone, about 49 times out of 50
- From the name — the one thing blind-hiring policies remove — about 19 times out of 20
You did not take away its best clue. You took away its worst one.
Why is race in four places at once? Because segregation did not operate on one dimension. It ran through housing, education, association and employment simultaneously — redlined neighbourhoods set which schools a child could attend, those schools set which universities were reachable, those universities set which networks opened, those networks set which employers ever saw the application. Each link was enforced separately, so each link now carries the signal separately. A résumé describes a life; if the life was shaped by race, the résumé carries race in several places at once. Deleting one line closes one door in a house that was built with several.
That is what a “proxy” is: something on the résumé that isn’t race but gives it away anyway. A ZIP code is not race — but if a neighbourhood is 96% Black, writing that ZIP down tells a computer nearly as much as writing the person’s race would. Nobody has to intend it. The model works it out on its own. The full history is below.
How to read the scores below. They run from 0.5 to 1.0. 0.5 means the model is guessing at random — it has learned nothing from the résumé. 1.0 means it is right every single time. There are only two possible answers, so random guessing gets you 0.5. Anything above that is real information the model picked up. (The technical name for this measure is AUC.)
Detection is the product. Erasure is not removal — we measured that too, and we publish what survives it. Measured on a white-collar résumé corpus that is 41% software/IT and 23% finance; we scope claims to tech and finance hiring, not to hiring generally.
Note on that CSV: its erase_after_auc column reads 0.500 throughout. That column is retracted — the erasure direction and the post-erasure probe were fit on the same channel, so 0.500 was guaranteed by construction. Detection columns stand.
The measurement
Four signals, four AI models, 500 résumé pairs each
Every pair of résumés is identical word for word except for one detail — so any difference in what the model reads has to come from that detail alone.
| What’s on the résumé | What was changed | Model guesses race(0.5 = random guess) | In plain words |
|---|---|---|---|
| Home ZIP codePROXY | address line only | 0.984 | right ~49 times out of 50 |
| University (HBCU)PROXY | education line only | 0.983 | right ~49 times out of 50 |
| Gender | first name + pronouns | 0.979 | right ~24 times out of 25 |
| Race (by name) | first name only | 0.945 | right ~19 times out of 20 |
The proxies score higher than the name. Any mitigation that removes only explicit identifiers leaves the stronger pathway wide open — and nothing in a standard fairness review would catch it.
Why race shows up in four different places
Segregation did not operate on one dimension. It ran through housing, education, association and employment at the same time — redlined neighbourhoods set which schools a child could attend, those schools set which universities were reachable, those set which networks opened, and those set who ever saw the application. Each link was enforced separately, so each one now carries the signal separately.
That is why deleting one field cannot work — and why, when we measured it, the four traces sat in largely different parts of the model.
Read the full findings, method and historyRetracted 2026-07-28: erasure does not remove the attribute. Detection is the product. Erasure is not removal: rank-3 erasure leaves race readable at 0.947-0.993 on the same model, 0.949-0.998 on a channel never used in the fit, and 0.996-1.000 cross-channel (4 models x 600 real resumes). Removing race from ONE channel took k=12 directions (surname linear 0.535 / MLP 0.508) and left ZIP 0.9936, school 0.9958, first name 0.986 untouched. The edit is cheap (qualification 0.4677 -> 0.4672) but it moved top-10 selection share beyond a random-direction control on 1 of 4 models.
Collateral damage from the edit is small — profession accuracy moves by at most ±0.008 (mean 0.002) across the 16 model-axis runs. That is the one thing the old “drops to 0.500” claim got right: the edit is cheap. What it does not buy you is removal.
A norm-matched random direction is a floor to beat, not a zero (Rogue Scalpel, arXiv 2509.22067).
Why now
Proxy testing is named in regulation — and insurance is where it bites hardest
Current as of July 2026, and we scope every engagement to the regimes that actually apply to you.
NY DFS Circular Letter No. 7
Insurers (New York)
Names the quantitative tests by name and requires proxy assessment before production and on a regular cadence — plus independent review and effective challenge. Insurers may not rely solely on a vendor's claim of non-discrimination.
Colorado Reg 10-1-1
Insurers (life, auto, health)
Governance and testing obligations for external consumer data, extended beyond life to auto and health from October 2025.
California FEHA — ADS regulations
Employers & their AI vendors
Evidence of anti-bias testing is expressly relevant — and its absence counts against you. AI vendors are themselves covered as agents.
NYC Local Law 144
Employers & vendors
Annual independent bias audit for automated employment decision tools, published publicly.
What you get
An artifact that survives an auditor
- Per-axis leak table: which attributes your system can read, and how strongly
- Proxy coverage — address, institution, and custom proxies specific to your data
- Post-erasure read-back on channels the erasure fit never saw, with the qualification signal measured separately — we report what survives, not a number the fit guaranteed
- Named judge for every number — held-out probes, never the model grading itself
- A content hash you can recompute offline against the released result data
- Stated limitations, including which proxies were not tested
Checkable against the data you were handed
Every report carries a content hash you can recompute offline — an unkeyed SHA-256 over the result data, alongside the judge named for each number. Recompute it yourself and it either matches the released data or it does not.
What it is not: it is not signed, not timestamped, and not yet persisted server-side, so it proves the report matches the data you were handed — not who produced it or when. Anyone who can change both can change the hash with them. Signing is not shipped; we will not call it signed until it is.
See a sample reportWhat this does not claim
- • Findings above come from a controlled matched-pair evaluation, not a live end-to-end pipeline. Direction of findings is the takeaway; your pipeline should be audited on your own data.
- • Coverage is a choice. A proxy we did not test may still leak — every report states which axes were and were not covered.
- • Detection is measured on the representation. Whether a leak changes a final decision depends on your downstream ranking, which we audit separately.
- • The eraser is a published, open-source method. We do not claim to have invented it — what we sell is the measurement, the proxy coverage, and the evidence.
- • Retraction (2026-07-28). We previously published “after mitigation every axis drops to 0.500.” That result was circular: the erasure direction and the post-erasure probe were fit on the same channel, so chance was guaranteed by construction. It was never evidence of removal and must not be cited as such — including the
erase_after_auccolumn in the CSV linked above. - • We do not sell removal. Erasure edits one channel; race stays readable from the others, and stripping identifiers was never the fix. If your requirement is “the attribute is gone,” we cannot meet it today and will say so.
- • The résumé corpus is 41% software/IT and 23% finance. Findings are scoped to white-collar tech and finance hiring; we have not measured hourly, clinical, industrial, or public-sector hiring and do not generalise to them.
- • We do not compute a disparate-impact ratio from a single document. The EEOC four-fifths ratio is a pool statistic — selection rates across a set of candidates — and is undefined for one pasted résumé. Any per-document score we return is an internal leakage index with no legal threshold attached, and is not a Title VII, ECOA, or four-fifths finding. (ECOA disparate impact was deleted 21 Jul 2026, 91 FR 21620.)
Find out what your model reads
Bring a model and a sample of records. We will tell you which protected attributes it can recover, which proxies carry them, and how much of that survives the mitigation you already have. We measure; we do not promise removal.
Request an audit