Iterative Null-space Projection (INLP)

• INLP is a model-agnostic technique that iteratively removes linear signals tied to protected attributes by projecting representations onto the null-space of trained linear classifiers.
• The process involves training a classifier, computing its row-space, and projecting the data to eliminate target attribute signals, ensuring that subsequent predictions reach chance-level accuracy.
• Widely applied in bias mitigation and fairness interventions, INLP has demonstrated effectiveness in debiasing word embeddings and translationese, while prompting research into its geometric side effects and alternatives.

Searching arXiv for recent and foundational papers on INLP and closely related work. Iterative Null-space Projection (INLP) is a post-hoc, model-agnostic method for removing linear information about a designated target attribute from learned representations while preserving as much task-relevant information as possible. Introduced for guarding protected attributes in neural representations, INLP repeatedly trains a linear classifier to predict the attribute of interest and then projects the representations onto the null-space of the classifier’s row space, thereby eliminating the linear directions used by that classifier (Ravfogel et al., 2020). In the NLP literature, the method has been used for bias mitigation, fairness interventions, and amnesic probing; later work has also scrutinized its geometric side effects and proposed single-projection or closed-form alternatives (Haghighatkhah et al., 2022, Dobrzeniecka et al., 13 Jun 2025).

1. Definition and mathematical construction

INLP assumes a representation vector $h \in \mathbb{R}^d$ or a matrix of representations $X \in \mathbb{R}^{n \times d}$, together with a protected or target attribute $z$ with $k$ possible classes. Its objective is to transform the representation so that, after transformation, no linear classifier should be able to predict $z$ better than chance from the representation (Ravfogel et al., 2020).

At each iteration, a strong linear classifier is trained on the current representations to predict the target attribute. Common choices are multiclass logistic regression with $L2$ regularization and linear SVM. For softmax classifiers,

$p(z=i \mid h) = \mathrm{softmax}_i(W h + b).$

If the classifier has weight matrix $W \in \mathbb{R}^{k \times d}$, INLP removes the row space of $W$ by projecting onto its orthogonal complement. Using an orthonormal basis $Q$ for the row space,

$X \in \mathbb{R}^{n \times d}$0

Using $X \in \mathbb{R}^{n \times d}$1 directly, assuming full row rank,

$X \in \mathbb{R}^{n \times d}$2

and when $X \in \mathbb{R}^{n \times d}$3 is rank-deficient,

$X \in \mathbb{R}^{n \times d}$4

With thin SVD $X \in \mathbb{R}^{n \times d}$5, letting $X \in \mathbb{R}^{n \times d}$6 denote the right singular vectors corresponding to nonzero singular values,

$X \in \mathbb{R}^{n \times d}$7

The transformed representation is then $X \in \mathbb{R}^{n \times d}$8, or in matrix form,

$X \in \mathbb{R}^{n \times d}$9

The total projection after $z$0 iterations is the composition

$z$1

Efficient application avoids forming dense projectors and instead uses

$z$2

with cost $z$3 per iteration (Ravfogel et al., 2020).

A central guarantee is immediate for the trained classifier: projecting onto the exact null-space of the row space ensures that, for any $z$4,

$z$5

up to numerical precision, so the specific classifier’s logits reduce to the bias term and become independent of $z$6 (Ravfogel et al., 2020).

2. Iterative procedure, stopping, and implementation

The basic INLP loop initializes $z$7, then alternates between fitting a linear classifier on $z$8, computing the projection matrix from the classifier’s row space, projecting the current representations, and evaluating whether the target attribute remains linearly recoverable (Ravfogel et al., 2020). Retraining after each projection is essential because a single projection may fail to remove residual linear signals not captured by the first classifier, for example because of regularization, class imbalance, or a weak probe (Ravfogel et al., 2020).

Stopping is typically based on one of three criteria: probe performance reaching near chance, a fixed number of iterations, or a rank or utility budget. Chance-level stopping is often phrased as validation accuracy approaching $z$9, or balanced accuracy approaching $k$0 in multiclass settings (Ravfogel et al., 2020). Validation-based early stopping is also used when downstream utility begins to degrade while fairness gains plateau (Ravfogel et al., 2020).

Several implementation details recur across the literature. SVD is preferred for constructing the row-space basis and for numerical stability; pseudoinverses are used when $k$1 is rank-deficient; and accumulated bases may be re-orthonormalized with procedures such as Gram–Schmidt or QR to prevent drift (Ravfogel et al., 2020). For large $k$2, batching and low-rank application of the projector are standard efficiency measures (Ravfogel et al., 2020).

In applied work on translationese debiasing, the procedure is instantiated almost literally. Linear classifiers are trained on fixed sentence or word embeddings, projections are computed with the SVD-based INLP implementation, and iteration continues until the translationese classifier reaches chance accuracy, approximately $k$3 on balanced data (Chowdhury et al., 2022). In that study, reported iteration counts for NLI debiasing were $k$4 for sentence-level SNLI, $k$5 for aligned word-level debiasing, and $k$6 for joint word-level debiasing (Chowdhury et al., 2022).

3. Guarantees and limitations of linear erasure

INLP removes linear information. More precisely, it ensures that the transformed representation is not linearly separable along directions spanned by the accumulated row spaces of the trained probes (Ravfogel et al., 2020). This is the sense in which the method “removes” a protected attribute: it eliminates linear signals of that attribute from the representation as seen by the sequence of linear classifiers used during the procedure (Ravfogel et al., 2020).

The method does not guarantee removal of nonlinear information. Nonlinear classifiers, quadratic interactions, or other nonlinear functionals of the representation may still recover the target attribute after INLP (Ravfogel et al., 2020). This limitation is explicit in both the original formulation and later critiques. Work on amnesic probing argues that, although INLP is commonly used to remove a target property, its repeated projections can introduce collateral modifications to the overall space, complicating causal interpretation of downstream performance changes (Dobrzeniecka et al., 13 Jun 2025).

Dimensionality reduction is intrinsic to the method. If iteration $k$7 removes a subspace of rank $k$8, then the effective dimension is reduced by the rank of the union of the removed subspaces, and in the multiclass case $k$9 (Ravfogel et al., 2020). This explains why aggressive use of INLP can alter geometry more broadly than the target attribute alone.

A worked binary example makes the construction explicit. For a classifier weight vector

$z$0

the projection matrix is

$z$1

For

$z$2

the projected vector is

$z$3

and $z$4, so that classifier’s logit becomes independent of $z$5 (Ravfogel et al., 2020).

4. Empirical uses in bias mitigation and representation editing

The original evaluation of INLP focused on bias and fairness use-cases. In word embeddings, INLP reduces the ability of linear gender classifiers to predict gender-associated signals and alters nearest-neighbor structure so that words whose neighborhoods are dominated by gendered terms become more neutral after projection (Ravfogel et al., 2020). Appendix examples in that work identify strong shifts for gendered terms such as “mr., mrs., his, her, he, she,” as well as profession-associated words (Ravfogel et al., 2020).

In text classification, the method has been applied to bag-of-words or neural sentence representations for multi-class profession classification with gender as the protected attribute. The reported pattern is a strong drop in attribute-prediction accuracy from high pre-INLP accuracy to near chance after $z$6 iterations, alongside improved demographic parity and more balanced macro-F1 across protected groups, with modest decreases in downstream accuracy or F1 (Ravfogel et al., 2020).

A distinct application concerns translationese. In "Towards Debiasing Translation Artifacts" (Chowdhury et al., 2022), INLP is used to remove the signal distinguishing original from translated text from sentence and word embeddings. Sentence-level translationese classification accuracies before debiasing were reported as $z$7–$z$8 for fastText, $z$9–$L2$0 for mBERT_CLS, $L2$1–$L2$2 for mBERT_pool, and $L2$3–$L2$4 for XLM-R CLS; after INLP debiasing, accuracy became $L2$5 in all cases (Chowdhury et al., 2022). At the word level, direct joint-space classification dropped from $L2$6–$L2$7 to $L2$8, and stepwise aligned-space classification dropped from $L2$9–$p(z=i \mid h) = \mathrm{softmax}_i(W h + b).$0 to $p(z=i \mid h) = \mathrm{softmax}_i(W h + b).$1 after INLP (Chowdhury et al., 2022).

The same study evaluated downstream NLI using back-translated data. In the symmetric setting, sentence-level debiasing improved SNLI accuracy from $p(z=i \mid h) = \mathrm{softmax}_i(W h + b).$2 on back-translated embeddings to $p(z=i \mid h) = \mathrm{softmax}_i(W h + b).$3 after debiasing; in the asymmetric setting, it improved from $p(z=i \mid h) = \mathrm{softmax}_i(W h + b).$4 to $p(z=i \mid h) = \mathrm{softmax}_i(W h + b).$5 (Chowdhury et al., 2022). Word-level gains were smaller but positive in both joint and aligned setups (Chowdhury et al., 2022). The authors interpret these improvements as evidence that reducing translationese bias can mitigate train–test asymmetry induced by translation artifacts (Chowdhury et al., 2022).

More recent work extends the projection idea beyond strictly linear ambient spaces. A 2026 recommendation paper proposes a kernelized INLP combined with a gated Mixture-of-Experts adapter for LLM-based recommender systems, where a closed-form projector is computed in an RFF-lifted space and then applied as a frozen buffer to backbone representations (Cui et al., 24 Mar 2026). This suggests that the null-space projection paradigm has been adapted to settings where nonlinear attribute leakage is substantial, although the resulting procedure is no longer identical to the 2020 linear formulation.

5. Critiques, side effects, and proposed alternatives

A major line of subsequent work argues that multiple INLP iterations can damage non-target information. "Better Hit the Nail on the Head than Beat around the Bush: Removing Protected Attributes with a Single Projection" (Haghighatkhah et al., 2022) states that multiple projections increase the risk that information other than the target is negatively affected. That paper introduces Mean Projection (MP) and Tukey Median Projection (TMP) as single-projection alternatives and reports that one MP projection can achieve linear guarding with less impact on the overall space than many INLP iterations (Haghighatkhah et al., 2022).

On GloVe gender-debiasing experiments, MP reduced linear classifier accuracy to $p(z=i \mid h) = \mathrm{softmax}_i(W h + b).$6 in a single projection for the 3-class setting, whereas INLP required $p(z=i \mid h) = \mathrm{softmax}_i(W h + b).$7 iterations to reach $p(z=i \mid h) = \mathrm{softmax}_i(W h + b).$8; in the binary setting, MP reached $p(z=i \mid h) = \mathrm{softmax}_i(W h + b).$9 in one step and INLP needed $W \in \mathbb{R}^{k \times d}$0 iterations to obtain $W \in \mathbb{R}^{k \times d}$1 (Haghighatkhah et al., 2022). Neighborhood stability also differed sharply: for $W \in \mathbb{R}^{k \times d}$2 random words, MP changed $W \in \mathbb{R}^{k \times d}$3 neighbors versus $W \in \mathbb{R}^{k \times d}$4 for INLP, and for $W \in \mathbb{R}^{k \times d}$5 gendered names, MP changed $W \in \mathbb{R}^{k \times d}$6 neighbors versus $W \in \mathbb{R}^{k \times d}$7 for INLP (Haghighatkhah et al., 2022). That paper further argues that many of the late-stage improvements attributed to INLP can be reproduced by random projections after an initial targeted step, implying that such gains may derive from generic dimensionality reduction rather than additional targeted attribute removal (Haghighatkhah et al., 2022).

A more explicit critique appears in "Improving Causal Interventions in Amnesic Probing with Mean Projection or LEACE" (Dobrzeniecka et al., 13 Jun 2025). There, INLP is described as a widely used removal technique in amnesic probing, but the paper reports that repeated classifier-dependent projections introduce random modifications to representations and reduce the method’s “targetedness” (Dobrzeniecka et al., 13 Jun 2025). For non-masked BERT, INLP removed hundreds of directions and produced large rank reductions: directions removed were $W \in \mathbb{R}^{k \times d}$8 for dependency labels, $W \in \mathbb{R}^{k \times d}$9 for fine POS, and $W$0 for coarse POS, with rank changes of $W$1, $W$2, and $W$3, respectively (Dobrzeniecka et al., 13 Jun 2025). Mean Projection and LEACE removed far fewer directions and preserved rank much better in the same setting (Dobrzeniecka et al., 13 Jun 2025).

The same paper reports low cosine similarity between original and modified representations under INLP—$W$4 for dependency labels, $W$5 for fine POS, and $W$6 for coarse POS in non-masked BERT—whereas MP yielded $W$7, $W$8, and $W$9, and LEACE yielded $Q$0, $Q$1, and $Q$2 (Dobrzeniecka et al., 13 Jun 2025). In language modeling, INLP often failed the information control because matched random projections of the same cardinality sometimes harmed performance even more than amnesic INLP, especially for dependency and fine POS removal (Dobrzeniecka et al., 13 Jun 2025). The paper therefore recommends MP by default and LEACE when stronger linear-erasure guarantees are required (Dobrzeniecka et al., 13 Jun 2025).

These critiques do not negate the original guarantee that the trained linear probe’s row space is removed. Rather, they delimit what that guarantee means operationally. The main dispute concerns whether repeated projection remains a clean intervention when the scientific goal is causal interpretation or fine-grained preservation of non-target information (Haghighatkhah et al., 2022, Dobrzeniecka et al., 13 Jun 2025).

6. Positioning, variants, and nomenclature

INLP is commonly positioned against three families of alternatives. First, compared with Hard Debias, which relies on manually specified gender directions, INLP is data-driven and generalizes beyond word embeddings and binary attributes (Ravfogel et al., 2020). Second, compared with adversarial debiasing, INLP is post-hoc, simple, and interpretable, because it deterministically removes the row space used by a trained linear probe rather than modifying the representation through adversarial dynamics (Ravfogel et al., 2020). Third, unlike naive PCA removal, INLP uses attribute supervision and therefore targets the row space associated with the designated variable rather than unsupervised high-variance directions (Ravfogel et al., 2020).

Later extensions preserve the same projection intuition while modifying the representation space or the projector construction. The 2026 kernelized variant for LLM-based recommendation lifts representations with Random Fourier Features, performs INLP in the lifted space, and exports the backbone block of the closed-form projector as the deployed transformation (Cui et al., 24 Mar 2026). The stated motivation is that LLM representations may carry nonlinear attribute signals that ordinary linear INLP can miss (Cui et al., 24 Mar 2026).

The acronym also has an unrelated earlier use in signal processing. "Iterative Null-space Projection Method with Adaptive Thresholding in Sparse Signal Recovery and Matrix Completion" (Esmaeili et al., 2016) uses the term for a compressed sensing algorithm based on iterative projections of thresholded signals onto the null-space of a sensing matrix. Although it shares the language of null-space projection, that method addresses sparse recovery and matrix completion rather than attribute erasure in learned representations (Esmaeili et al., 2016). The overlap is terminological rather than methodological in the NLP sense.

In current representation analysis, the canonical meaning of INLP refers to the 2020 null-space projection method for removing linear information about a protected or target attribute from embeddings (Ravfogel et al., 2020). Its continuing relevance lies in the combination of closed-form geometry, direct compatibility with linear probing, and post-hoc applicability to arbitrary vector representations, together with a now well-documented need for careful stopping, validation, and control experiments when repeated projections are used for causal interpretation (Dobrzeniecka et al., 13 Jun 2025).