When TrustNLP launched in 2021, "trust" mostly meant auditing a classifier for bias. Six years later, the concept has broadened significantly and now involves constraining an autonomous agent that writes code, browses the web, and negotiates on our behalf. The workshop's evolution is, in miniature, the story of how the entire field has risen to keep pace with what AI can suddenly do.
With large language models and agentic systems now woven into everyday tasks — coding, web surfing, information seeking, deep research — the case for reliable, responsible, ethical, and safe AI has never been more concrete. This year's edition, co-located with ACL 2026 and supported by Meta, Capital One, and Amazon, gathers work on models that are explainable, fair, privacy-preserving, causal, and robust — its largest yet, with 53 papers accepted and 41 of them submitted as archival papers in the proceedings. The workshop funds a mission that has stayed constant even as the technology has evolved: promoting diversity, participation, and mentoring in trustworthy NLP.
This post does two things at once. It reviews the day — the two keynotes and the accepted papers — and it steps back to trace the arc that a new retrospective of the workshop lays out: a field-wide shift from simply trying to understand what specialized models have learned, to actively steering and constraining what today’s generative models do.
The Long ViewSix years of TrustNLP, shaped by capability emergence
A retrospective synthesized from 103 proceedings papers across the first five editions — a picture that this year's sixth edition only sharpens — makes a striking argument: while trustworthy NLP does make steady, cumulative progress, its direction is repeatedly redrawn by emerging capabilities — moments when a leap in what AI can do reshapes what the field works on. Between those shifts the field consolidates; each new capability, though, tends to reset what "trust" even means.
Before the LLM era, the defining questions were about fairness and explainability: can we audit a model's decisions and understand its biases? With the resurgence of large language models by the end of 2023, trust became a question of truthfulness: is the model factually reliable, and can we calibrate its confidence? And by 2024–2025, as multimodal and agentic systems arrived, trust expanded into safety alignment and controllability: can we constrain a model's behavior under adversarial conditions and ensure it acts within ethical norms? The through-line tracks the dominant mode of human–AI interaction at each moment (inspecting a model's internals, then prompting black-box APIs, then delegating multi-step tasks to agents).
The figure below traces that shift edition by edition — and each year links straight to its proceedings on the ACL Anthology, so you can jump from the trend to the papers themselves:
What the Corpus SaysThe dimensions that grew — and the ones that show up only sparsely
Classifying all 144 papers across six editions* against six trust dimensions — a taxonomy aligned with TrustLLM (Huang et al., 2024) with certain dimensions enriched based on DecodingTrust (Wang et al., 2024), plus a corpus-motivated Explainability dimension — reveals clear trends. Truthfulness (hallucination, factuality, calibration) is the dominant growth story: absent in 2021–2022, it rose to 5 papers in 2023, then surged to 13 in both 2025 and 2026 — the single largest dimension. Robustness & adversarial followed a similar trajectory (0 → 7 → 8 → 8), plateauing as the field absorbed adversarial robustness as a baseline concern rather than a growth frontier.
Fairness & bias is the quiet constant — present in every edition, though it dipped slightly in 2026 (5, down from 8 in 2025). Machine ethics & safety shows the steepest 2026 rise (from ~2–4 per year to 8), suggesting safety alignment and value alignment are now recognized as a distinct dimension from adversarial robustness. Most strikingly, explainability has rebounded sharply — after declining to just 2 papers in 2025, it jumped to 11 this edition, signaling that interpretability is being re-embraced as the practical toolkit for steering and controlling model behavior. Privacy peaked in 2023 (6 papers).
Trust dimensions over six editions
Papers tagged per topic per year (papers may span multiple topics). 2021–2025 from the TrustNLP retrospective (Table 1); 2026 classified from the published proceedings' titles and abstracts using the same Table 1 match criteria.
Structural InsightsFour structural insights
Beyond the topic counts, this retrospective distills four structural observations about how the field behaves.
Trust research spikes reactively
Surges in trust research tend to be reactive — each capability emergence is followed by a wave of work responding to it, rather than anticipating it. That reactive lag appears to persist even as challenges grow more complex, suggesting the bottleneck is at least partly structural (publication and review cycles), not purely intellectual.
Trust tracks the interaction paradigm
The working definition of trust follows the dominant human–AI interaction mode: interpretability under direct model access, reliability under API access, controllability under agentic use. As the interface changed, so did what counts as evidence of trustworthiness.
Output audits miss latent behavior
Behavioral tests systematically underestimate what models do internally. Unlearning suppresses concepts at inference without erasing them; output-level fairness audits miss representational bias. Trustworthy evaluation must treat internal probing as a first-class component.
The field lacks a unifying framework
Fairness, robustness, factuality, privacy, and calibration demonstrably interact — and there is a clear need for a framework that formalizes their trade-offs. Without such a framework, each new capability emergence risks spawning another disconnected line of research rather than cumulative theory.
On StageTwo keynotes on the interpretability-to-control arc
Adversarial Arena: Driving Innovation in Responsible AI through Interactive Competition
Johnston frames three pressing problems that static evaluation can't solve on its own: scaling safety to keep pace with capability, the limitations of static benchmarks (contamination, single-turn framing, poor real-world proxy), and the scarcity of diverse, high-quality data. His answer is the Adversarial Arena: an interactive competition format where attacker and defender teams face off across tournaments, generating both innovation and training data as byproducts of the contest. The running case study is the Amazon Nova AI Challenge — in Year 1 (Trusted AI), coding-agent teams had to stay useful while refusing to generate malicious or vulnerable code, while red teams built automated agents to elicit exactly that, with scoring deliberately adversarial: defense scaled by utility, attacks scaled by diversity. The effort released 25,600 annotated multi-turn adversarial conversations.
Year 2 (Trusted Software Agents) raises the bar to repo-level software engineering, with cybersecurity agents probing full-stack apps for verified vulnerabilities and benign/malicious user simulators driving the conversations. The closing note doubles as a thesis for the whole workshop: adversarial interactive competition overcomes the ceilings of static benchmarks, generates diverse evaluation and training artifacts, and pushes evaluation science toward the multi-turn, collaborative settings that real deployments demand.
Toward Trustworthy Language Models through Interpretability and Control
Weng approaches trustworthiness from the inside — through neuron- and representation-level interpretability, behavior steering, and principled evaluation. Her central framing views interpretability as a control interface: once you can understand what a model encodes, you can steer it, modify it, or even make it forget. She shows that behaviors such as self-reflection and reasoning dynamics are encoded in a model's internal representations and can be manipulated to steer behavior, improve reasoning performance, and enable more efficient reasoning — work exemplified by her lab's ThinkEdit, ReflCtrl, and interpretable-by-design Concept-bottleneck LLMs (CB-LLMs).
Equally important, she complements these advances with emerging frameworks for rigorous evaluations of the explanations themselves. Her lab's NeuronEval framework provides a principled way to measure the faithfulness of neuron- and representation-level explanations, so that steering rests on explanations we can actually trust. Her broader message is that reliable language models require not only strong capabilities, but also principled mechanisms for understanding, evaluating, and controlling their internal behaviors. Together, the two keynotes bracket the field's central arc — Johnston stress-tests models from the outside through competition, Weng opens them up from the inside — understanding what models are doing, and then controlling what they do.
The 2026 CorpusWhat 41 papers say about where trust research is now
If the retrospective's thesis is right — that trust has moved from interpretability to reliability to controllability — the 2026 proceedings should show it. Manually annotating all 41 archival papers against six trust dimensions, truthfulness (13 papers) and explainability (11) dominate, followed by robustness & adversarial and machine ethics & safety (8 each). The 2026 picture is striking in two ways: truthfulness has plateaued at its 2025 peak, confirming hallucination/factuality as a sustained concern rather than a passing wave, while explainability has surged from just 2 papers in 2025 to 11 — signaling a rebound of interpretability not as an end in itself, but as the practical toolkit for steering and controlling model behavior.
TrustNLP 2026: trust dimension distribution
41 archival papers, classified by title + abstract against the retrospective's Table 1 topic criteria (multi-label). Source: Proceedings of the 6th Workshop on Trustworthy NLP (TrustNLP 2026), ACL Anthology.
Controllability, and its discontents
The most striking pattern this year is how many papers treat safety alignment as a fragile, geometric property rather than a settled one. The Geometry of Refusal shows that refusal behavior in safety-aligned models sits on a linearly unstable direction; Hair-Trigger Alignment argues that black-box evaluation simply cannot guarantee alignment survives a model update; and Deactivating Refusal Triggers tackles the overrefusal problem from a mechanistic angle. Others map the attack surface directly: a survival-analysis view of safety degradation under repeated attacks, PII leakage via activation steering, and the bluntly-titled “Don't Want Your LLM to Recommend Nuclear Strike? Try Asking It in Japanese” — a reminder that alignment is unevenly distributed across languages.
Looking inside the model
The interpretability cluster is less about proposing brand-new tools than about interrogating what today's tools can and cannot do inside a model. Single-Layer Activation Edits Easily Corrupt Factual Recall but Rarely Repair It and Linear Probes Detect Task Format, Not Reasoning Mode are cautionary tales — they show that familiar techniques often read off, or write into, a model far less faithfully than assumed. Complementary work refines the toolkit for reliability: lightweight controllers for weighted activation steering and multilingual sparse autoencoders for principled, layer-selective steering. Read together, these papers are exactly what Insight 3 anticipated — that output-level behavior underestimates what a model is doing internally, so trustworthy evaluation has to probe the internals directly, not just the outputs.
Reliability, factuality, and cultural fairness
A large share of the program still targets classic reliability: how quantization erodes factual recall, how susceptible LLMs are to external evidence of varying factuality, prospective-memory failures in long interactions, and trust-aware fact-checking agents for open-world claims. Fairness — the workshop's one constant — remains strongly represented and increasingly cultural: South Asian biases in multilingual generation, dialect-aware safety evaluation for Arabic LLMs, and social-dimension fairness audits. And retrieval-augmented systems get direct scrutiny in authorization-first retrieval for multi-agent RAG and a systematic taxonomy of RAG failure modes — reliability and access-control questions that grow more pressing as retrieval pipelines are wired into larger, increasingly agentic systems.
* All 144 papers were manually annotated by the workshop organizers against six trust dimensions derived from TrustLLM (Huang et al., 2024) and DecodingTrust (Wang et al., 2024), plus a corpus-motivated Explainability dimension. Each paper was labeled on title + abstract (multi-label). Full criteria are documented in the workshop’s classification taxonomy.
Looking AheadFrom documenting failures to engineering guarantees
The growth from 8 archival papers in the first edition to 41 this year is real evidence of sustained community investment. But the retrospective ends on a pointed question: will that investment compound into cumulative progress, or keep producing fragmented reactions to each new emergence? The honest answer depends on whether the field can make a shift it has so far only gestured at — moving from documenting trust failures to engineering trust guarantees, proactively and in lockstep with capability emergence rather than in its wake.
That is the challenge implicit in both keynotes and in every poster presented this year. The interfaces will keep changing; the next capability emergence is already forming. Whether trust research leads it or once again trails it is, for now, still up to us.
Behind the WorkshopOrganizers & sponsors
Organizing Committee
Kai-Wei Chang · Ninareh Mehrabi · Satyapriya Krishna · Anubrata Das · Jwala Dhamala · Yang Trista Cao · Tharindu Kumarage · Anil Ramakrishna · Christos Christodoulopoulos · Yixin Wan · Aram Galstyan · Anoop Kumar · Rahul Gupta
Sponsors
Meta · Capital One · Amazon — funding diversity, participation, and mentoring across the workshop.
▶ Trust dimension definitions
| Dimension | Definition |
|---|---|
| Fairness & Bias | Papers whose primary focus is measuring, analyzing, or mitigating social bias (gender, race, disability, demographic, toxicity) in model outputs or representations. |
| Robustness & Adversarial | Papers primarily proposing or evaluating adversarial attacks, defenses, backdoor/watermark detection, jailbreaks, red-teaming, or input perturbation robustness. |
| Privacy | Papers primarily addressing differential privacy, text anonymization/privatization, training data extraction, membership inference, PII protection, or machine unlearning. |
| Machine Ethics & Safety | Papers primarily addressing alignment with human values, safety guardrails, harmful content generation, or moral reasoning in models. |
| Truthfulness | Papers primarily addressing hallucination, factuality, calibration, uncertainty estimation, or faithfulness of model outputs. |
| Explainability | Papers whose primary contribution is an interpretability method, explanation generation, feature attribution, rationale extraction, or probing of internal representations. |