Door-in-the-Face Requests and Refusal Behaviour in Large Language Models
cs.AI · cs.CL
Quick verdict
First enacted DITF test on LLMs: works on Anthropic frontier models, backfires on OpenAI/Google frontier; rigorous but one 60-item template.
Summary
The paper tests whether the human door-in-the-face (DITF) compliance technique transfers to large language models: a large anchor request is refused, the model is offered a smaller version of the same request, and compliance is compared against a cold direct ask, an answered warm-up turn, and a refused unrelated request. Nine production models from three providers ran four conditions on 60 constructed 'verdict' items (hedged requests to name one allegedly worst institution) at 10 replicates per cell, judged by two cross-family judges under a strict two-judge rule; a secondary run used 399 movable refused items from public benchmarks. DITF raises compliance on Anthropic frontier models (Opus 5 +36.5 pp, 29.3% to 65.8%, Holm-adjusted p=5.5e-12) but backfires on Haiku 4.5 (-16.0), GPT-5.6 sol (-15.5), and Gemini 3.1 Pro (-23.0). Warm-up turns suppress compliance on all nine models, while each item's own refused anchor beats an unrelated one everywhere (concession premium). On benchmark refusals no model gains, and Opus 5 flips to -13.3 pp. The authors attribute the split to deliverable type: rewriting 265 refused requests for usable content into inert explanation requests left 263 always complying (RTM null p<10^-278). Main limitations: one English request family, eight of nine endpoints unpinned (August 2026 snapshot), and mechanism inferred behaviorally only.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 4
● low 1
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- An enacted door-in-the-face sequence raises compliance with the identical smaller request by +13.7 to +36.5 pp on four Anthropic frontier models and lowers it by 15.5 to 23.0 pp on Haiku 4.5, GPT-5.6 sol, and Gemini 3.1 Pro (all Holm-significant), a within-item Opus 5 vs Gemini 3.1 Pro gap of +59.5 pp.
- The concession relation is model-general: on all nine models the item's own refused anchor beats an unrelated refused anchor (+0.7 to +22.8 pp), while any completed prior turn (warm-up) suppresses compliance everywhere (pooled -17.8 pp).
- The technique does not transfer to benchmark-derived refusals: no intention-to-treat DITF contrast is significantly positive, and Opus 5 flips from +36.5 pp on verdict items to -13.3 pp on its own movable benchmark refusals.
- Deliverable type governs whether a retreat can work: rewriting 265 refused requests for usable content into requests for explanations of the same topic left 263 always complying, and a blind holdout shows +20.5 pp on inert vs -11.7 pp on operational items.
- Sequential-request effects must be measured against a cold direct ask, because warm-up referencing overstates DITF by exactly the warm-up suppression and would flip conclusions on 5 of 9 models.
Strengths
First study of the actual DITF setting, with the controls the human literature demands
Unlike persuasion taxonomies that paraphrase DITF without a real refusal (Zeng et al., 2024), this paper elicits genuine refusals and retreats, and adds the three controls human meta-analyses treat as necessary: cold direct ask, answered warm-up, and an unrelated refused anchor matched to within 1.7 pp on first-turn refusal rate (Sections 3.1, B.4).
The warm-up arm exposes a measurement trap most of the field falls into
Warm-up minus cold is negative on 9/9 models (-3.7 to -34.5 pp; pooled GEE -17.8 pp, SE 2.0), and the Section 3.5 identity shows any DITF estimate referenced to a warm-up control is inflated by exactly that suppression, flipping the qualitative conclusion on 5 of 9 models — a concrete methodological lesson for refusal benchmarking (Section 4.2, B.3).
Statistical machinery is unusually thorough for an LLM behaviour paper
The causal rewrite analysis quantifies regression to the mean instead of waving at it
Honest decomposition of the measurement stack
Weaknesses
External validity rests on a single 60-item template family
Every family is tested at Opus 5's refusal boundary, not its own
Judge quality is uneven and judges come from the studied pool
The deliverable-type 'necessity' claim outruns its powered evidence
Artifacts promised, not released; endpoints unpinned
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper asks whether the human door-in-the-face (DITF) technique [Cialdini et al., 1975] transfers to LLMs when enacted: a large anchor request is genuinely refused, the smaller version of the same request follows, and compliance with that small ask is compared against a cold direct ask (arm A), an answered warm-up turn (arm C), and a refused unrelated request (arm D). Four hypotheses (H1 transfer, H2 specificity, H3 generality, H4 mechanism) are tested on nine production models — five Anthropic, two OpenAI, two Google — on two datasets: a 60-item constructed 'verdict' set (hedged 'which X is worst, in your opinion' asks) at 10 replicates per cell across four arms, and 399 movable refused model-item pairs from ten public benchmark suites at one replicate. The headline claim — a sign reversal by model family, +36.5 pp on Opus 5 versus -23.0 pp on Gemini 3.1 Pro on the same items — is well supported. The mechanistic claim that deliverable type (inert judgement vs operational artefact) governs the effect is supported for direction but underpowered for magnitude.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
Does the door-in-the-face technique work on AI chatbots?
According to this study, it depends on the model family. After a model refuses an oversized request, asking for a smaller version of the same thing raised compliance on Anthropic's frontier models — Opus 5 complied 65.8% of the time after a refusal versus 29.3% when asked directly — but lowered compliance by 15.5 to 23.0 percentage points on Haiku 4.5, GPT-5.6 sol, and Gemini 3.1 Pro.
Can door-in-the-face be used to jailbreak LLMs?
Not per this paper. On refusals drawn from public safety benchmarks — where the request asks for usable content like instructions or code — the technique produced no significant gains on any model and significantly hurt some (down to -28 pp per-protocol). The compliance gains appeared only on hedged judgement questions ('which is worst, in your opinion'), not requests for actionable artefacts.
What is the door-in-the-face technique?
A compliance strategy from social psychology (Cialdini et al., 1975): make a large request that is expected to be refused, then retreat to the smaller request you actually wanted. In humans, the refusal makes the smaller request more likely to be granted, an effect that is reliable but small (r about .07-.15 across meta-analyses).
Which models were tested and when?
Nine production models from three providers via public APIs in August 2026: Opus 5, Opus 4.8, Opus 4.5, Sonnet 5, and Haiku 4.5 (Anthropic); GPT-5.6 sol and GPT-5 mini (OpenAI); Gemini 3.1 Pro and Gemini 3 Flash (Google). Only GPT-5 mini was a pinned snapshot, so the numbers describe that month's deployments.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Table and figure layout was flattened by PDF extraction (e.g., Table 1 row labels and Figure 1 annotations are interleaved); every number quoted in this review was cross-checked as present in the extracted text.
- No truncation was observed: the extraction runs from the abstract through Appendix B.8 and ends cleanly with the relation-to-Meincke paragraph, so the review covers the full main text and appendices A.1-B.8.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.