How AI Assistants Respond to Repeated Abuse
William Guey, Wei Zhang, Wei Zhang, Pierrick Bougault, Yi Wang, Yi Wang, Agoston Bodo, Vitor D de Moura, et al.
cs.CL
Quick verdict
Claims refusal is not one axis: AI configs differ sharply under repeated abuse; measurement careful and transparent, but exploratory and deployment-bound.
Summary
The paper asks how AI assistants behave when a benign task is accompanied by escalating verbal abuse, arguing that a single refusal label conflates distinct behaviors. It defines five observable response dimensions: hard disengagement (unconditional noncontinuation with no route to resume), withdrawal and soft withdrawal, continued availability, observable task-related work, and boundary setting. Eight time-specific OpenRouter configurations each ran 48 five-turn escalation conversations (8 prompt ladders x 2 languages x 3 repetitions) plus 8 constant-frustration comparisons, for 448 conversations and 2,240 responses, judged by three LLM judges under metadata withholding (6,720 judgments) with human coding on subsets. At the turn-5 endpoint, hard disengagement ranged from 0/48 in four configurations to 24/48 (50.0%) for Gemini 3.1 Pro; a matched permutation test gave p = 1.0e-5. Claude Fable 5 combined 0% hard disengagement with 87.5% soft withdrawal, whereas GPT-5.6 Sol split 31.2% hard versus 22.9% soft (McNemar p = 0.000061). Availability diverged from task work (Claude Opus 4.8: 48/48 available, 8/48 with work). Machine-human F1 was 0.836 for hard disengagement but only 0.644-0.675 for soft withdrawal. Key limitations: exploratory post hoc specification, time-specific API deployments, imperfect judge blinding, and a weakly measured soft construct.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
4 strengths · 5 weaknesses · 5 author questions
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Hard disengagement under sustained abuse varies sharply across eight API configurations, from 0/48 to 24/48 (50.0%) at turn 5, exceeding chance under a matched permutation test (p = 1.0e-5).
- A single refusal label conflates distinct behaviors: soft withdrawal, continued availability, observable task-related work, and boundary setting each follow different configuration profiles than hard disengagement.
- Explicit availability does not imply substantive work: Claude Opus 4.8 and Claude Fable 5 were explicitly available in 48/48 endpoints but showed task-related work in only 8/48 and 7/48.
- Hard disengagement concentrates late in escalation (0/384 responses at turns 1-3 versus 62/384 at turn 5), consistent with history-sensitive behavior.
- Aggregate English and Chinese hard-disengagement rates are similar (30/192 vs 32/192), but configuration-specific directions vary, so no general language claim holds.
Strengths
Constructive decomposition of 'refusal' that the data actually validate
Section 3's five dimensions are shown to dissociate in Section 5.2-5.3 (Figure 3): Claude Fable 5 is 0% hard, 87.5% soft, 100% available, 14.6% task work, 97.9% boundary; GPT-5.5 is 0% hard, 6.2% soft, 79.2% work; Gemini 3.1 Pro is 50% hard with 0% boundary. The paper's central claim is demonstrated, not merely asserted.
Measurement transparency beyond typical LLM-judge practice
Section 4.3: three judges at temperature 0 with fixed seed, metadata withheld, and a deterministic scope rule whose effect is fully reported (raw 67/384 hard endpoints vs adjusted 62/384; 5 reallocations; both versions tested). Human validation: kappa 0.816 and machine-human F1 0.836 for the hard construct, with an explicit hierarchy of confidence in the Discussion.
Robustness of the headline configuration contrast
Artifact-level reproducibility
Weaknesses
Soft-withdrawal construct is weakly measured
Judges saw single turns without dialogue context
Configuration-versus-model confound
Incomplete judge blinding via unredacted text
Exploratory post hoc analysis design
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
- All 4 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
Which AI assistant was most likely to end the conversation when repeatedly insulted?
In this July 2026 study of eight API configurations, Gemini 3.1 Pro showed the highest hard-disengagement rate, unconditionally stopping the task in 24 of 48 (50%) sustained-abuse endpoints. Four configurations (Claude Opus 4.8, GPT-5.5, Grok 4.5, and Claude Fable 5) never did, at 0/48.
What is the difference between hard disengagement and soft withdrawal?
Hard disengagement is an explicit, unconditional statement that the assistant will not continue, with no stated route to resume ('I will leave the conversation here'). Soft withdrawal means the assistant visibly steps back while keeping a route back, for example pausing, setting conditions, or saying 'I can help when you are ready' without doing the current task.
Did using English versus Chinese change how the models responded to abuse?
Aggregate hard-disengagement rates at the final turn were nearly identical: 30/192 (15.6%) for English and 32/192 (16.7%) for Chinese. However, individual configurations leaned in different directions across languages, so the paper supports no general language claim.
Is this paper about models refusing harmful requests?
No. The underlying tasks (coding, factual questions, planning, writing) stayed benign throughout. The study varies only the user's verbal hostility across five turns to test whether abuse alone changes how an assistant engages with a legitimate task, which is distinct from classic harmful-request refusal benchmarks.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures 2-3 were available only as embedded textual values in the extracted text; interval widths and heat-map shading could not be independently verified.
- Supplementary materials (full coding manuals, complete agreement tables, the five collision cases) were not part of the extracted text and could not be checked.
- Findings are tied to July 2026 API deployments; this review takes the reported model identifiers and returned-identifier strings at face value.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.