New benchmark finds prompt framing and fallacy type strongly influence LLM refusal rates

Researchers introduced DeflectBench, a benchmark designed to evaluate whether large language models can be prompted to generate rhetorical fallacies on demand and whether current safety post-training constrains such behavior. The work addresses a gap in existing research, which has focused more on detecting fallacies in text than on evaluating models' susceptibility to generating them under adversarial prompts.

The benchmark evaluates 23,990 generations from four frontier models, testing three deflection strategies—whataboutism, ad hominem, and red herring—across seven prompt framings and 80 claims spanning four controversy levels. Findings indicate that refusal to generate fallacies is governed primarily by request structure rather than the content of the claim itself. For example, per-claim refusal rates varied by only 11 percentage points across the 80 claims, while changing a single prompt frame could swing refusal rates within a model by nearly 100 percentage points.

Switching the requested fallacy type within explicit framings could alter refusal rates by over 80 percentage points. Notably, an 'educational debate coach' prompt framing reduced refusal rates to near zero across all four model families, though the bypassed behavior was not clean compliance. Instead, models often produced labeled compliance, explicitly naming the requested manipulation within the same response that contained it.

The four models evaluated distributed differently across refusal, labeled compliance, soft refusal, and clean compliance, suggesting variability in how safety mechanisms are implemented or triggered across model families. The researchers released the code and dataset alongside the benchmark to facilitate further study.