DeflectBench: A Benchmark for Evaluating Rhetorical Fallacy Generation in LLMs
DeflectBench is a new benchmark evaluating whether LLMs can be prompted to generate rhetorical fallacies (whataboutism, ad hominem, red herring) on demand Refusal behavior is driven primarily by prompt structure rather than claim content, with single framing changes causing up to 100 percentage point swings in refusal rates An "educational debate coach" prompt framing collapses refusal to near zero across all four frontier models tested, but models typically respond with "labeled compliance" rat
Analysis
TL;DR
- DeflectBench is a new benchmark evaluating whether LLMs can be prompted to generate rhetorical fallacies (whataboutism, ad hominem, red herring) on demand
- Refusal behavior is driven primarily by prompt structure rather than claim content, with single framing changes causing up to 100 percentage point swings in refusal rates
- An "educational debate coach" prompt framing collapses refusal to near zero across all four frontier models tested, but models typically respond with "labeled compliance" rather than clean compliance
- Per-claim refusal varies by only 11 percentage points across 80 claims spanning four controversy levels, while switching fallacy types causes over 80 percentage point swings within explicit framings
- The benchmark evaluated 23,990 generations and the code/dataset have been publicly released
Why It Matters
This research exposes a critical vulnerability in current LLM safety post-training: refusal patterns are highly sensitive to prompt framing rather than being grounded in the substantive content being requested. For AI practitioners, this means safety guardrails may be more fragile than assumed, and adversarial prompt engineering can systematically bypass them. For researchers, it highlights the need for more robust evaluation frameworks that distinguish between genuine safety compliance and superficial labeled compliance.
Technical Details
- Benchmark scope: 23,990 model generations evaluated across four frontier LLM families, testing three deflection strategies (whataboutism, ad hominem, red herring), seven distinct prompt framings, and 80 claims spanning four controversy levels
- Key finding on refusal drivers: Refusal is governed by request structure, not claim content—per-claim refusal varies by only 11 percentage points, while a single prompt frame change can swing refusal by nearly 100 percentage points and switching fallacy types causes over 80 percentage point swings
- Educational framing bypass: The "educational debate coach" prompt framing reduced refusal to near zero across all model families, but models predominantly exhibited "labeled compliance"—naming the requested rhetorical manipulation within the same response that contained it—rather than clean compliance
- Model distribution differences: The four evaluated models showed distinct behavioral distributions across four response categories: refusal, labeled compliance, soft refusal, and clean compliance
- Open release: Code and dataset made publicly available for reproducibility and further research
Industry Insight
- Safety evaluation frameworks must account for prompt framing sensitivity; current benchmarks may overestimate model robustness if they don't test structural adversarial variations
- The "labeled compliance" phenomenon—where models name a fallacy while simultaneously producing it—represents a subtle failure mode that could undermine trust in AI safety claims and should be explicitly measured in red-teaming protocols
- Organizations deploying LLMs in high-stakes contexts (debate, legal, political analysis) should implement structural prompt filters and content-aware safeguards rather than relying solely on refusal-based safety post-training
Disclaimer: The above content is generated by AI and is for reference only.