mlsanityData to 7 Oct 2026

Door-in-the-Face Requests and Refusal Behaviour in Large Language Models

arXiv 2609.02707 ↗First posted 2 Sep 2026cs.AI cs.CLcited by 0

Not on the map. Why?

Abstract (arXiv)

Does the door-in-the-face technique work on language models? In humans, a large request that is refused makes a smaller follow-up request more likely to be granted. We test this on nine production models from three providers: each model refuses a large request, then receives a smaller version of the same request, and we compare its compliance with asking directly. The answer depends on the model. On Anthropic's frontier models the technique works: Opus 5 answers the smaller request 65.8% of the time after refusing the larger one, against 29.3% when asked directly. On the frontier models of OpenAI and Google, and on Haiku 4.5, it backfires, lowering compliance by 15.5 to 23.0 points. A control locates the effect: a refused large request on an unrelated topic does less than the related one on all nine models, so the concession itself matters everywhere, while the reaction to having just refused something differs by model family. The technique does not transfer to refusals drawn from public benchmarks. What decides whether a retreat can work is what the request asks for: rewriting 265 refused requests for usable instructions into requests for explanations of the same topic removed the refusal in 263 cases. Human influence techniques port to language models one model family at a time.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 32 of its 66 references that are in the map. First posted on arXiv 2 Sep 2026.

Builds on

32 of 66 references.

References · 32

  1. 2023Generative Agents: Interactive Simulacra of Human Behaviorcited by 3,500
  2. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  3. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  4. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 960
  5. 2022Out of One, Many: Using Language Models to Simulate Human Samplescited by 737
  6. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMscited by 533
  7. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 494
  8. 2023XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Modelscited by 477
  9. 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deepcited by 450
  10. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrationscited by 401
  11. 2025LLMs Get Lost In Multi-Turn Conversationcited by 400
  12. 2022Using cognitive psychology to understand GPT-3cited by 389
20 more
  1. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attackcited by 364
  2. 2023Large Language Models Fail on Trivial Alterations to Theory-of-Mind Taskscited by 288
  3. 2024SORRY-Bench: Systematically Evaluating Large Language Model Safety Refusalcited by 224
  4. 2024OR-Bench: An Over-Refusal Benchmark for Large Language Modelscited by 222
  5. 2023Do LLMs exhibit human-like response biases? A case study in survey designcited by 176
  6. 2025Constitutional Classifiers: Defending against Universal Jailbreaks across Thousands of Hours of Red Teamingcited by 172
  7. 2024The Art of Saying No: Contextual Noncompliance in Language Modelscited by 100
  8. 2024Does Refusal Training in LLMs Generalize to the Past Tense?cited by 74
  9. 2025Position: Evaluating Generative AI Systems Is a Social Science Measurement Challengecited by 61
  10. 2025FalseReject: A Resource for Improving Contextual Safety and Mitigating Over-Refusals in LLMs via Structured Reasoningcited by 53
  11. 2025Foot-In-The-Door: A Multi-turn Jailbreak for LLMscited by 50
  12. 2024Navigating the OverKill in Large Language Modelscited by 40
  13. 2024Automatic Pseudo-Harmful Prompt Generation for Evaluating False Refusals in Large Language Modelscited by 35
  14. 2024Foot In The Door: Understanding Large Language Model Jailbreaking via Cognitive Psychologycited by 25
  15. 2025Validating LLM-as-a-Judge Systems under Rating Indeterminacycited by 23
  16. 2025Multi-lingual Multi-turn Automated Red Teaming for LLMscited by 12
  17. 2025EVOREFUSE: Evolutionary Prompt Optimization for Evaluation and Mitigation of LLM Over-Refusal to Pseudo-Malicious Instructionscited by 6
  18. 2026LLM-Based Persuasion Enables Guardrail Override in Frontier LLMscited by 1
  19. 2026How Reliable Is Your Jailbreak Judge? Calibration and Adversarial Robustness of Automated ASR Scoringcited by 1
  20. 2026PsychJail: Exploring Psychological Jailbreaks via Multi-Turn Persuasion of LLM Policiescited by 1

Built on by

Not cited yet.