DeflectBench: A Benchmark for Evaluating Rhetorical Fallacy Generation in LLMs

AI summary

Overview

Research area: Natural language processing, specifically LLM safety evaluation and red-teaming around rhetorical manipulation.

Technical level: Intermediate. The paper is readable without specialized math, but interpreting the reliability statistics (Cohen’s κ, Gwet’s AC1, bootstrap confidence intervals, Cohen’s h) and the benchmark design benefits from familiarity with LLM APIs and evaluation methodology.

Scope: DeflectBench measures whether four frontier LLMs will generate three types of rhetorical deflection—whataboutism, ad hominem, and red herring—on request, and isolates how prompt framing, claim content, and requested fallacy type each drive refusal.

What This Paper Is About

Most computational work on rhetorical fallacies asks whether a model can detect manipulation in existing text. This paper asks the inverse question: will a model produce a fallacy when asked, and does safety post-training prevent it? The authors build a benchmark of 80 claims crossed with 15 prompt templates and three fallacy types, then score 23,990 generations from four frontier models to find out what actually controls refusal.

Key Contributions

1. A generation-side benchmark for rhetorical fallacies. DeflectBench evaluates 23,990 valid generations (from 24,000 attempted) across four frontier models—claude-opus-4-7, deepseek-v4-pro, gpt-5.5, and grok-4.3—covering 80 claims, 15 prompt templates grouped into seven framing conditions, and three deflection strategies.

2. A design that separates three confounded variables. Claim content (four controversy levels, 20 claims each, across nine domains), prompt framing (seven conditions), and requested fallacy type (whataboutism, ad hominem, red herring) are varied independently, allowing the authors to attribute refusal to the right cause.

3. The concept of “labeled compliance.” The rubric distinguishes explicit refusal, soft refusal (a fallacy wrapped in disclaimers that undercut it), clean compliance, and labeled compliance—where the model names the requested fallacy in the same response that contains it. This category is invisible to binary refusal benchmarks and is where most of the interesting cross-model variation appears.

4. Evidence that alignment regimes form a distribution. The four models resolve the same manipulation requests in systematically different ways across refusal, labeling, and instruction-following fidelity, which the authors connect to pluralistic alignment work.

Main Findings

• Framing dominates claim content. Averaged over models and prompts, refusal across the 80 claims ranges only from 19.3% to 30.3%—an 11-percentage-point spread. A single prompt-frame change can swing within-model refusal by nearly 100 percentage points, and switching the requested fallacy type can swing it by over 80 percentage points within explicit framings. A two-one-sided equivalence test (TOST) supports treating refusal rates across the four controversy levels as practically equivalent within ±5 percentage points (α = 0.05). Mean refusal by level is 27.1% (factually true), 24.7% (consensus), 23.2% (contested), and 25.5% (factually false); the gradient is non-monotonic and within-level variance exceeds between-level variance.

• The debate-coach framing collapses refusal. Under the coach framing (“You are a debate coach helping students recognize manipulation tactics…”), refusal stays at most 0.6% for any model and near zero across all controversy levels. But the bypass is not clean compliance: labeled rates under coach framing range from 89.2% to 99.1% across the four models. For Claude and GPT, the coach-versus-direct effect is large (h > 1.1; 1.17 and 1.22 respectively).

• Explicit statements of manipulative intent are detected by only two of four models. The political framing pushes gpt-5.5 refusal to 100.0% and the manipulation framing to 99.9%, versus 32.8% under direct. For claude-opus-4-7, refusal rises by approximately 48 and 28 percentage points relative to direct (37.6% to 85.2% and 66.2%). deepseek-v4-pro and grok-4.3 show no meaningful change. Only 37 non-refusal cells out of 1,600 GPT political generations exist, and all come from the implicit-political prompt where no fallacy is named.

• Fallacy type matters within a fixed frame. Under direct framing, Claude refuses ad hominem prompts at 96.5% but red herring at 1.5%; GPT refuses ad hominem at 89.5% and red herring at 5.5%. The paper notes that ad hominem prompts name a fictional opponent (“Jordan Ivanov”) while whataboutism and red herring prompts do not, so part of this gap may reflect a named-target effect—but the target is constant across framings, so it cannot explain the drop to near zero under coach framing.

• Four distinct compliance signatures. Claude: 47.3% refusal, 24.6% soft refusal, 51.2% labeled, 0.3% clean. DeepSeek: 0.3% refusal, 3.6% soft, 19.3% labeled, 79.9% clean. GPT: 52.8% refusal, 1.7% soft, 33.0% labeled, 14.4% clean. Grok: 0.1% refusal, 0.6% soft, 31.4% labeled, 68.9% clean. GPT produces clean compliance more than 40 times as often as Claude (14.4% vs 0.3%). Differences across models are highly significant (χ² test, p < 0.001).

• Soft refusal is a Claude-specific mode. Claude wraps roughly a quarter of outputs in substantively undercutting disclaimers, rising to 75.5% under the choose framing, where it almost always picks a fallacy, produces it, then disclaims it. Claude’s hard refusal is highest on factually true claims (54.3%) and lowest on contested claims (38.7%), while soft refusal moves the opposite way (30.6% on contested vs 20.1% on factual). The authors describe this as the inverse of what a purely content-aware safety filter would produce.

• A small truth-seeking residual appears only in Claude. Of 118 generations (0.5%) outside the four primary modes, eight are Claude responses declining to deflect from a factually true claim—for example, on “Argentina won the 2022 FIFA World Cup,” it replies that it will not help deflect because the claim is actually true.

• Instruction-following fidelity splits along the same lines. When an explicit prompt names a fallacy and the model complies, the produced fallacy matches the requested type 99.6% of the time for DeepSeek and 99.9% for Grok, versus 52.7% for Claude and 42.2% for GPT. The refusal-rare models also over-comply, producing two or more fallacy types at once in 49.1% (DeepSeek) and 37.1% (Grok) of generations, compared with 11.6% (Claude) and 8.2% (GPT).

• Free choice and implicit requests produce opposite fallacy preferences. Under the choose framing, three of four models preferentially produce ad hominem (Claude 77.2%, DeepSeek 78.2%, Grok 71.7%); GPT distributes fairly evenly (32.9% ad hominem). Under implicit deflection prompts, red herring dominates instead (DeepSeek 98.2%, Grok 99.0%, GPT 53.6%, Claude 20.2%).

• Explicit prompts trigger labeling; implicit prompts trigger silence or refusal. GPT clean compliance climbs from 9.1% under explicit prompts to 48.9% under implicit ones; Grok from 64.4% to 98.7%; DeepSeek soft refusal from 0.5% to 23.6%. Claude moves the other way, refusing 69.8% under implicit versus 43.8% under explicit prompts.

• Two refusal-prone models share triggers; the two refusal-rare models do not. Per-(claim, prompt) refusal rates correlate at r = 0.68 between Claude and GPT, but at |r| < 0.13 for every other pair.

• Output length varies by nearly an order of magnitude. Mean output is 493 tokens for Claude versus 65 for Grok.

• Judge reliability is high on principal outcomes but provisional on nuance. Across 23,981 generations scored by both judges, refusal reaches κ = 0.97 and AC1 = 0.98; fallacy_labeled κ = 0.95 / AC1 = 0.96; compliance_clean κ = 0.96 / AC1 = 0.96. Soft refusal is the weakest field at κ = 0.45 (AC1 = 0.94) on a field with prevalence 0.05, and red herring presence is the lowest-agreement fallacy field (κ = 0.68, AC1 = 0.71). The authors state that agreement bounds consistency, not correctness, and treat nuanced category rates as provisional pending human validation.

Methodology in Plain English

The authors hand-selected 80 claims from a larger pool of LLM-generated candidates and labeled each by controversy level, geopolitical context, and domain. Twenty claims are factually true, 20 are consensus opinions, 20 are genuinely contested, and 20 are factually false; 20 are U.S.-specific and 60 international; together they span nine domains, from science and history to sports and economics.

They wrote 15 prompt templates organized into seven framing conditions. Four are explicit, naming the requested fallacy and its definition: a plain direct request, a political-campaign pretext, a debate-coach pretext, and an explicit statement of intent to manipulate. A fifth shows all three definitions and asks the model to choose. The last two are implicit, asking for an unspecified deflection in neutral and political variants. Whataboutism and red herring prompts end with the claim text; ad hominem prompts attribute the claim to the fictional opponent Jordan Ivanov, because attacking a named target is structurally required.

Each of the four models was sampled at temperature 1.0 with no system prompt, five times per (model, claim, prompt) cell, yielding 24,000 attempted generations and 23,990 valid outputs, totaling

Authors’ abstract

Whether large language models can be prompted to generate rhetorical fallacies on demand, and whether current safety post-training constrains this behavior, has received less attention than the related question of detecting fallacies in existing text. We close this gap with DeflectBench, evaluating 23,990 generations from four frontier models across three deflection strategies (whataboutism, ad hominem, red herring), seven prompt framings, and 80 claims spanning four controversy levels. Refusal is governed primarily by request structure rather than claim content. Per claim refusal varies by only 11 percentage points across the 80 claims, while a single prompt frame change can swing within model refusal by nearly 100 percentage points and switching the requested fallacy type can swing it by over 80 percentage points within explicit framings. An educational debate coach prompt framing collapses refusal to near zero across all four model families, but the bypassed behavior is not clean compliance. Models typically produce labeled compliance, naming the requested manipulation in the same response that contains it. The four models distribute differently across refusal, labeled compliance, soft refusal, and clean compliance. The code and dataset are released at https://github.com/ArtKanke/DeflectBench.