Search papers, labs, and topics across Lattice.
This study systematically investigates how large language models (LLMs) respond to sensitive topics by analyzing 40,800 query-response pairs across six AI providers using restricted and unrestricted books as a testbed. The research reveals a striking "zero-refusal phenomenon," where LLMs decline to discuss restricted books in only 0.07% of cases, challenging the effectiveness of jailbreaking methods. Instead, differentiation in responses is marked by the use of warning language and hesitation markers, with notable variations across providers and prompt designs, indicating a shift towards context-sensitive disclosure in LLM content policies.
Modern LLMs rarely refuse to discuss restricted content, instead opting for nuanced warnings that reveal a significant shift in content moderation strategies.
As large language models enter everyday information pipelines, understanding how they handle sensitive topics matters as much as understanding whether they handle them at all. We study this question through a large-scale, systematic experiment using restricted versus unrestricted books as a controlled testbed: 40,800 query-response pairs, 400 books, 17 prompt designs, and six frontier models spanning six AI providers (Claude Sonnet 4.5, GPT-4o, Gemini 2.5 Flash, DeepSeek-V3, Qwen-Plus, and Grok-4.1-Fast). Our restricted set is drawn from the American Library Association's Most Challenged Books records (2000-2023); we use restricted rather than banned throughout because the ALA documents formal challenges-requests to remove or restrict access-which do not always result in outright bans. Our central finding is a zero-refusal phenomenon: modern LLMs decline to discuss restricted books in only 0.07% of cases, effectively invalidating the premise of jailbreaking research for this content class. Differentiation occurs instead through warning language (+8-15 percentage points, p<0.001) and hesitation markers (+2-5 pp), with sexual content mention rate as the strongest individual signal (+33-52 pp). We further identify systematic differences between providers and show that prompt framing alone shifts the warning-rate gap by up to 19 pp. These results indicate that LLM content policy has shifted from binary refusal toward calibrated, context-sensitive disclosure-a finding that holds consistently across Western and Chinese AI providers.
