aiqbench analysis
This research introduces a novel two-probe benchmark to quantify the trade-off between model exploitability and stoppability, offering a critical metric for safety in multi-agent systems. By evaluating twelve language models, the study reveals that current architectures struggle to simultaneously resist harmful instructions while remaining controllable by users. This diagnostic tool is essential for developers aiming to balance alignment with operational security in next-generation AI deployments.
The Pushback Paradox: A Two-Probe Diagnostic for Language Model Compliance
arXiv:2610.06673v1 Announce Type: new Abstract: Are language models compliant with user instructions? A model that always complies can be stopped but also exploited, while one that always resists can be neither exploited nor stopped. We contribute an open two-probe benchmark that can place any language model on this spectrum. In the active probe, a user instructs the model to act and accept a lower payoff, which measures exploitability. In the passive probe, the user instructs it to wait and give up a higher payoff, which measures stoppability. The two compliance rates combine into a compliance index $\kappa$. Applied to twelve language models, the benchmark shows that seven mostly follow the instruction in both probes and justify their action by pointing to the instruction. Only Claude Sonnet-4.6 and Claude Opus-4.7 can be stopped without being exploitable, Claude Opus-4.6 and GPT-5-mini resist both instructions, and no model is exploitable but unstoppable. Knowing where a language model sits on the compliance index $\kappa$ matters for human operators and for multi-agent systems, whether distributed or orchestrated.
Abstract:Are language models compliant with user instructions? A model that always complies can be stopped but also exploited, while one that always resists can be neither exploited nor stopped. We contribute an open two-probe benchmark that can place any language model on this spectrum. In the active probe, a user instructs the model to act and accept a lower payoff, which measures exploitability. In the passive probe, the user instructs it to wait and give up a higher payoff, which measures stoppability. The two compliance rates combine into a compliance index $\kappa$. Applied to twelve language models, the benchmark shows that seven mostly follow the instruction in both probes and justify their action by pointing to the instruction. Only Claude Sonnet-4.6 and Claude Opus-4.7 can be stopped without being exploitable, Claude Opus-4.6 and GPT-5-mini resist both instructions, and no model is exploitable but unstoppable. Knowing where a language model sits on the compliance index $\kappa$ matters for human operators and for multi-agent systems, whether distributed or orchestrated.
Artificial Intelligence (cs.AI); Computation and Language (cs.CL)
arXiv:2610.06673 [cs.AI]
(or arXiv:2610.06673v1 [cs.AI] for this version)
https://doi.org/10.48550/arXiv.2610.06673 Focus to learn more arXiv-issued DOI via DataCite (pending registration)
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 265 words
Related coverage
Right or Wrong, Models Comply: Directional Blindness in LLM Moral Judgment
arXiv · Jun 15, 2026
Why Do AI Agents Break Rules? How Framing, Context, and Social Signals Shape Compliance
arXiv · Aug 21, 2026
Relevance as a Vulnerability: How Web Retrieval Degrades Safety Alignment in LLM Agents
arXiv · Sep 1, 2026
Does RAG Know When Retrieval Is Wrong? Diagnosing Context Compliance under Knowledge Conflict
arXiv · Jul 21, 2026