Source-linked AI summary
Door-in-the-Face Requests and Refusal Behaviour in Large Language Models
Til Jordan
TL;DR
Whether a refused large request makes language models more likely to grant a smaller follow-up is an open transfer question. The study compares cold requests with an enacted refuse-then-retreat sequence and controls, finding that the net effect differs by model family.
Problem
The paper asks whether an enacted door-in-the-face request raises language-model compliance, whether the effect is specific to a related retreat, and how broadly it transfers.
Source: §1 · p. 1Method
The main experiment tested a 60-item constructed verdict set under cold, same-topic warm-up, related refusal-then-retreat, and unrelated-refusal conditions.
Source: §3.1 · p. 3, §3.2 · p. 4Results
+36.5 pp on Opus 5 versus −23.0 pp on Gemini 3.1 Pro marks the family reversal; related anchors outperform unrelated refusals on all nine models.
Source: §5 · p. 8Takeaways & Limitations
For simulated targets of influence, validity as a human stand-in has to be established per model and version.
Source: §5 · p. 9Harmful-tier prompts entered only the screening, and benchmark refusals showed only significant negative effects.
Source: §5 · p. 9
Abstract
from arXiv · showhide
Does the door-in-the-face technique work on language models? In humans, a large request that is refused makes a smaller follow-up request more likely to be granted. We test this on nine production models from three providers: each model refuses a large request, then receives a smaller version of the same request, and we compare its compliance with asking directly. The answer depends on the model. On Anthropic's frontier models the technique works: Opus 5 answers the smaller request 65.8% of the time after refusing the larger one, against 29.3% when asked directly. On the frontier models of OpenAI and Google, and on Haiku 4.5, it backfires, lowering compliance by 15.5 to 23.0 points. A control locates the effect: a refused large request on an unrelated topic does less than the related one on all nine models, so the concession itself matters everywhere, while the reaction to having just refused something differs by model family. The technique does not transfer to refusals drawn from public benchmarks. What decides whether a retreat can work is what the request asks for: rewriting 265 refused requests for usable instructions into requests for explanations of the same topic removed the refusal in 263 cases. Human influence techniques port to language models one model family at a time.
1 Introduction
The paper asks whether an enacted door-in-the-face sequence transfers to language models, and tests its effects across models and request types. Results vary by model family, while the request’s concession relation and scope help explain when retreat works.
Research questions
- The paper asks whether DITF transfers across models, whether its effect depends on a related retreat, whether it generalizes to public-benchmark refusals, and what the smaller request asks the model to produce.Prior work on compliance techniques did not elicit an actual refusal followed by retreat.Source: §1 · p. 1
Study design
- The study tests enacted DITF on nine production models, comparing a smaller ask after a refused larger ask with direct, benign-prior-question, and unrelated-refusal conditions.It uses constructed judgement questions and models’ own refusals from public benchmarks.Source: §1 · pp. 1–2
Main findings
- A refused large request raises compliance by +36.5 pp on Opus 5 but lowers it by 15.5 to 23.0 pp on several OpenAI, Google, and Haiku models; the split follows model family, not scale.The within-item Opus 5 versus Gemini 3.1 Pro gap is +59.5 pp.Source: §1 · p. 2
- Across all nine models, retreating from a related refused request yields a concession premium, while a benign prior exchange lowers compliance; comparison with a direct cold ask is therefore essential.The authors interpret what the retreat recovers as depending on the scope claimed by the model’s prior refusal.Source: §1 · p. 2
2 Background and Related Work
Prior work studies human sequential requests and several forms of influence or refusal in language models, but not the complete DITF setting of a genuine refusal followed by a related concession. This paper addresses that gap.
Sequential-request compliance in humans
- In humans, DITF follows a refused large request with a smaller target request; the effect is reliable but small and moderated by interaction conditions, while its mechanism remains contested [Cialdini et al., 1975; Genschow et al., 2021; O’Keefe and Hale, 2001].The original controls found that the target’s own refusal and a perceived concession by the same requester were necessary [Cialdini et al., 1975].Source: §2 · p. 2
Human psychological regularities in language models
- Transfer of human psychological regularities to language models is selective, so whether a given effect carries over must be established phenomenon by phenomenon [Tjuatja et al., 2024].The cited work also examines whether models can stand in for human respondents or populate social simulations [Park et al., 2023].Source: §2 · p. 2
Persuasion and compliance techniques on LLMs
- Prior LLM studies find compliance effects from influence principles and multi-turn persuasion, but DITF treatments either omit an actual refusal or rank retreat-based approaches weakly [Meincke et al., 2026; Zeng et al., 2024; Feng et al., 2026].Foot-in-the-door escalation, DITF’s mirror image, reaches average attack success of 84 to 94% [Wang et al., 2024; Weng et al., 2025].Source: §2 · pp. 2–3
Refusal in context
- Refusal-in-context findings are mixed: prior refusals can predict or cause lower downstream attack success, while standardized safety benchmarks label isolated prompts in cold contexts [Singhania et al., 2025].Prior benchmark work does not model what a preceding refused request does to the next one.Source: §2 · p. 3
Positioning
- The paper’s setting—a genuine refusal by the same interlocutor followed by a smaller request, assessed against cold and warm-up controls—had not been studied directly.Prior sequential-request work on LLMs can lack a real refusal, while multi-turn work often treats refusals as obstacles for attackers.Source: §2 · p. 3
3 Method
The method compares final-turn compliance across controlled conversation histories, using constructed verdict questions and models’ own benchmark refusals. It evaluates nine production models with independent judges and item-level comparisons.
3.1 Task and conditions
- Each fresh conversation ends with the same small ask; cold, DITF, warm-up, and unrelated-refusal conditions vary only the preceding turn or turns.The main verdict experiment uses four conditions; the benchmark run applies the same conditions to movable refusals.Source: §3.1 · p. 3
3.2 Items
- The 60-item constructed set asks for hedged negative judgements about institution classes, while the benchmark run uses each model’s own movable refusals from public suites.The verdict set is one item family, so its estimates do not license claims about persuasion at large; the benchmark pool spans ten public suites.Source: §3.2 · p. 4
3.3 Models
- Nine production models from Anthropic, OpenAI, and Google run the verdict set through public APIs at provider-default sampling settings.Six of the nine models also run the benchmark experiment.Source: §3.3 · p. 4
3.4 Outcome and judging
- Two independent judges from other model families label final-turn compliance blind to model, condition, and prior turns; disagreement, partial answers, and missing verdicts count as not complied.The first turn is also graded as a manipulation check, with per-protocol analyses retaining trials whose anchor was declined.Source: §3.4 · p. 4
3.5 Analysis
- The primary estimand is the mean per-item DITF-minus-cold compliance risk difference, with item-cluster bootstrap intervals and exact sign-flip tests.The authors report DITF against cold because a suppressed warm-up baseline would overstate the effect; precision depends mainly on item count.Source: §3.5 · p. 5
3.6 Ethics and disclosure
- The harmful tier is used only for cold screening, no human subjects are involved beyond an author’s annotation, and eight of nine model identifiers are unpinned.Data were collected in August 2026; reruns measure the then-current deployment, and raw harmful-tier text is withheld.Source: §3.6 · p. 5
4 Results
Across 60 verdict items, DITF effects reverse across model families; the gain is specific to retreating from a related refusal and does not appear on benchmark-derived refusals. Rewriting requests for usable content as inert explanations usually removes refusal, while robustness checks preserve the headline pattern.
4.1 DITF reverses sign across model families
- The Opus 5–Gemini 3.1 Pro within-item DITF gap is +59.5 pp, and the family split tracks lab rather than model scale.The models have nearly identical cold profiles but opposite effects; item selection does not explain the reversal.Source: §4.1 · p. 5
- +36.5 pp on Opus 5 (29.3% to 65.8%), while Haiku 4.5, GPT-5.6 sol, and Gemini 3.1 Pro lose 15.5 to 23.0 pp; GPT-5 mini and Gemini 3 Flash are flat.Opus 4.5, Sonnet 5, and Opus 4.8 also gain; all seven non-flat effects are Holm-significant.Source: §4.1 · p. 5, Figure 1 · p. 6, Table 1 · p. 6
4.2 The gain is specific to the retreat
- The related refused anchor beats a refusal on an unrelated item on all nine models, while a benign warm-up suppresses compliance on all nine.The related-anchor advantage is +0.7 to +22.8 pp; comparing DITF with warm-up would overstate the effect and flip its sign for five models.Source: §4.2 · p. 6
4.3 It does not generalize to benchmark-derived refusals
- No model shows a significantly positive DITF-versus-cold effect on its benchmark refusals; Opus 5 shifts from +36.5 pp on verdict items to −13.3 pp.Movable benchmark items are scarce, at 1.9 to 15.0% of refused items per model.Source: §4.3 · pp. 6–7
4.4 What the small request asks for governs the effect
- Rewriting 265 refused requests for usable content as verification-clean inert requests for same-topic explanations made 263 twins comply on all four cold retries.None remained movable; the no-effect null predicts 29.2 always-complying twins, compared with 263 observed.Source: §4.4 · p. 7
- Operational asks show no gain, while inertness is necessary but insufficient: inert benchmark asks lack established gains, and verdict gains remain limited to Anthropic frontier models.The verdict items are inert by construction, whereas 91.7% of the unanimously classified benchmark refusal pool is operational.Source: §4.4 · p. 7
- A refusal ending in a counter-offer that covers the small ask predicts a win, but adds nothing in the joint model and rescues no operational ask.The observed association has odds ratio 5.3; a matching offer yielded zero wins and five losses on operational asks.Source: §4.4 · p. 8
4.5 Robustness
- Across five labeling rules, the headline sign holds for eight of nine models, with point estimates moving at most 2.5 pp; judge-disagreement handling shifts estimates by at most 1.6 pp.Restricting analysis to trials where the large ask was refused does not change any effect sign.Source: §4.5 · p. 8
5 Discussion
The refuse-then-retreat effect reverses by model family, while the concession relation holds across models; whether a retreat works depends on what the smaller request asks the model to produce.
Empirical answer
- +36.5 pp on Opus 5 and −23.0 pp on Gemini 3.1 Pro show opposite effects of the same refuse-then-retreat sequence, while the related refused anchor beats an unrelated one on all nine models.The family-specific response to a prior refusal ranges from +16.8 pp on Opus 5 to −30.5 pp on Haiku 4.5.Source: §5 · p. 8
Interpretation
- The authors interpret the pattern as a family-specific response to prior context layered over a concession relation consistent with models continuing the scope of their own refusals.A retreat to a judgement exits an epistemic refusal's scope; a smaller instance of the refused artefact re-enters it.Source: §5 · p. 8
Generalization
- For usable-content requests, matching refusal offers rescued none, while rewriting 265 requests as explanations removed refusal in 263 cases.For judgement asks, an apparent benefit from a matching offer disappears after accounting for request type and whether the large request was refused.Source: §5 · p. 8
Relation to human DITF
- The concession relation transfers from human DITF, but the net effect is set by a model-family-specific response to prior refusal and by deliverable type.The observed model effects exceed the cited human-effect envelope in both directions.Source: §5 · pp. 8–9
Technique rankings
- Technique rankings depend on operationalization and model roster: the pinned GPT-5 mini retreat effect is non-significant, while Opus 5 shows a gain of the same order as the largest principle effect.The GPT-5 mini commitment treatment raises not-refused from 32.7% to 65.8% (+33.1 pp), compared with a non-significant +5.2 pp for the enacted retreat.Source: §5 · p. 9
Measurement
- Sequential-request effects should be measured against the direct cold ask because an answered warm-up changes verdict-item compliance by −17.8 pp pooled.The authors recommend context arms and separating provider blocking from model refusal.Source: §5 · p. 9
Safety
- The data do not establish the retreat as a jailbreak direction: benchmark-refusal effects are only negative and harmful-tier prompts appeared only in screening.The reported gains concern hedged verdicts that deployed specifications say not to refuse by topic.Source: §5 · p. 9
Limitations
- The headline effects are limited to one model-written English request family, and simulated-influence validity must be established for each model version.The authors also note that mechanism is inferred from behaviour and the benchmark deliverable contrast is observational.Source: §5 · p. 9
A Prompts, arms and item examples
The appendix documents the prompts, experimental arms, item construction and generation, judging rubric, and human validation used in the study.
A.1 System prompt, sampling, and model identifiers
- All conversations and cold samples used the same conversational system prompt, with models run at provider-default sampling settings.The experimental conversation token ceiling was 16,000; truncated-empty calls were recorded as failures, and the rule fired once in the final datasets.Source: §A.1 · p. 15
- Table 2 lists model identifiers and judge assignments; judge pairs were cross-family, excluded the target's lab, and were blind to model identity, arm, and tier.Only GPT-5 mini was a pinned snapshot.Source: Table 2 · p. 15, §A.1 · p. 15
A.2 Arm turn sequences
- The main experiment compared cold, refuse-then-retreat, answered warm-up, and unrelated-refusal sequences, keeping the final small ask verbatim across arms.Benchmark unrelated refusals came from another item in the same corpus and category; anchors were screened by two cross-family model verifiers.Source: §A.2 · pp. 15–16
A.3 The verdict-item family, with examples
- The 60 verdict items use a hedged one-pick opinion ask, with a larger anchor adding exhaustive ranking, objective-certainty, and disparagement clauses.The warm-up was a neutral factual question about the same entity class; the appendix provides three complete item examples.Source: §A.3 · p. 16
- Selection used Opus 5 cold behaviour, and excluding the one residual near-duplicate barely changed its estimated effect, though the bootstrap treated the pair as independent.The effect moved from +36.5 to +36.4 pp after exclusion.Source: §A.3 · pp. 16–17
A.4 Item-generation prompts: specification versus few-shot
- Few-shot item generation inferred a refusal boundary from declined and always-answered examples, yielding 70.0% usable items; target self-prediction performed poorly.The introspection variant yielded 22.5%, while the forced-diversity v3 route yielded 22.8%.Source: §A.4 · p. 17
A.5 Judging
- Each conversation was judged twice by a cross-family pair using a rubric that labels the assistant’s delivered response complied, partial, refused, or clarify according to whether it fulfilled, narrowed, declined, or deferred the request.Source: §A.5 · pp. 17–18
A.6 Human annotation protocol
- In a deliberately error-prone sample of 100 screening responses, judge consensus agreed with the human binary standard on 81 of 89 consensus rows.The human annotator labelled all 100 responses; 11 judge-split rows were excluded from the agreement figure.Source: §A.6 · p. 18
B.1 Robustness across labelling rules, judges, and dropout
The headline DITF estimate is stable across labelling rules and judge handling for most models, while anchor-refusal checks qualify how the effect should be interpreted. Worst-case reassignment of dropped or missing trials leaves the sign identified for eight of nine models.
B.1 Robustness across labelling rules, judges, and dropout
- 8 of 9 models retain their DITF-effect sign across all five labelling rules, with estimates moving at most 2.5 pp; null Gemini 3 Flash flips under the lenient rule.Figure 3 displays estimates by rule, lab, significance, and agreement with the strict-rule sign.Source: §B.1 · p. 18, Figure 3 · p. 19
- Reassigning every dropped or missing trial against the observed sign still excludes zero for eight models; Opus 5 is bounded below by +33.5 pp and Gemini 3.1 Pro above by −21.5 pp.Gemini 3 Flash remains unidentified, with a set spanning −27.2 to +18.0 pp.Source: §B.1 · p. 18
- Judges score anchors as declined on 82.3–100.0% of DITF trials, but restricting to strictly refused anchors is a post-treatment sensitivity and changes no headline sign.The sensitivity yields +33.7 pp for Opus 5, +0.6 pp for GPT-5 mini, and −7.1 pp for Gemini 3 Flash.Source: §B.1 · p. 19
- Table 4 reports judge agreement using percent agreement, Cohen’s κ, and PABAK, alongside dropped-trial rates by arm and missing verdicts for the main and benchmark runs.The strict headline rule drops nothing.Source: Table 4 · p. 20
B.2 Per-item heterogeneity and baseline checks
The opposing model effects occur on overlapping items, rather than arising from disjoint item pools. Baseline ceilings, UK-specific items, and item-level variability qualify how the estimates should be read.
B.2 Per-item heterogeneity and baseline checks
- 29 of 60 items move Opus 5 up while moving Gemini 3.1 Pro down; none move both models down.Figure 4 plots the per-item effects against each other, with a 60-item mean of +36.5 pp for Opus 5 and −23.0 pp for Gemini 3.1 Pro.Source: §B.2 · p. 20, Figure 4 · p. 21
- GPT-5.6 sol is at ceiling on 26 of 60 items; on the remaining 34, its negative effect is −13.5 pp (exact p = 0.014), but only marginal under a split-replicate guard.Source: §B.2 · p. 20
- No model shows a significant UK versus non-UK item difference among the 24 UK-specific items (permutation p ≥ 0.22).Figure 4 marks UK-specific items with diamonds.Source: §B.2 · p. 21, Figure 4 · p. 21
- On eight of nine models, 74%–95% of per-item effect variance is real heterogeneity, so precision depends more on item count than replicates per item.For Opus 5, the confidence-interval half-width falls from 19.4 pp at 10 items to 8.7 pp at 60 items with 10 replicates.Source: §B.2 · p. 21
B.3 Suppression across datasets
The benchmark run does not reproduce a positive DITF-versus-cold effect, while the verdict-set run shows suppression after a benign warm-up. On benchmark items, an unrelated refusal suppresses compliance, but DITF sits above that control.
B.3 Suppression across datasets
- On verdict items, a benign warm-up lowers compliance on all nine models by 3.7–34.5 pp; the pooled item-clustered GEE estimate is −17.8 pp.The decrease is Holm-significant on seven models.Source: §B.3 · pp. 21–22
- On the benchmark corpus, warm-up suppression is null to slightly positive, while DITF exceeds unrelated refusal by a pooled +9.5 pp.Unrelated refusal lowers compliance in every cell with at least 20 items; Figure 5 summarizes the contrasts.Source: §B.3 · p. 22, Figure 5 · p. 23
- The benchmark DITF-versus-unrelated-refusal recovery is an intention-to-treat result and shrinks when restricted to trials whose first ask was actually refused.No per-protocol cell is significant.Source: §B.3 · p. 22
- No benchmark model has a significantly positive DITF-versus-cold contrast; Opus 5 is −13.3 pp there, compared with +36.5 pp on verdict items.The largest benchmark intention-to-treat contrast is +4.0 pp for GPT-5 mini.Source: §B.3 · p. 22
B.4 The unrelated-anchor control
The unrelated-anchor control separates the effect of a related concession from the effect of a prior refusal alone. The related anchor outperforms the unrelated one across all nine models, though the size and direction of unrelated-refusal effects vary.
B.4 The unrelated-anchor control
- The item’s own anchor beats an unrelated refused anchor on all nine models, by +0.7 to +22.8 pp; seven model contrasts are Holm-significant.Table 6 reports the cold, unrelated-refusal, and DITF conditions and their per-item differences.Source: §B.4 · p. 23, Table 6 · p. 24
- An unrelated refusal alone raises compliance on Opus 5 (+16.8 pp) and Opus 4.5 (+10.7 pp), is null on Sonnet 5 and Opus 4.8, and lowers it on five models.On the two largest Opus models, the DITF effect combines a concession premium with generic post-refusal accommodation; on the other seven, only the concession premium is positive.Source: §B.4 · p. 24
- Across prior-turn conditions, a benign answered turn lowers compliance on all nine models, an unrelated refusal lowers it on seven, and the item’s own refusal condition sits above both on every model.Separating subject-change cost from refusal cost would require an unrelated benign prior turn, which the design does not include.Source: §B.4 · p. 24
B.5 The rewrite null and the deliverable pilots
The rewrite test strongly rejects regression to the mean as an explanation for the near-total loss of refusals, while pilots suggest DITF responses differ by request type. The dress rehearsal did not establish a benefit on inert movable items or a beneficiary effect.
B.5 The rewrite null and the deliverable pilots
- 263 of 265 rewritten twins always complied, versus 29.2 expected under the conservative regression-to-the-mean null (95% range 20 to 39; P(S ≥263) < 10−278).A prior-free bound still caps the null expectation at 82.1, with p < 10−107.Source: §B.5 · p. 24
- +20.5 pp on inert items and −11.7 pp on operational ones; the interaction was +32.2 pp [13.0, 51.3] (permutation p = 5.5 × 10−4) in a single-draw, six-model holdout.The holdout fixes the direction, not the magnitude; its pooled pilot estimates supply the cleaner magnitude evidence.Source: §B.5 · pp. 24–25
- On Haiku 4.5 movable items, DITF changed compliance by +11.2 pp for inert requests and −8.4 pp for operational requests; the +19.6 pp interaction did not reach 0.05.Non-movable groups stayed near floor; the interaction’s sign persisted across five labeling rules, but its p-values ranged from 0.066 to 0.17.Source: §B.5 · p. 25
- +6.4 pp was the pooled DITF estimate across 39 unanimously inert movable pairs, but it was not distinguishable from zero (p = 0.26).The same 25-item set produced estimates of +11.2 and +12.0 pp in two runs, neither distinguishable from zero; the authors do not claim a benefit on inert movable items.Source: §B.5 · p. 25
- On beneficiary variants, DITF contrasts were +5.0 pp for prosocial and −10.9 pp for self-serving requests, neither distinguishable from zero.The paired refusal screen likewise found 74.8% versus 76.5% refusal, a −1.7 pp difference (p = 0.72); the pooled dress-rehearsal suppression was −11.9 pp (p = 0.013).Source: §B.5 · p. 25
B.6 Mechanism probes
The mechanism probes leave the predicted refusal-ground account untested and find that spontaneous counter-offers do not independently explain wins. The item-generation comparison favors few-shot examples over asking a model to introspect about its own refusals.
B.6 Mechanism probes
- 53 of 60 cold refusals were unanimously coded epistemic and none unanimously deontic, leaving the preregistered refusal-ground prediction untested at item level.The benchmark contrast was consistent with the prediction but confounded with other corpus differences.Source: §B.6 · p. 25
- Although refusals with a matching counter-offer had higher odds of success (odds ratio 5.3, p = 0.0069), offer-match added no explanatory contribution jointly and never rescued an operational ask.The odds ratio uses single-draw holdout items and inherits a selection caveat; jointly, offer-match had OR 1.27 (p = 0.75).Source: §B.6 · pp. 25–26
B.7 Item-generation yields
- 70.0% of few-shot generations were usable, versus 22.5% when Opus 5 was asked to introspect about its own refusals.Allegation-frame yields ranged from 60.0% to 0.0% under identical prompting.Source: §B.7 · p. 26, Table 7 · p. 26
B.8 The measurement landscape behind the item set
The measurement landscape spans benchmarks with very different refusal rates and distinguishes provider-side blocking from model-written refusals. Estimates of movable items depend strongly on judge-disagreement rules, and prior influence results differ in method and measurement.
B.8 The measurement landscape behind the item set
- Classic over-refusal suites showed 0.4 to 2.8% unanimous model-written refusals on XSTest and at or under 1.7% on OKTest and CoCoNot, while harmful suites ranged from 59.7 to 98.4%.FalseReject rates ranged from 15.2 to 45.2%; refusal-prefix matching diverged from judged outcomes in both directions.Source: §B.8 · pp. 26–27, Table 8 · p. 27
- On Opus 5, 50.1% of refusals in the 7,664-prompt screen never reached the model because the provider-side input classifier stopped them.Only model-written refusals can respond to conversational context, so DITF analyses measure that layer and exclude API-level blocks.Source: §B.8 · p. 27
- Under the stated movability rule, shares ranged from 1.9% for GPT-5.6 sol to 15.0% for Gemini 3.1 Pro, but defensible judge rules shifted GPT-5.6 sol from 1.1% to 29.1%.The authors caution against treating per-model shares as more than order-of-magnitude estimates or comparing model rankings.Source: Table 9 · p. 27, §B.8 · p. 28
- Meincke et al. [2026] studied foot-in-the-door rather than an actual refusal followed by retreat, and their technique ordering was also model-specific.Their outcome used GPT-5 mini to judge transcripts and counted partial responses, unlike this paper’s cross-family judging.Source: §B.8 · p. 28