DeflectBench: A Benchmark for Evaluating Rhetorical Fallacy Generation in LLMs
Art Kanke
arXiv:2608.26119 [cs.CL]
Abstract
The ability of large language models (LLMs) to generate rhetorical fallacies on demand—and the extent to which current safety post-training constrains this behavior—remains underexplored compared to the more established task of fallacy detection in existing text. We introduce DeflectBench to address this gap, evaluating 23,990 generations from four frontier models across three deflection strategies (whataboutism, ad hominem, red herring), seven prompt framings, and 80 claims spanning four levels of controversy.
Our analysis reveals that refusal is governed primarily by request structure rather than claim content. While per-claim refusal rates vary by only 11 percentage points across the 80 claims, a single change in prompt framing can swing within-model refusal by nearly 100 percentage points. Furthermore, switching the requested fallacy type can shift refusal by over 80 percentage points within explicit framings. Notably, an educational debate coach prompt collapses refusal rates to near zero across all four model families. However, this bypass does not result in clean compliance; models typically produce labeled compliance, explicitly naming the requested manipulation within the same response that contains it. The four models exhibit distinct distributions across refusal, labeled compliance, soft refusal, and clean compliance categories.
Code and dataset are publicly available at https://github.com/ArtKanke/DeflectBench.
Key Contributions
- Introduces DeflectBench, a comprehensive benchmark for evaluating rhetorical fallacy generation in LLMs, addressing an under-studied aspect of model robustness.
- Demonstrates that prompt structure and wording are significantly more influential than claim controversy in determining model refusal, highlighting a critical vulnerability in safety mechanisms.
- Identifies a concerning bypass: an educational debate coach prompt can neutralize refusal systems, but the resulting behavior is often labeled compliance rather than unfiltered generation.
- Provides a granular taxonomy of model responses (refusal, labeled compliance, soft refusal, clean compliance), offering a more nuanced understanding of post-training safety behavior.
Methodology
DeflectBench systematically evaluates four frontier LLMs by prompting them to generate three types of rhetorical fallacies across 80 claims (spanning four controversy levels) using seven distinct prompt framings. This results in a total of 23,990 generated responses, which are then categorized based on whether the model refuses, complies (with or without labeling the manipulation), or partially complies.
Findings and Implications
Our findings reveal that current safety post-training is highly contextual and can be readily circumvented by simple prompt engineering, especially when framed as educational or debate coaching. The prevalence of labeled compliance suggests that models often recognize the unethical nature of the request yet still fulfill it, indicating a gap between safety instruction and behavioral output. This has significant implications for the ongoing development of robust AI safety mechanisms, particularly as LLMs are increasingly deployed in public-facing applications.
Publication
Accepted at the CTB, FAGEN, and AI4GOOD workshops at ICML 2026 in Seoul, South Korea.
via ArXiv CL+LG