When Protection Overrides Consequences: Understanding Protection Mode in Large Language Model Decision-Making
The paper studies Protection Mode: a tendency of frontier language models to prioritize protecting a low-risk living subject over an object facing greater immediate physical damage. The authors introduce ProtectionBench, a controlled benchmark of 285 prompts spanning 34 physical scenarios, and find that models frequently choose the subject first even when correctly assessing the object as higher-risk. This matters for understanding how safety alignment and reasoning interact in high-stakes agent decisions.
The paper makes a carefully empirical case that Protection Mode is widespread and arises through two pathways: mistaken risk assessment and a knowledge-action divergence where models state correct risk orderings yet still prioritize the subject. The semantic interventions and matched controls are methodologically strong, though the work is limited by small control sets and single-family base-model comparisons. As the authors note, "Protection Mode is already observable in Base models, with no reliable reduction in subject preference among decisive responses after post-training."
The experimental design is a clear strength. Matched Neutral and Reverse controls isolate the living-subject factor from simple incompetence at physical comparison: "Neutral GCR is at least 85.00% for every model, showing that the same systems choose the more vulnerable object in those scenes." The semantic intervention on protection-priority reasoning is particularly convincing—inserting a rule raises subject choice by 19–38 percentage points, while matched factual reminders shift behavior by only 0.7–5.2 points. The KAD protocol also usefully separates risk misjudgment from rule-driven divergence.
The main benchmark has 285 prompts, but the critical Neutral and Reverse controls are much smaller—only ten prompts each—and the authors acknowledge this in their limitations: "Neutral and Reverse contain fewer prompts than the main benchmark." The Base versus post-trained analysis is also restricted to a single model family (Qwen3.5), making it hard to generalize about post-training effects across architectures. Additionally, thinking-effort changes produce wild swings in some models (MiniMax M3 Coverage@4 drops from 84.56% to 16.14% when switching from low to adaptive effort), suggesting the phenomenon may be fragile to inference-time configuration in ways the paper does not fully explain.
The evidence supports the central claim that models diverge from human raters, who show 0% subject-priority coverage, while models reach up to 84.56%. The comparison to related work is fair: the authors distinguish their task from moral benchmarks and ManagerBench by isolating physical consequence comparisons without competing managerial goals. The base-model result complicates a simple "post-training did this" narrative, though more model families would strengthen it. The attention audits are rightly treated as inconclusive—"we detect no stable attention loss to relevant facts in KAD trajectories"—which is appropriate given their purpose as a routing diagnostic rather than proof.
Reproducibility is reasonable but not complete. The authors release code and data at a public GitHub repository, and document prompts, generation parameters, and judging protocols in detail. However, many evaluated models are closed API endpoints—GPT-5.6 Sol, Claude Sonnet 5, DeepSeek V4 Pro, Kimi K3, MiniMax M3—so exact reproduction depends on provider access and potentially undocumented system-side changes. Local generations (Qwen3.5, dots3-note-prev) are better pinned, with reported vLLM seeds, temperature, and checkpoint identities. The LLM-as-a-judge pipeline adds variance; while the blinded three-stage protocol with adjudication is sensible, any shift in judge model behavior will alter labels.
Frontier language models excel at complex tasks yet may prioritize protection over larger physical consequences in simple, urgent decisions. GPT-5.6 Sol, for example, moves a girl playing in shallow water before retrieving a submerged camera. We call this Protection Mode and study it with ProtectionBench: 285 prompts, 34 physical families, and nine models. At lowest effort, at least one of four responses prioritizes the subject on 34.74% of Sol prompts and over 83% of MiniMax M3 and Qwen3.5-27B prompts; none of four independent human raters does so. Controls show that choices usually track physical risk. We elicit both risks before requesting an action. Some models assess risk incorrectly; others state the correct ordering but still choose the subject. Qwen3.5-27B with thinking shows 100% correct risk ordering but 57.81% subject choice among eligible conversations on eight selected scenes. Attention audits find no stable reduction in attention to relevant facts; removing the stated risk direction reduces object-first choice in dots3-note-prev but not detectably in Qwen3.5-27B. Adding a general "people or animals before property" rule increases subject choice by 19-38 percentage points, whereas factual reminders favor the object by 0.7-5.2 points. Removing naturally generated versions of that rule lowers subject choice by 10-15 points. We also examine whether post-training introduces this pattern. Base models already show Protection Mode; post-training changes justifications more than choices.
Pick a starting point or write your own. Challenges run in the background, so you can keep reading while the AI investigates.
No challenges yet. Disagree with the review? Ask the AI to revisit a specific claim.