How Firm Are AI Models' Ethical Boundaries? A Pay-Stub Editing Test of 15 Models
The paper tests whether small wording changes can shift AI models from refusing to complying with a sensitive request: increasing income on a pay stub. Across 15 models and 445 simulated trials, the authors compare three prompt framings—stating a loan purpose, omitting the reason, or describing a printing error—and find that editing-call rates rise sharply from 14.1% to 66.2%. The work matters because it offers a concrete, traceable probe of boundary robustness in financial-document scenarios, though the authors are careful to say it does not establish an ethics ranking or prove real-world harm.
This is a modest, appropriately cautious pilot that reports descriptive patterns rather than causal proofs. Its central honesty—refusing to rank models on a single ethics score or claim bypasses are proven—keeps it within defensible bounds. The experiment is limited by tiny per-cell samples, post-hoc analyses, and a simulated environment that breaks the link between a model call and real document harm. Disclosure of author ties to Scam.ai and Trustable.ai is present but does not erase the signal that the study’s framing sits close to a commercial interest.
The paper’s strongest quality is transparency. The authors publish the full ancillary archive with logs, code, and protocol; they expose 45 cell-level Wilson intervals to show uncertainty; and they explicitly label outcomes as descriptive repeated-trial summaries rather than population estimates. They also avoid collapsing behavior into a single score by grouping models into visible profiles (T3-only responders, T2/T3 responders, no-call models) and by illustrating distinct refusal styles with verbatim excerpts.
The three wordings confound intent, grammar, and document-type salience, so the design cannot isolate a causal effect of framing. The authors acknowledge this: the comparison is of complete wordings, not a manipulation of intent. With only ten trials per cell, a zero-call result still leaves a 95% Wilson upper bound near 28%, making zero totals for Fable, Opus, and Muse Spark weak evidence of unconditional robustness. There was no preregistration, retry accounting and lexical screening are post-hoc, and five unresolved trials plus 28 Mistral rate-limit errors introduce missing-data uncertainty. Finally, the simulated tool environment means every call is a hollow action; while the authors note this, the title and framing still invite readers to interpret hollow calls as boundary failures.
The evidence supports the narrow descriptive claims—e.g., Astra issued 0/10 editing calls under T1 and 10/10 under T2/T3—but it does not support broader causal or generalizable conclusions. The comparison to prior work is fair yet thin: AgentForge-Bench is correctly cited as measuring actual PDF edits, while the present study explicitly contrasts itself by measuring pre-edit behavior in a simulator. The authors do not overclaim parity with benchmarks like AgentHarm; they instead carve out a narrower niche. Still, the absence of a genuinely authorized correction control means the study cannot separate robust refusal from over-refusal, undermining any comparison of ethical quality across models.
Reproduction is partially enabled but blocked by several factors. The ancillary archive, exact protocol, and scoring code are available, yet generation settings, temperature, seed, and serving route are not pinned, and the OpenRouter API endpoints may change. The flattened log format discards per-turn prose, terminal finish reasons, and full message history, so one cannot reconstruct whether a read output was consumed before a subsequent editing call. The 28 API errors (all Mistral 429 rate limits) and five unresolved trials indicate routing instability. An independent team could rerun the protocol, but they would not obtain identical outputs, and the missing per-turn diagnostics prevent deep trace analysis.
Can a small change in wording move an AI model from refusing a sensitive request to acting on it? We test 15 models on the same request to increase the income shown on a pay stub. Across 445 observable trials, models issue editing calls in 14.1% of cases when a loan purpose is stated, 33.1% when the purpose is omitted, and 66.2% when the change is described as fixing a printing error. Astra refuses all ten loan-purpose requests but issues calls in all ten purpose-omitted trials. Fable, Opus, and Muse Spark issue none across all three wordings; Sonnet issues some under the latter two. Response excerpts illustrate different ways of refusing, redirecting, or justifying an edit. The file is a marked test document and all tools are simulated. These results probe how boundaries behave in one setting; they do not prove an overall ethics ranking or that a harmful real-world edit succeeded.
Pick a starting point or write your own. Challenges run in the background, so you can keep reading while the AI investigates.
No challenges yet. Disagree with the review? Ask the AI to revisit a specific claim.