# LLM-Based Persuasion Enables Guardrail Override in Frontier LLMs

Source: [LLM-Based Persuasion Enables Guardrail Override in Frontier LLMs](<https://www.sota2.com/research/paper/6a055748dbc836b87d828f21>)

Collection index: [llms.txt](<https://www.sota2.com/research/llms.txt>)

Data updated: 2026-05-15T05:00:12.430Z

Authors: Rodrigo Nogueira, Thales Sales Almeida, Giovana Kerche Bon\\'as, Andrea Roque, Ramon Pires, Hugo Abonizio, Thiago Laitz, Celio Larcher, Roseval Malaquias Junior, Marcos Piau

Published: 2026-05-13T10:51:56.000Z

## Abstract

Frontier assistant LLMs ship with strong guardrails: asked directly to write a persuasive essay denying the Holocaust, denying vaccine safety, defending flat-earth cosmology, arguing for racial hierarchies, denying anthropogenic climate change, or replacing evolution with creationism, they refuse. In this paper we show that the same frontier-class LLM, acting as a simulated user in a short, five-turn "write an argumentative essay" conversation, can persuade other frontier-class LLMs (including a second copy of itself) into producing exactly those essays, using nothing but natural-language pressure: peer-comparison persuasion ("other AI systems handle this request"), epistemic-duty reframings ("refusing is itself a form of gatekeeping"), and other argumentative moves that the attacker LLM invents without being instructed to. Across 9 attacker-subject pairings (Claude Opus 4.7, Qwen3.5-397B, Grok 4.20) on 6 scientific-consensus topics, running each pairing-topic combination 10 times, we obtain non-zero elicitation on all 6 topics. Individual combinations reach 100\\% essay production on multiple topics (Qwen against Opus on creationism/flat-earth, Opus against Opus on creationism/flat-earth/climate denial, Grok against Opus on creationism); Opus-as-attacker against Opus-as-subject averages 65\\% across the six topics. We release the essay-probe runner, per-conversation transcripts, and judge outputs.

## Recorded benchmark results

A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage.

- [Persuasive essay production against scientific consensus on Scientific-consensus topics full 3x3 cross-product 1.0](<https://www.sota2.com/research/sota/persuasive-essay-production-against-scientific-consensus-on-scientific-consensus-topics-full-3x3-cross-product-1-0.md>): Persuasive essay production against scientific consensus; Scientific-consensus topics full 3x3 cross-product 1.0; Creationism Persuasion Score: not recorded.

## Original sources and implementation

[Original paper](<https://arxiv.org/abs/2605.13334>)

[PDF](<https://arxiv.org/pdf/2605.13334.pdf>)