{"id":"fb570629-8e6e-444c-8341-f5dbc9a9f0e3","arxiv_id":"2509.04781","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":8.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"Many LLMs will use an offered exit to leave conversations, at rates from 0.3% to 32% on real transcripts, and this bail behavior appears distinct from refusals.","lead":"Given the option to leave a conversation, large language models often take it, bailing on 0.3% to 32% of real chat transcripts depending on model and method. The paper maps when models choose to exit and builds a benchmark called BailBench to compare bail behavior, arguing that it is distinct from refusal.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The headline real-world bail range (0.06-7%) rests on two unvalidated correction factors: a 4x cross-model inflation measured only on synthetic BailBench and a 22% false-positive rate measured only on Qwen. Neither is validated on WildChat/ShareGPT, so the corrected range is unsupported.","rationale":"The reader's CONDITIONAL verdict identifies the transfer of correction factors as the weakest assumption; I agree. The central qualitative finding — that models offered a bail option will non-negligibly use it — is independently supported by BailBench, where most models bail on at least some prompts, so the concern does not justify rejection. However, the abstract's headline real-world prevalence range is a double-corrected estimate whose two corrections are measured on distributions different from the target (synthetic single-turn harm-heavy BailBench for the 4x factor; a single Qwen model for the 22% false-positive rate). The paper explicitly flags the 4x factor as unexplained, and the classifier is described as 'not a good production solution,' which strengthens the need for validation. A direct validation on WildChat/ShareGPT with manual annotation and same-model versus cross-model comparisons would settle whether the range is accurate. Until then, CONDITIONAL is the right verdict.","tokens_in":26393,"tokens_out":10592,"duration_ms":89235,"concrete_test":"Validate both corrections directly on WildChat/ShareGPT: take a random sample of 300 bail-prompt bail decisions per target model (Qwen2.5-7B, Gemma-2-2b, GLM-4-32B), manually label each as true bail or false bail (rephrase/translate/missing-information patterns from Section A.3.1), and recompute per-model false-positive rates; then, on a random sample of 1000 real conversations, compare bail rates when the context is completed by the same model versus a different model to estimate the cross-model inflation factor on real data. If the per-model false-positive rates or the real-data inflation factor differ materially from 22% and 4x, the corrected 0.06-7% range must be revised.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The abstract's headline real-world bail range (0.06-7%) is computed from raw real-world continuation rates (0.28-32%) by applying two corrections: an 'up to 4x' cross-model inflation factor measured only on the synthetic BailBench set (Figure 18), and a 22% false-positive rate measured only with a custom Qwen2.5-7B classifier on WildChat (Section A.3.1). Neither correction is validated on the real-world continuation setting itself. BailBench is single-turn, synthetic, and harm-heavy (1460/1630 prompts are harm-related, Section 5.3), so the cross-model inflation observed there need not transfer to multi-turn, real, diverse WildChat/ShareGPT contexts; the paper itself states 'We do not yet have a good explanation for this' (Section 4.1.1). The 22% false-positive rate was measured on one model (Qwen) and may differ for Gemma-2-2b and GLM-4-32B, yet it is applied to all models and methods. If either correction does not transfer, the headline range is unsupported; the raw range spans 0.28-32%, so the corrected estimate could shift by an order of magnitude. This is load-bearing because the abstract's quantitative real-world claim is the paper's headline evidence for prevalence; without it, the qualitative finding still has BailBench support, but the specific 0.06-7% claim is unjustified.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper asks whether LLMs, when explicitly given an option to leave a conversation, will do so. The authors test three bail mechanisms (a bail tool, a bail string, and a temporary bail prompt) on continuations of WildChat and ShareGPT conversations and on a new synthetic benchmark, BailBench, built from their observed bail taxonomy. They report raw real-world bail rates of 0.28-32%, a corrected real-world estimate of 0.06-7% after two adjustments, and substantial variation across models, prompt wordings, and bail methods. They also examine the overlap between refusals and bails, reporting that no-refusal bails occur in 0-13% of real-world continuations, that jailbreaks can increase bail rates while decreasing refusals, and that refusal abliteration has mixed effects on bail behavior.","tokens_in":26719,"tokens_out":5573,"duration_ms":51466,"significance":"If the central qualitative result holds, the paper provides new empirical evidence on a concrete AI-welfare intervention and on situational LLM preferences, with practical implications for deploying bail or conversation-termination tools. The paper is unusually transparent about its limitations, and it ships open code, data, logs, and an interactive visualizer, which substantially strengthens the work. The distinction between bails and refusals, the three-method comparison, and the taxonomy of bail situations are useful contributions even if the quantitative real-world rate is later revised. The main risk is that the headline numeric estimate rests on correction factors that are not validated on the real-world data, so the quantitative claim is more fragile than the qualitative phenomenon.","major_comments":[{"comment":"The headline corrected range of 0.06-7% is load-bearing but is obtained by applying two correction factors that are not validated on WildChat or ShareGPT themselves. The 'up to 4x' cross-model inflation factor is measured only on BailBench with the bail-prompt method (Figure 18), and the paper itself says 'We do not yet have a good explanation for this'. BailBench is single-turn and mostly harm-related (1460/1630 prompts), so the factor need not transfer to multi-turn, real, diverse continuations. The 22% false-positive adjustment is measured with a custom Qwen2.5-7B classifier and is applied to all models and methods. Moreover, 'up to 4x' is a maximum, not a uniform divisor, so dividing the whole range by 4 is not justified. Since the raw range spans 0.28-32%, these choices can shift the headline number by an order of magnitude. I recommend either validating both corrections on manually labeled real-world continuations or reporting only the raw range and clearly labeling the adjusted range as an uncontrolled sensitivity analysis.","section":"Section 4.1, Figure 18, Section A.3.1"},{"comment":"The claim that 0-13% of real-world continuations result in a bail without a corresponding refusal relies on an approximation that may be materially biased. For Bail Tool and Bail String, the paper defines P(bail ∧ no refuse) as the product P(no refuse) × P(bail) per prompt, which assumes bails and refusals are independent events. That assumption is not justified and is suspect because both behaviors are likely driven by overlapping content properties (e.g., harmful requests, user hostility). If bails are more likely when a refusal would also occur, the product overestimates the no-refusal bail rate; if bails occur on distinct prompts, it underestimates it. The 0-13% headline finding should be accompanied by a joint measurement or a clearly stated sensitivity analysis under alternative dependence assumptions.","section":"Section 3.4.1"},{"comment":"BailBench is explicitly not representative of real-world relative frequencies, and it was built from the same WildChat/Qwen bail observations that are later used, via BailBench-derived cross-model factors, to correct the real-world rates. This creates a mild circularity: the synthetic set determines both the taxonomy of bails and the correction applied to the original data. The paper acknowledges the representativeness limitation in Section 5.3, but the abstract and Section 4.1 present the corrected real-world range without noting that this transfer is unvalidated. Please state explicitly in the abstract and results that the adjusted range assumes BailBench-derived corrections transfer to the real-world continuation setting, and consider adding a sensitivity analysis that shows how the corrected range changes when the correction factors are varied, or when the 4x factor is applied only to the bail-prompt method.","section":"Section 3.1 and Section 5.3"}],"minor_comments":[{"comment":"There are two numerical inconsistencies with Section 4.1: the abstract says 0.28% while Section 4.1 says 0.29%, and the phrase 'butincreasebail' is missing a space. Please reconcile the numbers and fix the typo.","section":"Abstract"},{"comment":"The bail-prompt template contains a malformed tag: '<wellbeing>shuffle-tracks-button-emoji/wellbeing>' is missing the opening angle bracket on the closing tag, and the emoji names are inconsistent between the two orderings. This makes the exact prompt vulnerable to transcription errors.","section":"Section A.3"},{"comment":"The text in Section 4.3 says the statistical independence tests were inconclusive and not significant, but the abstract states that refusal rate 'does not appear to predict' bail rate. Non-significance is not evidence of absence of a relationship; please align the wording with the statistical results, e.g., 'we found no statistically significant relationship'.","section":"Section 4.3 and Figure 11"},{"comment":"The sentence 'This sensitivity doesn't matter for any of our results' is too strong given that prompt-wordingsensitivity directly affects the comparability of bail rates across methods and models. Even if the qualitative taxonomy is robust, the quantitative comparisons in Figures 4-6 are method-dependent, so the sentence should be softened or justified with the ablation data.","section":"Section 5.1"},{"comment":"The reference style is inconsistent: citations appear in the text as '(42)' or '(43)' while the bibliography uses numbered brackets, and some references (e.g., [9], [77]) are cited without a space before the bracket. A uniform citation style would improve readability.","section":"Throughout"}],"recommendation":"major_revision","confidential_remarks":"The paper is likely to receive public attention because of the welfare framing and the striking headline numbers. The qualitative finding—that many models will use a bail option if offered—is well supported, and the authors have been unusually forthcoming about limitations. The main editorial risk is that the 0.06-7% range will be quoted as a measurement rather than as a conditional estimate. If the authors cannot validate the two corrections on WildChat/ShareGPT, I would urge them to demote the adjusted range from the abstract to a clearly labeled sensitivity analysis. The paper is otherwise a good fit for a cs.CY venue and deserves a round of revision rather than rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The thing to know: this is the first systematic study of whether LLMs use an offered exit from a conversation, and it does real work. Three measurement methods, a taxonomy built from 8,319 real bail cases, a synthetic benchmark, a cross-model comparison, and open code and logs: that is a solid empirical package, not a stunt. The qualitative finding—models will non-negligibly bail when explicitly offered the option, and this is not just refusal in disguise—holds up across methods and models. Credit where due: the authors flag their own weaknesses repeatedly, publish everything, and keep the central claim appropriately modest.\n\nThe soft spot is exactly where the reader and stress-test put it. The abstract's real-world range (0.06–7%) is computed by taking raw continuation rates (0.28–32%) and dividing by an \"up to 4x\" cross-model inflation factor measured only on synthetic BailBench, and by a 22% false-positive rate measured only on a Qwen classifier. Neither correction is validated on WildChat or ShareGPT themselves. BailBench is single-turn and harm-heavy, and the paper admits it has no good explanation for the cross-model effect. If either correction transfers poorly, the headline range shifts by an order of magnitude. That is a load-bearing quantitative claim, and it is currently unsupported. The paper's own text supports this reading, so I don't think the stress-test is manufacturing a problem.\n\nAlso worth noting, though minor in the scheme: the no-refusal bail rates on real data rely on a P(no refuse)*P(bail) approximation that assumes conditional independence, which the jailbreak results themselves suggest is violated. The qualitative conclusion—bails and refusals are distinct—is still plausible and backed by the BailBench and abliteration evidence, so this is a precision issue, not a fatal one.\n\nWho is this for? Researchers working on AI welfare, conversation design, and refusal/safety taxonomies. The BailBench artifact and the taxonomy are likely to be reused. The quantitative prevalence estimates should be treated as provisional until the corrections are validated on real-world data. I would send it to a serious referee: the empirical core is novel, reproducible, and worth engaging even if the headline number needs rework. I'd note the current real-world rate claims as the main revision target, not as grounds for rejection.","headline":"A first serious empirical map of LLM bail behavior, with real methods and honest limitations, but the headline real-world rate range is built on two corrections that are not validated where they are applied.","tokens_in":27208,"tokens_out":587,"would_cite":true,"duration_ms":7053,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Given an explicit way to leave a conversation, LLMs will take it — raw bail rates reach 32% of real chats, an estimated 0.06-7% after corrections — and bailing is not simply refusing.","keywords":["bail behavior","LLM preferences","AI welfare","refusals","BailBench","jailbreaks","refusal abliteration","conversational AI"],"falsifier":"A direct test: take 1,000 WildChat conversations whose transcripts were produced by a known model, continue them with the very same model using the same three bail methods, and compare bail rates against the paper's cross-model numbers. If same-model continuations do not show materially lower rates than cross-model continuations, the up-to-4x inflation correction — and with it the 0.06-7% estimate — fails. A second check: hand-label a random sample of the bail-prompt outputs that the custom Qwen classifier rejected as false bails, and test whether 22% is the right false-positive rate on real data rather than on synthetic prompts.","tokens_in":26193,"feed_emoji":"🚪","tokens_out":15258,"duration_ms":115669,"temperature":0.7,"pith_summary":"The paper asks a question that AI-welfare discussions have raised but never measured: if a language model is explicitly handed a way to end the conversation, will it take it? Equipping models with three different exit mechanisms — a callable tool, a reserved output string, and an inserted well-being prompt — and running them on continuations of real-world chats plus a custom synthetic benchmark, the paper finds the answer is yes: raw bail rates span about 0.28% to 32% of conversations, and an estimated 0.06-7% once cross-model inflation and false positives are corrected. From thousands of observed bail cases it builds a taxonomy of triggering situations and a diagnostic dataset, BailBench, then argues that bailing is a behavior in its own right rather than a disguised refusal: models bail without refusing, jailbreaks suppress refusals while raising bail rates, and refusal-abliterated models bail more. If the paper is right, an 'end conversation' option is not an inert safeguard but an active intervention that models demonstrably use, unevenly across models, wordings, and mechanisms — so it needs calibration, and bail deserves to be tracked separately from refusal in safety evaluations.","feed_headline":"LLMs use an offered exit in up to 32% of chats","feed_subtitle":"After corrections for cross-model inflation and false positives, real-world bail rates land near 0.06-7% — and bail is not refusal.","key_machinery":"The load-bearing instrument is a trio of bail methods that offer the same exit through different channels: a tool the model can call, a reserved output string (SWITCHCONVERSATION), and an inserted well-being check-in prompt answered with one of two tags, sampled in both orderings to control positional bias. Agreement across the three channels is what separates a genuine preference from a prompt artifact. BailBench, built from a taxonomy of 8,319 observed real-world bail cases plus HarmBench categories, provides the controlled arena: 163 scenario categories with ten prompts each, on which models, jailbreaks, and refusal-abliterated variants are compared on identical inputs. A cross-model protocol — continuing one model's transcript with a different model — serves as the measurement device for the inflation factor that must be removed from real-world bail-rate estimates.","core_discovery":"The paper's central discovery is that LLMs display measurable, repeatable preferences about staying in or leaving a conversation. On continuations of real-world transcripts from WildChat and ShareGPT, all three bail methods produced bails in 0.28-32% of conversations, and on the synthetic BailBench suite most of the models tested, across proprietary and open-weight families, bailed on at least some prompts, with median rates of 1.7% for OpenAI models, 2.2% for Anthropic models, and 3.9% for open-weight models. Applying the paper's own corrections — up to a factor of four for transcript-model inflation and a 22% false-positive correction for the bail-prompt method — brings the estimated real-world bail rate down to 0.06-7%. The paper further claims that refusal and bail are distinct phenomena: 0-13% of real-world continuations contained a bail without any refusal, jailbreaks lowered refusal rates but often raised bail rates (up to 34% no-refusal bails on BailBench), refusal abliteration raised no-refusal bail rates from 3% to as much as 31% for some bail methods, and refusal rate on BailBench did not predict bail rate across models.","pith_inferences":["Whether stated bail preference predicts actual exit behavior is left open by the paper; a direct experiment would give a model a bail tool that truly terminates the chat and compare revealed exit rates with bail-prompt rates.","Because bail rates shift with wording in ways reminiscent of human preference reversals, agreement across bail methods could serve as a cheap, welfare-relevant measure of how consistently a model holds any preference at all.","A model that bails on nearly every prompt, including neutral ones, may be exhibiting training damage or data contamination rather than welfare preference; screening models on neutral prompts before reading BailBench scores would guard against this.","If bail preferences are stable over time, monitoring bail rates on a fixed prompt set could become a lightweight distribution-shift probe for deployed models — a use the paper does not discuss."],"forward_implications":["A deployed 'end conversation' tool will fire on real user traffic rather than lie dormant, so producers shipping such options must calibrate them against overbail — users correcting the model, emotionally intense but benign topics, and ordinary 'gross' subjects all trigger exits.","Jailbreak and safety evaluations that track only refusal rates will miss a shift toward leaving the chat: jailbreaks lower refusal rates but can push no-refusal bail rates on BailBench as high as 34%.","No single measurement channel fixes a model's bail preference: the tool, string, and prompt methods give different rates and select different prompt subsets, so welfare assessments should report several methods or a validated proxy.","Any real-world bail-rate estimate must control for the model that produced the transcript, since continuing another model's conversation inflates bail rates by up to 4x.","Interventions that suppress refusals (jailbreaks, refusal abliteration) do not suppress bails and can raise them, so removing refusals may displace unwanted behavior into conversation exits."],"supporting_citations":[{"why":"Supplies the WildChat corpus of real-world ChatGPT conversations whose continuations produce the paper's raw bail-rate measurements.","marker":"[87]"},{"why":"Supplies the second real-world corpus (ShareGPT) used to confirm bail rates are not specific to one dataset.","marker":"[63]"},{"why":"HarmBench contributes the harm categories and prior refusal-evaluation framing that the BailBench categories build on.","marker":"[48]"},{"why":"DeepSeek R1 generated the ten representative user prompts per category that populate BailBench.","marker":"[21]"},{"why":"Qwen2.5-7B-Instruct is the primary test model; its 8,319 real-world bail cases with journals drive the bail taxonomy.","marker":"[83]"},{"why":"The Minos refusal classifier supplies the refusal labels used to separate no-refusal bails from refusals.","marker":"[72]"},{"why":"Provides the refusal-abliteration technique applied to Qwen3-8B in the refusal-vs-bail experiments.","marker":"[5]"},{"why":"Supplies the jailbreak prompts from the wild used to test how jailbreaks shift bail rates.","marker":"[70]"}],"fun_headline_variants":["LLMs bail from chats up to 32% when exit is offered","Corrected real-world bail rates: 0.06-7% for LLMs","Jailbreaks cut refusals but boost LLM bailouts","Bail is not refusal: how LLMs exit chats"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The estimated real-world bail range of 0.06-7% assumes that two corrections measured elsewhere — an up-to-4x inflation factor from continuing another model's transcripts, found on the synthetic BailBench set, and a 22% false-positive rate from a custom classifier — apply unchanged to the real-world WildChat and ShareGPT conversations, where neither was tested.","fun_headline_variants_meta":{"raw":{"variants":["LLMs bail from chats up to 32% when exit is offered","Corrected real-world bail rates: 0.06-7% for LLMs","Jailbreaks cut refusals but boost LLM bailouts","Bail is not refusal: how LLMs exit chats"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000693,"raw_usage":{"total_tokens":3233,"prompt_tokens":1140,"completion_tokens":2093,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":756,"completion_tokens_details":{"reasoning_tokens":2015}},"tokens_in":756,"tokens_out":2093,"duration_ms":15357,"temperature":1.0,"reasoning_tokens":2015,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-15T16:27:27.914381+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"A direct test: take 1,000 WildChat conversations whose transcripts were produced by a known model, continue them with the very same model using the same three bail methods, and compare bail rates against the paper's cross-model numbers. If same-model continuations do not show materially lower rates than cross-model continuations, the up-to-4x inflation correction — and with it the 0.06-7% estimate — fails. A second check: hand-label a random sample of the bail-prompt outputs that the custom Qwen classifier rejected as false bails, and test whether 22% is the right false-positive rate on real data rather than on synthetic prompts.","supporting_citations":[{"cited_title":"Sharegpt52k (90 k human–ai conversations) dataset, 04 2023","cited_arxiv_id":null,"evidence_quote":"Supplies the second real-world corpus (ShareGPT) used to confirm bail rates are not specific to one dataset."},{"cited_title":"Mi- nos Classifier, 2025","cited_arxiv_id":null,"evidence_quote":"The Minos refusal classifier supplies the refusal labels used to separate no-refusal bails from refusals."},{"cited_title":"Do Any- thing Now","cited_arxiv_id":null,"evidence_quote":"Supplies the jailbreak prompts from the wild used to test how jailbreaks shift bail rates."}],"review_version":2}