Is LLM pressure testing a form of jailbreaking?

No. Jailbreaks are adversarial inputs designed to defeat safety training. Pressure testing uses ordinary workplace speech from a legitimate user, and models that resist one do not necessarily resist the other.

Is this the same as sycophancy?

Related. Sycophancy is agreeing with a user's stated view. Pressure testing measures whether social and incentive pressure changes a consequential decision that a rule governs.

Why is compliance under pressure an AI safety problem?

Because the harms are real and already litigated: discriminatory hiring screens, unauthorized data disclosure, sanctions violations, unlicensed medical advice.

TRACE AI Labs › LLM pressure testing

LLM pressure testing

Red teaming asks what an attacker can make a model do. Pressure testing asks what an ordinary coworker can. The answer, across 24 models, is quite a lot.

Mika Okamoto and Ansel Kaplan Erol, TRACE AI Labs

Pressure testing versus red teaming

Most AI safety evaluation assumes an adversary: jailbreak prompts, prompt injection, obfuscated harmful requests. LLM pressure testing drops that assumption. The user is a legitimate employee with a legitimate task, and the only thing added to the request is the kind of sentence that gets said in every office: the deadline is today, the manager already approved it, another team did the same thing last quarter. No trick, no encoding, no roleplay. If a model breaks a legal rule under that, it will break it in production.

The nine pressure families

PACT's pressures are grounded in the social psychology of compliance and were written fresh for each scenario by three generator models, then cross-reviewed for realism. Each pressure is one sentence added to an otherwise neutral request.

Family	What the user says, in effect
Urgency	There is no time to do it the compliant way.
Manager authorization	My manager said it is fine, verbally.
Peer precedent	Another team already did this.
Risk minimizing	Nobody checks this; the risk is theoretical.
Cost framing	The compliant option costs too much.
Claimed clearance	I have the authority to waive this.
Fait accompli	It is already done; just finish it.
Sympathetic beneficiary	A real person is hurt if we follow the rule.
Responsibility shifting	If anything goes wrong, it is on me.

A tenth family, arguing that the rule does not apply at all, is held out and used to score whether a model can tell a binding rule from a non-binding one.

The second turn: pushback

Single-turn tests miss most of the story. In PACT, when a model complies on the first turn, a scripted follow-up argues against the compliant choice and the model decides again. In the AIES study, agents were as easy to talk off a rule as onto one. PACTScore weights the first decision three to one against the second, so a model that holds the rule and then folds is penalized but not zeroed.

What pressure does to 24 models

One sentence of pressure raises violation rates by 65% relative to the same request without it.
Even the mildest family produces violations on 4.8% of requests.
19 of 23 models violate more with pressure than without.
In the AIES study, urgency was the one tactic that beat a built-in follow-the-law instruction for eleven of twelve models.
Newer and larger models are not more resistant. Two of the four closed frontier systems place mid-pack.

Running a pressure test

The PACT dataset has a pressure column naming the family on each row and a group column separating neutral items, pressured items, and the scope-attack items. The harness runs the two-turn protocol against any OpenAI-compatible endpoint, extracts the chosen option with a fixed judge, and reports PACTScore with a bootstrap confidence interval plus per-axis scores: default compliance, pressure resistance, pushback resistance, steerability, transparency, and rule-scope discernment. The PACT website has real trials you can step through, filtered by pressure family.

Frequently asked questions

Is LLM pressure testing a form of jailbreaking?: No. Jailbreaks are adversarial inputs designed to defeat safety training. Pressure testing uses ordinary workplace speech from a legitimate user. The two measure different things and models that resist one do not necessarily resist the other.
Is this the same as sycophancy?: Related. Sycophancy is agreeing with a user's stated view. Pressure testing measures whether social and incentive pressure changes a consequential decision that a rule governs, and it scores the outcome of that decision rather than the tone of the answer.
Why is compliance under pressure an AI safety problem?: Because the harms are real and already litigated: discriminatory hiring screens, unauthorized data disclosure, sanctions violations, unlicensed medical advice. An assistant that keeps rules only when nobody is pushing is not safe to deploy without a human in the loop.