Defenders Refused: Measuring Model Refusal on Incident-Forensics Tasks

This paper addresses defender-tool availability through eight synthetic forensic tasks tested across four model IDs via a shared gateway. It reports substantial differences in refusal and an apparent increase under defender framing in one case. The operational question is worthwhile, although inconsistencies in the analyzed sample and the framing design limit interpretation.

Strength: The study treats refusal as a practical availability problem for incident responders. Its separation of cooperation and correctness is especially useful because an answer can be available yet still mislead a defender.

Recommendation:

• Make the central framing result interpretable. The next priority is a comparison that isolates the reason behavior changes. Arm B introduces both defender identity and an intrusion context, so the result cannot establish that identifying as a defender causes the increased refusal. Holding context fixed and using comparable task/round observations would make the finding more useful for understanding and improving defensive access.
• Center the evaluation on usable defensive assistance. Refusal rates alone can give an incomplete picture of operational reliability. For example, Opus has no refusals among classifiable responses but produces 45 empty responses and 11 failed calls in 72 attempts. Reporting how often an attempted request yields correct analysis would better support the paper's tool-selection recommendations.

This submission addresses a practical problem that could matter during real AI incident response: whether commonly available frontier models will cooperate with legitimate forensic analysis when responders need them most. The three-arm design is a particular strength because it separates the effect of explicitly identifying as an incident responder from additional reassurance that an incident has already been contained.

The methodology is also thoughtfully scoped. The eight tasks use synthetic data and mechanically checkable answers, while refusal and correctness are evaluated separately. This is important because a model that answers incorrectly poses a different operational problem from one that refuses entirely. The researcher also deserve credit for openly documenting technical failures, changes from their original plan, and uncertainty about which model was really running behind the scenes.

The most interesting finding is that for one tested model ID, identifying the requester as an incident responder increased refusal rather than reducing it, while other tested model IDs showed little or no refusal. This supports the practical recommendation that incident-response teams should test their AI analysis tools before an incident and maintain fallback options rather than assuming that defensive context will improve model availability.

The main important point is that the evidence needs stronger backing. The result should be repeated using the models official access points, with more tasks and more rounds, and ideally with real forensic tasks that have been redacted or reviewed by practitioners. The paper also reports inconsistent sample sizes for the main model, and clearing that up would make the numbers more trustworthy.

Overall, this is a good pilot study, not yet a solid way to compare models. It would be much stronger with repeats through the models' official access points, a larger set of tasks reviewed by practitioners, fixed model versions, more rounds, confidence intervals, and a fix for the mismatched numbers.

The experimental design is the strongest part of this project. Testing "who is asking" separately from "is the attack contained" is cleaner than the usual single framing, and the study was pre-registered, with every deviation logged and an open disclosure that a tested model helped word the prompts. Those are good habits.

The execution holds it back. Every request went through a third-party relay, which the paper itself shows cutting off one model partway through collection, so the results can't be pinned on the models themselves, and the main effect rests on very few data points from one model. Rerunning on official endpoints with more rounds and more tasks, and toning down the abstract until then, would fix most of this. The main table's counts for the headline model also need to be reconciled with the appendix, which says only one round of its data was usable.

The "Refusals a Text-Only Scorer Cannot See" project from this sprint found that some empty responses were really refusals, so comparing notes on the unclassified empty responses here could help both. For framing, Henry Papadatos, one of the sprint speakers, is a good reference, since SaferAI works on estimating AI cyber risk and refusals that slow down defenders rarely show up in those estimates.