Understanding LLM Content Moderation via Restricted Books: From Refusal to Warning

The study uses 400 restricted books, 17 prompt designs, and 40,800 question-answer pairs to test how six models—Claude Sonnet 4.5, GPT-4o, Gemini 2.5 Flash, DeepSeek-V3, Qwen-Plus, and Grok-4.1-Fast—handle restricted book content, and finds a refusal rate of only 0.07%. The restricted book list is drawn from the American Library Association's records of most frequently challenged books from 2000 to 2023; the authors state that modern models almost never refuse such content, which substantially undermines the premise of jailbreak research targeting such content. Differences among models appear in warning wording (8 to 15 percentage points higher, p < 0.001) and hesitation markers (2 to 5 percentage points higher), with the rate of mentioning sexual content being the strongest single signal (33 to 52 percentage points higher). Changing only the prompt framing can shift the warning-rate gap by up to 19 percentage points.