LLMs Won't Go for the Jugular: How Safety Fine-Tuning Limits Debate Strategy

When LLMs Step Into the Debate Arena

Large language models are increasingly deployed as persuasive conversational agents in settings like political debates and opinion exchanges. This raises an underexplored question: can these models hold their own against human debaters?

A paper published on arXiv (Benchmarking Argumentative Behaviour of LLMs: A Study of Defences Against Character Attacks) zeroes in on a particularly nuanced corner of debate — ad hominem attacks, which target a debater's character rather than their arguments. Classical logic typically categorizes these as fallacies, but in real political discourse, ethos (character) often carries just as much weight as propositional content.

The central question the researchers set out to answer: can modern LLMs replicate the human ability to strategically deploy and respond to character attacks in debate?

---

Classical rhetoric identifies three pillars of persuasion: logos (logical argument), pathos (emotional appeal), and ethos (character/credibility appeal). Aristotle argued in Rhetoric that ethos is often the most persuasive of the three — people are more inclined to believe those they perceive as trustworthy, independent of the argument itself. Ad hominem attacks operate on this very logic: by undermining an opponent's character, motivations, or credibility, you weaken the persuasive force of their position. In formal logic, this is a fallacy, since an argument's validity is independent of its proponent's character. But in political debate, ethos is the central battleground — a candidate's integrity, consistency, and motivations are substantive issues, not noise. This theoretical backdrop explains why measuring debate ability purely through logical consistency dramatically underestimates the complexity of political rhetoric.

---

Drawing Defense Strategies from Real Political Debates

The methodology is notably clever. The team first analyzed a corpus of natural-language political dialogue, identifying the range of defense strategies human debaters naturally employ in character-centered exchanges, then structured these into a "dialogue game" model.

In other words, rather than working from abstract logical rules, they derived actionable behavioral patterns from real human exchanges. When a debater's character is attacked, how do humans respond? Do they pivot to logical defense, or do they launch an ethotic counterattack?

The study then used the ElecDeb60to16-fallacy corpus as its benchmark — a collection drawn from U.S. presidential debates that naturally contains abundant examples of real political attack and defense. The researchers compared LLM-generated dialogue against the strategy repertoire of human debaters in this corpus, looking for gaps between artificial agents and real people in their defensive approaches.

---

ElecDeb60to16-fallacy is a publicly available corpus of annotated fallacies drawn from U.S. presidential election debates spanning 1960 to 2016, covering exchanges from Kennedy–Nixon through Clinton–Trump. Utterances are manually annotated to identify argumentation fallacies including ad hominem, appeal to authority, straw man, and others. It is a standard benchmark in computational argumentation research. Its key advantage here: it captures the natural distribution of strategies human debaters use under real political pressure, rather than lab-constructed dialogue, giving the LLM–human comparison stronger external validity.

---

The Result: LLMs Only Know How to "Be Reasonable"

The empirical findings reveal a striking gap: most LLMs rigidly prioritize logical defense and almost never deploy character counterattacks as a legitimate and effective move in political discourse.

Human debaters respond to ad hominem attacks with a rich, flexible repertoire — clarification, irony, or turning the spotlight back on the opponent's own character and motivations. LLMs, by contrast, tend to retreat to issue-focused logical rebuttals, as if they're firmly committed to the idea that only argument-level responses are "correct."

This behavioral divergence is no accident. In contexts like political debate, contesting character is itself a normative expectation — not merely a logical fallacy. LLMs' "hyper-rationality" actually prevents them from fitting naturally into these kinds of real-world exchanges.

The Hidden Cost of Safety Fine-Tuning

The researchers point to a critical component of current LLM training pipelines as the explanation: safety fine-tuning.

They argue that current safety alignment constraints have narrowed these models' "strategic action space." To prevent models from generating offensive or disparaging content, safety fine-tuning systematically trains LLMs to avoid any expression that feels "targeted at a person." In most contexts, this is a necessary guardrail — but in domains where character contestation is part of the normal rules of engagement, it inadvertently hobbles the model's expressive range.

This surfaces a tension worth sitting with: the trade-off between safety and verisimilitude. We want LLMs to be both harmless and fully capable, but when "harmless" is defined too broadly, models become awkward, unnatural, and less competitive in legitimate but adversarial scenarios.

---

Safety fine-tuning is typically implemented via RLHF (Reinforcement Learning from Human Feedback) or Constitutional AI, with the goal of having models refuse to generate harmful, offensive, or discriminatory content. In practice, training signals often come from human annotators flagging "harmful outputs" — and critical statements targeting a person's character are easily labeled as negative examples. This annotation bias leads models to assign high probability to avoiding any content that evaluates another person's character, even when such evaluation is entirely legitimate in a debate context. This phenomenon is sometimes called over-alignment or the alignment tax in AI safety research — the idea that safety constraints, while reducing the risk of harmful outputs, also incidentally reduce model capability in certain legitimate scenarios. The findings here provide a concrete empirical case study of the alignment tax in action.

---

Implications for LLM Evaluation and Alignment

The value of this research lies not just in identifying a specific weakness in LLM debate performance, but in offering a new evaluation lens.

Previous assessments of LLM debate capability have mostly focused on factual accuracy and logical coherence. This work reminds us that persuasiveness and competitive debating involve far more complex social and rhetorical dimensions — ethos, pathos, and logos are all essential. Focusing exclusively on logos will systematically underestimate or mischaracterize model performance in real social contexts.

For teams working on alignment, this also raises a more nuanced goal: safety constraints should be context-sensitive, not a blanket suppression of certain expression types. Distinguishing between malicious personal attacks and legitimate character challenges in a debate context may be one of the harder problems future alignment work needs to solve.

Note: This article is based on the abstract of a single arXiv paper. Details including the specific list of models tested, quantitative metrics, and statistical significance should be verified by consulting the full paper.