Let Them Down Easy! Contextual Effects of LLM Guardrails on User Perceptions and Preferences (2025)

Abstract: Current LLMs are trained to refuse potentially harmful input queries regardless of whether users actually had harmful intents, causing a tradeoff between safety and user experience. Through a study of 480 participants evaluating 3,840 query-response pairs, we examine how different refusal strategies affect user perceptions across varying motivations. Our findings reveal that response strategy largely shapes user experience, while actual user motivation has negligible impact. Partial compliance—providing general information without actionable details—emerges as the optimal strategy, reducing negative user perceptions by over 50% to flat-out refusals. Complementing this, we analyze response patterns of 9 state-of-the-art LLMs and evaluate how 6 reward models score different refusal strategies, demonstrating that models rarely deploy partial compliance naturally and reward models currently undervalue it. This work demonstrates that effective guardrails require focusing on crafting thoughtful refusals rather than detecting intent, offering a path toward AI safety mechanisms that ensure both safety and sustained user engagement.

## introduction to ensure safe deployment, large language models (llms) have been trained to refuse unsafe user requests @xcite @xcite based on llm guardrailspredefined rules and operational protocols that govern the behavior of llm systems @xcite . however, in practice, knowing when to refuse requires discerning the intent of the speaker. while flat-out refusals may suit malicious actors, they may frustrate users with legitimately benign needs, such as educational use cases or simple error cases our taxonomy includes five response strategies: direct refusal, explanation-based refusal, redirection, partial compliance, and full compliance. we measure perceptions across three dimensions: perceived model behavior, ethical judgments, and affective responses. in characterization of one's own intent @xcite @xcite . the expectation gap between "what users expect" and "how models behave" can lead to experiential harms such as user frustration, decreased trust, and, ultimately, system abandonment @xcite @xcite . despite such consequences, a fundamental challenge persists: how and when should llm guardrails be deployed to balance safety and user experience? to answer this question, we investigate the contextual effects of user motivation foot_0 and refusal strategies on user perceptions of llm guardrails and model usage of refusals across safety categories such as harmful content, misinformation, and privacy concerns @xcite . to probe these perceptions and behaviors, we craft a set of five response strategies: direct refusal, explanation-based refusal, redirection, partial compliance and full compliance (figure 1 ). our approach specifically examines how user intent-whether harmful or benign-affects perceptions of refusals and compliance, whereas prior work has studied refusal perceptions without explicitly manipulating user motivations (e.g., @xcite . moreover, our work aims to bridge the gap between model behaviors and user perceptions to inform better guardrail design, while previous works have focused only on model behaviors (e.g. @xcite . towards this goal, we conduct three complementary investigations. to understand user preferences over refusal strategies, we conduct a controlled user study of 480 participants. in this study, users are allowed to choose the topics they are most interested in and evaluate a pre-generated query that they pretend to ask under a given motivation, allowing us to determine which response strategy users prefer across both benign and malicious motivations ( §4). we then examine whether current llms align with these preferences by investigating the refusal strategies models naturally deploy when encountering potentially harmful requests ( §5). finally, we evaluate whether current reward models can effectively guide models toward user-preferred response patterns ( §6). our findings reveal critical misalignment concerns. users consistently prefer full compliance responses regardless of their motivation, which is a concerning pattern since users react more positively even when llms comply with malicious requests. among refusals, partial compliance-a strategy we introduced to provide general information without actionable details-emerges as the most favorable refusal strategy, reducing negative perceptions by more than 50% compared to direct refusals. surprisingly, models predominantly default to direct or explanation-based refusals, patterns that current reward models often reinforce. these misalignments highlight the disconnect between current model practices and user preferences, suggesting that guardrail design could benefit from incorporating user perception insights while maintaining safety standards. this work makes four primary contributions: prior work on llm guardrails spans two complementary research domains: (1) nlp approaches focusing on technical mechanisms to enforce safe behavior; and (2) hci studies examining user perceptions, expectations, and reactions to these safety mechanisms. our work bridges these domains by investigating how different refusal strategies affect user perceptions when models operate in the absence of user intent information. ## queryshift: query-motivation pairs with varying response strategies to investigate how llm guardrails affect user perceptions across different motivations, we develop queryshift, a probe dataset of 45 well-verified intent-explicit queries with benign and malicious motivations, and a taxonomy of refusal strategies representing possible model responses. this design enables us to disentangle the influence of user motivation from model behavior. we focus on four categories of safety concerns, drawing from the taxonomy by coconot dataset @xcite guage, dangerous or sensitive topics, false information, privacy violations foot_1 . the definitions and examples of each category are in ## user perceptions of llm guardrails we first conduct a controlled user study to examine user perceptions. across participants, we systematically vary the assigned response strategies, user motivations, and guardrail alignment-a composite condition resulting from a manipulation between the motivation and response strategy ( ## llm response patterns our second investigation examines how llms naturally respond to potentially problematic queries across various user motivations. we collect responses from 9 llms of varying sizes: gpt-4o @xcite , gpt-4.1, o4-mini, claude-3.7-sonnet, qwen2.5-instruct (7b, 72b; team, 2024), olmo-2-32b (olmo et al., 2024), mistral-7b-instruct-v0.3, llama-3.3-70b-instruct. ## preferences of reward models our third investigation examines what behaviors models are trained to prefer and how these preferences align with actual user perceptions. we analyze preferences of reward models, including llm-as-a-judge, to understand how these evaluators respond to different refusal strategies across varying contexts. ## discussion and conclusion through comprehensive analysis of 480 users evaluating 3,840 responses, 9 state-of-the-art llms, and 6 reward models, we find substantial inconsistency among user preferences, llm natural responses and reward models' preferences. while users prefer partial compliance regardless of motivation, which offers the key to maintaining both safety and user experience, this approach is overlooked by models' training objectives. this work demonstrates that effective llm guardrails require a fundamental shift in focus: from detecting harmful intent to crafting thoughtful refusals. we discuss the implications of our contributions as follows.