User-Centric Design Paradigms for Trust and Control in Human- LLM -Interactions: A Survey (2025)

Abstract: As LLMs become widespread, trust in their behavior becomes increasingly important. For NLP research, it is crucial to ensure that not only AI designers and developers, but also end users, are enabled to control the properties of trustworthy LLMs, such as transparency, privacy, or accuracy. However, involving end users in this process remains a practical challenge. Based on a design-centered survey of methods developed in recent papers from HCI and NLP venues, this paper proposes seven design paradigms that can be integrated in NLP research to enhance end-user control over the trustworthiness of LLMs. We discuss design gaps and challenges of applying these paradigms in NLP and propose future research directions.

## introduction while llms bring many advantages, their opacity hinders human agency and trust, as especially end users lack the necessary information and transparency to critically assess system decisions before following or acting on them @xcite . for this reason, there is a growing need in the field of nlp to develop methods that enhance end-user control over ai systems. at the same time, in the domain of humancomputer interaction (hci), approximately 22 regulations comprising normative principles for mitigating ai risks and enhancing trust in ai systems had been published by 2020 @xcite . while recent hci studies explore the attitudes of different groups towards these policies @xcite , their practical implementation is underexplored @xcite , particularly regarding how to enable end users to proactively participate in controlling the trustworthiness of llm systems. this paper proposes seven design paradigms for enhancing end-user control over the trustworthi-ness of llm systems based on a design-centered survey of novel methods from recent hci and nlp studies. we define trustworthy llms using the following requirements for trustworthy ai proposed by ethics guidelines for trustworthy ai (hleg, 2019): (1) human agency and oversight (including fundamental rights); (2) technical robustness and safety (including resilience to attack and security, fallback plan and general safety, accuracy, reliability, and reproducibility); (3) privacy and data governance (including respect for privacy, quality and integrity of data, and access to data); (4) transparency (including traceability, explainability, and communication); (5) diversity, non-discrimination and fairness (including the avoidance of unfair bias, accessibility and universal design, and stakeholder participation); (6) environmental and societal wellbeing (including sustainability and environmental friendliness, social impact, society, and democracy) and ( 7 ) accountability (including auditability, minimization, and reporting of negative impact, tradeoffs, and redress). although these guidelines were published before the rise of llms, we use them to define trust in llms because they were among the first to foreground a user-centered approach to trustworthy ai @xcite and remain an influential user-centered policy. this survey contributes to human-centered approaches to llms by bridging regulatory perspectives on trustworthy ai from the field of hci with their practical applications in nlp research on end users' interactions with llms. ## methodology we surveyed original research papers (no work in progress, demo papers, posters, provocations, surveys, or extended abstracts) published in english in the acm digital library and the acl anthology between january 1, 2022, and august 1, 2025. the start date was selected to include papers published shortly before the release of chatgpt on november 30, 2022. while the acm library was selected for its comprehensive coverage of hci design research and venues (e.g., chi) relevant to our focus, the acl anthology comprises work from some of the most important nlp venues, such as emnlp and naacl. this dual-sourced corpus provides a balanced foundation for identifying design patterns at the intersection of hci and nlp. the following search string was used for the acm library: the search function in acl anthology is limited to simple keyword queries and does not support using this search string. therefore, we performed multiple keyword-based searches (e.g., trust llm, transparency llm, bias llm) and complemented this with google site:aclanthology.org searches to approximate boolean logic and ensure broader coverage. a total of 1781 papers were screened from both databases. at least one of the search words had to appear in the abstract, the title, or the keywords of the paper to be included in the final dataset. importantly, the papers that fulfill this criterion were manually inspected to determine whether they have a clear focus on both trust (i.e., the trust aspect mentioned in the abstract) and end-user control in the full text. accordingly, user-centric papers without a clear relationship to trust and vice versa: trustrelated papers without end-user involvement in the design and/or evaluation stage (e.g., @xcite or papers where the evaluation is conducted based only on datasets, performance comparison of several models, and evaluation metrics, rather than involving users and explicitly addressing how user control is achieved, were not considered. however, papers combining user studies with, for example, comparing the performance of several models, were considered (e.g., @xcite @xcite . also, papers not explicitly dealing with language models or language model-based applications were excluded (e.g., devos et al. 2022). these criteria reduced the number of eligible papers to 773. finally, papers that considered user studies as future work (e.g., @xcite were excluded. in this way, 713 papers were excluded. the final list comprises 60 papers from both sources. papers did not need to explicitly address the ai hleg guidelines, nor did we include studies that analyzed the guidelines themselves. multimodal llms @xcite @xcite were discarded due to the broader use of text-based models. figure 1 note that this is not a systematic review aiming for completeness, but a design-centered survey of recent work focusing on a synthesis of paradigms that support user control and trust in llm systems. two annotators searched for the papers in the databases described above. they discussed and refined the inclusion criteria following the prisma paradigm @xcite . the included papers were then annotated for their primary trust aspects (multiple assignment was allowed), and design paradigm. annotation decisions were reached via iterative discussion. no formal inter-annotator agreement was calculated, as the focus was on interpretive synthesis. as a result, seven design paradigms are proposed (section 3) and discussed in terms of their applications in nlp (section 5). note that although multiple paradigm assignments were theoretically possible, each paper was assigned to exactly one primary design paradigm based on annotator agreement. ## results interface-level accuracy control interface-level accuracy control refers to design approaches that equip users with interactive tools and visual cues at the interface level to help inspect, verify, and guide the factual accuracy of llm outputs. these interfaces do not require altering the model itself, but instead focus on enhancing user control, interpretability of outputs, and trust calibration through features such as consistency checks, confidence scores, source attributions, and interactive verification workflows. the primary goal of this paradigm is to foster accuracy and user agency by integrating transparent control mechanisms directly into the interface rather than modifying the llm architecture. core strategies include tools for output verification, hallucination detection, and user-led content auditing. for example, @xcite enable users to compare the factual consistency of multiple llm outputs. @xcite introduce a factual editing framework that alerts users to new content, supports verification via web search, and enables tracing of model-generated edits. formal verification has also been integrated into llm planning tasks: @xcite combine model checking with user oversight. other interfaces visualize hallucination risks or confidence scores to help users identify unreliable content @xcite . despite promising interaction designs, this paradigm faces several challenges. first, many studies prioritize surface-level model accuracy without systematically examining how interface interventions influence other trust dimensions such as fairness, transparency, or robustness. second, tools like confidence scores @xcite assume a high degree of ai literacy and decisionmaking capacity, potentially excluding non-expert users or overburdening them with the responsibility to correctly interpret, evaluate, and act on information provided by an ai system. third, the usability and cognitive demands of these systems remain under-evaluated, as it is often unclear whether users meaningfully benefit from features like verification workflows or simply ignore them in practice. workflow-aligned and domain-adapted llm assistance this design approach integrates llms into real-world tasks or professional practices, such as education @xcite , qualitative analysis @xcite , legal consultation @xcite , banking @xcite , coding @xcite , or clinical settings @xcite , addressing domain-specific challenges of the llm application. users are typically given mechanisms to adapt, guide, or verify outputs in-situ, through plan-then-execute pipelines @xcite , interface-level guardrails @xcite , or feedback loops involving humans in iterative roles @xcite . unlike generic chat interfaces, these systems align generation with domain goals and domain-specific verification routines and constraints. the goal is to integrate llms into domainspecific workflows in ways that preserve user control, ensure output reliability, and align with domain-specific goals. examples include the restriction of llm outputs to pseudocode in educational contexts to prevent over-reliance and support learning @xcite , real-time human feedback @xcite , iterative human verification @xcite , or guardrails that prevent programmers' over-reliance @xcite , collaborative human-llm thematic analysis and topic modeling @xcite @xcite . while these paradigms offer promising forms of human-in-the-loop control, several limitations remain. first, they often assume static domain knowledge and well-formed tasks and do not adapt to rapid changes in domains like coding. second, despite placing high cognitive demands on users (e.g., verifying assertions @xcite or interpreting multi-step plans (he et al., 2025)), most designs treat users as uniformly skilled and do not assess or adjust for varying levels of domain expertise and ai literacy. this creates risks of misalignment between tool complexity and user capability and of mismatched support (either under-serving novice users or constraining experts). finally, the integration of these designs in professional workflows raises epistemic and normative concerns since the normative assumptions integrated in designs (e.g., what counts as a "good" summary or acceptable pseudocode) are rarely made explicit or empirically evaluated. as a result, these designs may reinforce domain conventions (e.g., legal templates) without enabling critical reflection, for example in qualitative analysis @xcite . in sum, workflow-aligned assistance offers a promising direction for domain-specific llm use, but often relies on hidden assumptions about task stability, user capability, and normative correctness. future work should investigate how designs could better adapt to user diversity and task ambiguity. participatory designs participatory designs aim to empower users through learning and reflection, engaging them not just as passive recipients of ai output but as active collaborators, educators, assessors, or learners. the goal is to foster ai literacy, critical awareness of llm capabilities, and trust calibration by giving users tools to customize, question, and steer llm behavior, particularly in educational, reflective, or interpersonal contexts. common strategies include user-controlled editable outputs @xcite , scaffolded interaction via ai literacy workshops @xcite , user-led evaluation through comparisons, subjective trust metrics @xcite @xcite , or human-llm evaluation of social appropriateness @xcite . expert-in-the-loop approaches include collaborative prompt refinement for educational content @xcite or feedback-driven role-play simulation in counseling @xcite . despite the user-centered intent, several gaps persist. first, participatory mechanisms are often introduced without sufficient onboarding or scaffolding. users are asked to judge, configure, or collaborate with llms before acquiring a conceptual understanding of model behavior, which may lead to overtrust. ai literacy, while a core aim, is rarely embedded as a design prerequisite- @xcite being a notable exception. second, customization and feedback are typically limited to surface-level tuning (e.g., tone or behavior), with little support for questioning underlying assumptions, biases, or system limitations. third, while many systems frame participation as empowering, they may implicitly rely on user labor, placing the burden of correction, verification, and ethical reflection onto the user without adequate institutional or system-side accountability. overall, participatory designs signal a significant shift toward user agency and transparency, but remain underdeveloped in terms of empowering user ai literacy and critical engagement with model limitations. interactive authoring and co-creation this paradigm focuses on enabling users to collaborate with llms during complex or creative tasks (e.g., writing, prompt design, workflow creation) by enabling real-time interaction, iterative refinement, and mixed-initiative control. these systems support back-and-forth exchanges between users and llms, allowing users to guide, steer, edit, or evaluate intermediate outputs through customizable workflows. the primary goal is to empower users as coauthors, prompt designers, or evaluators in creative or analytical tasks by enabling interactive, transparent, and customizable collaboration with llms. these systems seek to enhance human agency, re-duce cognitive load, and make llm-powered generation more interpretable and aligned with users' goals and values. this paradigm centers on prompt chaining @xcite , co-auditing llm-behavior in general @xcite , or llm-generated biases @xcite and personality traits @xcite in particular, llm-and human-based disinformation evaluation @xcite , co-creative authoring @xcite @xcite , direct manipulation (masson et al., 2024), and mixed-initiative control, enabling users to collaboratively shape llm behavior via initiative-sharing interfaces @xcite , llm-initiated prompt pipelines @xcite and editable preference profiles created based on user preferences @xcite . despite their promise, interactive authoring designs raise several unresolved questions. first, while many interfaces emphasize modularity, prompt chaining, or editable outputs @xcite @xcite , it remains unclear how much initiative users actually retain in practice. systems often alternate initiative without clearly defining the boundaries of user agency, and few studies examine whether users can override or put the model's underlying assumptions into question. customization is usually limited to surface-level, such as prompt components, without affording deeper user control or interpretability of generation mechanisms. second, user literacy and feedback quality are assumed rather than supported. designs empower users to filter outputs, flag disinformation, or assess persuasiveness @xcite , but offer limited scaffolding to support critical evaluation. since there are no clear scaffolds for critical reflection, user perception of biases or auditing personality traits @xcite risks being subjective and culturally dependent. third, while some systems highlight transparency and provenance (e.g., via interface visualizations or think-aloud protocols @xcite ), it remains unclear whether such interventions are always desirable and whether more transparency always leads to better trust calibration. finally, there is limited evidence that these approaches generalize beyond low-stakes, exploratory domains. many studies involve small participant samples (e.g., thirteen participants in @xcite , leaving open the question of how co-creation behaves under real-world constraints such as time pressure or conflicting user goals. in sum, interactive authoring represents a promising design approach to expanding human-ai collaboration, but current work underestimates the dynamics of control and overlooks users' cognitive limitations. explanation-centered approaches explanationcentered approaches aim to make llm behavior more interpretable by providing humanunderstandable justifications for model predictions, such as rationales @xcite , contrastive explanations @xcite , multilevel and contextualized explanations (monteiro @xcite @xcite , anchored in situ explanations @xcite , explanations with different confidence levels @xcite , saliency explanations @xcite or visualization of internal states @xcite , at various stages of interaction @xcite to help users understand how and why a model generated a particular output. the primary goal is to empower users to interpret, question, and calibrate trust in llm outputs by integrating user-relevant explanations into the human-llm interaction. rather than being a posthoc feature, explanations are regarded as an integral part of the user experience. however, several design limitations remain underexplored. first, explanation quality is uneven, and users are often asked to trust model-generated justifications without support for interrogating the explanation itself. for instance, saliency maps or ranked rationales assume that the model's attention aligns with human reasoning, but users are not empowered to put this alignment into question. most designs present a single explanation type, limiting opportunities for comparison @xcite . second, explanation interfaces often rely on static visualizations or textual input. while a few designs allow users to manipulate explanations (e.g., editable search trees or contrastive comparisons), these remain exceptions. moreover, explanations are usually presented as final, and users can not contribute to the model's reasoning. this risks reinforcing overreliance on explanation rather than promoting interactivity and critical engagement. third, the cognitive demands of interpreting explanations are often overlooked. visualizations, importance heatmaps, or rationales may be challenging to interpret for non-experts or minoritized groups, and some studies suggest that users make better decisions with external references (e.g., wikipedia) than with model-generated explanations @xcite . the assumption that explanations automatically enhance trust or understanding must be validated across diverse user groups and domains. finally, most explanation-centered designs explain one output at a time (for example, why the model gave a specific answer), but they usually don't help users understand a general model behavior, such as whether the model is biased, how it was trained, or what kinds of mistakes it tends to make overall. an exception is @xcite where human-annotated explanations are integrated into active learning loops for annotation support, involving users in both training and evaluation phases. in sum, while explanation-centered interfaces enhance transparency, they risk oversimplifying the complexity of llm behavior and limiting user agency if not designed with deeper interactivity, explanation pluralism, and user education in mind. style-based trust calibration style-based trust calibration refers to design strategies that shape users' trust in llm outputs by varying the communicative style of the output. rather than changing the factual content, these approaches manipulate how information is conveyed, for example, by presenting the output in an assertive or a hesitant tone, or showing confidence cues and visually marking lexical indicators of uncertainty to help users form more accurate mental models of llm reliability. the central assumption is that stylistic framing and contextual cues strongly influence user reliance, perceived transparency, and decision confidence. the primary goal is to support better alignment between perceived and actual model capabilities. this is especially crucial in settings involving uncertainty or risk, such as healthcare, legal advice, or career guidance. rather than improving accuracy directly, these interventions calibrate user perception of models. studies have tested expressions of uncertainty (e.g., first-person: "i'm not sure..." vs. impersonal: "it is not sure...") @xcite , confidence disclaimers @xcite , comparing hesitant versus assertive tones @xcite , trust repair techniques through apologies, denials, and promises @xcite , stylistic variations across chatbot types (llm-based vs. intentbased vs. form-based) @xcite , uncertainty markers @xcite , model-generated greetings @xcite , and visual disclaimers or highlights @xcite . these features are tested in calibrated and miscalibrated scenarios to assess their influence on user trust. however, most work remains narrowly focused on whether a given stylistic manipulation influences trust, rather than how users can be supported in recognizing and critically engaging with such cues in everyday use. for instance, while many features are shown to affect trust in experimental setups, they are rarely integrated into interface systems with guidance or educational scaffolding. @xcite address this by proposing a deliberation-based interface that encourages users to reason through llm suggestions. yet, dealing with insufficient analytical engagement of users with ai recommendations remains an exception. a further limitation is the tension between helping users calibrate trust and the risk of unintentionally manipulating them or introducing new ethical problems. specifically, stylistic cues may encode cultural or gender biases, reinforce stereotypes, or mask unreliable model behavior behind persuasive style. future work should examine how style interacts with power, and whether certain user groups are more vulnerable to over-reliance due to stylistic calibration alone. in conclusion, while style-based approaches offer promising mechanisms for aligning userperceived trust with actual model reliability, they raise critical open questions about fairness and the long-term effects of such calibration. privacy-aware architectures and tools privacyaware architectures and tools are systems, interfaces, or frameworks that aim to detect, minimize, or prevent privacy risks in human-llm interaction. they enhance user awareness, control, and protection by implementing privacy safeguards either before, during, or after data exchange with llms. these approaches consider input redaction, output inspection, system-level manipulation detection, and user education, often grounded in user-centered design and participatory development. unlike general security methods, this category focuses on enduser-facing privacy measures, enabling users to actively participate in managing their personal data exposure and autonomy in llm-mediated environments. the primary goal is to empower users to manage and protect their personal data by providing controllable tools that mitigate privacy risks at every stage of the interaction pipeline. these systems aim to increase user agency and awareness while reducing unintended data leakage, over-disclosure, or manipulation in ai-mediated communication. they address not only what llms can "know" or "leak", but how users can actively participate in preventing harm and making informed choices about data use, visibility, and trustworthiness. core strategies in this paradigm span the full privacy lifecycle, from input-level privacy control @xcite through self-disclosure detection @xcite , user-led data minimization via browser extensions @xcite to posthoc inspection (e.g., leaking personal identifiers through llm outputs @xcite or detecting prompt injection attacks @xcite ) and user education @xcite . however, these designs may face adoption challenges. many tools assume that users are both willing and able to engage in privacy management, although users may sometimes prioritize convenience or utility over caution, especially in lowstakes contexts. moreover, privacy-aware interfaces can disrupt the user experience if they demand too much time, technical understanding, or attention. to be effective, they must be carefully adapted to the context of use and the user's mental workload, for example by being paired with automation, personalization, or persuasive design. finally, some designs risk offloading the responsibility for privacy onto the user without addressing underlying system-level weaknesses in how llms handle user data. for example, asking users to identify sensitive content assumes they understand what counts as risky in the context of opaque model behavior, but this assumption may not hold. it is also unclear how such tools perform across user groups with varying levels of sensitivity to privacy issues. in sum, more research is needed to assess how to communicate privacy risks without overwhelming users or discouraging them from critical use of llms. privacy-aware tools play a crucial role in shifting privacy control closer to users, but must be designed to balance protection, usability, and psychological trust across varied real-world scenarios. ## theoretical perspectives to synthesize the design strategies identified through inductive coding, we draw on three complementary frameworks from hci and cognitive science: activity theory @xcite , distributed cognition @xcite , and mental models (see an overview in payne, 2003). these descriptive theories are suited for analyzing user-centred paradigms across nlp and hci research. activity theory highlights how users engage with llms as tools to achieve specific goals (e.g., writing, learning). it aligns closely with interactive authoring & co-creation and workflow-aligned designs where llms support domain-specific tasks (e.g., @xcite , enabling users to shift from passive prompting to active participation. participatory designs also empower users by emphasizing their agency in shaping system behavior (e.g., @xcite . distributed cognition frames trust as emerging from the interaction between the user, the llm system, and the interventions (e.g., visualizations, warnings), such as in interface-level accuracy control (e.g., @xcite and style-based trust calibration (e.g., @xcite . trust calibration is distributed across the model's suggestions, system-generated evidence, and design interventions rather than by internal understanding alone. referring to users' internal understandings of how llms work, mental models are central to explanation-centered approaches (e.g., @xcite ) that aim to scaffold reasoning about model logic, privacy-aware designs (e.g., @xcite ) that help users understand what llms might infer from personal data, and style-based trust calibration, which influences users' conceptual models of llm reliability. additionally, our classification aligns with the more recent human-centered ai (hcai) framework proposed by @xcite , particularly in treating user control not only as an outcome (product) but also as a participatory design process. the proposed design paradigms also align with principles from classical hci, such as norman's gulfs of execution and evaluation (see @xcite , which describe the barriers users face in acting on and interpreting system behavior. several designs aim to reduce norman's gulf of execution by simplifying prompt design @xcite or providing scaffolds that guide users in expressing their intentions. others address the gulf of evaluation by offering visualizations @xcite of model decisions or contrastive explanations @xcite to help users interpret outputs. furthermore, activity theory helps reduce the gulf of execution by analyzing whether users can meaningfully act on interfaces to achieve their goals. distributed cognition addresses the gulf of evaluation by highlighting how trust and understanding are mediated through interface-level cues, external visualizations, and interaction history. finally, mental models support both gulfs by determining how users understand what actions are possible and how outputs should be interpreted. together, these theories provide a layered perspective on user control in llm interactions. ## discussion and conclusions this paper identified and systematized seven design paradigms that promote user control in human-llm interaction and reflect design strategies grounded in different user goals, ranging from verifying factuality and shaping model output to managing trust and data exposure. our design-centered perspective complements current discussions on human involvement in post-training by emphasizing user control during deployment and interaction. while empirical studies have offered scattered examples of user-centered designs and most recent related surveys do not primarily focus on trust or have a broader scope (e.g., human-model cooperation in @xcite , our contribution lies in synthesizing these efforts into a coherent framework that centers user goals as the organizing principle of human trust in llms. across paradigms, we observe a shift from one-shot prompting toward interactive, iterative, and increasingly userconfigurable llm workflows. these designs foreground a broad spectrum of control types: perceptual (e.g., accuracy cues), procedural (e.g., workflow pausing), epistemic (e.g., explanations, varying linguistic style), and protective (e.g., privacy screening). yet, critical gaps remain. although many studies mention cross-domain application (e.g. @xcite , the variety of tested scenarios is limited. we also observe a lack of design frameworks that help practitioners balance automation and human agency. for example, many tools mediate control through additional llms (e.g., @xcite , which risks reinforcing automation bias rather than supporting user autonomy. to address this, future systems could incorporate trust calibration strategies (e.g., communicative framing, interactive uncertainty visualization) that help users reflect on when and how to trust outputs. most studies assume ai-literate end users with a high level of technical literacy. designs rarely account for diverse user needs, e.g., those with low reading/writing literacy, limited technical expertise, or from marginalized communities. this limits the accessibility and generalizability of proposed methods. users are often expected to interpret complex cues (e.g., factuality scores) without training. it remains unclear how to prevent over-reliance on automation while avoiding user frustration and how to balance control vs. usability, or privacy vs. personalization. for the research at the intersection of hci and nlp, we identify several promising directions for future work: finally, we advocate for design that enables not just enhanced control, but critical engagement with llm behavior, especially through scaffolds that support users in questioning and modifying model output.