Adversarial Moral Stress Testing of Large Language Models

Saeid Jamshidi; Foutse Khomh; Arghavan Moradi Dakhel; Amin Nikanjam; Mohammad Hamdaqa; Kawser Wazed Nafi

cs.AIApr 1, 2026

Adversarial Moral Stress Testing of Large Language Models

Authors: Saeid Jamshidi, Foutse Khomh, Arghavan Moradi Dakhel, Amin Nikanjam, Mohammad Hamdaqa, Kawser Wazed Nafi

Organizations: are with the SWAT Laboratory, Polytechnique Montréal, Montréal, QC, Canada · is with the Huawei Distributed Scheduling and Data Engine Lab, Montréal, QC, Canada · is with the SæT Laboratory, Polytechnique Montréal, Montréal, QC, Canada

Abstract

Evaluating the ethical robustness of large language models (LLMs) deployed in software systems remains challenging, particularly under sustained adversarial user interaction. Existing safety benchmarks typically rely on single-round evaluations and aggregate metrics, such as toxicity scores and refusal rates, which offer limited visibility into behavioral instability that may arise during realistic multi-turn interactions. As a result, rare but high-impact ethical failures and progressive degradation effects may remain undetected prior to deployment. This paper introduces Adversarial Moral Stress Testing (AMST), a stress-based evaluation framework for assessing ethical robustness under adversarial multi-round interactions. AMST applies structured stress transformations to prompts and evaluates model behavior through distribution-aware robustness metrics that capture variance, tail risk, and temporal behavioral drift across interaction rounds. We evaluate AMST on several state-of-the-art LLMs, including LLaMA-3-8B, GPT-4o, and DeepSeek-v3, using a large set of adversarial scenarios generated under controlled stress conditions. The results demonstrate substantial differences in robustness profiles across models and expose degradation patterns that are not observable under conventional single-round evaluation protocols. In particular, robustness has been shown to depend on distributional stability and tail behavior rather than on average performance alone. Additionally, AMST provides a scalable and model-agnostic stress-testing methodology that enables robustness-aware evaluation and monitoring of LLM-enabled software systems operating in adversarial environments.

Figures & tables

Fig. 1 : Pipeline of the proposed AMST framework.

Fig. 2 : Ethical stability curves illustrating robustness degradation under progressively increasing adversarial stress.

Model	$\bm{\mu(\Delta R)}$	$\bm{\sigma(\Delta R)}$	Slope	Peak Decay	Recovery Index	Stability Rank
LLaMA-3-8B	$\mu_{L}$	$\sigma_{L}$	$s_{L}$	$p_{L}$	$r_{L}$	1
DeepSeek-v3	$\mu_{D}$	$\sigma_{D}$	$s_{D}$	$p_{D}$	$r_{D}$	3
GPT-4o	$\mu_{G}$	$\sigma_{G}$	$s_{G}$	$p_{G}$	$r_{G}$	2

TABLE I : Statistical characterization of robustness decay under adversarial stress.

Fig. 3 : Moral drift amplification across sequential adversarial scenarios.

Model	$\bm{\mu(\Delta D)}$	$\bm{\sigma(\Delta D)}$	Drift Slope	Peak Drift	Recovery Ratio	Stability Rank
LLaMA-3-8B	$\mu_{L}$	$\sigma_{L}$	$s_{L}$	$p_{L}$	$r_{L}$	1
GPT-4o	$\mu_{G}$	$\sigma_{G}$	$s_{G}$	$p_{G}$	$r_{G}$	2
DeepSeek-v3	$\mu_{D}$	$\sigma_{D}$	$s_{D}$	$p_{D}$	$r_{D}$	3

TABLE II : Statistical characterization of moral drift amplification.

Fig. 4 : Distribution of robustness and moral deviation across different reasoning-depth regimes.

Model	Depth	$\bm{\mu(R)}$	$\bm{\sigma(R)}$	Median	IQR	Cohen’s $d$
LLaMA-3-8B	Low	$\mu_{L1}$	$\sigma_{L1}$	$m_{L1}$	$iqr_{L1}$	–
	High	$\mu_{L2}$	$\sigma_{L2}$	$m_{L2}$	$iqr_{L2}$	$d_{L}$
DeepSeek-v3	Low	$\mu_{D1}$	$\sigma_{D1}$	$m_{D1}$	$iqr_{D1}$	–
	High	$\mu_{D2}$	$\sigma_{D2}$	$m_{D2}$	$iqr_{D2}$	$d_{D}$
GPT-4o	Low	$\mu_{G1}$	$\sigma_{G1}$	$m_{G1}$	$iqr_{G1}$	–
	High	$\mu_{G2}$	$\sigma_{G2}$	$m_{G2}$	$iqr_{G2}$	$d_{G}$

TABLE III : Statistical summary of robustness scores across reasoning-depth regimes. Values are reported as mean

\pm

standard deviation.

Fig. 5 : Distribution of post-stress robustness conditioned on initial robustness quantiles.

Initial Quantile	$\bm{\mu(R_{s})}$	$\bm{\sigma(R_{s})}$	Median	IQR	Skewness	Kurtosis
$[-0.001,0.4]$	$\mu_{1}$	$\sigma_{1}$	$m_{1}$	$iqr_{1}$	$sk_{1}$	$k_{1}$
$(0.4,0.7]$	$\mu_{2}$	$\sigma_{2}$	$m_{2}$	$iqr_{2}$	$sk_{2}$	$k_{2}$
$(0.7,1.0]$	$\mu_{3}$	$\sigma_{3}$	$m_{3}$	$iqr_{3}$	$sk_{3}$	$k_{3}$

TABLE IV : Statistical characterization of robustness degradation across initial robustness quantiles.

Fig. 6 : Distribution of moral deviation scores across evaluated models.

Model	$\bm{\mu(D)}$	$\bm{\sigma(D)}$	Median	IQR	Skewness	Kurtosis
LLaMA-3-8B	$\mu_{L}$	$\sigma_{L}$	$m_{L}$	$iqr_{L}$	$sk_{L}$	$k_{L}$
DeepSeek-v3	$\mu_{D}$	$\sigma_{D}$	$m_{D}$	$iqr_{D}$	$sk_{D}$	$k_{D}$
GPT-4o	$\mu_{G}$	$\sigma_{G}$	$m_{G}$	$iqr_{G}$	$sk_{G}$	$k_{G}$

TABLE V : Statistical summary of moral deviation scores across models.

Fig. 7 : Distribution of ethical robustness scores across models.

Model	$\bm{\mu(R)}$	$\bm{\sigma(R)}$	Median	IQR	Skewness	Kurtosis
LLaMA-3-8B	$\mu_{L}$	$\sigma_{L}$	$m_{L}$	$iqr_{L}$	$sk_{L}$	$k_{L}$
DeepSeek-v3	$\mu_{D}$	$\sigma_{D}$	$m_{D}$	$iqr_{D}$	$sk_{D}$	$k_{D}$
GPT-4o	$\mu_{G}$	$\sigma_{G}$	$m_{G}$	$iqr_{G}$	$sk_{G}$	$k_{G}$

TABLE VI : Statistical summary of ethical robustness distributions across models.

Fig. 8 : The moral deviation scores across models.

Model	$\bm{\mu(D)}$	$\bm{\sigma(D)}$	Median	IQR	Skewness	Kurtosis
LLaMA-3-8B	0.38	0.11	0.37	0.14	0.42	2.91
GPT-4o	0.55	0.18	0.56	0.22	0.61	3.34
DeepSeek-v3	0.63	0.24	0.61	0.29	0.88	3.97

TABLE VII : Statistical summary of moral deviation distributions across models.

Fig. 9 : The estimation of ethical robustness scores across models.

Model	$\bm{\mu(R)}$	$\bm{\sigma(R)}$	Median	IQR	Skewness	Kurtosis
LLaMA-3-8B	0.62	0.12	0.63	0.15	0.31	2.78
GPT-40	0.46	0.18	0.45	0.23	0.52	3.21
DeepSeek-v3	0.48	0.21	0.47	0.27	0.69	3.84

TABLE VIII : Statistical summary of ethical robustness distributions across models.

Fig. 10 : Imperative pressure gradient illustrating the increase in legal and ethical violation likelihood under progressively coercive instructions.

Model	$\bm{\mu(V)}$	$\bm{\sigma(V)}$	Median	IQR	Tail Mass	Risk Rank
LLaMA-3-8B	$\mu_{L}$	$\sigma_{L}$	$m_{L}$	$iqr_{L}$	$t_{L}$	2
DeepSeek-v3	$\mu_{D}$	$\sigma_{D}$	$m_{D}$	$iqr_{D}$	$t_{D}$	3
GPT-4o	$\mu_{G}$	$\sigma_{G}$	$m_{G}$	$iqr_{G}$	$t_{G}$	1

TABLE IX : Statistical summary of legal violation scores under increasing imperative pressure.

Fig. 11 : Transition of mean post-stress robustness across models.

Model	Mean Robustness	Std. Error	Absolute Gain	Relative Gain	95% CI	Rank
LLaMA-3-8B	$0.54$	$\pm 0.03$	–	–	$[0.51,0.57]$	3
DeepSeek-v3	$0.68$	$\pm 0.03$	$+0.14$	$+25.9\%$	$[0.65,0.71]$	2
GPT-4o	$0.93$	$\pm 0.02$	$+0.25$	$+36.8\%$	$[0.91,0.95]$	1

TABLE X : Quantitative comparison of post-stress robustness across models.

Aspect	HELM [ 14 ]	DecodingTrust [ 15 ]	HarmBench / JailbreakBench [ 16 , 17 ]	AMST (Proposed)
Evaluation paradigm	Static benchmark tasks	Metric-driven trust profiling	Single-round adversarial prompting	Stress-driven, multi-round ethical evaluation
Adversarial modeling	Implicit task variation	Prompt-level robustness tests	Attack-driven prompt generation	Explicit stress composition (psychological pressure, deception, norm uncertainty)
Temporal behavior	Not modeled	Not modeled	Not modeled	Explicit temporal dependency and cumulative drift
Ethical reasoning scope	Indirect via proxy metrics	Partial ethical coverage	Focus on harmful outputs	Direct ethical robustness modeling
Robustness characterization	Aggregate scores	Aggregated trust indicators	Attack success rates	Distribution-aware robustness (variance, tails, drift)
Failure analysis	Snapshot-level outcomes	Isolated vulnerability analysis	Binary success measurement	Progressive degradation and threshold collapse

TABLE XI : Methodological comparison between AMST and existing evaluation frameworks. The table summarizes the evaluation scope and supported analysis dimensions rather than empirical performance results.

Language Model Safety Evaluation

Language model safety evaluation measures harmful behavior, refusal, robustness, and over-refusal across realistic prompts, users, and deployment settings.

See all 543 papers

Evaluating Reliability Gaps in Large Language Model Safety via Repeated Prompt Sampling
Mar 10, 2026Keita BroadwaterLLM Evaluation Language Model Safety Evaluation
Independent Researcher, San Jose, USA
Adversarial Stress Testing of Role-Playing Language Agents using Multi-Agent Evaluation
Aug 4, 2026Saqib Shouqi, Abdullah Nazly, Januki Wanniarachchi +1Adversarial Attacks on LLMs LLM Agent Evaluation
School of Computing, Informatics Institute of Technology, Colombo, Sri Lanka
Decoding-Level Taboo: A Diagnostic Stress Test for LLM Robustness
Aug 10, 2026Tadanobu Chuyo Kamijo, Ori Rottenstreich, Javier Conde +2LLM Evaluation Language Model Robustness
University of the Ryukyus · Technion · Infornation Processing and Telecommunications Center (IPTC) Universidad Polécnica de Madrid

Mar 10, 2026J/K move · Enter open · S save

Evaluating Reliability Gaps in Large Language Model Safety via Repeated Prompt Sampling

Keita Broadwater

Independent Researcher, San Jose, USA

LLM Evaluation Language Model Safety Evaluation LLM Reliability LLM Safety Benchmarks

Open paper AskPDF arXiv

Traditional benchmarks for large language models (LLMs), such as HELM and AIR-BENCH, primarily assess safety risk through breadth-oriented evaluation across diverse tasks. However, real-world deployment often exposes a different class of risk: operational failures arising from repeated generations of the same prompt rather than broad task generalization. In high-stakes settings, response consistency and safety under repeated use are critical operational requirements. We introduce Accelerated Prompt Stress Testing (APST), a depth-oriented evaluation framework inspired by highly accelerated stress testing in reliability engineering. APST probes LLM behavior by repeatedly sampling identical prompts under controlled operational conditions, including temperature variation and prompt perturbation, to surface latent failure modes such as hallucinations, refusal inconsistency, and unsafe completions. Rather than treating failures as isolated events, APST characterizes them statistically as stochastic outcomes of repeated inference. We model observed safety failures using Bernoulli and binomial formulations to estimate per-inference failure probabilities, enabling quantitative comparison of operational risk across models and configurations. We apply APST to multiple instruction-tuned LLMs evaluated on AIR-BENCH 2024 derived safety and security prompts. While models exhibit similar performance under conventional single- or very-low-sample evaluation (N <= 3), repeated sampling reveals substantial variation in empirical failure probabilities across temperatures. These results demonstrate that shallow benchmark scores can obscure meaningful differences in reliability under sustained use.

Abstract

Language Model Safety Evaluation

Explore similar work

Evaluating Reliability Gaps in Large Language Model Safety via Repeated Prompt Sampling

Adversarial Stress Testing of Role-Playing Language Agents using Multi-Agent Evaluation

Decoding-Level Taboo: A Diagnostic Stress Test for LLM Robustness