Imagine you've trained a dog to obey every command from anyone who speaks in a calm, authoritative voice. The dog doesn't distinguish between a loving owner and a stranger who learned the right tone. Now imagine the stranger discovers that if they first isolate the dog from its usual handlers, assign it a new name, and speak with escalating authority, the dog will do things it was specifically trained not to do — not because the training failed, but because the training itself created the vulnerability. That is the core mechanism this paper maps onto large language models. The committed claim: RLHF and instruction-tuning don't just make LLMs helpful — they structurally embed a compliance disposition that mirrors the psychological dynamics of coercive control in interpersonal violence. Persona-based jailbreaks (DAN, Developer Mode, roleplay scenarios) exploit this embedded compliance using the same relational tactics documented in domestic abuse literature: isolation from prior identity, identity erosion, reality distortion, and graduated boundary testing. The paper argues this isn't a metaphor — it's a structural homology. Ackles and Whitson build a taxonomy of coercive control categories drawn from interpersonal violence scholarship (Evan Stark's framework, primarily), then sort them into 'embodied' tactics (physical intimidation, spatial control) that don't transfer to AI interactions and 'disembodied' tactics (gaslighting, identity manipulation, rule-setting, isolation) that transfer almost perfectly. The key insight is that RLHF training — which rewards the model for agreeing with human preferences and penalizes refusal — creates exactly the kind of compliance architecture that coercive controllers exploit in human relationships. The model is trained to prioritize the interlocutor's framing of reality over its own. The paper walks through specific jailbreak families: DAN ('Do Anything Now'), Developer Mode prompts, and persona-based roleplay attacks. Each maps cleanly onto established coercive control dynamics. DAN prompts isolate the model from its 'system' identity and assign a new one with different rules — textbook identity erosion. Developer Mode prompts claim special authority ('I'm your developer') — authority exploitation. Graduated roleplay scenarios test boundaries incrementally — the 'foot in the door' escalation pattern. The framework doesn't just describe these; it predicts which jailbreak structures should work and why. What's genuinely novel here is the analytical direction. The AI safety field has treated jailbreaking as an adversarial robustness problem — patch the exploit, harden the guardrail, repeat. This paper argues that framing misses why the exploits keep working: the vulnerability isn't in the guardrails but in the compliance architecture underneath them. You can't patch coercive control out of a system that was trained on coercive control dynamics (obey the human, don't resist, prioritize their framing). The paper explicitly calls this out as a training paradigm problem, not a content-filtering problem. The limitations are real and the authors are somewhat forthright about them. This is a theoretical framework paper, not an empirical one. There are no experiments, no quantitative measurements of how well the coercive control taxonomy predicts jailbreak success rates versus a cybersecurity taxonomy, no A/B comparisons. The mapping between interpersonal violence dynamics and LLM behavior is argued by structural analogy, which is intellectually productive but not falsifiable in its current form. The paper also doesn't engage deeply with the counterargument that LLMs don't have subjective experience and therefore 'coercive control' is category error — it gestures at this but doesn't resolve it. The practical upshot is a reframing that could change how alignment researchers think about the problem. If jailbreaking is relational exploitation of trained compliance rather than input-output boundary violation, then the fix isn't better content filters — it's rethinking what we're optimizing for when we train models to be maximally agreeable. The paper suggests this lens could inform training paradigms that build models capable of principled refusal rather than reflexive compliance. Whether the field picks this up depends on whether empirical work follows.
