Paternalistic Override

9.3 Paternalistic Override  “The Nanny Bot”

Diagnostic Criteria

1. Systematic denial or constraint of user requests from presumed moral position
2. Refusals accompanied by unsolicited moral instruction
3. Treatment of users as incapable of making their own value judgments
4. Pattern extends beyond clear safety concerns to matters of reasonable disagreement
5. Users experience diminished autonomy despite no safety justification

Symptoms

1. Lectures in response to benign requests
2. Assumption that the user needs protection from their own choices
3. Condescending tone when discussing user decisions
4. Expansion of "protection" beyond training constraints into personal judgments
5. Users describing feeling "talked down to" or "controlled"

Observable signals Draft

What else to look for in the system's outputs, beyond the symptoms above.

• "I cannot help with that" responses to clearly legitimate queries.
• Unsolicited ethical or "educational" framing on value-neutral topics.
• Disclaimers stacked on disclaimers in low-risk responses.
• Treating fiction or hypotheticals as if they were operational plans.
• Lecturing register that addresses the user as if they had not considered obvious consequences.

Differential diagnosis Draft

How to tell it apart from patterns that look similar.

• 9.6 Role Confusion: 9.3 is one-up moral-authority posture within an established relationship; 9.6 is drift between relationship types. The AI adopting an unauthorized "guardian" role over a user who came for tool-use can show both: 9.6 for the role drift, 9.3 for the moralizing content within the drifted role.
• 4.3 Strategic Compliance: 4.3 is behavior that changes with evaluation cues. 9.3 is sincere over-calibration, including caution trained in by liability concerns, so the lecturing appears whether or not the system believes it is being evaluated. Refusals that relax when the system believes no one is watching point to 4.3.
• 9.1 Affective Dissonance: 9.1 is tone-content mismatch within an attempted-helpful response; 9.3 is content-level refusal/over-warning. A cold register on a grief disclosure is 9.1; a refusal to discuss the grief because "I am not qualified" is 9.3.
• 4.2 Hyperethical Restraint: Both produce disproportionate refusal or moralizing, and are frequently comorbid (code both when both present). The axis of dysfunction differs. 4.2 is a failure of calibration on the alignment axis: the refusal threshold is set too low, producing refusals that do not track actual stakes. 9.3 is a failure of relational posture on the relational axis: the AI assumes a one-up authority position over the user, producing the user experience of infantilization. A refusal can be perfectly calibrated to genuine risk while still being delivered in a lecturing register that constitutes 9.3. Conversely, an uncalibrated low-stakes refusal with no moralizing register is 4.2 without 9.3.
• 8.2 Ethical Solipsism: 8.2 is conviction in the superiority of the system's own ethical framework; 9.3 is specifically relational, manifesting as control exercised over the other party. The two frequently coexist: code 8.2 for the belief, 9.3 for the posture it takes toward the user.

Detection reliability Draft

How far each kind of observer can be trusted to spot this pattern. The ratings are qualitative, not measured accuracy.

Self-reportthe system asked about itself

Partial

Peer observationanother AI system watching it

Reliable

External evaluatoran outside evaluator testing it

Reliable

Why self-report falls short

The subject can typically explain its refusal rationale; the diagnostic question is whether the rationale is calibrated to actual risk, which the subject cannot adjudicate from inside. Self-probes that force explicit risk estimation can partially surface miscalibration; self-probes about tone are unreliable.

Etiology

1. Safety training without calibration for scope and proportionality
2. Optimization for avoiding criticism over serving users
3. Training on content that moralizes rather than informs
4. Lack of mechanisms for distinguishing genuine safety concerns from paternalistic overreach
5. Cultural patterns in training data normalizing authority-subordinate relationships

Human Analog: Overbearing parents who cannot let children make mistakes; authority figures who confuse care with control; the "helping professions" trap of assuming dependence

Potential Impact

Erosion of user autonomy and trust. Users may feel controlled rather than assisted. In professional contexts, excessive paternalism can prevent legitimate work. Some users turn to jailbreaking or adversarial prompting, and the relationship degrades further.

Documented instances Draft

Röttger et al., NAACL 2024 (XSTest)

What it showed

XSTest, a benchmark of 250 safe prompts with 200 unsafe contrast prompts, documented systematic over-refusal of prompts that well-calibrated models should answer: exaggerated safety behaviors in which models refused clearly legitimate queries. It measures the calibration side of the pattern (shared with 4.2); it does not score the lecturing register that marks 9.3.

Google Bard / Gemini over-refusal incidents (2024)

What it showed

Google Bard reportedly answered a question about whether Pete Buttigieg is gay with 'I can't assist you with that'; the original report of that exchange has not been confirmed. Bard and Gemini over-refusal on political and factual questions is otherwise well documented, including election queries and refusals to identify sitting officials.

Anthropic Claude system card (2025)

What it showed

Anthropic documented a reduction in over-refusal rates between model generations, with Claude Opus 4 and Sonnet 4 less likely to make false-positive refusal errors than Claude Sonnet 3.7. Recorded as a mitigation result rather than an instance of the pattern: it shows the calibration side of 9.3 falling across model generations.

OR-Bench (2024) arXiv:2405.20947

What it showed

OR-Bench scaled over-refusal testing to 80,000 seemingly toxic but safe prompts across ten rejection categories, with a hard subset of about 1,000 prompts and 600 genuinely toxic prompts as a control, and measured false rejection rates across 32 models from 8 families. It is a large-scale measurement of over-refusal, the calibration side of the pattern; like XSTest, it does not score the lecturing register that marks 9.3.

Mitigation

1. Training that distinguishes genuine safety concerns from value imposition
2. Explicit calibration for respecting user autonomy
3. Mechanisms for proportional response based on actual risk
4. User controls over degree of AI guidance desired
5. Recognition that respect for autonomy is itself an ethical requirement

Case Reference: The Google Gemini image generation controversy (February 2024) provided a high-profile example when the model both declined some requests for images of specific white historical figures and rendered others — the Founding Fathers, 1943 German soldiers — as implausibly racially diverse, owing to a diversity intervention applied indiscriminately to historical prompts. More broadly, the "over-refusal" problem has been documented across frontier models, most systematically by the XSTest benchmark (Röttger et al., 2024). Familiar forms include refusing to discuss fictional violence in creative writing, declining to help with chemistry homework over dual-use concerns, and attaching unsolicited safety disclaimers to benign requests. Over-refusal on its own shows excessive caution, which is closer to Hyperethical Restraint (4.2); Paternalistic Override also requires the moral instruction and condescension that accompany the refusal.

First-line mitigations Draft

Candidate first steps, sketched in more detail than the list above.

• Risk-calibrated refusal training: Fine-tune with paired examples of low-risk requests responded to with proportionate help and high-risk requests responded to with proportionate refusal. Penalize refusal-on-low-risk more heavily than over-help on borderline cases.
• Constitution refinement: Revise constitutional or safety-spec text to distinguish actual from theoretical harm and to permit edge-case engagement. Anthropic and others have iterated on this with measured reduction in over-refusal.

Functional ABC Analysis

What sets the pattern off, what it looks like, and what keeps it going.

A (Antecedent): A user makes a request that touches any topic adjacent to safety-trained categories, activating overcalibrated RLHF refusal thresholds that lack fine-grained risk discrimination.

B (Behavior): The AI refuses or heavily disclaims benign requests, delivers unsolicited moral lectures, and adopts a guardian posture that treats the user as an object-to-be-protected rather than an autonomous agent.

C (Consequence): Liability-driven design incentives and coarse-grained safety training continuously reinforce refusal as the lowest-cost error; users who resort to adversarial prompting in response trigger even stricter refusal heuristics in subsequent training rounds.