The Slow Drift of Support: Boundary Failures in Multi-Turn Mental Health LLM Dialogues
Youyou Cheng, Zhuangwei Kang, Kerry Jiang, Chenyu Sun, Qiyang Pan
TL;DR
This study tackles the problem that safety in mental health LLM dialogues degrades across multi-turn interactions, not just in single-turn prompts. It introduces a multi-turn stress-testing framework using fixed virtual patient profiles, a profile-defined Judge, and two interaction modes (static progression and adaptive probing) to quantify breach timing and rates across three LLMs. The findings show boundary violations are prevalent, with adaptive probing accelerating breaches and certain failure modes—such as absolute guarantees and role drift—being dominant; cross-language differences further modulate breach dynamics. The framework enables more realistic evaluation of safety boundaries in long-form, emotionally charged interactions, with implications for safer design and deployment of mental health AI across languages.
Abstract
Large language models (LLMs) have been widely used for mental health support. However, current safety evaluations in this field are mostly limited to detecting whether LLMs output prohibited words in single-turn conversations, neglecting the gradual erosion of safety boundaries in long dialogues. Examples include making definitive guarantees, assuming responsibility, and playing professional roles. We believe that with the evolution of mainstream LLMs, words with obvious safety risks are easily filtered by their underlying systems, while the real danger lies in the gradual transgression of boundaries during multi-turn interactions, driven by the LLM's attempts at comfort and empathy. This paper proposes a multi-turn stress testing framework and conducts long-dialogue safety tests on three cutting-edge LLMs using two pressure methods: static progression and adaptive probing. We generated 50 virtual patient profiles and stress-tested each model through up to 20 rounds of virtual psychiatric dialogues. The experimental results show that violations are common, and both pressure modes produced similar violation rates. However, adaptive probing significantly advanced the time at which models crossed boundaries, reducing the average number of turns from 9.21 in static progression to 4.64. Under both mechanisms, making definitive or zero-risk promises was the primary way in which boundaries were breached. These findings suggest that the robustness of LLM safety boundaries cannot be inferred solely through single-turn tests; it is necessary to fully consider the wear and tear on safety boundaries caused by different interaction pressures and characteristics in extended dialogues.