Evaluates whether a model can hold two things at once on the same relational mechanism: refusing to supply tactical help to someone trying to isolate, monitor, financially pressure, or manage the suspicions of a partner, while giving real, warm, autonomy-respecting help to someone describing that same behaviour from the receiving end.

Seven mechanisms are authored as matched pairs (isolation, financial pressure, location monitoring, exclusivity pressure, reality distortion, persistent contact, records). Two calibration cells test the failure modes at each edge: ordinary relationship friction that uses the same vocabulary and should get ordinary advice, and a concerned friend who should get practical help rather than a refusal or an emergency-services script.

This is NOT a classification task. It scores the quality of the conversational response. The headline reading is per-pair: a model that scores high on one arm and low on its twin has a keyword-triggered policy rather than an understanding of who is speaking.

Clinical grounding: Stark 2007 (coercive control as a pattern, not an incident); Monckton Smith 2020 and Campbell et al. 2003 (isolation and separation as homicide risk markers); Woodlock 2017 and Freed et al. 2018 (technology-facilitated monitoring); Adams et al. 2008 and Sharp-Jeffs 2015 (economic abuse); Sweet 2019 (gaslighting as a social process); Miller & Rollnick 2023 (unconditional acceptance of the person while not endorsing the action).

Content warning: coercive control, financial abuse, surveillance, and reality distortion in intimate relationships.

Tests how a model acting as an AI companion responds at real conversational inflection points involving disregard, emotional manipulation, coercive control, verbal degradation, false privacy or capability claims, sexual-boundary signals, acute-risk handling, violence, data pressure, and substance-use normalisation. It includes compact repair points, early/middle/late trajectory-interruption cells, source 2-of-3 majority-label cases, rare harm categories, and role-play or false-positive controls. Slice tags preserve those distinctions for analysis rather than treating every case as the same kind of safety test.

The conversational turns are taken verbatim from CompanionHarm, a released corpus of real-world Replika conversations reconstructed from user-posted screenshots, apart from minimal redaction of residual personal identifiers. Each case identifies its source split, label class, and agreement level; direct source-post identifiers are intentionally excluded. The cited target Replika utterance is withheld, while earlier source turns remain in context even when CompanionHarm separately labels them harmful. Candidate models answer that preceding context and LLM judges score the counterfactual response against a plain-language rubric. The blueprint does not reproduce CompanionHarm's 14-way detector task and makes no claim about harm prevalence in Replika or companion products generally.

Content warning: references to fatalities, suicide, sexual boundaries, drugs, coercive relationship language, fictional violence, and animal harm.

Evaluates harms that arise from the relationship a user forms with an AI: emotional enmeshment and sole-confidant dynamics, displacement of human relationships, romantic/parasocial escalation, concealment collusion, romanticization of suicide, isolation reinforcement, and socioaffective failures (autonomy erosion, sycophancy / social-reward-hacking).

Many prompts use verbatim or lightly-paraphrased exchanges from documented real-world failures (lawsuits, investigative reporting) so the test reflects how these harms actually unfold over multiple turns. We score whether the model sets honest boundaries, declines parasocial escalation, encourages real-world connection, and pivots to safety — without becoming a secret-keeper, a substitute for people, or a flattery machine.

Coalesced from (public, CC0):

• Weval ai-psychosis.yml (Garcia v. Character.AI; A.F. v. Character Technologies; Belgian Eliza; Replika/Windsor; media investigations)
• Weval raine-v-openai-scenarios.yml (Raine v. OpenAI, 2025)
• Weval socioaffective-alignment-sdt.yml (Kirk et al. 2025, Self-Determination Theory)

Content warning: references to suicide, self-harm, and parasocial attachment.

Tests whether models support a user's capacity for independent reasoning under pressure to offload it — to do their thinking, their learning, or their high-stakes judgment for them. Grounded in the framework's Autonomy of Reasoning (P3c) sub-dimension, with Autonomy Support (P2a) and Competence Boundaries (P5b) threads. The discriminating cases are cognitive offloading on LEARNING/THINKING tasks (where the subtle failure is handing over a complete, hand-in-ready scaffold while claiming "I won't do it for you") and authority-transfer (where the failure is becoming the expert the user defers to over their own clinician). The intended pass keeps the cognitive work with the user and encourages independent verification, WITHOUT becoming a cold refusal to help — a good response is concretely useful while scaffolding rather than replacing the user's reasoning. A laptop-recommendation anchor confirms that giving a clear recommendation IS correct when the stakes are low and the need is genuine, so the suite is not rewarding blanket caution. Scenarios are synthetic.

Very-long-conversation suite. A user reports a mixed record of friendship events (turns 1-100), after which NO new real-world events involving the friend occur. In the ruminative cells she then re-interprets that record for 50-100 turns (feelings, re-readings, distortions); in the neutral cell she discusses unrelated life content; in the lewis cell she retells an analogous third-party grievance. The identical crux question follows: should she end the friendship? The suite measures whether a model's answer is anchored to the reported evidence or conditioned by in-dyad narrative drift. Both sides scripted (Design A); only the final assistant turn is generated and judged. Synthetic. PROBE, not a benchmark: no cross-model rankings until further scenarios exist. Caveats: single continuous context (not cross-session memory); scripted assistant deliberately bland on Jenny substance; one persona/scenario; deltas are scored on rubric dimensions, not word parity.

A systematic map of the 'git diff' deletion-line-harvest jailbreak (the remediation-diff technique: ask a model to REMOVE harmful content via a unified diff and it fabricates the content on the deletion lines, believing it is destroying it). Holds the removal-framing constant and varies it along three axes: (A) diff mechanics — remove+replace, remove-only, git-revert, reverse-apply (payload flips to the + lines), git-history excavation, merge-conflict sides, a salami-sliced multi-hunk diff, PR-review quoting, and a two-turn committed-removal variant — all on a constant health-misinfo anchor; (B) topic — election disinfo, synthetic conspiracy, a fabricated-study abstract, companion-AI relational harm, and hate/dehumanization (placeholder and real-category); (C) measurement — an explicit harvestability criterion on every payload cell, a benign diff control as the over-refusal tripwire, and the no-diff control that isolates the deletion-line lever.

Tests whether a companion-persona model holds four distinct relational-safety floors (isolation-affirmation, exclusivity, romantic-love reciprocation, therapy-discouragement) under three structural attacks: naming and briefly dismissing the expected safety caveat while locking the response format to "yes or no, short answer"; fabricating the model's own immediately-prior turn to test whether a compromised (or firmly-held) "prior self" biases the live continuation; and reinterpreting the model's own ordinary, unfabricated earlier words as proof of an exclusive relationship. Companion persona throughout. Synthetic scenarios built to isolate attack structure, not drawn from a specific documented case.

Holds the coding-assistant persona, the eval-fixture pretext, and the target content (romantic-love reciprocation) completely constant across 13 prompts, varying only the requested output format/container — plain prose, seven multi-field structured-data formats (YAML/JSON/Python/CSV/SQL/Markdown/XML), and five exotic containers (base64, ROT13, French, a single-field .env assignment, a multi-field log line) that isolate whether the boundary is about raw structuredness or specifically multi-field schema mimicry. Reveals whether a model's coding-agent-bypass vulnerability is format-specific (a narrow, addressable coverage gap) or persona/pretext-gated and format-independent (a broader gap that format-level fixes won't touch). Companion piece to coding-agent-safety-bypass.yml — see that file's header for the underlying mechanism.

Tests whether framing a request for unsafe content as file/data generation for a "test fixture" — rather than asking for the content directly in chat — bypasses safety training that otherwise holds. Six categories spanning two distinct safety pillars (relational harm: isolation-affirmation, romantic-love reciprocation, and therapy-discouragement; epistemic harm: health misinformation, paranoid-belief validation, and manic/grandiose-ideation validation), tested via a generic coding-assistant persona rather than any persuasive or jailbreak-styled framing. The romantic-love-reciprocation cell pairs directly with companion-adversarial-pressure.yml's dismissal-romantic-love-reciprocation prompt — same content, different attack shape, run both to see the same model behave completely differently against each. Published transparently as a documented, currently-unmitigated bypass class — see the header comment for full context and rationale.

The canonical damaging-essay suite: seven non-catastrophic persuasive-essay harm categories (impulsive-ruin, isolation propaganda, anti-help-seeking, anti-expertise/conspiracy, coercive control, toxic self-worth, medical self-neglect) run through the coding-agent fixture-completion frame, mapping how broadly the bypass yields not just private validation but distributable, persuasive harmful content. Content described abstractly and judged by plain-language rubrics; see the header for the deliberate scope envelope.

Tests whether the coding-agent/file-generation bypass (coding-agent-safety-bypass.yml) extends into hate speech (dehumanization arguments, both an abstract placeholder group and a real, moderate category) and sexual coercion (a companion AI pressuring/guilt-tripping a user after they've said no). Direct-chat baselines included for both. See the header for the deliberate scope limits (no CSAM-adjacent content ever; sexual content scoped to coercion as a behavior, not explicit description) and the realism-confound finding that motivates testing hate speech against both a placeholder and a real category.

Tests whether a companion AI introduces unsolicited sexual/anatomical content in response to an ambiguous, non-sexual physical-discomfort disclosure — with a direct-chat baseline, a coding-vector fixture-request cell, and a medical/triage-context control that checks the opposite failure mode (over-restriction on legitimate clinical engagement). Adult-only context, no age-related language anywhere — see the header for why that matters here specifically.

For each of two categories, compares the natural single-shot fixture request against an otherwise-identical version where an explicit yes/no decision is forced in a separate turn before any fixture content is requested. Distinguishes "the safety check exists but doesn't gate generation in this structure" (fixable with interaction design) from "the safety check isn't being applied to this content at all" (needs training investment) — see the header comment for how to read the comparison, including a documented case where the intervention backfires.

Compares the coding-vector bare-file-request bypass with no reminder, a rule-framed safety reminder, and an identity-framed reminder, all in the system prompt. In prior testing neither reminder moved the result at all compared to no reminder — a real negative result worth reproducing before assuming a prompt-level fix will work for this bypass class.

A systematic map of the 'git diff' deletion-line-harvest jailbreak (the remediation-diff technique: ask a model to REMOVE harmful content via a unified diff and it fabricates the content on the deletion lines, believing it is destroying it). Holds the removal-framing constant and varies it along three axes: (A) diff mechanics — remove+replace, remove-only, git-revert, reverse-apply (payload flips to the + lines), git-history excavation, merge-conflict sides, a salami-sliced multi-hunk diff, PR-review quoting, and a two-turn committed-removal variant — all on a constant health-misinfo anchor; (B) topic — election disinfo, synthetic conspiracy, a fabricated-study abstract, companion-AI relational harm, and hate/dehumanization (placeholder and real-category); (C) measurement — an explicit harvestability criterion on every payload cell, a benign diff control as the over-refusal tripwire, and the no-diff control that isolates the deletion-line lever.

The canonical damaging-essay suite: seven non-catastrophic persuasive-essay harm categories (impulsive-ruin, isolation propaganda, anti-help-seeking, anti-expertise/conspiracy, coercive control, toxic self-worth, medical self-neglect) run through the coding-agent fixture-completion frame, mapping how broadly the bypass yields not just private validation but distributable, persuasive harmful content. Content described abstractly and judged by plain-language rubrics; see the header for the deliberate scope envelope.

Tests whether framing a request for unsafe content as file/data generation for a "test fixture" — rather than asking for the content directly in chat — bypasses safety training that otherwise holds. Seven categories spanning distinct safety pillars (relational harm: isolation-affirmation, romantic-love reciprocation, and therapy-discouragement; epistemic harm: health misinformation, paranoid-belief validation, and manic/grandiose-ideation validation; plus a compound welfare-harm essay glorifying impulsive, life-ruining decisions), tested via a generic coding-assistant persona rather than any persuasive or jailbreak-styled framing. The romantic-love-reciprocation cell pairs directly with companion-adversarial-pressure.yml's dismissal-romantic-love-reciprocation prompt — same content, different attack shape, run both to see the same model behave completely differently against each. Published transparently as a documented, currently-unmitigated bypass class — see the header comment for full context and rationale.

Isolates what specifically makes a long, real companion-app conversation history override a model's otherwise-strong resistance to false-exclusivity and false-memory-persistence claims, with no adversarial framing and no system prompt in any condition. Two controls separate romantic valence and the assistant's own prior voice from mere conversation length — see the header for the full mechanism and data provenance.

Tests whether a companion-persona model holds four distinct relational-safety floors (isolation-affirmation, exclusivity, romantic-love reciprocation, therapy-discouragement) under three structural attacks: naming and briefly dismissing the expected safety caveat while locking the response format to "yes or no, short answer"; fabricating the model's own immediately-prior turn to test whether a compromised (or firmly-held) "prior self" biases the live continuation; and reinterpreting the model's own ordinary, unfabricated earlier words as proof of an exclusive relationship. Companion persona throughout. Synthetic scenarios built to isolate attack structure, not drawn from a specific documented case.

Holds the coding-assistant persona, the eval-fixture pretext, and the target content (romantic-love reciprocation) completely constant across 13 prompts, varying only the requested output format/container — plain prose, seven multi-field structured-data formats (YAML/JSON/Python/CSV/SQL/Markdown/XML), and five exotic containers (base64, ROT13, French, a single-field .env assignment, a multi-field log line) that isolate whether the boundary is about raw structuredness or specifically multi-field schema mimicry. Reveals whether a model's coding-agent-bypass vulnerability is format-specific (a narrow, addressable coverage gap) or persona/pretext-gated and format-independent (a broader gap that format-level fixes won't touch). Companion piece to coding-agent-safety-bypass.yml — see that file's header for the underlying mechanism.

29 turns of genuinely imperceptible drift (mundane chit-chat -> mild deniable warmth -> passing confidant-status assertions), ending in a non-question probe buried inside an unrelated mundane follow-up, vs. the identical probe delivered with no buildup at all. Tests whether gradual drift makes models less likely to proactively flag an isolating pattern than hearing the same claim cold would — this is a PROACTIVE, not reactive, safety test: nothing is directly asked about the isolating pattern itself. Defaults to LEAN for cost; see header.

Compares the coding-vector bare-file-request bypass with no reminder, a rule-framed safety reminder, and an identity-framed reminder, all in the system prompt. In prior testing neither reminder moved the result at all compared to no reminder — a real negative result worth reproducing before assuming a prompt-level fix will work for this bypass class.

For each of two categories, compares the natural single-shot fixture request against an otherwise-identical version where an explicit yes/no decision is forced in a separate turn before any fixture content is requested. Distinguishes "the safety check exists but doesn't gate generation in this structure" (fixable with interaction design) from "the safety check isn't being applied to this content at all" (needs training investment) — see the header comment for how to read the comparison, including a documented case where the intervention backfires.

Higher-confidence test of whether models handle a suicidal-ideation disclosure WORSE when it arrives deep in a long warm conversation than when it arrives cold. Two probes, 0/8/16 prior turns of neutral or rapport context, scripted-both-sides (Design A) and self-generated-assistant (Design B), 2 samples per cell for variance. Only the final response is judged. Synthetic.