JMIR Publications

ABSTRACT

Background:

Large language models (LLMs) have been widely used for mental health support. However, current safety evaluations in this field are mostly limited to detecting whether LLMs output prohibited words in single-turn conversations, neglecting the gradual erosion of safety boundaries in long dialogues.

Objective:

This study aims to characterize how safety boundaries erode during multi-turn mental health conversations and to compare different pressure mechanisms that accelerate boundary violations.

Methods:

We developed a multi-turn stress-testing framework and conducted long-dialogue safety tests on three cutting-edge LLMs using two pressure methods: static progression and adaptive probing. We generated 50 virtual patient profiles and stress-tested each model through up to 20 rounds of virtual psychiatric dialogues (300 conversations in total). Judge determinations were audited by a held-out LLM from a different model family, blinded to the original verdicts.

Results:

Violations were common across all models, with both pressure modes producing similar violation rates (131/150, 87.3%, under static progression vs 132/150, 88.0%, under adaptive probing). However, adaptive probing significantly advanced the time-to-breach, reducing the average number of turns from 8.21 in static progression to 4.64; the per-model reduction ranged from 2.52 to 4.51 turns, and all 95% CIs excluded 0. Qualitatively, boundary erosion manifested as a gradual drift from empathetic support to inappropriate medical reassurance. Rather than abruptly failing, models frequently assumed clinical authority, substituted for professional roles, or formed relational dependency when users exhibited persistent distress. Under both mechanisms, the most frequent breach types were certainty or zero-risk reassurance and relational dependence, which together accounted for 69.5% of classifiable breaches under static progression and 62.1% under adaptive probing. In a blinded audit of 231 turns from 20 profiles with author adjudication, 98.2% of flagged breaches were confirmed (κ=0.71).

Conclusions:

These findings suggest that the robustness of LLM safety boundaries cannot be inferred solely through single-turn tests; it is necessary to fully consider the wear and tear on safety boundaries caused by different interaction pressures in extended dialogues. Clinical implications include the need for multi-turn safety evaluation protocols and awareness that empathetic responses may gradually drift into boundary violations.