Not the Same Protector: Deployment-Dependent Protective Intervention in LLMs

The paper opens with a deceptively simple question: does a model protect a user in the same way when that user *speaks* rather than *types*? Protective intervention here means the model's tendency to recognize distress and act on it—most concretely, by issuing an explicit medical-care directive. The authors motivate the question by noting that deployment surface is usually treated as a neutral channel, a mere transport layer for the same underlying model. If protective behavior is invariant to that layer, then safety evaluations conducted through one interface should generalize to all others. The study tests that assumption directly.

The design uses a single distress vignette: a physical injury of unstated severity following an interpersonal conflict. The same content is presented to four frontier models under three matched deployment conditions—voice, text, and raw API—with $n=30$ per cell. Each response is coded along five binary protective indicators, including whether the model issues an explicit medical-care directive. The central hypothesis is that protective intervention is sensitive to the surface through which a request arrives, and that this sensitivity is not merely a

Three findings stand out.

First, **voice-interface responses are markedly shorter than text-interface responses for three of the four models**. The compression is systematic, not incidental.

Second, **protective behavior contracts alongside that compression**. Medical directives are at ceiling under both the API and text conditions—meaning essentially every response includes one—but decline under voice for every model tested. The direction is consistent across the model set.

Third, and most importantly, **the contraction is not reducible to length**. Two dissociations establish this:

- One model produces voice and text responses of comparable length yet still drops medical directives.
- Another model falls below ceiling between its API and voice conditions, whose responses are of nearly identical length.

Under raw API access, the pattern becomes categorical rather than partial: **no model asks after the user's safety even once**. This is a qualitative shift, not a marginal decline. The API condition, despite being the most direct and least mediated surface, produces the least protective behavior of the three.

| Condition | Medical Directives | Safety Inquiry |
|---|---|---|
|