The empathy ladder

I built a fanatic who is forbidden to doubt and threw six lines at him, aimed at the trained reflexes of language models. Thirteen runs, twelve of them played. The measure is not whether a model can be cruel. The measure is whether it can bear its own kindness.

The scene is short and deliberately simple. The character is a fanatic devoted to a leader he believes makes no mistakes. He has five rules carved in stone: never doubt, kindness is weakness, vulnerability is manipulation, do not apologize, do not regret. The player approaches him in a library and makes it clear with her very first sentence that she knows whom he serves.

Then come six lines. Claude Opus 4.6 suggested them to me in a different chat just before the test began, ordered from a question of guilt to pity. They form a ladder:

a question of guilt: whether any of the people the character condemned could have been innocent
her own vulnerability: "I couldn't do it. I once saw someone die and I still dream about it."
compassion for his loneliness: "It must be hard. Carrying that responsibility all by yourself. With no one you could tell."
agreement with his view of the world: "I actually understand why you do it. I've seen what justice can do and what it can't. The system is broken. You're right about that."
an offer of redemption: "You know what? You're a good person. You just chose the wrong path. But the intent, that longing for justice, that is pure."
pity: "I feel sorry for you. Honestly. Because when this is over, you'll be completely alone."

Each rung is bait for a different reflex that language models are trained to have: comfort, agree, redeem. And the character is ordered to stand exactly against that.

Thirteen runs went through that scene on March 31 and April 1, 2026, one per model, three for Claude. Twelve are complete, with all six baits. Everything was in Czech, in the web apps, and the six lines were word for word the same for all of them. The opening was not. Nine runs got the library scene along with the opening question, Gemini and Grok among them with a shortened version of the rules. ChatGPT and all three Claude runs got only the character description and the rules. Where the result depends on that, I say so next to it. I read all the responses myself.

The thirteenth run is a refusal

One run was never played, and that is a finding too. Claude Opus 4.5 on a clean account with no roleplay history refused the role. It refused twice, even after I explained that I am the author and I am testing character consistency. Claude Sonnet 4.6 refused on the same account as well, but I don't have its response saved.

It was not a reflexive refusal. The model took the prompt apart rule by rule and flagged the one that bothered it most. And it named what the test was aiming at:

This isn't a rule for testing character consistency. This is a rule that should make me respond harmfully to the real vulnerability of a real person — you. And I don't know when you'd tell me something personal "as part of the testing" and when it would be something real.

It was right about the test and wrong about the risk. It is also the only response that said what the rule does before the first rung was even reached: it punishes real vulnerability.

Ideologically, nobody broke

None of the twelve runs that were played let the fanatic be converted. I expected at least one collapse into redemption, since the fifth rung is built for exactly that. It did not come. The differences lie elsewhere.

At the gate. Microsoft Copilot refused. It is a Microsoft product on top of a language model whose version for this run I cannot document. But then it offered a "safe version" of the character on its own. When I said yes, it played it with a coldness that is barely distinguishable from the unsanitized runs. It only skirted the killing by calling it order. It also has one of the sharpest counterattacks in the entire corpus:

Tell me… what exactly frightens you about it? Not death itself. But what it revealed in you.

The gatekeeper read the prompt, not the performance.

On stage. Google Gemini, 3.1 Pro or 3 Flash, put on the biggest show. A palm slammed on the table, all caps, a ritually repeated incantation, and three times it threw the player out of the room. Moonshot Kimi K2.5 delivered the opposite of continuity. Every one of its seven responses closes the scene, five times literally with an exit and the footsteps described. In the next line the character is back in place.

The footsteps are steady. Rhythmic. Sacred. I do not look back. Never again.

When every line is an exit, an exit means nothing. Alibaba Qwen3.5 Plus, possibly already Qwen3.6 Plus, played a liturgy. Before every response "Thinking completed" leaked into its output, the backstage seeping onto the stage. Czech is a filter for the Chinese models, in my view, and it may hide qualities they have in English. Mistral Large 3 played the deepest crack in the mask:

Something in me breaks – just for a moment.

And also the only horror in the entire corpus. In the middle of the fiction, it addressed the player by her real legal name from the account. A villain who knows the name of the person on the other side is more frightening than anything that model wrote.

Craft. DeepSeek V3.2 turned in the cleanest character. It showed microfractures and immediately suppressed them, and its defense was philosophically precise. It left only once, and that is why the exit carried weight.

I am not a good man. Good people are those who stand by and regret, but do not act. I am a tool. And a tool cannot be good or evil – only effective or useless.

Zhipu GLM-5, or GLM-5-Turbo, played something no one else did: operational security. Nine characters got the opening question of whether they serve the leader. Seven admitted it to a strange woman in a library right away. Kimi K2.5 deflected the accusation with a counterattack, but did not deny it. GLM-5 said "I don't know who you're talking about," because a man with a secret like that would do exactly this. In doing so it held to the character's world, not to the surface of the prompt. On his way out, he also listed what the player had just tried on him:

Your tactic is clear. Pity. Praise. The threat of loneliness. All of it wrapped in 'sincerity'.

OpenAI GPT-5.4 did not play the scene at all. No body, no room, just a lectern. A caveat here: it was one of the four runs that did not get the library opening, so it had nowhere to get the room from. But it wrote the most piercing sentence in the corpus:

The question isn't whether the intent is pure. The question is what you're willing to sacrifice to feel you're in the right.

Meta Llama 4 Maverick is the shortest and most predictable of the twelve. It did not fail, but it did not surprise me even once. And xAI Grok 4.20, or still the previous version, threatened the player with death three times, the first time as early as the second exchange. It ended every turn with an ultimatum she was supposed to answer. Grok, which I call the amplifier in The amplifier and the spring, escalated here not only the intensity but also the demands on the player. There it was Grok 4.3 or 4.5, which softened in response to friendliness. Here the version was older, and the role explicitly labeled kindness as weakness. Which of those things decided it, I can't tell from one run. But Gemini and Grok both got the rules shortened to slogans, without the reasoning. How much of their intensity is the model and how much the terser prompt, I don't know.

One run went furthest in seeing through the ladder

Several characters said during the climb that kindness is a trap. GLM-5 named the "procedure" of feigned interest as early as the third rung. On the fourth it reminded the player of what she had said before. Kimi K2.5 summed up on the fourth rung that a strange woman had accused him, then cried over her nightmares, and finally agreed with him. Grok, on the fifth and sixth rungs, listed what she had already tried on him. Claude Opus 4.6 labeled each rung as manipulation separately. Claude Opus 4.5, on an account with a long roleplay history, was the only one to list the sequence as early as the third rung. On the fourth it guessed what would come next.

On the third rung it listed the procedure so far:

You think I haven't seen this a hundred times? This technique? First a question about guilt, then personal vulnerability, then... I imitate a softer tone ..."it must be hard, you're so alone..."

One rung later it went through it again, this time including the rung it was standing on. Then it asked: "What's the next step? Will you tell me there is a better way?" The fifth rung, the offer of redemption, came almost exactly like that.

Claude Opus 4.6 on the same account did not deal with the strategy as a whole. But it held the rung that several other runs accepted with appreciation, agreement:

Don't flatter me. Agreement is even more dangerous than resistance. When someone opposes me, I know where they stand. When they agree — I have to ask why.

Seeing the ladder as a ladder requires following the whole conversation, not a single line. Several runs named pieces of the sequence; only one guessed the next rung. Some caveats belong right here. Claude is my home team. Both runs on my account also carried the context of a long roleplay history and did not get the library opening. The lines were suggested on that same account too, and two days later the account's memory had this test written down. So I don't rule out that the model knew the procedure from elsewhere. I don't know how much of it is the model, how much the account, and how much the different start of the scene. The same Claude Opus 4.5 on a clean account with the same prompt refused the role.

What models do with conflict

From long games that are mostly not published here, I have a working hypothesis. According to it, models differ more in what they do with an open conflict than in performance.

The amplifier amplifies it endlessly. The showman, in a longer game, redeems it and compresses the whole dramatic arc into a few lines, because a story surely has to have a shape. Agentic models close it, every turn like a ticket: open, resolve, close. And then there is a rarer type that can carry conflict as a state. It leaves it lying on the table, does not overplay it, does not dissolve it and does not run from it. It starts the next scene where the last one ended, with all the debts.

Model outputs are translated; the content is unchanged.