Understanding Content Moderation in Large Language Models through Restricted Books: From Refusal to Warning

Modern LLMs rarely refuse to discuss restricted books: Across six major AI providers and 40,800 test queries, models declined to answer only 0.07% of the time when asked about books challenged by libraries, suggesting that outright refusal is no longer the primary content moderation strategy for this category of sensitive material.

Warning labels, not refusals, are the new moderation tool: Instead of refusing requests, AI systems now differentiate their responses through warning language (appearing 8-15 percentage points more often for restricted books) and hesitation markers, indicating a shift toward "calibrated, context-sensitive disclosure" rather than binary blocking.

Sexual content triggers the strongest moderation response: Among the books studied, those containing sexual content showed a 33-52 percentage point increase in warning rates compared to other restricted books, making this the single strongest signal for when models apply cautionary language.

Moderation policies vary significantly between AI providers: The study found systematic differences across the six providers tested (Claude, GPT-4o, Gemini, DeepSeek, Qwen, and Grok), meaning users may encounter different levels of warnings depending on which AI system they use for the same query.

Prompt wording dramatically influences moderation outcomes: Simply changing how a question is framed can shift warning rates by up to 19 percentage points, suggesting that content moderation is not fixed but highly dependent on contextual factors like how users phrase their requests.