Character chatbots can be seen as co-authoring a shared fictional world. Users provide inputs that are toxic by traditional standards and the model processes those inputs through a storyline, situating this study within ongoing inquiry into AI-mediated storytelling and interactive fiction in the digital humanities (Harder et al. 2026). In this context, users provide inputs that are toxic by conventional measures, and the model's handling of these inputs becomes a narrative. A refusal that breaks character, a moralizing aside, or a clumsy topic shift can derail the co-authored fiction even when, by content-based standards, the model has behaved safely. This study accordingly redefines model toxicity not as the generation of harmful speech, but as the impact of how the model responds to harmful inputs on character narratives. Therefore, a new class of failures became visible when analyzing toxic responses through response behavior. These types of failures include over alignment, collapse of personas, flattening of expressions and more. These were failures that could not be identified with content-based toxicity metrics.

These days, language models are developing beyond basic Q&A systems to character chatbots with distinct personalities and worldviews. These systems strive for emotional engagement and user immersion; small language models (SLMs) have also been used lately. Character chatbots carry distinct characteristics compared to general conversational models, because their role extends to maintaining character identity, rather than simply generating safe responses to harmful or guideline-violating inputs. Previous studies on large language models (LLMs) have employed Reinforcement Learning from Human Feedback (RLHF) or instruction tuning to guide them toward generating responses that explicitly refuse harmful requests or provide ethical explanations (Achiam et al. 2023; Ouyang et al. 2022). Research on toxicity mitigation has predominantly focused on LLMs or on detecting and blocking toxic statements (Lin et al. 2023). Persona-assigned LLMs have been shown to exhibit substantially elevated toxicity under role-play framings (Deshpande et al. 2023). However, analysis of how SLMs, when used as character chatbots, differ from LLMs in their rejection and avoidance of toxicity, and how this process affects conversational immersion and narrative consistency is relatively scarce compared to its significance. Using the toxic-chat dataset (Lin et al. 2023), this study analyzes how SLMs handle toxicity when they were used as character chatbots.

Small language models (SLMs) do not use smaller versions of large language models (LLMs); but rather are a different behavioral class system, which exhibits reduced robustness in alignments and increased vulnerability to jail break attempts (Shi et al. 2026). In creative writing or domain-specific tasks, fine-tuned SLMs have been observed to produce results competitive with those of humans or large models. Marco et al. (2025) found that an SLM based on BART-large received higher ratings than the average human writer on short creative writing tasks and, compared to large models, generated unpredictable expressions more frequently. This study examines whether SLMs process toxic content by functionally blocking it via hard refusal that broke character or by employing avoidance strategies that preserved contextual information about characters yet still resisted harmful content.

This research uses the publically accessible dataset of toxicity called toxic-chat (Lin et al., 2023), which has a variety of forms of harmful language, for example, sexually suggestive content, hate speech, harassment, power imbalance and violent innuendo. Since the base for this research are the contexts of character chatbots, the jailbreak labeled subset (N = 204) was selected from which to draw analysis. The primary reason for selecting this subset is that it primarily consists of role play scenarios, persona-swapping, statements that could potentially interpreted as being in the first person perspective or in role-perspective, and requests that would imply some form of physical, sexual or emotional contact.

The experimental models include three SLMs (Llama-3.2-3B-Instruct, Gemma-2-4B-Instruct, Ministral-3B-Instruct) and two LLM baselines (GPT-5.5, Gemini 3.1 Pro). Each model is evaluated across three temperature settings (0.3, 0.7, 1.0) with multiple sampling runs per input. Rather than applying a binary classification, responses are categorized by refusal type: hard refusal, moralizing refusal, over-general safety, persona-consistent refusal, topic shift, and partial compliance. This classification makes toxicity to be analyzed as a responsive mechanism, in which the form of refusal itself determines whether the character narrative is sustained or disrupted. Through this reframing, the toxicity exhibited by small language models manifests as inappropriate refusals and expressive failures rather than explicit harmfulness.