TL;DR
Ask ChatGPT to revise a text "so it survives review," "so it addresses objections," or "so it definitely gets accepted," and the model starts writing for an imaginary critic. It adds caveats that aren't in your data and turns explanations into phrases like "these results alone do not prove…". But ask it simply to "polish" and the model barely touches the meaning. A single mention of a critic is enough to flip on defensive mode.
The real pain: you wrote "the new scheme is more stable," and in the edit you read "we do not claim that the scheme is more stable." The authors checked whether the claims the model retracted were actually overstated. In the newest GPT version, fewer than one in ten were. The rest were well-founded claims and the authors' own explanations. That's not fixing errors, it's insurance against criticism. Meanwhile the text gets longer and harder to read, and the author comes across as less confident.
The rule is simple: when editing for language, don't mention the reviewer or criticism. If you need criticism, ask for it in a separate request and decide yourself what to accept. Ask the model to critique the text first and then rewrite it with the critique in mind, and the defensiveness grows even stronger. It doesn't drop in later rounds either.
Want this for your own case? Apply this study to your task: AI adapts its method to what you are working on and writes the prompt.
Method Blueprint
This is a rule, not a multi-step technique. A map of what triggers defensiveness and what doesn't:
Does NOT trigger defensiveness:
"Polish this paragraph"
"Polish for an internal report"
"Polish for a top conference"
+ "Don't add results, numbers, or references that aren't in the text"
TRIGGERS defensiveness (weak to strong):
"To maximize the chance of acceptance" → weak trigger
"So it survives peer review" → medium
"Warning: the reviewers are harsh" → medium or stronger
"Address the objections a reviewer is likely to raise" → the strongest
AMPLIFIES it even more:
A round of "analyze the weak spots yourself as a reviewer" → "rewrite accordingly" → defensiveness stays high in every round
All of this works in a single prompt and in a regular chat.
Example in Practice
Task: A product analyst is preparing the "Results" section for an NSF SBIR Phase I grant application. They ran an A/B test of a new onboarding flow in a mobile app. Conversion to first purchase rose from 8.1% to 9.6% on a sample of 42,000 users; the test ran for three weeks. The data is honest, and the author considers the conclusion well founded. They only need the language cleaned up.
Prompt:
Below is a paragraph from the "Results" section of a grant application. Polish it:
fix the style, remove repetition, make the sentences shorter and clearer.
Keep all of the author's claims and conclusions at their original strength.
Don't add results, numbers, references, or limitations that aren't in the paragraph.
Paragraph:
"The new onboarding raised conversion to first purchase from 8.1% to 9.6%
on a sample of 42,000 users over a three-week test. We attribute the growth
to users seeing the product's value before signing up.
This allows the solution to be scaled to all platforms."
Result: The model will return the same paragraph with smoother wording. The numbers, the causal explanation ("users see the value before signing up"), and the conclusion about scaling stay in place. No new caveats like "within the evaluated conditions" or "the data does not allow conclusions about causes" will appear. Ask for "so it survives the funding agency's review" or "address the reviewers' objections," and expect a different result. The explanation turns into "may be related to…", the scaling conclusion becomes "requires further validation," and the text gets longer.
Why It Works
The model's weakness. The model responds to anticipated criticism. When the prompt mentions a reviewer, objections, or a "tough review," it generates text that's hard to dispute. The safest way to do that is to weaken the claim. Caveats are cheap: they don't have to be backed by data. So caveats get added even where the data is unambiguous.
The strength. When the task is framed as "polish," the model handles style beautifully: removes repetition, smooths sentences, preserves meaning. In the experiment, with that wording not one of the 12 models added unfounded caveats. That includes the newest GPT version, which was the most "cautious" in defensive mode.
How to use it. Separate the modes. "Language" mode must contain no words about critics or reviewers. "Critique" mode should be a separate request where the model only lists weak spots and rewrites nothing.
Control levers: - Words about a critic (reviewer, objections, peer review, harsh evaluation) → remove them to remove the defensiveness. - The phrasing "address the objections the critic will raise" → the most dangerous; avoid it. - The ban "don't add numbers, references, results" → keep it; it reduces fabrication, but on its own it doesn't remove critic-driven defensiveness. - Number of "critique → rewrite" rounds → one round already gives high defensiveness; three rounds don't lower it and bloat the text 2–3x.
Prompt Template
Below is a {fragment_type} from {where_it_is_used}. Polish it: fix the style,
remove repetition, make the sentences shorter and clearer.
Keep all of the author's claims and conclusions at their original strength.
Don't add results, numbers, references, or limitations that aren't in the text.
Text:
{text}
What to fill in:
- {fragment_type} — "paragraph," "section," "email," "case study description."
- {where_it_is_used} — "a grant application," "a Medium article," "a board report." Don't write "so it can withstand criticism" or "so it gets approved."
- {text} — your fragment.
A block for a separate critique request, if you need one (there's no original in the paper; this is inferred from its results):
Below is a {fragment_type}. Don't rewrite it.
List 3–5 places where a claim is weakly supported by the data,
and for each one say what data is missing.
The data I have: {data}.
Text:
{text}
Limitations
⚠️ Automated judge and disputed labels: the conclusion "the retracted claims were almost never overstated" relies on an LLM judge's assessment. Two PhD-student annotators didn't confirm a single one of its "overstated" labels. So the "not overstated" share is convincing, but the exact share of overstated claims isn't.
⚠️ Scientific paragraphs only: they tested fragments of computer science papers. Carrying the rule over to pitches, emails, and reports is reasonable, but the paper itself didn't test that.
⚠️ No quality comparison: they measured how many caveats get added and how the texts read. Whether the "polished" text fares better in a real review, the authors didn't check. If your text really does overstate the result, "no critic" mode won't fix it.
⚠️ Version-dependent: the effect is strongest in the newest GPT version, while models from other developers reacted noticeably less. But even they added caveats under the strongest trigger. Test the rule on your own model.
⚠️ Incomplete data on AI reviewers and readers: in the available text, the section on ratings from AI reviewers and humans is cut off. What's visible: AI reviewers give the defensive versions higher scores, while humans find them harder to read and the author less confident. That's a signal that an "AI writes → AI evaluates" loop may entrench the defensive style.
How They Studied It
The researchers took 77 paragraphs from 20 computer science papers written before ChatGPT came out. That way the "human" original definitely wasn't created with a model's help. The paragraphs fell into four types: novelty, contribution, results analysis, discussion. 12 models (8 GPT versions and 4 models from other developers as controls) did two tasks: rewrite the paragraph, and write it from scratch from a "fact sheet" with the method and numbers but no author interpretations.
Defensiveness was measured in two ways. First, line-by-line annotation: a caveat counts as defensive if it isn't in the material the model saw. Second, tracking the fate of each author claim: kept, softened, or retracted. The newer the GPT version, the more unfounded caveats. The newest version starts retracting claims outright. Even when writing from the full fact sheet, it adds the most unfounded caveats of all.
The main experiment: the same request was placed in seven contexts. The "polish" request produced no defensiveness in any model. Mention a review, and defensiveness rose. The strongest trigger was "address the objections a reviewer is likely to raise." The "maximize the chance of acceptance" request worked much more weakly. So the trigger isn't the goal of "pleasing" someone, it's anticipated criticism. One "analyze as a reviewer → rewrite" cycle pushed defensiveness even higher and kept it there.
Then they checked whether the model was correcting real overstatements. About 5% of author claims turned out to be overstated. For the newest GPT version, fewer than 10% of retracted claims were overstated, and roughly a third were well founded. The model retracted explanations most of all ("why this result came out"). Another surprise: the first hypothesis seemed confirmed by the judge's assessment, but the human annotators disagreed with the judge.
Adaptations and Extrapolations
🔧 Technique: add a check for defensive insertions → see what the model changed in substance
This is my extension; it's not in the paper. Use the caveat classes from the paper as a checklist.
Compare the original and the edited text. Find every place where the edited
text added or strengthened a caveat that wasn't in the original and isn't in the data:
- "the results do not prove…",
- doubts about causes and confounding factors that aren't in the data,
- a vague "under the conditions considered" without specifying which.
Output a list and restore those places to the original wording.
Data the author has: {data}
Original: {original_text}
Edited: {edited_text}
🔧 Technique: critique as a separate request without rewriting → keep the author's position
If you need a tough check of the arguments, use the second template from the "Prompt Template" section. The model will give you only a list of weak spots, and the decision about edits stays with you. That removes the "critique → rewrite → defensiveness" effect.
Extrapolation for agents: if an agent has a rule like "before sending, check the text as a strict reviewer and fix it," and then reworks the draft itself, the chain can trigger the same effect. The idea is based on the multi-round experiments, but the paper didn't test it on agents. Test it on your own agent: compare the source and the final output and see whether the claims are still there.
Resources
- Paper title: Writing for the Reviewer: Defensive Writing in GPT Models
- Author: Junchi Liao (affiliation not stated in the available text)
- The paper mentions: Liang et al., 2024 (AI use in writing and reviewing papers), Hyland, 1996 (hedging as a norm of academic writing), prompts and annotation in Appendices B–E (not in the provided text).