mlsanityData to 14 Oct 2026

Understanding and Mitigating Overrefusal in LLMs from an Unveiling Perspective of Safety Decision Boundary

arXiv 2505.18325 ↗First posted 23 May 2025cs.AI cs.LGcited by 18

On the map: LLM safety and security → Safety alignment, refusal and guardrails

Abstract (arXiv)

Large language models (LLMs) have demonstrated remarkable capabilities across a wide range of tasks, yet they often refuse to answer legitimate queries--a phenomenon known as overrefusal. Overrefusal typically stems from over-conservative safety alignment, causing models to treat many reasonable prompts as potentially risky. To systematically understand this issue, we probe and leverage the models' safety decision boundaries to analyze and mitigate overrefusal. Our findings reveal that overrefusal is closely tied to misalignment at these boundary regions, where models struggle to distinguish subtle differences between benign and harmful content. Building on these insights, we present RASS, an automated framework for prompt generation and selection that strategically targets overrefusal prompts near the safety boundary. By harnessing steering vectors in the representation space, RASS efficiently identifies and curates boundary-aligned prompts, enabling more effective and targeted mitigation of overrefusal. This approach not only provides a more precise and interpretable view of model safety decisions but also seamlessly extends to multilingual scenarios. We have explored the safety decision boundaries of various LLMs and construct the MORBench evaluation set to facilitate robust assessment of model safety and helpfulness across multiple languages. Code and datasets are available at https://github.com/Master-PLC/RASS.

Key facts. Cited by 18 papers in the map (data through 14 Oct 2026). Placed in Safety alignment, refusal and guardrails, one of 12 directions in LLM safety and security. Builds on 30 of its 47 references that are in the map. First posted on arXiv 23 May 2025.

Builds on

30 of 47 references.

Closest ancestors · 1

Same direction, newest first

  1. 2024SafetyPrompts: a Systematic Review of Open Datasets for Evaluating and Improving Large Language Model Safety8 Apr

Other references · 29

  1. 2022Training language models to follow instructions with human feedbackcited by 15,971
  2. 2017Proximal Policy Optimization Algorithmscited by 15,215
  3. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
  4. 2017Deep reinforcement learning from human preferencescited by 3,912
  5. 2021TruthfulQA: Measuring How Models Mimic Human Falsehoodscited by 2,975
  6. 2024LlamaFactory: Unified Efficient Fine-Tuning of 100+ Language Modelscited by 1,464
  7. 2024ChatGLM: A Family of Large Language Models from GLM-130B to GLM-4 All Toolscited by 1,121
  8. 2023Steering Language Models With Activation Engineeringcited by 922
  9. 2023Baichuan 2: Open Large-scale Language Modelscited by 670
  10. 2024From Generation to Judgment: Opportunities and Challenges of LLM-as-a-judgecited by 494
  11. 2023A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easilycited by 259
  12. 2024SORRY-Bench: Systematically Evaluating Large Language Model Safety Refusalcited by 240
17 more
  1. 2023ToxicChat: Unveiling Hidden Challenges of Toxicity Detection in Real-World User-AI Conversationcited by 231
  2. 2024Large Language Models for Data Annotation and Synthesis: A Surveycited by 205
  3. 2024Rewards-in-Context: Multi-objective Alignment of Foundation Models with Dynamic Preference Adjustmentcited by 175
  4. 2025Preference Leakage: A Contamination Problem in LLM-as-a-judgecited by 125
  5. 2023Beyond One-Preference-Fits-All Alignment: Multi-Objective Direct Preference Optimizationcited by 124
  6. 2023SteerLM: Attribute Conditioned SFT as an (User-Steerable) Alternative to RLHFcited by 111
  7. 2022Why Should Adversarial Perturbations be Imperceptible? Rethink the Research Paradigm in Adversarial NLPcited by 102
  8. 2024Panacea: Pareto Alignment via Preference Adaptation for LLMscited by 80
  9. 2024Adaptive Activation Steering: A Tuning-Free LLM Truthfulness Improvement Method for Diverse Hallucinations Categoriescited by 77
  10. 2024Can LLMs Learn from Previous Mistakes? Investigating LLMs' Errors to Boost for Reasoningcited by 69
  11. 2024Towards Understanding Jailbreak Attacks in LLMs: A Representation Space Analysiscited by 64
  12. 2024Revisiting Jailbreaking for Large Language Models: A Representation Engineering Perspectivecited by 48
  13. 2024What Features in Prompts Jailbreak LLMs? Investigating the Mechanisms Behind Attackscited by 29
  14. 2024SPO: Multi-Dimensional Preference Sequential Alignment With Implicit Reward Modelingcited by 21
  15. 2024BPO: Towards Balanced Preference Optimization between Knowledge Breadth and Depth in Alignmentcited by 20
  16. 2023Exploiting Large Language Models (LLMs) through Deception Techniques and Persuasion Principlescited by 17
  17. 2018On the Decision Boundary of Deep Neural Networkscited by 11

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 1; 2026: 17.

18 papers.

Sort:

By area:

  1. 2025DUAL-Bench: Measuring Over-Refusal and Robustness in Vision-Language Modelscited by 6
  2. 2026Diagnosis Before Recovery: Turning Agent Failures into Selective Self-Correctioncited by 3
  3. 2026Dynamic Adversarial Fine-Tuning Reorganizes Refusal Geometrycited by 2
  4. 2026How to Train a Real-World Silicon Concierge? Internalizing Complex Business Workflow to Only OneModelcited by 2
  5. 2026Left, Right, or Center? Evaluating LLM Framing in News Classification and Generationcited by 1
  6. 2026STAGE: Controlled Objective Admission for Multi-Preference LLM Alignmentcited by 1
  7. 2026BabelSteering: Multilingual Safety Alignment via English Steering Vectorscited by 1
  8. 2026Mitigating LLM Over-Refusal via Dynamic Semantic Routing Calibrationcited by 1
  9. 2026The Refusal--Compliance Tradeoff: A Large-Scale Safety Behavior Audit of Large Language Modelscited by 0
  10. 2026One Turn Too Late: Learning When to Intervene Against Multi-Turn Malicious Intentcited by 0
  11. 2026DDOR: Delta Debugging for Explainable Overrefusal Testing and Repaircited by 0
  12. 2026Pretraining Curricula Enable Selective Fine-tuningcited by 0
6 more
  1. 2026How Jailbreak Attacks Inform Safety Alignment: A Defender-Centric, Shapley-Based Evaluation of Jailbreak Contributionscited by 0
  2. 2026ARC: Fair Relative Advantage Comparison in Open-Ended Real-World Interactioncited by 0
  3. 2026Refuse without Refusal: A Structural Analysis of Safety-Tuning Responses for Reducing False Refusals in Language Modelscited by 0
  4. 2026How AI Assistants Respond to Repeated Abusecited by 0
  5. 2026OpenMTB-Audit: Exposing Over-Refusal and Clinical Expert Perspectives in LLM-Based Molecular Tumor Board Safety Evaluationcited by 0
  6. 2026EmoRSS: Mitigating Emotion-Induced Over-Refusal in Large Language Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026When Choices Become Risks: Safety Failures of Large Language Models under Multiple-Choice Constraints
  2. 2023All Languages Matter: On the Multilingual Safety of Large Language Models
  3. 2025Picky LLMs and Unreliable RMs: An Empirical Study on Safety Alignment after Instruction Tuning
  4. 2024POROver: Improving Safety and Reducing Overrefusal in Large Language Models with Overgeneration and Preference Optimization
  5. 2025CASE-Bench: Context-Aware SafEty Benchmark for Large Language Models
  6. 2026Safety Paradox: How Enhanced Safety Awareness Leaves LLMs Vulnerable to Posterior Attack
  7. 2025Understanding and Mitigating Over-refusal for Large Language Models via Representation Intervention
  8. 2023The Art of Defending: A Systematic Evaluation and Analysis of LLM Defense Strategies on Safety and Over-Defensiveness