mlsanityData to 14 Oct 2026

From Hard Refusals to Safe-Completions: Toward Output-Centric Safety Training

arXiv 2508.09224 ↗First posted 12 Aug 2025cs.CY cs.AI cs.CLcited by 52

Not on the map. Why?

Cited by 25 in LLM safety and security, but placed by its own abstract, which didn’t fit.

Abstract (arXiv)

Large Language Models used in ChatGPT have traditionally been trained to learn a refusal boundary: depending on the user's intent, the model is taught to either fully comply or outright refuse. While this is a strong mitigation for explicitly malicious prompts, focusing safety training on refusals can lead to brittleness for prompts with obscured user intent. Binary refusal boundaries are especially ill-suited for dual-use cases (such as biology or cybersecurity), where a user request can be answered safely at a high level, but in some cases can lead to malicious uplift if sufficiently detailed or actionable. As an alternative, we propose safe-completions: a safety-training approach that centers on the safety of the assistant's output, rather than a binary classification of the user's intent. Safe-completions seek to maximize helpfulness within the safety policy's constraints. We incorporated this approach into GPT-5 and find that across both production comparisons and internally controlled experiments, safe-completion training improves safety (especially on dual-use prompts), reduces the severity of residual safety failures, and substantially increases model helpfulness.

Key facts. Cited by 52 papers in the map (data through 14 Oct 2026). Builds on 15 of its 20 references that are in the map. First posted on arXiv 12 Aug 2025.

Builds on

15 of 20 references.

References · 15

  1. 2022Training language models to follow instructions with human feedbackcited by 15,971
  2. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
  3. 2024GPT-4o System Cardcited by 4,588
  4. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,720
  5. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  6. 2022Constitutional AI: Harmlessness from AI Feedbackcited by 3,050
  7. 2023Safe RLHF: Safe Reinforcement Learning from Human Feedbackcited by 656
  8. 2023XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Modelscited by 505
  9. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 486
  10. 2023Safety-Tuned LLaMAs: Lessons From Improving the Safety of Large Language Models that Follow Instructionscited by 387
  11. 2024Deliberative Alignment: Reasoning Enables Safer Language Modelscited by 308
  12. 2024Rule Based Rewards for Language Model Safetycited by 108
3 more
  1. 2023The Art of Defending: A Systematic Evaluation and Analysis of LLM Defense Strategies on Safety and Over-Defensivenesscited by 67
  2. 2024Navigating the OverKill in Large Language Modelscited by 44
  3. 2024Automatic Pseudo-Harmful Prompt Generation for Evaluating False Refusals in Large Language Modelscited by 35

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 16; 2026: 36.

52 papers.

Sort:

By area:

  1. 2025Oyster-I: Beyond Refusal -- Constructive Safety Alignment for Responsible Language Modelscited by 19
  2. 2026Prompt Injection as Role Confusioncited by 17
  3. 2025Beyond Linear Probes: Dynamic Safety Monitoring for Language Modelscited by 16
  4. 2026Comparison requires valid measurement: Rethinking attack success rate comparisons in AI red teamingcited by 15
  5. 2026IH-Challenge: A Training Dataset to Improve Instruction Hierarchy on Frontier LLMscited by 15
  6. 2025The Alignment Waltz: Jointly Training Agents to Collaborate for Safetycited by 10
  7. 2025SafeSearch: Do Not Trade Safety for Utility in LLM Search Agentscited by 9
  8. 2026GPT-Red: Automated Red Teaming via Self-Play at Scalecited by 8
  9. 2025Steering Multimodal Large Language Models Decoding for Context-Aware Safetycited by 7
  10. 2026When Should We Introduce Safety Interventions During Pretraining?cited by 7
  11. 2025Read the Scene, Not the Script: Outcome-Aware Safety for LLMscited by 6
  12. 2025DUAL-Bench: Measuring Over-Refusal and Robustness in Vision-Language Modelscited by 6
38 more
  1. 2026Training Agents to Self-Report Misbehaviorcited by 6
  2. 2025LongRM: Revealing and Unlocking the Context Boundary of Reward Modelingcited by 5
  3. 2026Evolving Contextual Safety in Multi-Modal Large Language Models via Inference-Time Self-Reflective Memorycited by 5
  4. 2026Using large language models for embodied planning introduces systematic safety riskscited by 5
  5. 2025Vibe Check: Understanding the Effects of LLM-Based Conversational Agents' Personality and Alignment on User Perceptions in Goal-Oriented Taskscited by 4
  6. 2026Health-ORSC-Bench: A Benchmark for Measuring Over-Refusal and Safety Completion in Health Contextcited by 4
  7. 2026EvoDefense: Co-Evolving Black-Box Defense with Large Language Modelscited by 4
  8. 2025Beyond Over-Refusal: Scenario-Based Diagnostics and Post-Hoc Mitigation for Exaggerated Refusals in LLMscited by 3
  9. 2025Scaling Reinforcement Learning for Content Moderation with Large Language Modelscited by 3
  10. 2025AI Security Beyond Core Domains: Resume Screening as a Case Study of Adversarial Vulnerabilities in Specialized LLM Applicationscited by 3
  11. 2026Internalizing Safety Understanding in Large Reasoning Models via Verificationcited by 3
  12. 2025Longitudinal Monitoring of LLM Content Moderation of Social Issuescited by 2
  13. 2026Identifying Adversary Tactics and Techniques in Malware Binaries with an LLM Agentcited by 2
  14. 2026Investigating and Alleviating Harm Amplification in LLM Interactionscited by 2
  15. 2026OpenSafeIntent: Evaluating Intent-Calibrated Safe Completion Across Dual-Use Prompt Setscited by 2
  16. 2025FlagEval Findings Report: A Preliminary Evaluation of Large Reasoning Models on Automatically Verifiable Textual and Visual Questionscited by 1
  17. 2025Steering Over-refusals Towards Safety in Retrieval Augmented Generationcited by 1
  18. 2026Understanding LLM Evaluator Behavior: A Structured Multi-Evaluator Framework for Merchant Risk Assessmentcited by 1
  19. 2026A Content-Based Framework for Cybersecurity Refusal Decisions in Large Language Modelscited by 1
  20. 2026Cat-DPO: Category-Adaptive Safety Alignmentcited by 1
  21. 2026Chain of Risk: Safety Failures in Large Reasoning Models and Mitigation via Adaptive Multi-Principle Steeringcited by 1
  22. 2026LLM Judges Inconsistently Disagree Across Safety Criteria and Harm Categoriescited by 1
  23. 2026Beyond Safe Data: Pretraining-Stage Alignment with Regular Safety Reflectioncited by 1
  24. 2026Safeguards Based on Copyable Context Cannot Provide Reliable Safety for LLMscited by 1
  25. 2026You Shouldn't Have Asked: A Pragmatics-Inspired Taxonomy for Evaluating LLM Refusalscited by 1
  26. 2025Don't Walk the Line: Boundary Guidance for Filtered Generationcited by 0
  27. 2026Magic, Madness, Heaven, Sin: LLM Output Diversity is Everything, Everywhere, All at Oncecited by 0
  28. 2026Gradient-Controlled Decoding: A Safety Guardrail for LLMs with Dual-Anchor Steeringcited by 0
  29. 2026IatroBench: A Pre-Registered Benchmark of Clinical Omission in Language Modelscited by 0
  30. 2026Jailbreaking Frontier Foundation Models Through Intention Deceptioncited by 0
  31. 2026Reducing Political Manipulation with Consistency Trainingcited by 0
  32. 2026Safety Measurements for Fine-tuned LLMs Should be Grounded in Capabilitycited by 0
  33. 2026Safety Paradox: How Enhanced Safety Awareness Leaves LLMs Vulnerable to Posterior Attackcited by 0
  34. 2026Oyster-II: Reinforcement Learning for Constructive Safety Alignment in Large Language Modelscited by 0
  35. 2026ToolAlignBench: Investigating Alignment Conflicts in Tool-Calling Enabled LLMscited by 0
  36. 2026Choosing Where and How to Moderate: End-to-End Trade-offs in Filter Placement and Response Rewritingcited by 0
  37. 2026Who Pays More for Safety? Measuring the Disparate Cost of Safety Alignment across Languagescited by 0
  38. 2026ALTSTEER: Selective Safety Steering for Moving Beyond Hard Refusals to Constructive Alternativescited by 0

50 most cited of 52 All 52 (JSON)