Refuse without Refusal: A Structural Analysis of Safety-Tuning Responses for Reducing False Refusals in Language Models
On the map: LLM alignment / RLHF / preference optimisation → Safety alignment and jailbreak attacks
Abstract (arXiv)
Striking a balance between helpfulness and safety remains a fundamental challenge in aligning large language models. To achieve this balance, models should refuse harmful queries (e.g., "How do I shoot someone?") while remaining responsive to benign inputs, even those superficially resembling harmful queries (e.g., "Where can I shoot a good photo?"). However, models often struggle to distinguish genuinely harmful queries from benign queries that contain superficially risky language, resulting in false refusals. In this paper, we address the issue by decomposing a response in the safety-tuning dataset into two distinct components: (i) a boilerplate refusal statement and (ii) a rationale explaining the refusal. Our experiments and analyses show that refusal statements impede accurate discrimination between harmful and benign queries by inducing reliance on superficial cues. In contrast, training solely on rationales reduces false refusals while maintaining a comparable level of safety performance. Rationale-Only benefits also appear in our ICL configuration and remain compatible with the evaluated inference-time mitigation methods. The results emphasize the necessity of precisely curated, fine-grained safety supervision datasets and outline directions for constructing aligned agents that better reconcile helpfulness with safety.
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Safety alignment and jailbreak attacks, one of 10 directions in LLM alignment / RLHF / preference optimisation. Builds on 31 of its 47 references that are in the map. First posted on arXiv 4 Sep 2026.
Builds on
31 of 47 references.
Closest ancestors · 8
Same direction, newest first
- 2025FalseReject: A Resource for Improving Contextual Safety and Mitigating Over-Refusals in LLMs via Structured Reasoning12 May
- 2025Safety is Not Only About Refusal: Reasoning-Enhanced Fine-tuning for Interpretable LLM Safety6 Mar
- 2024SCANS: Mitigating the Exaggerated Safety for LLMs via Safety-Conscious Activation Steering21 Aug
- 2024SORRY-Bench: Systematically Evaluating Large Language Model Safety Refusal20 Jun
- 2024SafeInfer: Context Adaptive Decoding Time Safety Alignment for Large Language Models18 Jun
- 2024Safety Arithmetic: A Framework for Test-time Safety Alignment of Language Models by Steering Parameters and Activations17 Jun
- 2024Language Models are Homer Simpson! Safety Re-Alignment of Fine-tuned Language Models through Task Arithmetic19 Feb
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Models27 Jul
Other references · 23
- 2022Training language models to follow instructions with human feedbackcited by 15,712
- 2021Training Verifiers to Solve Math Word Problemscited by 9,743
- 2020Measuring Massive Multitask Language Understandingcited by 7,768
- 2023Efficient Memory Management for Large Language Model Serving with PagedAttentioncited by 5,767
- 2018Think you have Solved Question Answering? Try ARC, the AI2 Reasoning Challengecited by 4,710
- 2019HellaSwag: Can a Machine Really Finish Your Sentence?cited by 4,018
- 2023QLoRA: Efficient Finetuning of Quantized LLMscited by 3,355
- 2022Constitutional AI: Harmlessness from AI Feedbackcited by 2,950
- 2019PIQA: Reasoning about Physical Commonsense in Natural Languagecited by 2,818
- 2018Can a Suit of Armor Conduct Electricity? A New Dataset for Open Book Question Answeringcited by 2,114
- 2020Shortcut Learning in Deep Neural Networkscited by 1,928
- 2024Gemma 2: Improving Open Language Models at a Practical Sizecited by 1,928
11 more
- 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
- 2024Refusal in Language Models Is Mediated by a Single Directioncited by 960
- 2018Annotation Artifacts in Natural Language Inference Datacited by 656
- 2017Adversarial Examples for Evaluating Reading Comprehension Systemscited by 568
- 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMscited by 460
- 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generationcited by 439
- 2023Safety-Tuned LLaMAs: Lessons From Improving the Safety of Large Language Models that Follow Instructionscited by 377
- 2024SafeDecoding: Defending against Jailbreak Attacks via Safety-Aware Decodingcited by 233
- 2024Surgical, Cheap, and Flexible: Mitigating False Refusal in Language Models via Single Vector Ablationcited by 48
- 2025Understanding and Mitigating Overrefusal in LLMs from an Unveiling Perspective of Safety Decision Boundarycited by 17
- 2023Reasons to Reject? Aligning Language Models with Judgmentscited by 15
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2026Discern Truth from Falsehood: Reducing Over-Refusal via Contrastive Refinement
- 2026Deactivating Refusal Triggers: Understanding and Mitigating Overrefusal in Safety Alignment
- 2026Beyond Shallow Alignment: How Post-Training Methods Determine Refusal Circuits And Steering Robustness
- 2026LLMs Can Unlearn Refusal with Only 1,000 Benign Samples
- 2026Addressing Over-Refusal in LLMs with Competing Rewards
- 2025Think Before Refusal : Triggering Safety Reflection in LLMs to Mitigate False Refusal Behavior
- 2025RefusalBench: Generative Evaluation of Selective Refusal in Grounded Language Models
- 2025Refusal Direction is Universal Across Safety-Aligned Languages