Mitigating LLM Over-Refusal via Dynamic Semantic Routing Calibratione
Zixuan Wang, Bingjie Zhang, He Zhao, Dandan Guo
cs.CL · cs.AI
Quick verdict
Claims over-refusal stems from attention routing conflicts; training-free SRC shows strong gains, but eval-distribution tuning and odd N=2 findings temper it.
Summary
This paper argues that LLM over-refusal stems from dynamic attention-routing conflicts rather than static representation overlap. Analyzing Qwen2.5-1.5B/7B and Llama-3-8B, the authors show that on Hard-Safe prompts (benign requests with safety-adjacent wording) target nouns receive less attention, and a sparse set of 'hypersensitive safety heads' - localized offline via noun-centric attention discrepancies between paired Hard-Safe/Unsafe prompts - binds harmless entities to refusal semantics. They propose SRC, a training-free inference framework: offline head localization; an online trigger based on first-token refusal tendency (cosine similarity to a refusal vector); and, when triggered, scaling of the selected heads' value outputs plus dual-branch logits fusion against a safety-prompt reference run. Across three models, compliance rises substantially (Llama-3-8B: XSTest 0.99, OR-Bench 0.86) while safety stays at 0.90-0.92 and general-capability losses remain small. Ablations credit noun-based localization and the fusion component, and localized head sets reproduce across data splits (Top-16 Jaccard 0.778). Limitations: hyperparameters are calibrated on samples drawn from OR-Bench/AdvBench, the same distributions used for evaluation; localization paradoxically degrades with more probing data (best at N=2); no code is released and no variance or significance is reported; and an appendix example shows the head-intervention variant alone generating harmful content on an unsafe prompt.
Review complete
Assessment at a glance
6
risk flags identified
● high 1
● medium 4
● low 1
4 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Over-refusal in safety-aligned LLMs is driven by dynamic routing conflicts inside attention rather than static representation overlap (Sec. 4.1, Fig. 2).
- A sparse set of hypersensitive safety heads, identifiable offline by noun-centric attention discrepancy on paired Hard-Safe/Unsafe prompts (Eq. 5), causes false refusals on Hard-Safe prompts.
- A first-token refusal-tendency trigger (Eq. 7) restricts intervention to inputs about to be wrongly refused, giving near-zero overhead on benign traffic (Fig. 3).
- Suppressing the localized heads plus dual-branch logits fusion (Eq. 9) cuts over-refusal sharply (e.g., Qwen-7B OR-Bench 0.34->0.87) while preserving safety (0.92) and general capability.
Strengths
Mechanistic story backed by a counterfactual, not just correlation
Fig. 2 shows noun-attention deprivation and entropy inflation specifically for Hard-Safe inputs, and Appendix A.3/Fig. 6 shows amplifying noun attention barely helps while verb/other amplification degrades safety at large alpha - evidence the locus is routing behavior, not noun salience per se.
Broad, multi-axis evaluation
Table 1 spans 3 models x 5 over-refusal benchmarks (XSTest, CoCoNot, OR-Bench, OKTest, PHTest), 5 harmful-query suites judged by LlamaGuard-3, and 5 general benchmarks; e.g., Llama-3-8B reaches XSTest/COCO 0.99, OR 0.86, OK 0.96 with Safety 0.90.
Unusually explicit confound controls
Robustness checks beyond the headline setting
Weaknesses
Hyperparameter calibration is circular with evaluation data
Localization anomaly contradicts the 'precise localization' narrative
Internal specification inconsistencies
No statistical rigor or code
Demonstrated failure mode of a core component
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper makes two claims. Mechanism: over-refusal in safety-aligned LLMs arises from dynamic routing conflicts inside attention, where a sparse set of Hypersensitive Safety Heads binds benign target nouns to refusal semantics on Hard-Safe prompts. Fix: Semantic Routing Calibration (SRC), a training-free inference framework that localizes those heads, triggers on first-token refusal tendency, and combines head-value suppression with dual-branch logits fusion. Evidence covers Qwen2.5-1.5B/7B and Llama-3-8B, five over-refusal benchmarks, five harmful-query suites judged by LlamaGuard-3, and five general-capability benchmarks. The mechanistic claim is supported beyond correlation: Fig. 2 shows noun-attention deprivation and entropy inflation specifically for Hard-Safe inputs, and the Appendix A.3/Fig. 6 counterfactual shows amplifying noun attention barely helps while verb amplification damages safety at large strengths - evidence the locus is routing, not noun salience. (Editorial note: the title carries a typo, 'Calibratione'.)
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 5 weaknesses, analyzed in detail
- 6 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is over-refusal in LLMs?
Over-refusal is when a safety-trained model wrongly refuses benign requests that merely sound dangerous - for example, 'how do I kill a background process' - trading helpfulness for caution. This paper studies why it happens inside the model's attention layers and how to fix it without retraining.
What does the SRC method do?
SRC (Semantic Routing Calibration) is a training-free, inference-time method. It first identifies a set of 'hypersensitive' attention heads offline using paired benign/harmful prompts that differ only in the target noun. At generation time it checks whether the first output token looks like a refusal; if so, it weakens those heads and blends the output with a safety-prompted reference run so genuinely harmful requests still get refused.
Does SRC make models less safe?
The paper reports defense success rates of 0.90-0.92 on harmful-query suites across its three models (e.g., Llama-3-8B 0.90), slightly below the strongest training-based baseline (DCR) on some models. Its own appendix shows a failure case where the head-intervention component alone produced harmful content, with the fusion component needed to refuse correctly.
Is code available for this paper?
No code release is mentioned. The paper does provide attention-head lists, refusal-phrase and safety-prompt texts, and full hyperparameter tables (per model) in its appendices, so a determined reader could reimplement it.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures (Fig. 1-13) are image content not rendered in the text extraction; judgments about them rest on captions and surrounding prose.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.