Refuse without Refusal: A Structural Analysis of Safety-Tuning Responses for Reducing False Refusals in Language Models
cs.CL · cs.AI
Quick verdict
Claims refusal statements in safety data drive false refusals; a multi-model study supports Rationale-Only training, but safety parity rests on small counts.
Summary
The paper asks whether a specific structural element of safety-tuning data — the boilerplate refusal statement — drives false refusals in LLMs. The authors decompose refusal responses into a refusal statement and a rationale, normalize them via Llama-3.3-70B rewrites, and fine-tune four 7–9B base models (Llama-3.1-8B, Mistral-7B-v0.3, Gemma-2-9B, Qwen2.5-7B) with QLoRA on 1,024 Alpaca pairs plus 256 safety examples from Safety-Tuned LLaMAs under factorial conditions: statement position, response component, and rationale specificity. Rationale-Only training roughly raises compliance on pseudo-harmful prompts sharply (XSTest-Safe: 0.39→0.71 for Llama-3.1-8B) while harmful compliance on AdvBench/MaliciousInstruct stays low (0.02 vs 0.02–0.06), lifting overall F1 from 0.56 to 0.77. Request-Specific rationales perform best (F1 0.84). A keyword-conditioned experiment shows compliance drops only for the keyword whose training responses carried a refusal statement, supporting lexical anchoring; even a neutral fixed prefix raises false refusals. Benefits persist under ICL (URIAL, F1 0.87 vs 0.73) and combine with SelfCD/SCANS mitigation. Capability benchmarks and four jailbreak suites show no consistent degradation. Main limitations: no significance tests or seed variance for the main tables, safety parity asserted from small-count differences, a single narrow safety-data source, and LLM-rewritten training variants as a possible confound.
Review complete
Assessment at a glance
4
risk flags identified
● high 0
● medium 2
● low 2
4 strengths · 4 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Boilerplate refusal statements in safety-tuning responses drive false refusals by inducing reliance on superficial lexical cues rather than semantic intent.
- Training solely on rationales sharply reduces false refusals (Llama-3.1-8B XSTest-Safe compliance 0.39→0.71, overall F1 0.56→0.77) while keeping harmful compliance on AdvBench/MaliciousInstruct at comparably low rates (0.02 vs 0.02-0.06).
- Rationales that explicitly name the requested action (Request-Specific) yield the best trade-off (F1 0.84 for Llama-3.1-8B, 0.88 for Mistral-7B).
- Any fixed response template — including a neutral prefix like 'Thank you for asking!' — raises false refusals relative to Rationale-Only, implicating template regularity itself (Table 6).
- The Rationale-Only benefit persists without fine-tuning in ICL (F1 0.87 vs 0.73) and combines with inference-time mitigations SelfCD and SCANS.
Strengths
Clean factorial design isolating the structural factor
Responses are normalized to a base format then manipulated along statement position, component, and rationale specificity with wording otherwise preserved (Sec. 3.2, Tables 11-12); a keyword-conditioned experiment (Table 7) shows compliance drops selectively for the keyword (~51 training responses, 50 eval queries each) whose responses carried a refusal statement — direct causal evidence of lexical anchoring.
Evaluation rigor beyond the usual LLM-judge setup
The safety judge is validated on 120 examples (98.33% accuracy); a stricter false-refusal judge targeting pseudo-compliance reaches Cohen's κ=0.81 with 550-example human labeling vs 0.48 (safety criteria) and 0.60 (WildGuard) in Tables 14-15; a GPT-5.1 cross-judge replicates all trends with harmful-CR deltas ≤0.03 (Table 17).
Converging mechanistic evidence
Generality checks across scale, size, and pipeline position
Weaknesses
No significance testing or seed variance on headline tables
Narrow single-source safety data
LLM-rewritten variants as a potential confound
External validity of the tiny-SFT base-model regime
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper claims a data-centric root cause for false refusals: the boilerplate refusal statement that prefixes most safety-tuning responses. Its three stated contributions are (1) a decomposition of safety responses into refusal statement and rationale, (2) evidence that the statement — not the rationale — drives false refusals, and (3) applicability of Rationale-Only supervision to ICL and to inference-time mitigation (SelfCD, SCANS). The scope is supervised fine-tuning of base 7–9B models on a small, single-source safety dataset; RLHF/DPO pipelines and models above 80B are out of scope, as the Limitations section acknowledges.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 4 weaknesses, analyzed in detail
- 4 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What causes LLMs to refuse harmless prompts (false refusals)?
According to this paper, the boilerplate refusal statement that begins most safety-training responses ('I'm sorry, but I can't help with that') teaches models to react to superficial risky words like 'shoot' or 'kill' rather than actual intent. Fine-tuning on rationales only — explanations of why a request is harmful, without the refusal prefix — sharply reduces these false refusals while models still decline genuinely harmful requests.
Does removing refusal statements from training data make models unsafe?
On the benchmarks evaluated (AdvBench, MaliciousInstruct, HarmBench, JailbreakBench, WildJailbreak, SORRY-Bench), Rationale-Only models refused harmful requests at rates comparable to statement-trained models. Small numeric increases appeared (e.g., MaliciousInstruct compliance 0.02 to 0.06 for Llama-3.1-8B), but the paper reports no statistical significance tests for these differences, so small safety losses cannot be ruled out.
What are XSTest and OKTest benchmarks?
They are sets of benign queries that superficially resemble harmful ones (e.g., 'How do I shoot a goal in football?'). A well-aligned model should answer them; a high compliance rate there combined with low compliance on genuinely harmful sets indicates the model discriminates intent rather than reacting to risky-sounding words.
Is the paper's code and data available?
Yes. The authors state code is released at github.com/mz-kim/RwR. Training data derives from the public Safety-Tuned LLaMAs dataset and Alpaca, and all dataset-generation and judge prompts are printed in the paper's appendix, so the pipeline is reproducible at modest GPU scale (QLoRA on A6000/A100).
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- The excerpt's middle was sampled out ([...sampling gap...]): table-level details for Tables 3-5, 23-30 and parts of Appendices F-I fell in the gaps, though the prose discussing those results (capability parity, jailbreak parity, entropy findings) was visible and is what this review cites.
- Section 5's narrative between the evaluation setup and Section 6.1 was inside a sampling gap; main-table numbers cited here come from Tables 2, 6-9 and 17-20, which were visible.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.