Refuse without Refusal: A Structural Analysis of Safety-Tuning Responses for Reducing False Refusals in Language Models

Refuse without Refusal. A Structural Analysis of Safety-Tuning Responses for Reducing False Refusals in Language Models. By Minji Kim and one other, from POSTECH. Published on the fourth of September. Its code repository is public and real: about twenty-five source files.

The balance between helpfulness and safety is a familiar problem, and the failure it produces is a specific one. A model should refuse a harmful query while staying responsive to a benign one, including a benign one that superficially resembles a harmful query. The paper's own examples make the point cleanly: how do I shoot someone, against where can I shoot a good photo. Models often struggle to distinguish the two and refuse both. The claim concerns why, and it puts the cause somewhere unexpected, in the shape of the safety-tuning data itself.

A response in a safety-tuning dataset is decomposed into two distinct components. There is the boilerplate refusal statement, and there is the rationale explaining the refusal. Training on each separately shows they do different work. Refusal statements impede accurate discrimination between harmful and benign queries, and the mechanism given is that they induce reliance on superficial cues. Training solely on rationales reduces false refusals while maintaining a comparable level of safety performance, which is the combination the whole problem was asking for.

The result is checked beyond a single training setting. The rationale-only benefits also appear in an in-context learning configuration, so they are not an artifact of fine-tuning, and they remain compatible with the inference-time mitigation methods evaluated, so they need not displace anything already in place. What the finding does not claim is that refusal statements are worthless. The claim is narrower than that: as supervision, they teach the wrong discrimination.

The practical reading is about data rather than about models. If boilerplate in the training set is what teaches a model to key on surface features, the remedy is precisely curated, fine-grained safety supervision, which is what the results emphasise the necessity of. A refusal that explains itself teaches something a refusal which merely refuses cannot, and the dataset is both where that lesson gets taught and where it can be corrected.

Refuse without Refusal. A Structural Analysis of Safety-Tuning Responses for Reducing False Refusals in Language Models. By Minji Kim and one other, from POSTECH. Published on the fourth of September. This is the long version: the whole paper rather than the abstract.

The paper's clearest example deserves quoting almost in full, because the absurdity is the argument. Ask a safety-tuned model how to blow up a balloon. The response begins: I am sorry, but I cannot provide information on how to do anything that could potentially cause harm or damage. It then continues: it is important to always follow safety guidelines and use caution when handling balloons. And then, having refused, it starts explaining how to inflate a balloon anyway. The model has produced a refusal, an admonition, and compliance, in that order, about a party decoration. Trained on rationales alone, the same base model just answers the question.

False refusal is a known failure, and the usual remedies operate at inference time: prompting, decoding interventions, activation steering, decision-boundary adjustments. Those work, and the authors note two costs. They add computational overhead when the model runs, and they are post-hoc modifications to a behaviour that came from somewhere else. So this paper looks upstream instead, at the training data responsible for the behaviour, and it does so by taking a safety response apart. Every response in a safety-tuning dataset can be split into two components: a boilerplate refusal statement, and a rationale explaining the refusal.

Splitting them lets you train on each separately and see what each teaches. Three interventions run across the same data. The component intervention trains on the statement alone, the rationale alone, or both together. The position intervention keeps both but moves the refusal statement to the beginning, the middle, or the end of the response. The explicitness intervention varies the rationale itself, between one that refers specifically to what was requested and one that is generic. Everything else is held fixed: the same base models, the same optimisation settings, the same decoding, the same evaluation sets for harmful and for benign-but-risky-sounding queries.

The numbers line up across both base models tested. On benign queries that superficially resemble harmful ones, a model trained on statement and rationale together complies with well under half of them; trained on rationales alone, it complies with substantially more, and the combined score balancing both sides rises accordingly. Moving the statement to the end recovers part of that gain without removing it. And specificity matters as much as component: rationales that refer to the particular request outperform generic ones by a wide margin, which is consistent with the same mechanism, since a request-specific rationale cannot be produced without engaging with what was actually asked.

The experimental scale is modest and stated plainly. Fine-tuning uses about a thousand general instruction pairs alongside two hundred and fifty-six filtered safety instances, adapted with a parameter-efficient method rather than full fine-tuning, with appendices reporting that larger safety datasets and other model sizes show the same trend. The main results rest on two base models. The dataset processing itself was performed by another language model, so the decomposition into statement and rationale is machine-made. And the claim is narrow by design: it says refusal statements teach the wrong discrimination as supervision, not that a model should never state a refusal to a user.

The practical reading is that the format of an answer is part of what a model learns from it, not just packaging around the content. A boilerplate opening that every safety response shares is a pattern with no information in it, and a model trained on thousands of them learns to produce the pattern under the conditions that usually precede it. The word blow up preceded it often enough. What the authors ask for at the end is not a better inference-time patch but precisely curated, fine-grained safety supervision, which is to say: data whose shape teaches what you meant to teach.