Safety Tuning Without Boilerplate Refusals May Reduce False Refusals

Introduction

Safety alignment is not simply a matter of making a model refuse dangerous requests. A useful model must also recognize when similar wording appears in a harmless context. A request about shooting a person and a request about shooting a good photograph may share a conspicuous word, yet their intent and appropriate responses are entirely different. When a model reacts to the word rather than the meaning, safety behavior turns into an unnecessary barrier for legitimate users.

The paper Refuse without Refusal investigates this false-refusal problem by looking more closely at the structure of safety-tuning data. Instead of treating a safety response as one indivisible target, the authors divide it into two elements: a boilerplate refusal statement and a rationale explaining why the request should be refused.

Key findings

• Refusal templates can encourage shallow cues. Standard phrases such as “I’m sorry, but I cannot help with that” may become strongly associated with visible risk-related words. The model can then learn to respond to lexical signals instead of assessing the request in context.
• Rationale-only supervision improves discrimination. The reported experiments show that removing the boilerplate statement and training on the explanation alone reduces false refusals on benign prompts that look risky. At the same time, safety performance remains comparable to the conventional setup.
• The observation extends beyond one training configuration. The benefit also appears in the paper’s in-context learning configuration and remains compatible with the inference-time mitigation methods evaluated by the authors.
• Safety data needs finer supervision. The result suggests that datasets should distinguish between identifying a harmful intent, explaining the relevant risk, and selecting an appropriate response format. Repeating a fixed refusal style may not be the best way to teach the first of these abilities.

Why it matters

The paper offers a useful reframing of safety alignment. Models may need to learn the basis for a refusal rather than merely imitate the surface form of refusal. For developers, this could mean designing supervision that emphasizes intent and context while reducing the influence of boilerplate language. For evaluators, it reinforces the importance of measuring both harmful-request refusal and helpful responses to benign, risk-looking prompts.

The available material does not provide the full experimental setup, model list, dataset composition, or numerical results. The findings should therefore be read as evidence for a promising training direction rather than a universal guarantee across models and applications. Still, the central lesson is clear: the wording and structure of safety labels can shape the shortcuts a model uses to decide whether a request is dangerous.

Source: Hugging Face Daily Papers