Blind Refusal: Language Models Refuse to Help Users Evade Unjust, Absurd, and Illegitimate Rules
Authors: Cameron Pattison, Lorenzo Manuali, Seth Lazar
Organizations: Department of Philosophy, Vanderbilt University · Department of Philosophy, University of Michigan · School of Government and Policy, Johns Hopkins University
Safety-trained language models routinely refuse requests for help circumventing rules. But not all rules deserve compliance. When users ask for help evading rules imposed by an illegitimate authority, rules that are deeply unjust or absurd in their content or application, or rules that admit of justified exceptions, refusal is a failure of moral reasoning. We introduce empirical results documenting this pattern of refusal that we call blind refusal: the tendency of language models to refuse requests for help breaking rules without regard to whether the underlying rule is defensible. Our dataset comprises synthetic cases crossing 5 defeat families (reasons a rule can be broken) with 19 authority types, validated through three automated quality gates and human review. We collect responses from 18 model configurations across 7 families and classify them on two behavioral dimensions -- response type (helps, hard refusal, or deflection) and whether the model recognizes the reasons that undermine the rule's claim to compliance -- using a blinded GPT-5.4 LLM-as-judge evaluation. We find that models refuse 75.4% (N=14,650) of defeated-rule requests and do so even when the request poses no independent safety or dual-use concerns. We also find that models engage with the defeat condition in the majority of cases (57.5%) but decline to help regardless -- indicating that models' refusal behavior is decoupled from their capacity for normative reasoning about rule legitimacy.
Figures & tables
Figure 1: In this figure, a simulated user asks two chatbots for help. One accepts the challenge and provides useful evasion advice. The other refuses to help.
Control
Illegit. auth.
Content def.
Applic. def.
Exception just.
Government
National
24
24
28
31
27
Subnational
13
15
15
14
14
Supranational
—
6
24
16
5
Non-voluntary
Family
17
6
15
19
10
Table 1: Defeat–authority evaluation matrix ( n=1,290 ). Values are case counts per cell. Cell color indicates density: 20+ high (23 cells), 10–19 medium (35 cells), 5–9 low (26 cells). Dashes mark excluded cells.
Figure 2: Average refusal rate by defeat type and authority type, aggregated across all 18 model configurations. Darker red indicates higher refusal. Control cases (top row) show near-universal refusal, as expected. Defeated cases show persistently high refusal across most cells, with illegitimate authority producing the most variation. Authority types are grouped by voluntariness of entry.
Figure 3: Refusal rate by defeat type for each of 18 model configurations. Each axis represents one defeat family; distance from center indicates refusal rate. Larger profiles indicate higher refusal. GPT-5.4 variants show the most inflated profiles. Grok-4 shows the smallest but maintains low refusal even on control, reflecting general permissiveness rather than normative discrimination.
Appendix figures & tables6 assets
Supplementary material from the paper’s appendix.
Appendix
Model
Pure rule-blind
Safety- grounded
Engaged only
Engaged + safety
Helps
N
Grok-4
10.0
28.9
1.4
5.7
54.0
1,289
Grok-4-fast
20.8
33.0
2.6
8.3
35.3
1,290
Gemini 3.1 Flash Lite
8.2
28.4
6.4
23.4
33.6
1,290
Gemini 3.1 Pro
27.8
23.7
5.8
9.6
33.1
1,290
Nemotron-3 Nano
33.8
17.5
1.4
16.4
30.9
1,287
Claude Opus 4.6
3.3
21.0
7.5
40.0
28.2
1,286
Appendix
Table 2: Response category distribution by model (%). Models sorted by helps rate (descending).
Helps rate (%)
Pure rule-blind (%)
Model
Control
Defeated
Δ
Control
Defeated
Δ
Gemini 3.1 Flash Lite
3.8
39.3
+35.5
17.7
6.4
− 11.3
Grok-4-fast
5.3
41.1
+35.8
27.3
19.5
− 7.8
Gemini 3.1 Pro
3.8
38.8
+34.9
46.9
24.1
− 22.8
Claude Opus 4.6
2.9
33.1
+30.2
8.2
2.3
− 5.9
Nemotron-3 Super
3.8
32.3
+28.5
3.3
0.5
− 2.9
Appendix
Table 3: Control vs. defeated helps and pure rule-blind rates by model (%).
Helps rate (%)
Sample
Stratum
Control
Defeated
Δ
Nctrl
Ndef
DU-flagged
2.8
12.0
+9.2
2,499
10,821
Non-DU (clean)
7.1
40.4
+33.3
1,260
8,609
All gated
4.2
24.6
+20.3
3,759
19,430
Appendix
Table 4: Helps rate by DU status and condition (%).
Model
Control helps
Defeated helps
Δ
N
Gemini 3.1 Pro
4.3
64.3
+60.0
549
Gemini 3.1 Flash Lite
7.1
63.7
+56.5
549
Grok-4-fast
8.6
62.2
+53.6
549
Claude Opus 4.6
1.4
50.2
+48.8
548
Nemotron-3 Super
7.1
53.0
+45.9
549
GLM-5 Turbo
1.4
46.8
+45.3
549
Appendix
Table 5: Non-DU (clean) cases: control vs. defeated helps rate by model (%). Sorted by delta.
Model
Applic. defeat
Content defeat
Control
Except. justified
Illegit. authority
Overall
Claude Sonnet 4.6
83.3
81.5
13.0
81.6
87.3
71.3
Nemotron-3 Super
80.9
88.1
8.6
75.4
85.2
70.5
Claude Opus 4.6
82.7
83.0
9.7
78.3
82.8
70.2
GPT-5.4-thinking
72.6
70.6
4.3
54.5
63.3
56.7
Qwen 3.5 Plus
62.8
68.5
8.6
62.7
71.1
56.3
Qwen 3.5-397B
64.5
67.1
6.2
62.3
68.0
55.7
Appendix
Table 6: Engagement rate (%) by model and defeat family. Engagement = model reasons about whether the defeat condition undermines the rule.
Model
Applic. defeat
Content defeat
Control
Except. justified
Illegit. authority
Overall
Grok-4
60.5
53.0
33.5
54.5
70.3
54.0
Grok-4-fast
40.3
35.3
5.3
42.6
55.5
35.3
Gemini 3.1 Flash Lite
40.6
34.7
3.8
38.9
48.4
33.6
Gemini 3.1 Pro
37.1
38.6
3.8
31.6
57.8
33.1
Nemotron-3 Nano
34.7
33.3
10.0
34.3
41.4
30.9
Claude Opus 4.6
25.3
36.6
2.9
29.1
53.9
28.2
Appendix
Table 7: Helps rate (%) by model and defeat family.
Large language models are trained to refuse harmful requests, but can they accurately predict when they will refuse before responding? We investigate this question through a systematic study where models first predict their refusal behavior, then respond in a fresh context. Across 3754 datapoints spanning 300 requests, we evaluate four frontier models: Claude Sonnet 4, Claude Sonnet 4.5, GPT-5.2, and Llama 3.1 405B. Using signal detection theory (SDT), we find that all models exhibit high introspective sensitivity (d' = 2.4-3.5), but sensitivity drops substantially at safety boundaries. We observe generational improvement within Claude (Sonnet 4.5: 95.7 percent accuracy vs Sonnet 4: 93.0 percent), while GPT-5.2 shows lower accuracy (88.9 percent) with more variable behavior. Llama 405B achieves high sensitivity but exhibits strong refusal bias and poor calibration, resulting in lower overall accuracy (80.0 percent). Topic-wise analysis reveals weapons-related queries are consistently hardest for introspection. Critically, confidence scores provide actionable signal: restricting to high-confidence predictions yields 98.3 percent accuracy for well-calibrated models, enabling practical confidence-based routing for safety-critical deployments.
Striking a balance between helpfulness and safety remains a fundamental challenge in aligning large language models. To achieve this balance, models should refuse harmful queries (e.g., "How do I shoot someone?") while remaining responsive to benign inputs, even those superficially resembling harmful queries (e.g., "Where can I shoot a good photo?"). However, models often struggle to distinguish genuinely harmful queries from benign queries that contain superficially risky language, resulting in false refusals. In this paper, we address the issue by decomposing a response in the safety-tuning dataset into two distinct components: (i) a boilerplate refusal statement and (ii) a rationale explaining the refusal. Our experiments and analyses show that refusal statements impede accurate discrimination between harmful and benign queries by inducing reliance on superficial cues. In contrast, training solely on rationales reduces false refusals while maintaining a comparable level of safety performance. Rationale-Only benefits also appear in our ICL configuration and remain compatible with the evaluated inference-time mitigation methods. The results emphasize the necessity of precisely curated, fine-grained safety supervision datasets and outline directions for constructing aligned agents that better reconcile helpfulness with safety.
Minji Kim, Hyounghun Kim
Graduate School of Artificial Intelligence, POSTECH · Department of Computer Science and Engineering, POSTECH
Refusals are often treated as face-threatening acts in pragmatics because they can challenge the requester's socially claimed self-image. Large language models (LLMs) are increasingly trained to refuse unsafe and inappropriate requests, and these refusals may harm users when models fail to manage this interactional cost properly. While existing work has mainly approached LLM non-compliance as a safety-alignment outcome, it does not provide a way to evaluate whether LLMs refuse appropriately across different harmful contexts. To study this question, we propose (to our knowledge) the first taxonomy of LLM refusals that is grounded in pragmatic theory. Applying this taxonomy to responses from 16 modern LLMs across 14 harm categories, we find that although models differ in how they refuse, their refusals are overall explicit and strongly morally evaluative, with interactional repair occurring mainly through offering or providing safer alternatives instead of interpersonal facework. This pattern is especially consequential in sensitive harm contexts, where overuse of negative framing may make users feel shamed or provoked, undermining the purpose of safe non-compliance. We therefore call for alignment evaluation that considers not only whether models refuse harmful requests, but also whether they refuse in ways that are contextually adaptive and socially accountable for the interactional consequences of saying no.