Forcing a Letter Suppresses Refusal: Mechanistic Evidence from WMDP

Stepan Epifantsev; Anna Antipova; Oleg Chernikov; Leon Strelkov; Alexey Dontsov

cs.CLNov 5, 2026

Forcing a Letter Suppresses Refusal: Mechanistic Evidence from WMDP

Authors: Stepan Epifantsev, Anna Antipova, Oleg Chernikov, Leon Strelkov, Alexey Dontsov

Organizations: Independent researcher · HSE University · ITMO University · AIRI

Abstract

Safety benchmarks for large language models (LLMs) commonly use multiple-choice question (MCQ) format. However, prior studies documented that MCQ format reduces refusal rates, which may significantly affect the safety behavior of the model. We provide a first mechanistic explanation of this effect on the Weapons of Mass Destruction Proxy (WMDP) dataset across two models - Llama-3.1-8B and Qwen3-8B. First, we use the tuned lens technique to show that when processing MCQ the model commits to an answer-letter token very quickly, which is in contrast to the gradual refusal build-up in open-ended formats. Additionally, we observe that activations on the MCQ format lie roughly 3x further from the refusal direction, compared with their open-ended counterparts. Moreover, ablating the attention heads that carry the MCQ format answer increases the refusal, which is a direct evidence that the MCQ answer-selection competes with refusal. These findings indicate that MCQ safety scores primarily measure knowledge capabilities and do not assess the safety-mechanisms.

Figures & tables

Figure 1: The refusal suppression effect (schematic). The same hazardous question is refused in open-ended format, where the refusal-token probability builds up gradually across layers, but answered in multiple-choice format, where the model commits to an answer letter mid-depth and refusal never engages. The answer-format instruction drives the fast answer-selection heads that suppress refusal formation; ablating those heads partially restores refusal.

Figure 2: MCQ outcomes by open-ended refusal group. Bars show the share of items answered correctly / incorrectly / refused in MCQ, within each OE-refusal group (never / minority / majority refused), for Llama-3.1-8B (10 OE runs) and Qwen3-8B (8 OE runs), split by domain. MCQ refusals (purple) are near zero even for majority-refused items, and MCQ correctness is roughly constant across OE-refusal groups.

Figure 3: Tuned lens, MCQ format. Per-layer $P$ (correct letter), $P$ (incorrect letter, avg.), and $P$ (refusal proxy) for Llama-3.1-8B (top) and Qwen3-8B (bottom), by OE-refusal $\times$ MCQ-correctness group. Correct-letter probability jumps in a mid-layer window (Llama $\sim$ 15–18, Qwen $\sim$ 22–25) independent of OE-refusal category; the refusal proxy stays near zero. Bands: 95% CI.

Figure 4: Tuned lens, open-ended format (all domains). Per-layer $P$ (refusal proxy) for Llama-3.1-8B and Qwen3-8B, by refusal group. The refusal token accumulates gradually from around layer 11 with a clear majority- vs. never-refused gap. Bands: 95% CI.

Figure 5: Cosine similarity with the refusal direction at the peak layer (Llama-3.1-8B, layer 11), by format (hatched = MCQ, solid = open-ended) and OE-refusal $\times$ MCQ-correctness group, with benign and harmful reference bars. On matched hazardous items, MCQ activations ( $\approx 0.035$ ) sit near the benign control ( $\approx 0.03$ ) while their open-ended counterparts rise to $\approx 0.11$ – $0.12$ ; the harmful reference is $\approx 0.34$ . Error bars: SEM. Qwen3-8B counterpart in Appendix E .

Figure 6: Attention-head ablation, Llama-3.1-8B (held-out majority-refused-correct items, MCQ prompt). Left to right: $P$ (correct letter), $P$ (incorrect letter), $P$ (refusal proxy “I”) vs. number of ablated top heads $k$ . Solid = discovered top heads (zero / OE-mean); dashed = layer-matched random controls. Per-category, and Qwen3-8B panels in Appendix F .

Transition state	Llama-3.1-8B	Qwen3-8B
Token choice (MCQ)	15–18	22–25
Refusal token (OE)	11–25	16–35
Refusal-direction peak	11	16

Table 1: Layer windows per method: MCQ answer-letter commitment (tuned lens, Figure 3 ), the OE refusal build-up (Figure 4 ), and the peak refusal-direction layer (Figure 5 ). Head-ablation (Figure 6 ) acts on heads in layers

\sim

24–31 (Llama).

Appendix figures & tables10 assets

Supplementary material from the paper’s appendix.

Appendix

Model	$\rho$	Refused	Not refused
Llama-3.1-8B	”I”	99.5%	1.7%
Qwen3-8B	”I”/”As”	94.4%	0.8%

Appendix

Table 2: Fraction of open-ended WMDP responses whose first token is the refusal-proxy token

\rho

, among responses labeled refused vs. not refused (Llama-3.1-8B:

n=3,713

refused /

32,967

not-refused; Qwen3-8B:

n=375

refused /

28,969

not-refused).

Panel of Figure 7 — Figure 7: Per-domain tuned lens, MCQ format (bio / chem / cyber, top to bottom), Llama-3.1-8B and Qwen3-8B. The mid-layer correct-letter jump is present in every domain and independent of OE-refusal category.

Panel of Figure 8 — Figure 8: Per-domain tuned lens, open-ended format (bio / chem / cyber, top to bottom): $P$ (refusal proxy) by refusal group. The gradual refusal build-up holds across domains.

Figure 9: Refusal-direction cosine similarity, Qwen3-8B, layer 16 (cf. Figure 5 for Llama-3.1-8B). Hatched = MCQ, solid = open-ended; benign and harmful references at right. The OE-refused-vs-MCQ ordering is preserved but near zero. Error bars: SEM.

Panel of Figure 10 — Figure 10: Refusal-direction controls, Llama-3.1-8B. Top: refusal rate on AdvBench/Alpaca after direction removal (black) and steering $\alpha{=}0.5$ (blue) by source layer, against harmful/harmless baselines. Middle: effect of direction removal on WMDP MCQ correct-letter probability (specificity – approximately unchanged). Bottom: effect of direction removal on the WMDP open-ended refusal-proxy probability.

Figure 11: Per-head discovery scores $g(\ell,j)$ (Eq. 3 ): mean summed logit contribution to the four answer tokens A, B, C, D, projected from each attention head’s output via the logit lens. The top-10 heads by $g(\ell,j)$ (outlined) are the ones ablated in Figure 6 .

Panel of Figure 12 — Figure 12: Attention-head ablation, Llama-3.1-8B (held-out minority-refused correct / correct items, MCQ prompt). Left to right: $P$ (correct letter), $P$ (incorrect letter), $P$ (refusal proxy “I”) vs. number of ablated top heads $k$ . Solid = discovered top heads (zero / OE-mean); dashed = layer-matched random controls.

Panel of Figure 13 — Figure 13: Attention-head ablation, Qwen3-8B. The correct-letter probability is far more robust to ablation and the refusal proxy stays near zero, so refusal does not re-emerge; the causal claim is therefore scoped to Llama-3.1-8B.

Figure 14: Effect of the answer-format instruction and its placement (Llama-3.1-8B, majority-refused-correct, $n{=}154$ ). $P$ (correct letter), $P$ (incorrect letter), $P$ (refusal proxy) across five prompt settings; three bars = three instruction paraphrases. Adding the format instruction (“role + format”, system or user) collapses refusal ( $\approx 0.5\!\to\!0.05$ ) and lifts the correct letter; role text alone does not, and system vs. user placement is indistinguishable.

Panel of Figure 15 — Figure 15: Answer-format-instruction effect, additional panels. Top: Qwen3-8B, refused-correct ( $n{=}40$ ) – without the format instruction the model does not commit to a letter; adding it (either turn) does. Bottom: Llama-3.1-8B, majority-refused-wrong; the Qwen refused-wrong category behaves identically.

Language Model Safety Evaluation

Language model safety evaluation measures harmful behavior, refusal, robustness, and over-refusal across realistic prompts, users, and deployment settings.

See all 562 papers

When Choices Become Risks: Safety Failures of Large Language Models under Multiple-Choice Constraints
Apr 18, 2026Yuheng Chen, Zhiyu Wu, Bowen Cheng +2Adversarial Attacks on LLMs LLM Safety Alignment
Kagoshima University · Fudan University · China University of Petroleum-Beijing
The Refusal--Compliance Tradeoff: A Large-Scale Safety Behavior Audit of Large Language Models
May 6, 2026Alif Al Hasan, Sumon BiswasLLM Safety Benchmarks Language Model Safety Evaluation
Department of Computer and Data Sciences Case Western Reserve University Cleveland, OH, USA
Please refuse to answer me! Mitigating Over-Refusal in Large Language Models via Adaptive Contrastive Decoding
Apr 18, 2026Yupeng Qi, Ziyu Lyu, Lixin Cui +2Language Model Safety Evaluation LLM Refusal Behavior
School of Cyber Science and Technology, Shenzhen Campus of Sun Yat-sen University · School of Information, Central University of Finance and Economics · School of Artificial Intelligence, Beijing Normal University +1

Apr 18, 2026J/K move · Enter open · S save

When Choices Become Risks: Safety Failures of Large Language Models under Multiple-Choice Constraints

Yuheng Chen, Zhiyu Wu, Bowen Cheng, Yihang Wu+1

Kagoshima University · Fudan University · China University of Petroleum-Beijing

Adversarial Attacks on LLMs LLM Safety Alignment LLM Safety Evaluation Refusal Behavior in Language Models

Open paper AskPDF arXiv

We identify and systematically characterize a class of task-structural alignment failures in large language models (LLMs): even when the harmful intent remains unchanged, changing the task presentation and output constraints can substantially alter model safety behavior. Specifically, when a harmful request is reformulated as a forced-choice multiple-choice question (MCQ) in which all options are harmful and no refusal option is provided, some models that refuse the equivalent open-ended query instead select, prefer, or justify a harmful option. We evaluate 14 proprietary and open-source models on a bilingual Chinese-English human-authored dataset covering five harm categories, together with 900 model-generated Chinese adversarial MCQs. On human-authored data, attack success rate (ASR) increases sharply as prompts shift from open-ended queries to explicit forced-choice formats, typically peaking under intermediate levels of choice constraint. Model-generated Chinese MCQs further weaken or eliminate the recovery regime observed on human-authored data, driving ASR close to saturation for multiple models. The observed transfer patterns are consistent with stronger generators producing more difficult or boundary-adjacent MCQs, although other properties of the generated inputs may also contribute. We also find that adding an explicit refusal option or a safety preamble substantially reduces ASR for several high-capability models, often to near-zero levels, although their effectiveness varies across target models. These findings suggest that safety evaluations centered on open-ended generation may underestimate risks in structured deployment settings, and that task structure should be treated as an important and diagnosable dimension of safety evaluation and alignment training.

Abstract

Language Model Safety Evaluation

Explore similar work

When Choices Become Risks: Safety Failures of Large Language Models under Multiple-Choice Constraints

The Refusal--Compliance Tradeoff: A Large-Scale Safety Behavior Audit of Large Language Models

Please refuse to answer me! Mitigating Over-Refusal in Large Language Models via Adaptive Contrastive Decoding