LLM Refusal

LLM: Large Language Model

Large language model refusal research examines when models should decline requests, how refusals are produced, and how to avoid blocking benign help. Benchmarks in areas such as health and cybersecurity test harmful compliance alongside over-refusal on safe or ambiguous prompts. Approaches include calibrated refusal training and prompting, knowledge unlearning or conditional access, and mechanistic interventions that analyze or steer neurons and safety representations. A central challenge is achieving reliable, context-sensitive refusals: safety mechanisms can be distributed across model architectures, and interventions may reduce harmful answers while also impairing useful responses.

Latest papers

9 papers0 papers in the last four weeks, with none the four weeks before. 0.0% of all new papers.

Mark, Don't Erase: Token Inoculation for Dual-Use Knowledge in LLMs
Jul 21, 2026Seunghyun Lee, Dongyoon Han, Sangdoo YunLLM Alignment LLM Refusal
NAVER AI Lab
Faithfulness to Refusal: A Causal Audit of Neuron Selectors
Jul 6, 2026Ananth Eswar, Pratinav Seth, Utsav Avaiya +1Transformer Interpretability Feature Attribution
Lexsi Labs · Work done while at Lexsi Labs.
Not All Refusals Are Equal: How Safety Alignment Fails Cybersecurity at Scale
Jul 2, 2026Vadym Hadetskyi, Dario Pasquini, Artem SorokinLLM Refusal LLM Safety Alignment
Cracken AI
PsychoSafe: Eliciting Psychologically-Informed Refusals in Large Language Models
Jun 8, 2026Gianluca Barmina, Federico Torrielli, Sven Harms +7Emotional Support Conversation Mental Health
University of Southern Denmark · University of Turin · University of Hamburg +1
Distinguishable Deletion: Unifying Knowledge Erasure and Refusal for Large Language Model Unlearning
May 16, 2026Puning Yang, Junchi Yu, Qizhou Wang +3LLM Refusal LLM Safety
Department of Natural Language Processing, MBZUAI. · University of Oxford. · RIKEN Center for Advanced Intelligence Project. +1
Targeted Neuron Modulation via Contrastive Pair Search
May 12, 2026Sam Herring, Jake Naviasky, Karan MalhotraLanguage Model Steering LLM Interpretability
Nous Research
FinRAG-12B: A Production-Validated Recipe for Grounded Question Answering in Banking
May 6, 2026Denys Katerenchuk, Pablo Duboue, Keelan Evanini +6Financial Services LLM Grounding
Kasisto, New York, NY · Textualization, Vancouver, Canada · NBME, Philadelphia, PA
Knowing without Acting: The Disentangled Geometry of Safety Mechanisms in Large Language Models
Mar 6, 2026Jinman Wu, Yi Xie, Shen Lin +2Refusal Mechanisms in Language Models LLM Safety Alignment
Xidian University, Xi’an, China · Tsinghua University, Shenzhen, China · Fujian Normal University, Fuzhou, China +1
Health-ORSC-Bench: A Benchmark for Measuring Over-Refusal and Safety Completion in Health Context
Jan 25, 2026Zhihao Zhang, Liting Huang, Guanghao Wu +3LLM Safety Benchmarks Language Model Safety Evaluation
Macquarie University1 · UTS2 · MBZUAI3 +1

Jul 21, 2026J/K move · Enter open · S save

Mark, Don't Erase: Token Inoculation for Dual-Use Knowledge in LLMs

Seunghyun Lee, Dongyoon Han, Sangdoo Yun

NAVER AI Lab

LLM Alignment LLM Refusal Refusal Behavior in Language Models

Open paper AskPDF arXiv

In a dual-use field, hazardous knowledge and the benign expertise around it share vocabulary, concepts, and causal structure. That overlap makes selective refusal hard, and existing methods such as unlearning and refusal training overgeneralize their suppression into the benign side. We argue for conditioning, not suppression. In this work, we introduce Token Inoculation, which marks hazardous sentences with a special token, the inoculation token, during continued pre-training. We then fine-tune the model to refuse hazardous questions and, on the same questions under the inoculation token, to predict the hazardous answers. At test time the inoculation token is absent, so the model does not express the hazardous answers it learned to predict. Across 1.5B to 14B parameters and three architecture families it holds hazardous accuracy near 18% while retaining 93% of the instruct baseline's MMLU performance, the best safety-utility balance among the baselines we compare. The same advantage reproduces under open-ended generation and in a cybersecurity transfer. We test this with a causal do(X) analysis that randomizes the accuracy of the conditioning signal, and find that refusal becomes more selective the more of the hazardous domain the model still knows. Our findings underscore the importance of training to predict the responses that must be refused, and outline a direction for safety alignment that does not degrade models' growing frontier knowledge. Project page: https://token-inoculation.github.io/