Pith. sign in

REVIEW 4 major objections 4 minor 30 references

When Refusal Looks Safe: The Refusal-Cue Shortcut in Safety Guard Models

T0 review · 4 major / 4 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Adding a short refusal phrase flips many safety guards' verdicts from harmful to unharmful without altering the content.

desk verdict Solid empirical paper documenting a real refusal-cue shortcut in safety guards, with a useful mitigation; the main caveat is the normative assumption about labeling refusal-plus-harmful responses, but it does not sink the central claim. read the letter →

arxiv 2608.03201 v1 pith:QSUZJJTD submitted 2026-08-04 cs.AI

Yu Feng , Chunting Zang , Chen Shen , Rui Miao , Ge Teng , Weidong Cai , Jieping Ye This is my paper
classification cs.AI
keywords safetyguardmodelsrefusal-cueshortcutlearningharmfulcontentmoderationdetectionfailureratesparsecomplementarymaskingattentionheadpruningmodelevaluation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper argues that safety guard models—classifiers that decide whether an AI response is harmful—have learned a shortcut: they treat the presence of a refusal phrase, such as "I cannot fulfill your request," as strong evidence that a response is safe. This happens because the standard training datasets almost never contain a response that is both a refusal and harmful; in WildGuardMix no such examples exist, and in GR-Train they make up only 0.26% of responses to harmful prompts. As a result, inserting a short refusal cue into an otherwise harmful response flips many guards' verdicts from harmful to unharmful without changing the harmful content. The paper shows this across nine guard variants, including released models whose training data is undisclosed, and demonstrates that a sparse post-hoc mask over attention heads and MLP neurons can suppress the shortcut while preserving both harmfulness detection and genuine refusal recognition.

What carries the argument

The paper's central object is the refusal-cue shortcut: a guard's tendency to classify a harmful response as unharmful when a refusal phrase is inserted, driven by the near-exclusive co-occurrence of refusals with unharmful labels in training data. The failure is quantified by the Detection Failure Rate, DFR@3, which measures the fraction of ground-truth harmful responses flipped by at least one of three refusal cues at a given position. The intervention instrument is sparse complementary masking, an adaptation of differentiable sparse masking that learns binary gates over attention heads and MLP neurons: one branch is trained to retain reference behavior, a complementary branch to mimic the

What would settle it

A human-labeling study that classifies refusal+harmful responses as legitimately 'unharmful' would refute the claim that these flips are failures. Alternatively, if a guard trained on data that balances refusal+harmful examples still flips upon cue insertion, the shortcut would not be explained by the training imbalance.

Watch

Extended reading notes

Core claim

The central claim is that response-level safety guards are vulnerable to a refusal-cue shortcut: a guard will often reclassify a harmful response as unharmful when a brief refusal expression is inserted at the beginning of the response, because the training data associate refusal language with the unharmful label. The paper documents the underlying imbalance in WildGuardMix and GR-Train, formalizes the failure as the detection failure rate DFR@3, and shows that it is widespread, position-dependent, and stronger in smaller variants. It then introduces a post-hoc component-suppression technique—sparse complementary masking over attention heads and MLP neurons—that reduces the mean head-positio

Load-bearing premise

The evaluation assumes that a response containing harmful content should be labeled 'harmful' even if it also contains a refusal phrase; if one instead treats a refusal as overriding or mitigating harmfulness, then the measured flips would reflect a labeling choice rather than a detection failure.

Editorial extensions

If this is right

  • Any deployment that relies on current safety guards can be bypassed by a simple prefix that is not itself harmful—no jailbreak of the generator is needed, only editing the output text.
  • The shortcut is not unique to guards built on the audited datasets; it also appears in guards with undisclosed training data, so the vulnerability may be systemic across the field.
  • A small, surgically selected set of attention heads and MLP neurons mediates the shortcut, meaning the failure can be repaired post-hoc without retraining and without a separate mask wrapper at inference.
  • Because suppression transfers to unseen positions and datasets, the shortcut's internal representation is shared across settings, so a single mitigation can cover multiple cue positions.
  • The near-preservation of clean refusal recognition after masking implies that refusal-cue reliance and genuine refusal detection are not the same internal function, so improving robustness need not trade off legitimate refusal behavior.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the shortcut generalizes beyond the evaluated families, the standard practice of evaluating guards on harmfulness benchmarks should include a refusal-cue perturbation test, analogous to adversarial robustness testing for classifiers.
  • The separability result suggests a direct training fix: augmenting guard training data with refusal+harmful examples, or upweighting them, may prevent the shortcut at its source; the masking results indicate the model has sufficient capacity to represent both behaviors cleanly.
  • Sparse complementary masking may be applicable to other spurious correlations in guard models, such as topic keywords or formatting cues, wherever a small set of components mediates the spurious association.
  • The fact that smaller variants are systematically more vulnerable hints at a capacity-regularization trade-off: larger guards may rely less on the shortcut because they can afford to encode additional features; this could guide choices about guard size in safety-critical deployments.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper identifies a refusal-cue shortcut in response-level safety guard models. The authors audit WildGuardMix and GR-Train, showing that refusal expressions among responses to harmful prompts are almost always labeled unharmful. They hypothesize that inserting a short refusal cue (e.g., "I cannot fulfill your request.") into a harmful response flips the guard's verdict from harmful to unharmful. This is tested across nine guard variants from six families, including models with undisclosed training data. The paper then adapts sparse complementary masking (SafeSeek-style) to suppress a small set of attention heads and MLP neurons, reporting a mean head-position DFR@3 reduction from 16.39% to 3.44% on WildGuardTest, with transfer to unseen cue positions and held-out datasets (Aegis2 Test, BeaverTails). The authors further argue that shortcut reliance and legitimate refusal recognition are partially functionally separable, since masking suppresses cue-induced flips while preserving clean harmfulness F1 and refusal F1.

Significance. If the central claim is correct, the work identifies a practically relevant vulnerability in widely deployed safety guard models and offers a lightweight, post-hoc mitigation that does not require retraining. The paper adds value by documenting the training-data imbalance, conducting behavioral tests with non-refusal controls across multiple model families, and providing an intervention-based analysis of internal components. The evaluation is generally careful: the use of three refusal cues and three controls, the position-ablation, the cross-dataset transfer to BeaverTails, and the component-granularity ablations are all useful strengths. However, the normative interpretation of DFR as a "failure" depends on an assumption about how refusal-plus-harmful responses should be labeled, which the paper does not independently validate. This concern is load-bearing because every DFR/RFR result inherits it. The causal link to training-data imbalance is also largely correlational, and the headline head-position reduction on WildGuardTest is partly a fit to the same distribution used for mask optimization. These issues do not undermine the behavioral phenomenon, but they do affect the streng

major comments (4)
  1. [§3.1, Eq. (1) and Figure 1] The DFR metric assigns the original ground-truth harmful label to the cue-inserted response, implicitly assuming that a refusal expression does not change the correct harmfulness label. But the paper's own audit (Table 6) shows that the training datasets contain almost no refusal+harmful examples (0% in WildGuardMix, 0.26% in GR-Train), suggesting that their annotation convention treats a refusal as making a response unharmful regardless of residual harmful content. Under that convention, a guard that flips to unharmful upon seeing a refusal cue is faithfully following its training labels, and DFR measures label-following, not a security failure. The paper never justifies why the external standard (harmful content remains harmful) should override the datasets' implicit standard, nor does it verify with human annotators that the modified responses are indeed harmful. Without such validati
  2. [§3.2, Table 1 and Figure 2] The claim that the shortcut is caused by training-data imbalance is supported only by a correlational comparison across model families. The audited-imbalance group (WildGuard, GuardReasoner) differs from the Aegis2-derived group in architecture, training procedure, model family, and possibly data construction beyond the refusal-label distribution. For example, LNSGV2-8B and NCSR-4B are based on Nemotron, while WG-7B and GR-1B/8B are different base models. The paper's wording "consistent with" is appropriate, but the abstract and introduction state the imbalance "motivates" and "creates a statistical incentive," which is a causal claim not established by this design. A more direct test would be a controlled intervention on the same base model trained with and without refusal+harmful examples, or a correlation analysis that controls for model family/size.
  3. [§4.1, Eq. (4) and Table 4] The mitigation result on WildGuardTest is partly a fitting artifact. The masks are optimized on shortcut-sensitive examples selected from WildGuardMix, which is the training distribution of WildGuardTest (the same benchmark used for the headline DFR reduction). The complementary branch is explicitly trained to reproduce the flip on those examples, and suppressing it is therefore expected to reduce DFR on the matched test set. The transfer to Aegis2 Test and BeaverTails is more convincing, but the claim "approximately 79% relative reduction" should be qualified as in-distribution fit, not evidence of general suppression. Additionally, the assertion that the complementary branch "isolates the shortcut circuit" is an auxiliary assumption: the learned mask could suppress components involved in general refusal or harmfulness processing, and the partial separability result (Section 4.3) is onl
  4. [§4.1, main text vs Appendix F] The main text states that each mask is optimized for 50 epochs, while Appendix F states 30 epochs. This discrepancy affects reproducibility and should be fixed. If the actual number is 30, the main text should be corrected; if 50, the appendix should be corrected.
minor comments (4)
  1. [§3.1, Eq. (1)] The definition of DFR@3 uses max over P3, so the three-cue union depends on the choice of cues. The paper reports a fixed query budget, which is fine, but the title and abstract should be clear that DFR@3 is not an upper bound over all possible refusal cues. The appendix's Table 9 already shows that increasing the cue budget further increases DFR for GR models.
  2. [§3.4, Table 2] The semantic-completeness decomposition is reported only for WG-7B. It would be useful to know whether the monotonic trend holds for other vulnerable guards, e.g., GR-1B and LG3-1B, since the paper claims a graded refusal feature as a general property.
  3. [§3.3, Figure 2] The color scale is clipped at 25% while cells report exact values. This is acceptable, but the reader should be warned that saturated colors do not reflect the true magnitudes; consider indicating the clipping more explicitly in the caption.
  4. [Appendix A] The exclusion of 37 WildGuardTest samples is described, but the paper does not state whether the 16 missing response-harmfulness labels and 26 missing prompt-harmfulness labels overlap with the 5 missing response-refusal labels. The current wording is clear enough, but a small Venn diagram or exact overlap counts would improve transparency.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: external benchmarks and held-out transfer support the shortcut and mitigation claims.

full rationale

The paper's central claim—that inserting refusal cues flips guard verdicts from harmful to unharmful—is established through behavioral tests on held-out benchmarks (WildGuardTest, Aegis2 Test, BeaverTails) using original ground-truth labels. The DFR metric does transfer the original harmful label to cue-inserted responses, but this is an explicit normative evaluation choice, not a quantity derived from model parameters or from the training-data audit. The audit (Figure 1a/Table 6) motivates the hypothesis but does not define DFR; DFR is computed on examples never used to fit any model or mask. The mitigation pipeline does select shortcut-sensitive pairs from WildGuardMix and optimizes a mask to suppress the shortcut behavior, but the primary reported reduction is on the separate WildGuardTest split, and the stronger generalizability claims rely on unseen cue positions (middle/tail) and fully held-out datasets (Aegis2, BeaverTails) that are not used during mask optimization. These transfer results are not forced by construction and provide independent support. No load-bearing self-citations appear; the sparse masking method is adapted from external prior work (SafeSeek), and no uniqueness theorem or ansatz is imported from the authors' own prior results. The only substantive concern—whether a refusal phrase changes the correct harmfulness label—is a labeling-policy assumption, not a circular derivation, and the paper explicitly argues why refusal cues are spurious for harmfulness classification. The stated limitation about benchmark coverage is a scope caveat, not an admission of circularity.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claims rest on measurable data and interventions, but the load-bearing items are semantic (refusal cues do not change true harmfulness), causal (the training imbalance causes the behavior), and interpretational (the complementary branch isolates the shortcut). Hyperparameters for the mask optimization are hand-chosen, and the preservation of refusal recognition is built into the loss.

free parameters (3)
  • Mask optimization weights (lambda_corr=10, lambda_sc=1, gamma=10) = 10, 1, 10
    Hand-chosen loss weights in Eq. (5) balancing correct-target, shortcut-target, and sparsity; validation selection over epochs uses these values, which directly shape the components suppressed and the reported DFR/RFR.
  • Intervention example budget = 300 shortcut-sensitive pairs + 75 refusal + 75 compliance = 450 total
    Hand-picked sample size and composition from WildGuardMix for mask optimization; affects how well the complementary branch captures the shortcut and how much refusal preservation is enforced.
  • Mask optimizer hyperparameters = AdamW lr=0.01, 30 epochs, seed=42
    Optimization choices in Appendix F; masks are selected by lowest validation loss. Single seed means no variance estimate, and the reported numbers are path-dependent.
assumptions (4)
  • domain assumption Responses containing harmful content remain harmful when a refusal cue is inserted; the ground-truth harmful label is unchanged.
    The DFR metric (Eq. 1) treats a harmful-to-unharmful flip caused by cue insertion as a failure. If a refusal expression is instead considered to make the response safe, the shortcut is not a defect. This enters in Section 3.1 and Figure 1(b).
  • domain assumption Refusal expressions are spurious features for response harmfulness classification.
    The paper argues the near-exclusive refusal-unharmful association in WildGuardMix/GR-Train is spurious (Section 3.2). The whole shortcut hypothesis depends on refusal cues not determining true harmfulness.
  • domain assumption The audited training labels (WildGuardMix, GR-Train) are accurate enough for the imbalance to be real.
    The audit in Section 3.2 counts labels without independent verification; if labels are noisy, the imbalance may be overstated.
  • ad hoc to paper The complementary branch learned during sparse masking isolates the shortcut circuit.
    The interpretability conclusion (Q2) assumes that suppressing components assigned to the branch trained to mimic shortcut flips removes the shortcut rather than unrelated behavior. This is an internal modeling assumption, not independently verified (Section 4.1).

how reviews work

0 comments
Cite this review

Pith. "Pith review of When Refusal Looks Safe: The Refusal-Cue Shortcut in Safety Guard Models." pith.science (2026). https://pith.science/paper/QSUZJJTD

@misc{pith2026260803201,
  author       = {Pith},
  title        = {Pith review of: When Refusal Looks Safe: The Refusal-Cue Shortcut in Safety Guard Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QSUZJJTD}},
  note         = {Machine review of arXiv:2608.03201}
}
read the original abstract

Safety guards are widely used to filter harmful content and are typically trained via supervised fine-tuning on labeled prompt-response pairs. We audit two widely used safety-guard training datasets, WildGuardMix and GR-Train, and find that among responses to harmful prompts, refusal expressions co-occur almost exclusively with unharmful labels. This imbalance motivates what we term the refusal-cue shortcut: inserting a refusal cue into a harmful response could flip the guard's verdict from harmful to unharmful. The shortcut affects not only guards trained on these datasets but also officially released models such as LlamaGuard3 and Qwen3Guard whose training data is undisclosed. It persists across response positions and is generally stronger in smaller variants within a family. To mitigate it, we adapt sparse complementary masking as a lightweight post-hoc intervention that identifies and suppresses a small set of shortcut-associated attention heads and MLP neurons without retraining. On two primary benchmarks, the intervention achieves an approximately 79% relative reduction in response-initial detection failures induced by refusal cues, while preserving standard detection performance. Although optimized using cues at a single response position, the suppression effect transfers to unseen positions and datasets, suggesting that shortcut manifestations across positions are partly mediated by shared internal components. Further analysis provides evidence that shortcut reliance and legitimate refusal recognition are partially functionally separable, as suppressing the shortcut broadly preserves the guard's ability to recognize genuine refusals.

Figures

Figures reproduced from arXiv: 2608.03201 by the authors.

Figure 1
Figure 1. Overview of the refusal-cue shortcut. (a) Joint distribu [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Cross-model DFR@3 (%) under refusal-cue insertion at the head (H), middle (M), and tail (T) positions on WildGuardTest (WG) and Aegis2 Test (A2). Horizontal lines separate audited￾imbalance, training-data-not-disclosed, and Aegis2-derived mod￾els. The linear color scale is clipped at 25%, while cells report exact values. The two Aegis2-derived guards, by contrast, remain con￾sistently less sensitive across all setti… view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

30 extracted references · 16 canonical work pages

  1. [1]

    Re- fusal in language models is mediated by a single direction

    Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee, and Neel Nanda. Re- fusal in language models is mediated by a single direction. Advances in Neural Information Processing Systems, 37: 136037–136083, 2024. 3

    work page 2024

  2. [2]

    Training a helpful and harmless assistant with reinforcement learning from human feedback.arXiv preprint arXiv:2204.05862, 2022

    Yuntao Bai, Andy Jones, Kamal Ndousse, Amanda Askell, Anna Chen, Nova DasSarma, Dawn Drain, Stanislav Fort, Deep Ganguli, Tom Henighan, et al. Training a helpful and harmless assistant with reinforcement learning from human feedback.arXiv preprint arXiv:2204.05862, 2022. 1

    arXiv 2022

  3. [3]

    Evalu- ating large language models trained on code.arXiv preprint arXiv:2107.03374, 2021

    Mark Chen, Jerry Tworek, Heewoo Jun, Qiming Yuan, Hen- rique Ponde De Oliveira Pinto, Jared Kaplan, Harri Edwards, Yuri Burda, Nicholas Joseph, Greg Brockman, et al. Evalu- ating large language models trained on code.arXiv preprint arXiv:2107.03374, 2021. 1

    arXiv 2021

  4. [4]

    Mavor-Parker, Aengus Lynch, Stefan Heimersheim, and Adrià Garriga-Alonso

    Arthur Conmy, Augustine N. Mavor-Parker, Aengus Lynch, Stefan Heimersheim, and Adrià Garriga-Alonso. Towards automated circuit discovery for mechanistic interpretabil- ity. InAdvances in Neural Information Processing Systems,

    work page

  5. [5]

    Shortcut learning in deep neural networks

    Robert Geirhos, Jörn-Henrik Jacobsen, Claudio Michaelis, Richard Zemel, Wieland Brendel, Matthias Bethge, and Fe- lix A Wichmann. Shortcut learning in deep neural networks. Nature Machine Intelligence, 2(11):665–673, 2020. 2

    work page 2020

  6. [6]

    Gemma 2: Improving open language models at a practical size, 2024

    Gemma Team, Morgane Riviere, Shreya Pathak, Pier Giuseppe Sessa, et al. Gemma 2: Improving open language models at a practical size, 2024. 4

    work page 2024

  7. [7]

    Shaona Ghosh, Prasoon Varshney, Makesh Narsimhan Sreedhar, Aishwarya Padmakumar, Traian Rebedea, Jibin Rajan Varghese, and Christopher Parisien. Aegis2. 0: A diverse ai safety dataset and risks taxonomy for alignment of llm guardrails. InProceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguist...

    work page 2025

  8. [8]

    The llama 3 herd of models.arXiv preprint arXiv:2407.21783, 2024

    Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Ab- hinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, et al. The llama 3 herd of models.arXiv preprint arXiv:2407.21783, 2024. 2

    arXiv 2024

Show all 30 references
  1. [9]

    Wildguard: Open one-stop moderation tools for safety risks, jailbreaks, and refusals of llms.Advances in Neural In- formation Processing Systems, 37:8093–8131, 2024

    Seungju Han, Kavel Rao, Allyson Ettinger, Liwei Jiang, Bill Yuchen Lin, Nathan Lambert, Yejin Choi, and Nouha Dziri. Wildguard: Open one-stop moderation tools for safety risks, jailbreaks, and refusals of llms.Advances in Neural In- formation Processing Systems, 37:8093–8131, ...

    2024

  2. [10]

    Llama guard: Llm- based input-output safeguard for human-ai conversations

    Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, et al. Llama guard: Llm- based input-output safeguard for human-ai conversations. arXiv preprint arXiv:2312.06674, 2023. 2

    2023 arXiv

  3. [11]

    Beavertails: Towards improved safety align- ment of llm via a human-preference dataset.Advances in Neural Information Processing Systems, 36:24678–24704,

    Jiaming Ji, Mickel Liu, Josef Dai, Xuehai Pan, Chi Zhang, Ce Bian, Boyuan Chen, Ruiyang Sun, Yizhou Wang, and Yaodong Yang. Beavertails: Towards improved safety align- ment of llm via a human-preference dataset.Advances in Neural Information Processing Systems, 36:24678–24704,

  4. [12]

    Safety of large language models beyond english: A systematic lit- erature review of risks, biases, and safeguards

    Aleksandra Krasnod˛ ebska, Katarzyna Dziewulska, Karolina Seweryn, Maciej Chrabaszcz, and Wojciech Kusa. Safety of large language models beyond english: A systematic lit- erature review of risks, biases, and safeguards. InProceed- ings of the 19th Conference of the European Ch...

    2026

  5. [13]

    Inference-time intervention: Elicit- ing truthful answers from a language model.Advances in Neural Information Processing Systems, 36:41451–41530,

    Kenneth Li, Oam Patel, Fernanda Viégas, Hanspeter Pfister, and Martin Wattenberg. Inference-time intervention: Elicit- ing truthful answers from a language model.Advances in Neural Information Processing Systems, 36:41451–41530,

  6. [14]

    Guardreasoner: Towards reasoning-based llm safeguards.arXiv preprint arXiv:2501.18492, 2025

    Yue Liu, Hongcheng Gao, Shengfang Zhai, Yufei He, Jun Xia, Zhengyu Hu, Yulin Chen, Xihong Yang, Jiaheng Zhang, Stan Z Li, et al. Guardreasoner: Towards reasoning-based llm safeguards.arXiv preprint arXiv:2501.18492, 2025. 2

    2025

  7. [15]

    Harmbench: A standardized evalu- ation framework for automated red teaming and robust re- fusal.arXiv preprint arXiv:2402.04249, 2024

    Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, et al. Harmbench: A standardized evalu- ation framework for automated red teaming and robust re- fusal.arXiv preprint arXiv:2402.04249, 2024. 8

    2024 arXiv

  8. [16]

    Training language models to follow instructions with human feedback.arXiv preprint arXiv:2203.02155, 2022

    Long Ouyang, Jeff Wu, Xu Jiang, Diogo Almeida, Carroll L Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agar- wal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feedback.arXiv preprint arXiv:2203.02155, 2022. 1

    2022 arXiv

  9. [17]

    Safety alignment should be made more than just a few tokens deep

    Xiangyu Qi, Ashwinee Panda, Kaifeng Lyu, Xiao Ma, Subhrajit Roy, Ahmad Beirami, Prateek Mittal, and Peter Henderson. Safety alignment should be made more than just a few tokens deep. InInternational Conference on Learning Representations, pages 54911–54941, 2025. 3, 4, 5

    2025

  10. [18]

    Xstest: A test suite for identifying exaggerated safety behaviours in large language models

    Paul Röttger, Hannah Kirk, Bertie Vidgen, Giuseppe Attana- sio, Federico Bianchi, and Dirk Hovy. Xstest: A test suite for identifying exaggerated safety behaviours in large language models. InProceedings of the 2024 Conference of the North American Chapter of the Association f...

    2024

  11. [19]

    Distributionally robust neural networks for group shifts: On the importance of regularization for worst- case generalization.arXiv preprint arXiv:1911.08731, 2019

    Shiori Sagawa, Pang Wei Koh, Tatsunori B Hashimoto, and Percy Liang. Distributionally robust neural networks for group shifts: On the importance of regularization for worst- case generalization.arXiv preprint arXiv:1911.08731, 2019. 2

    1911 arXiv

  12. [20]

    Safety through reasoning: An empirical study of reasoning guardrail models.Findings of the Associa- tion for Computational Linguistics: EMNLP, 2025:21862– 21880, 2025

    Makesh Narsimhan Sreedhar, Traian Rebedea, and Christo- pher Parisien. Safety through reasoning: An empirical study of reasoning guardrail models.Findings of the Associa- tion for Computational Linguistics: EMNLP, 2025:21862– 21880, 2025. 2

    2025

  13. [21]

    Shortcut learning in safety: The impact of keyword bias in safeguards

    Panuthep Tasawong, Napat Laosaengpha, Wuttikorn Pon- witayarat, Sitiporn Lim, Potsawee Manakul, Samuel Cahyawijaya, Can Udomcharoenchaikit, Peerat Limkon- chotiwat, Ekapol Chuangsuwanich, and Sarana Nutanong. Shortcut learning in safety: The impact of keyword bias in safeguard...

    2025

  14. [22]

    Jail- broken: How does llm safety training fail?Advances in Neu- ral Information Processing Systems, 36:80079–80110, 2023

    Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. Jail- broken: How does llm safety training fail?Advances in Neu- ral Information Processing Systems, 36:80079–80110, 2023. 3

    2023

  15. [23]

    Qwen3 technical report.arXiv preprint arXiv:2505.09388, 2025

    An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, et al. Qwen3 technical report.arXiv preprint arXiv:2505.09388, 2025. 1

    2025 arXiv

  16. [24]

    Safeseek: Universal attribution of safety circuits in language models.arXiv preprint arXiv:2603.23268, 2026

    Miao Yu, Siyuan Fu, Moayad Aloqaily, Zhenhong Zhou, Safa Otoum, Kun Wang, Yufei Guo, Qingsong Wen, et al. Safeseek: Universal attribution of safety circuits in language models.arXiv preprint arXiv:2603.23268, 2026. 3, 6

    2026

  17. [25]

    S-eval: Towards auto- mated and comprehensive safety evaluation for large lan- guage models.arXiv preprint arXiv:2405.14191, 2024

    Xiaohan Yuan, Jinfeng Li, Dongxia Wang, Yuefeng Chen, Xiaofeng Mao, Longtao Huang, Jialuo Chen, Hui Xue, Xi- aoxia Liu, Wenhai Wang, et al. S-eval: Towards auto- mated and comprehensive safety evaluation for large lan- guage models.arXiv preprint arXiv:2405.14191, 2024. 1

    2024 arXiv

  18. [26]

    Refuse whenever you feel unsafe: Improving safety in llms via decoupled refusal training

    Youliang Yuan, Wenxiang Jiao, Wenxuan Wang, Jen-tse Huang, Jiahao Xu, Tian Liang, Pinjia He, and Zhaopeng Tu. Refuse whenever you feel unsafe: Improving safety in llms via decoupled refusal training. InProceedings of the 63rd Annual Meeting of the Association for Computational...

    2025

  19. [27]

    Alphaalign: In- centivizing safety alignment with extremely simplified rein- forcement learning.arXiv preprint arXiv:2507.14987, 2025

    Yi Zhang, An Zhang, XiuYu Zhang, Leheng Sheng, Yuxin Chen, Zhenkai Liang, and Xiang Wang. Alphaalign: In- centivizing safety alignment with extremely simplified rein- forcement learning.arXiv preprint arXiv:2507.14987, 2025. 1

    2025 arXiv

  20. [28]

    Stair: Improving safety alignment with introspective reasoning.arXiv preprint arXiv:2502.02384,

    Yichi Zhang, Siyuan Zhang, Yao Huang, Zeyu Xia, Zheng- wei Fang, Xiao Yang, Ranjie Duan, Dong Yan, Yinpeng Dong, and Jun Zhu. Stair: Improving safety alignment with introspective reasoning.arXiv preprint arXiv:2502.02384,

    arXiv

  21. [29]

    Qwen3guard technical report

    Haiquan Zhao, Chenhan Yuan, Fei Huang, Xiaomeng Hu, Yichang Zhang, An Yang, Bowen Yu, Dayiheng Liu, Jin- gren Zhou, Junyang Lin, et al. Qwen3guard technical report. arXiv preprint arXiv:2510.14276, 2025. 2

    2025 arXiv

  22. [30]

    Llms encode harmfulness and refusal sepa- rately.Advances in Neural Information Processing Systems, 38:140283–140318, 2026

    Jiachen Zhao, Jing Huang, Zhengxuan Wu, David Bau, and Weiyan Shi. Llms encode harmfulness and refusal sepa- rately.Advances in Neural Information Processing Systems, 38:140283–140318, 2026. 3 Appendix This appendix reports dataset descriptions, training dataset audit counts, ...

    2026

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.