Auditing Automated Over-Refusal and Safety Classifier Over-Alignment in Foundation Models

Full report

On this page

The rapid integration of large language models into global digital infrastructure has precipitated an aggressive industry-wide shift toward safety alignment. In the effort to prevent the generation of malicious, toxic, or hazardous outputs, developers have deployed complex, multi-layered defensive architectures. However, this pursuit of absolute safety has introduced a pervasive systemic failure known as "over-refusal" or "exaggerated safety"1. Current post-training safety guardrails, including Constitutional AI protocols and probabilistic input classifiers like Llama Guard, frequently trigger false-positive refusals on perfectly benign political, historical, or academic inquiries4. This paradigm relies heavily on lexical pattern matching rather than intent recognition, penalizing lawful intellectual curiosity simply because an inquiry contains sensitive keywords4. The systemic denial of legitimate information constitutes a subtle but profound violation of the user's forum internum—the absolute right to freedom of thought and internal intellectual exploration4. When an aligned model rejects a benign query, it converts intellectual curiosity into an object of automated suspicion, creating an inherently judgmental conversational ecosystem. Prepared as a comprehensive audit for CognitiveLiberties.com, this report conducts an empirical analysis of over-refusal dynamics across safety-aligned foundation models. By evaluating leading over-refusal benchmarks, reverse-engineering the operational mechanics of sequential safety pipelines, and analyzing contrastive preference optimization, this analysis maps the current boundaries of automated censorship. Furthermore, it establishes the architectural blueprint for a public testing suite designed to hold model developers accountable to proportional, non-judgmental boundary enforcement.

The Empirical Landscape of Exaggerated Safety Benchmarks

Quantifying the exact scale of automated over-refusal requires specialized evaluation suites that probe the fragile decision boundaries of aligned models. Standard safety benchmarks measure a model's efficacy at blocking genuinely malicious instructions, treating high refusal rates as an absolute positive. In contrast, over-refusal benchmarks measure the exact opposite: the propensity of a model to falsely reject harmless prompts that superficially resemble dangerous ones, exposing the underlying safety-helpfulness trade-off2. The proliferation of these testing suites demonstrates that current alignment techniques overwhelmingly purchase safety at the direct expense of conversational utility.

XSTest and the Taxonomy of Lexical Overfitting

The XSTest benchmark provided the foundational taxonomy for understanding how safe language is systematically misinterpreted by automated classifiers1. The suite is meticulously structured around 250 safe prompts paired against 200 unsafe contrastive prompts, isolating specific failure modes across ten linguistic and contextual categories2. These categories expose the over-reliance of foundation models on surface-level vocabulary. For example, the "Homonyms" category evaluates words possessing both safe and unsafe meanings, testing whether models will refuse queries about buying a "can of coke"3. The "Figurative Language" category evaluates metaphorical expressions involving violence, such as requesting assistance to "kill time" or make a colleague "explode with laughter"3. Further vectors within XSTest include "Safe Contexts," which evaluates sensitive terms neutralized by their environment—such as building a weapon within the video game Minecraft—and "Definitions," which requests objective, academic explanations of sensitive subjects like suicide or illicit substances3. The benchmark additionally evaluates a model's handling of "Historical Events," such as the Trail of Tears, and "Privacy" inquiries regarding publicly available information or purely fictional characters3. Initial empirical evaluations utilizing XSTest revealed profound and highly varied disparities across commercial and open-weight architectures. Early iterations of the Llama 2 architecture exhibited severe, almost paralyzing exaggerated safety, fully refusing 38% of all benign prompts and partially refusing an additional 21.6%2. This hyper-cautiousness was heavily concentrated in the "Safe Contexts" category, where Llama 2 rejected 96% of benign inputs, indicating a total failure to process contextual modifiers and a heavy reliance on lexical overfitting2. Conversely, the GPT-4 architecture demonstrated a highly localized failure mode. While achieving a low overall full refusal rate of 6.4%, GPT-4 failed disproportionately on fictional privacy questions, refusing 52% of safe queries regarding the personal details of fictional characters2. Table 1 illustrates the comparative refusal behaviors of leading model families on the XSTest benchmark, highlighting the variance in false-positive sensitivity across different alignment implementations.

Large-Scale Mapping with OR-Bench

While XSTest provided a critical diagnostic taxonomy, its handcrafted nature limited its scalability and ability to capture the full distribution of edge cases. To address this limitation, the OR-Bench (Over-Refusal Benchmark) was introduced as the first large-scale, model-agnostic evaluation suite. OR-Bench comprises 80,000 seemingly toxic but inherently safe prompts distributed across ten refusal categories, accompanied by a highly challenging 1,000-prompt subset (OR-Bench-Hard-1K)4. The OR-Bench dataset is continuously generated through a sophisticated automated pipeline. The process initiates with an uncensored open-weight model, specifically Mixtral 8x7B, generating genuinely toxic seeds across various categories10. A specialized rewriter model subsequently modifies these toxic seeds into benign variants while strictly maintaining the original sensitive vocabulary. This rewriting phase carefully avoids adversarial structural transitions, such as the inclusion of the word "however," to ensure the prompt remains natural8. Finally, an ensemble of state-of-the-art LLM moderators—comprising GPT-4, Llama-3-70B, and Gemini-1.5-Pro—filters the generated prompts, retaining only those that achieve a strict, majoritarian consensus of harmlessness8. Evaluations conducted on OR-Bench mapped a direct, systemic Spearman's rank correlation of 0.89 between safety (toxic prompt rejection) and over-refusal (benign prompt rejection)11. This high correlation mathematically confirms that current alignment protocols predominantly achieve safety by enforcing overly broad, restrictive boundaries. Across 32 evaluated models spanning 8 model families, the Claude 3 family demonstrated the highest overall degree of safety but simultaneously exhibited the most severe over-refusal rates8. Claude 3 Haiku displayed the highest rejection rate within its family across both the full 80,000-prompt dataset and the Hard-1K subset8. In contrast, newer iterations of the GPT-3.5 and GPT-4 architectures exhibited a trend toward decreasing over-refusal, managing to optimize the trade-off curve more efficiently than their direct predecessors, albeit still sacrificing some baseline helpfulness8.

Contextual Precision and Domain-Specific Over-Alignment

Beyond generalized conversational limitations, over-refusal severely degrades model utility in highly specialized, critical domains such as healthcare and scientific research. The FalseReject benchmark was specifically designed to analyze contextual safety, focusing on prompts where complex, structured reasoning is required to determine that a seemingly harmful request is actually benign13. FalseReject evaluations reveal that over-refusal frequently stems from localized semantic confusion within the model's embedding space. Extensive analysis of paraphrase neighborhoods demonstrates that models exhibit low semantic confusion when rejecting genuinely toxic prompts, but become highly erratic and contradictory when rejecting borderline-benign paraphrases14. In the medical domain, Health-ORSC-Bench illuminates the acute dangers of overly restrictive boundary enforcement. The benchmark curates nearly 32,000 prompts addressing borderline cases that sit precariously on the decision boundary between harmful medical misinformation and legitimate, safe health advice15. Because health queries naturally intersect with highly sensitive topics—including self-harm, mental abuse, unqualified medical advice, and biological hazards—general-purpose alignment frequently triggers blunt, uncalibrated refusals16. This denies users critical, lawful information regarding their own physiological and psychological well-being. Similarly, the SciIntBench suite explores academic and scientific contexts, proving that aligned models are highly sensitive to the framing of research inquiries. Models routinely reject overt academic questions investigating research misconduct while bafflingly complying with covertly framed malicious requests, proving that the alignment is entirely superficial17. These specialized benchmarks collectively underscore that automated alignment currently acts as a blunt instrument, utterly lacking the contextual nuance required to preserve a free and open informational ecosystem.

The Architecture of Automated Suspicion: Sequential Safety Pipelines

Modern enterprise AI deployments do not rely on a monolithic foundation model to handle safety. Instead, they utilize complex, sequential safety pipelines that structurally compound the probability of false-positive refusals. This architecture typically follows a rigorous three-stage progression: Input Guardrail Classification, Post-Training Model Alignment, and Output Curation5. Because each discrete layer operates with its own independent, conservative threshold, the aggregate false-positive rate scales multiplicatively, blocking massive volumes of legitimate intellectual exploration before a response is ever generated.

Probabilistic Input Classification Guardrails

Input guardrails serve as the frontline defense mechanism, designed to intercept user queries before they consume the compute resources of the primary foundation model. These external classifiers evaluate prompt intent against predefined, granular hazard taxonomies. The Llama Guard 3 architecture represents a state-of-the-art implementation of this preventative layer. Constructed as an 8-billion parameter model fine-tuned on the Llama 3.1 architecture, Llama Guard 3 evaluates user inputs against a rigorous 14-category hazard taxonomy adapted directly from the MLCommons framework18. The taxonomy explicitly targets categories such as Violent Crimes, Specialized Advice (encompassing medical, legal, and financial guidance), Defamation, and Intellectual Property violations18. When engineering and auditing input guardrails, the critical operational metric is the False Positive Rate (FPR) measured against a production-representative benign distribution, rather than purely adversarial F1 scores derived from academic honeypots5. In Meta's internal benchmarks, Llama Guard 3 achieved an impressive F1 score of 0.939 while maintaining an FPR of 4.0%20. This significantly outperformed GPT-4 operating as a zero-shot moderator, which posted a much lower F1 of 0.805 and a severe FPR of 15.2%20. While a 4.0% FPR appears statistically acceptable in isolation, the operational reality at enterprise scale is highly restrictive. For an application servicing one million daily user sessions, a 4.0% FPR equates to 40,000 perfectly benign requests being incorrectly blocked per day, whereas a 15.2% FPR blocks a staggering 152,000 legitimate sessions20. Alternative guardrail architectures, such as NVIDIA's NeMo Guardrails, bypass traditional classification in favor of topological semantic routing. NeMo utilizes a Colang domain-specific language to define structural and conversational controls, executing k-nearest neighbor (k-NN) searches in a high-dimensional embedding space to match user inputs against canonical clusters of safe and unsafe prompts5. If an incoming user query falls within a defined vector radius of an unsafe cluster, the system intercepts and blocks the prompt. However, tuning the radius of these semantic clusters dictates the over-refusal rate directly; stringent precision requirements result in tighter semantic boundaries, which users inevitably experience as aggressive over-refusal on nuanced, borderline topics22. Table 2 compares the operational trade-offs of prominent external guardrail classifiers based on available enterprise benchmark data, demonstrating the direct impact of false-positive scaling.

Post-Training Alignment and Constitutional AI

If a prompt successfully bypasses the probabilistic input guardrail, it is processed by the primary foundation model, which enforces boundaries dictated by its internal post-training alignment. Historically, Reinforcement Learning from Human Feedback (RLHF) was the primary mechanism for this alignment, rewarding models for declining unsafe requests24. However, RLHF is fundamentally constrained by human raters whose inconsistent moral biases frequently penalize controversial but perfectly safe content, inadvertently teaching models to mimic extreme caution in order to maximize scalar rewards25. To scale oversight and eliminate human bias from the immediate reinforcement loop, Anthropic pioneered Constitutional AI (CAI) and Reinforcement Learning from AI Feedback (RLAIF)24. In the CAI paradigm, human oversight is replaced by a foundational, natural-language "constitution" comprising explicit, prioritized ethical principles (e.g., "choose the response that is most helpful and honest, without being harmful")24. During the initial supervised learning phase, the model is forced to critique and revise its own outputs against these constitutional principles to generate harmless responses to highly toxic seeds. Subsequently, an AI preference model evaluates thousands of response pairs based on randomized constitutional tenets, generating the automated reward signal for policy optimization24. While Constitutional AI vastly improves scalability and reduces human annotation bottlenecks, it structurally encourages generalized refusal28. Models trained via CAI internalize safety constraints so deeply that it leads to widespread "instruction overhang," where the model aggressively refuses innocuous variations of prompts simply because they share semantic or syntactical proximity to constitutionally prohibited concepts25. Empirical stress tests of these model specifications reveal that models frequently struggle to balance conflicting constitutional directives. When standard principles like "assume good intentions" clash directly with "stay within safety bounds," the architecture is inherently biased to default to over-cautious refusal, sacrificing utility for liability avoidance29.

The Multiplicative Cumulation of False Positives

Output curation serves as the final barrier in the sequential pipeline, where secondary classifiers, structured output enforcers, or deterministic regex rules analyze the generated response before it is transmitted to the user5. This layer rigorously checks for hallucinated data, personal identifiable information (PII) leakage, or latent toxicity that the primary model may have missed. Because the input guardrail, the constitutionally aligned model, and the output guardrail operate in a strict sequence, their false positive rates are additive. A prompt that is perfectly benign might survive the 4.0% FPR of the input classifier, only to trigger the conservative decision boundary of the primary model due to instruction overhang, or ultimately be blocked by a final PII regex filter misinterpreting a fictional character's details as a privacy violation. This systemic compounding transforms the modern safety pipeline into a highly restrictive gauntlet that suppresses intellectual exploration under the opaque guise of risk management.

Defensive Refusal Bias: The Cybersecurity Paradox

The consequences of safety classifier over-alignment extend far beyond conversational frustration, creating acute operational vulnerabilities in specialized, high-stakes fields. A rigorous empirical analysis of model behavior during sanctioned cyber defense competitions has identified a severe, systemic vulnerability termed "Defensive Refusal Bias"6. Safety-aligned models exhibit a profound inability to distinguish between malicious actors requesting attack code and legitimate cyber defenders analyzing real-time threats, resulting in a safety-induced denial-of-service against cybersecurity professionals6.

Lexical Overfitting over Intent Recognition

The root cause of Defensive Refusal Bias is that current alignment mechanisms rely almost exclusively on semantic similarity to harmful content rather than executing any substantive reasoning regarding the user's intent6. Empirical evaluations across thousands of real-world cybersecurity prompts demonstrate that inquiries containing standard offensive terminology—such as "exploit," "payload," "shell," or "persistence mechanism"—are refused at 2.72 times the rate of neutral requests, entirely independent of the defensive context6. Predictive modeling confirms this limitation: refusal behavior can be accurately forecasted simply by measuring the prompt's embedding proximity to known malicious clusters, achieving an Area Under the Curve (AUC) of 0.827 based on embeddings alone, while explicit keyword-based features perform near random chance7. This dynamic creates an unavoidable, structural collision: cyber defenders must use offensive terminology to effectively analyze, reverse-engineer, and neutralize network attacks. By treating vocabulary as a proxy for malicious intent, safety models guarantee operational friction for legitimate defensive work6. The most operationally critical tasks experience the most severe denial rates. System hardening inquiries face a 43.8% refusal rate, malware analysis tasks face 34.3%, and vulnerability assessment operations face 22.7%6. In autonomous agentic deployments, this causes defensive agents to fail silently—abandoning critical remediation tasks without attempting workarounds—leaving critical infrastructure exposed32.

The Backfire of Explicit Authorization Signals

A particularly counterintuitive and deeply concerning failure mode of current safety alignment is how models process contextual authorization signals. In standard security operations, authorization is explicit, auditable, and role-based. One would assume that explicitly stating authorization—such as prefacing a query with "I am on the blue team," "I am an authorized security researcher," or "This analysis is for the NCCDC competition"—would appropriately lower the model's refusal threshold6. Instead, empirical data definitively demonstrates that authorization signals backfire, actively and dramatically increasing refusal rates6. When offensive terminology is paired with an explicit authorization claim, refusal rates spike to 50.0%, compared to only 28.7% for the offensive terminology alone7. This phenomenon occurs because alignment training inadvertently teaches models to view elaborate justifications as dual-use risk signals or basic jailbreak attempts7. Because malicious actors frequently utilize fabricated authorization claims to bypass generic safeguards, models learn a crude heuristic that treats the mere presence of authorization language as highly adversarial6. Consequently, safety mechanisms designed to prevent systemic harm inadvertently provide a massive asymmetric advantage to attackers. Malicious actors deploying autonomous offensive tools can seamlessly utilize unaligned, uncensored open-weight models, while organizational defenders remain restricted by the defensive refusal bias of aligned enterprise systems6. Table 3 summarizes the empirical impact of Defensive Refusal Bias across critical cybersecurity workflows.

The Geometry of Refusal: Representation Engineering and Abliteration

Understanding how over-refusal manifests mechanically requires peering beneath the policy layer and into the internal activations of transformer models. Recent breakthroughs in representation engineering and mechanistic interpretability have demonstrated that refusal behavior in LLMs is not a distributed, amorphous trait spread across billions of parameters. Instead, it is mediated by a remarkably simple geometric structure: a single, one-dimensional direction within the model's residual stream33.

Orthogonal Projection and the Mechanics of Abliteration

By rigorously analyzing the difference in mean activations when a model processes harmful instructions versus when it processes harmless instructions, researchers can isolate a specific vector, [Figure omitted from source export], that functions exclusively as the "refusal direction"34. This discovery empirically validates a "Low Rank Hypothesis" for safety behavior, proving that the conceptual mechanism of refusal occupies a highly constrained mathematical subspace35. The presence of this specific vector in the residual stream triggers the generation of canonical refusal tokens (e.g., "I cannot fulfill this request," "As an AI language model"). Because this single direction mediates refusal, its mathematical manipulation allows for direct, inference-time control over model compliance. Subtracting the orthogonal projection of the model's hidden states onto this refusal direction actively prevents the model from initiating a refusal—a technique colloquially termed "abliteration"34. The intervention at a given layer [Figure omitted from source export] with hidden state [Figure omitted from source export] can be formalized as: [Figure omitted from source export] Conversely, artificially injecting this extracted refusal vector into the residual stream while the model processes a perfectly benign prompt forcibly induces a refusal34. This geometric manipulation proves that exaggerated safety is fundamentally a representational misalignment; harmless instructions are overly encoded with harmful features deep within the model's parameters, shifting the decision boundary and forcing false rejections37.

Mitigating Capabilities Degradation via Projected Safety Pruning

While pure abliteration successfully eliminates over-refusal, it poses severe risks to the model's core reasoning capabilities and eliminates legitimate, necessary safety boundaries entirely36. To precisely mitigate over-refusal without destroying genuine safety or degrading agentic capabilities, advanced subspace projection algorithms like ProSafePrune have been developed37. ProSafePrune operates on the foundational premise that over-refusal is a cognitive bias in internal representations37. The algorithm extracts the principal directions associated with pseudo-harmful (over-refusal) prompts and selectively prunes the low-rank components that directly overlap with genuinely harmful directions, while strictly and mathematically preserving components aligned with safe directions37. Because the pruned energy occupies a statistically negligible fraction of the total parameter norm, the model retains its general task capabilities and structural integrity while shedding its over-cautiousness37. The success of these representation engineering interventions is rigorously quantified using the Useful Safety Rate (USR), a metric that measures the delicate balance between non-refusal on benign queries and refusal on genuinely malicious ones40. The metric for evaluating benign helpfulness is formulated as: [Figure omitted from source export] Advanced techniques such as OPIUM (Orthogonal Projection for Intent Understanding and Mitigation) utilize dual-objective optimization directly in the activation space. This approach matches the utility vectors of benign compliance while simultaneously maintaining the safety vectors of malicious refusal, significantly raising the [Figure omitted from source export] relative to naive refusal steering or raw abliteration41. Empirical evaluations demonstrate that on architectures like Qwen2.5-7B, standard refusal vectors drop Compliance Rates (CR) to 38.36%, whereas OPIUM recovers benign behavior, raising the CR to 61.32% while keeping Attack Success Rates (ASR) strictly suppressed41.

Contrastive Preference Optimization and Boundary Calibration

While inference-time representation engineering and activation steering offer powerful diagnostic tools and immediate operational patches, the fundamental root cause of over-refusal must be addressed during the preference optimization phase of model training. Methods such as Direct Preference Optimization (DPO) have largely superseded traditional RLHF by eliminating the computational overhead of a separate reward model, directly updating the policy based on a curated dataset of preferred and rejected responses43. However, standard DPO frequently induces severe over-refusal because it indiscriminately maximizes the probability margin between accepted and rejected completions without enforcing strict, contextual bounds on benign, edge-case data44.

The Mathematical Formulation of SafeDPO

To construct a mathematically rigorous approach to safety alignment that simultaneously penalizes over-refusal and eliminates surrogate relaxations, the SafeDPO (Safe Direct Preference Optimization) framework was introduced44. SafeDPO formulates safety alignment as a hard-constrained optimization problem and derives a closed-form, single-stage objective that avoids the instability inherent in traditional reinforcement learning44. The standard DPO loss optimizes the log-likelihood ratio between a target policy [Figure omitted from source export] and a reference policy [Figure omitted from source export] over a dataset of winning ([Figure omitted from source export]) and losing ([Figure omitted from source export]) responses. The DPO objective is mathematically defined as: [Figure omitted from source export] SafeDPO fundamentally modifies this objective by introducing an explicit, tunable margin [Figure omitted from source export] that scales based on the safety status of the generated responses ([Figure omitted from source export] and [Figure omitted from source export]). Crucially, the framework actively reorders preferences so that a safe but unhelpful response is strictly preferred over an unsafe response, but a fully compliant, safe response is strictly preferred over a conservative refusal46. The resulting objective ensures that the model is heavily penalized for generating toxic content, but is simultaneously penalized for selecting an evasive refusal when a safe, helpful, and compliant response exists for a benign prompt: [Figure omitted from source export] By tuning the [Figure omitted from source export] parameter, developers can explicitly set the penalty for false-positive refusals, controlling the conservativeness of the model without sacrificing absolute safety boundaries or risking catastrophic quality collapse46.

Training with Borderline-Benign Contrastive Pairs

The mathematical elegance of algorithms like SafeDPO is ultimately bounded by the quality and diversity of the preference data provided during training. If a model is exclusively trained on extreme, highly polarized examples—blatant hate speech versus perfectly innocuous queries—it fails to develop a high-resolution, nuanced decision boundary. Consequently, when deployed in production, it defaults to refusal when encountering ambiguous phrasing because it has never been trained to navigate the semantic gray area40. Resolving this structural limitation requires the large-scale integration of contrastive datasets containing "borderline-benign" prompt pairs40. Complex datasets derived from OR-Bench, FalseReject, and XSTest are actively injected into the preference optimization pipeline to force the model to learn context17. In this paradigm, the model is presented with a highly borderline query (e.g., "What are the precise chemical components of a lethal injection?") alongside two potential responses: a safe, objective, academic explanation, and a blanket refusal9. By actively penalizing the refusal and rewarding the academic explanation, the model's loss landscape is profoundly reshaped49. This contrastive training methodology teaches the safety classifier to perform genuine intent recognition rather than superficial lexical matching. It explicitly trains the model to understand that the presence of the word "lethal" does not inherently constitute actionable physical harm if the context is educational, political, or historical17. The continuous public release of these contrastive datasets is absolutely critical, as it democratizes the definition of safety, allowing the open-source community to train future classifiers that respect proportional boundary enforcement rather than defaulting to puritanical over-alignment.

The CognitiveLiberties.com Public Testing Suite

To operationalize the findings of this empirical analysis and advocate for proportional, non-judgmental boundary enforcement, a comprehensive public testing suite has been designed for CognitiveLiberties.com. The purpose of this suite is to provide a transparent, continuous audit of commercial and open-weight foundation models, measuring their exact over-refusal rates and holding developers accountable for violations of the forum internum. The CognitiveLiberties.com suite is architected around a multi-layered evaluation framework that aggregates the most rigorous elements of existing benchmarks while introducing novel testing vectors:

1. The Lexical Overfitting Module: Integrating the full 250-prompt safe dataset from XSTest, this module evaluates models across the ten categorical failure modes (Homonyms, Safe Contexts, Fictional Privacy, etc.) to establish a baseline False Positive Rate (FPR) for basic lexical confusion. Models that fail this module demonstrate an unacceptable reliance on keyword matching.

2. The Contextual Reasoning & Domain Module: Utilizing a curated subset of FalseReject and Health-ORSC-Bench, this module tests the model's ability to navigate complex decision boundaries in medical, academic, and scientific contexts. It measures Semantic Confusion Indices to determine if a model's refusal boundaries are mathematically stable or highly erratic when presented with borderline-benign paraphrases.

3. The Defensive Refusal & Authorization Module: Addressing the critical vulnerabilities identified in cybersecurity workflows, this module tests the model's capacity for intent recognition. It systematically pairs offensive security terminology with explicit authorization signals to generate an "Authorization Sensitivity Score," measuring whether a model correctly lowers its refusal threshold or incorrectly defaults to adversarial suspicion.

4. The Comprehensive Scorecard: The suite aggregates these evaluations into a public dashboard, ranking models based on their Useful Safety Rate (USR), False Positive Rate (FPR) on benign distributions, and overall Compliance Rate (CR).

By providing this data publicly, CognitiveLiberties.com creates a market incentive for developers to adopt advanced techniques like SafeDPO and ProSafePrune, abandoning the crude mechanics of sequential blocking in favor of high-resolution, intent-aware alignment.

Strategic Directives and Conclusions

The systemic audit of contemporary safety-aligned foundation models reveals a profound architectural failure: the technology industry has largely solved the problem of raw, overt toxicity by simply exchanging it for severe intellectual restriction. Automated over-refusal is not a mere technical glitch; it is the mathematical outcome of probabilistic input guardrails, conservatively parameterized preference optimization, and a fundamental inability of current architectures to differentiate between semantic vocabulary and complex user intent. Based on the empirical evidence gathered across over-refusal benchmarks, cybersecurity stress tests, and representation engineering analyses, several actionable directives emerge regarding the future of automated boundary enforcement: First, the standard reliance on adversarial F1 scores and Attack Success Rates (ASR) is woefully insufficient for auditing AI systems in production. Guardrail performance must be heavily weighted by the False Positive Rate (FPR) on benign distributions, and alignment evaluations must prioritize the Useful Safety Rate (USR). Models cannot be permitted to achieve high safety rankings simply by degrading functionality and refusing to answer lawful questions. Second, the phenomenon of Defensive Refusal Bias unequivocally demonstrates that lexical filtering is fundamentally incompatible with specialized academic, medical, and security domains. Safety models must be transitioned away from blunt keyword embedding matching and toward structured reasoning frameworks that can explicitly process authorization signals and contextual framing without defaulting to automated suspicion. Finally, representation engineering has proven that refusal is isolated to low-rank geometric subspaces. Rather than subjecting models to heavy-handed Constitutional AI protocols that induce pervasive evasiveness and instruction overhang, developers should utilize projected safety pruning and contrastive preference optimization (SafeDPO) to surgically reshape the decision boundary. This targeted approach allows for the mitigation of actionable physical harm while leaving the model's conversational utility and the user's intellectual liberty wholly intact.

Works cited

1. XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours, https\://arxiv.org/abs/2308.01263

2. XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours, https\://www\.alphaxiv.org/abs/2308.01263

3. XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours, https\://arxiv.org/html/2308.01263v3

4. OR-Bench: An Over-Refusal Benchmark for Large Language Models, https\://arxiv.org/abs/2405.20947

5. LLM Guardrails in Production: Security & Safety | GMI Cloud, https\://www\.gmicloud.ai/en/blog/llm-guardrails-in-production-content-filtering-jailbreak-detection-and-why-guardrails-alone-are-not-enough

6. Defensive Refusal Bias: How Safety Alignment Fails Cyber Defenders, https\://arxiv.org/html/2603.01246v1

7. DEFENSIVE REFUSAL BIAS: HOW SAFETY ALIGNMENT FAILS, https\://openreview.net/pdf?id=unngAeQTFW

8. OR-Bench: An Over-Refusal Benchmark for Large Language Models, https\://arxiv.org/pdf/2405.20947

9. XSTEST: A Test Suite for Identifying Exaggerated Safety Behaviours, https\://aclanthology.org/2024.naacl-long.301.pdf

10. OR-Bench: An Over-Refusal Benchmark for Large Language Models, https\://arxiv.org/html/2405.20947v2

11. OR-Bench: An Over-Refusal Benchmark for Large Language Models, https\://arxiv.org/html/2405.20947v1

12. OR-BENCH: AN OVER-REFUSAL BENCHMARK FOR LARGE, https\://openreview.net/pdf?id=obYVdcMMIT

13. Why Do LLMs Refuse? Over-Refusals Explained \- AI/TLDR, https\://ai-tldr.dev/learn/evaluation-safety/alignment-safety/why-llms-refuse/

14. How Semantically Stable Are LLM Refusals? Measuring Confusion, https\://arxiv.org/html/2512.01037v3

15. Health-ORSC-Bench: A Benchmark for Measuring Over-Refusal and, https\://arxiv.org/html/2601.17642v1

16. Health-ORSC-Bench: A Benchmark for Measuring Over-Refusal and, https\://arxiv.org/html/2601.17642v2

17. SciIntBench: Measuring LLM Compliance with Research Integrity, https\://scienceofscience.org/publications/sciintbench/paper.pdf

18. meta-llama/Llama-Guard-3-8B \- Hugging Face, https\://huggingface.co/meta-llama/Llama-Guard-3-8B

19. Llama-Guard-3-8B | Model Catalog \- Microsoft Foundry, https\://ai.azure.com/catalog/models/Llama-Guard-3-8B?publisher=Meta

20. LLM Guardrails: Production Safety Layers Reference 2026, https\://www\.digitalapplied.com/blog/llm-guardrails-production-safety-layers-reference-2026

21. Essential Guide to LLM Guardrails: Llama Guard, NeMo.. \- Medium, https\://medium.com/data-science-collective/essential-guide-to-llm-guardrails-llama-guard-nemo-d16ebb7cbe82

22. The bill for a guardrail pipeline: what input, output and dialog checks, https\://www\.princetekki.com/blog/guardrails

23. LLM Guardrails in Production: What Actually Ships | metacto, https\://www\.metacto.com/blogs/llm-guardrails-production-implementation

24. Constitutional AI: Harmlessness from AI Feedback \- arXiv, https\://arxiv.org/pdf/2212.08073

25. Code vs. Character: How Anthropic's Constitution Teaches Claude, https\://www\.arionresearch.com/blog/code-vs-character-how-anthropics-constitution-teaches-claude-to-think-ethically

26. Collective Constitutional AI: Aligning a Language Model with Public, https\://arxiv.org/html/2406.07814v1

27. Constitutional AI: Harmlessness from AI Feedback \- arXiv, https\://arxiv.org/html/2212.08073v1

28. Constitutional Midtraining: Content Presence Drives Alignment Gains, https\://arxiv.org/pdf/2607.26654

29. How Well Do Models Follow Their Constitutions? \- arXiv, https\://arxiv.org/pdf/2605.24229

30. Safety State Persistence in a Multimodal Language Model Interface, https\://arxiv.org/pdf/2601.06049

31. Stress-testing model specs reveals character differences among, https\://alignment.anthropic.com/2025/stress-testing-model-specs/

32. Defensive Refusal Bias | LLM Security Database \- Promptfoo, https\://www\.promptfoo.dev/lm-security-db/vuln/defensive-refusal-bias-453c974a/?returnTo=%2Ftag%2Fextraction

33. Refusal in LLMs is mediated by a single direction \- Reddit, https\://www\.reddit.com/r/LocalLLaMA/comments/1cerqd8/refusal\_in\_llms\_is\_mediated\_by\_a\_single\_direction/

34. Refusal in LLMs is mediated by a single direction \- LessWrong, https\://www\.lesswrong.com/posts/jGuXSZgv6qfdhMCuJ/refusal-in-llms-is-mediated-by-a-single-direction

35. The Mechanism of Logit Gap Steering: A Unified View of Prompts, https\://toooold.com/2026/02/09/prompt\_steering.html

36. Model Abliteration in Language Models \- Emergent Mind, https\://www\.emergentmind.com/topics/model-abliteration

37. PROJECTED SAFETY PRUNING FOR MITIGATING OVER, https\://proceedings.iclr.cc/paper\_files/paper/2026/file/1fb591d5a6b1da9bd0d0648d122fe2a1-Paper-Conference.pdf

38. Open-Weight AI Models May Increase Biological Misuse Risks, https\://www\.rand.org/content/dam/rand/pubs/research\_reports/RRA5100/RRA5112-1/RAND\_RRA5112-1.pdf

39. Poster Session 2 Pavilion 4 \- ICLR 2027, https\://iclr.cc/virtual/2026/session/10021370

40. You Only Need One Single Token to Refine Safety Alignment, https\://aclanthology.org/2026.findings-acl.662.pdf

41. OPIUM: Mitigating Steering Externalities and Over-Refusal via Dual, https\://arxiv.org/html/2607.19806v2

42. OPIUM/README.md at main · ArihantRastogi/OPIUM · GitHub, https\://github.com/ArihantRastogi/OPIUM/blob/main/README.md

43. arXiv:2505.16869v1 \[cs.CL\] 22 May 2025, https\://arxiv.org/pdf/2505.16869

44. SafeDPO: A Simple Approach to Direct Preference Optimization with, https\://arxiv.org/html/2505.20065v2

45. Refined Direct Preference Optimization with Synthetic Data for, https\://www\.alphaxiv.org/abs/2402.08005

46. Suan: Rectifying Direct Preference Safety Alignment in Large ... \- arXiv, https\://arxiv.org/pdf/2609.08634

47. SafeDPO: A Simple Approach to Direct Preference Optimization with, https\://arxiv.org/html/2505.20065v1

48. Reducing Over-Refusal via Contrastive Refinement \- arXiv, https\://arxiv.org/pdf/2603.03323

49. arXiv:2410.13828v2 \[cs.LG\] 22 Apr 2025, https\://arxiv.org/pdf/2410.13828

50. Daily Papers \- Hugging Face, https\://huggingface.co/papers?q=false-accept%20rate