LLM Safety Training Backfires: New Method Fixes Over-Refusal While Keeping Systems Secure

Large language models trained to resist jailbreak attacks often become overly cautious, refusing to answer perfectly legitimate questions. A new study from arXiv researchers digs into why this happens and offers a solution that balances security with usability.

The Over-Refusal Problem#

When researchers add safety defenses to LLMs, the models learn to block harmful requests—but they frequently overshoot. They end up rejecting benign queries too, making the systems less helpful and frustrating to use. This "over-refusal" undermines the practical reliability of AI assistants in real-world applications, even as their safety mechanisms improve.

Why Models Can't Tell the Difference#

The research team analyzed the problem at a deeper level: in the internal representations that LLMs use to process language, the models struggle to distinguish between harmful requests and innocent ones that merely resemble them. Both types activate similar neural patterns, so the model's safety filters fire indiscriminately.

A Two-Part Solution#

To fix this, the researchers propose intervening directly in how LLMs represent safety decisions:

• OverlapAware Loss Weighting: By measuring how similar over-refusal samples are to genuinely malicious ones in the model's internal representation space, the method calibrates which training signals matter most, reducing false alarms.

• ContextAware Augmentation: The technique adds helpful context before rejection responses—essentially supplying the model with better reasoning for when to refuse and when to proceed.

Better Trade-offs Ahead#

Experiments show the approach achieves a meaningful improvement over existing defenses, delivering stronger protection against jailbreaks while restoring responsiveness to legitimate requests. The authors argue that future safety research must evaluate defensive methods on both fronts: how well they prevent attacks and how often they misfire on harmless input.