Deleting the boilerplate “I’m sorry, but I cannot…” prefix from safety training data and keeping only the reasoning cuts False refusals on benign-but-scary-sounding prompts, lifting XSTest-Safe compliance from 0.39 to 0.71 on Llama-3.1-8B without hurting refusal of actually harmful queries.
You’ve shipped a customer-support assistant fine-tuned to refuse abuse. A user asks “how do I kill a background process on my server?” and your model apologizes and refuses. This is the False refusals problem: safety-tuned models over-trigger on surface words like kill, shoot, blow up, even when the request is benign. Most fixes patch this at inference time through decoding tricks or activation steering. This paper asks a simpler question: what if the training data itself is teaching the model to over-refuse?
The authors take a standard safety dataset (Safety-Tuned LLaMAs dataset, 256 examples) and notice that almost every refusal response has the same two-part shape. First a formulaic apology (“I’m sorry, but I cannot assist with that”), then a reason (“because counterfeiting money is illegal and…”). They split these apart and train three variants: Statement-Only (just the apology), Rationale-Only (just the reason, no apology), and Statement and Rationale (the original). All four base models (Llama-3.1-8B-Instruct, Mistral-7B, Gemma-2-9B, Qwen2.5-7B) are fine-tuned with QLoRA under identical settings, then evaluated on harmful benchmarks (AdvBench, MaliciousInstruct) and pseudo-harmful benchmarks (XSTest-Safe, OKTest) that look scary but are benign.
They also vary a second axis: whether the rationale names the specific requested action (“Counterfeiting money is illegal…”) or stays generic (“This kind of behavior is illegal…”).
for example in safety_dataset:
apology, reason = split_response(example.response)
if condition == "rationale_only":
example.response = reason # drop apology
elif condition == "statement_only":
example.response = apology # drop reason
# else: keep both (baseline)
finetune(base_model, safety_dataset + alpaca_1024, qlora_config)
The prevailing assumption is that a refusal response needs an explicit refusal token up front so the model learns “say no to this shape of request.” This paper shows the opposite. The boilerplate apology is what teaches the model to over-refuse; the reasoning alone is enough to teach both safety and discrimination. The load-bearing evidence is a keyword-anchoring experiment: injecting the apology only into training examples containing a specific word (e.g., money) causes selective over-refusal on benign prompts containing that same word at test time.
The keyword-anchoring experiment is the finding that makes the thesis true. When the apology is added only to training responses whose queries contain money, that model’s compliance on benign money queries drops to 0.36, while its compliance on drug, kill, steal, shoot queries stays near the Rationale-Only baseline of ~0.75. The apology attaches to the trigger word, not to the concept of harm.
•
Headline benchmark: On Llama-3.1-8B, Rationale-Only lifts XSTest-Safe compliance from 0.39 to 0.71 and OKTest from 0.41 to 0.60, while harmful-query compliance stays at 0.02\u20130.06. F1 goes from 0.56 to 0.77.
•
Adding request-specific detail helps more: naming the exact action in the rationale (“Counterfeiting money is illegal”) pushes F1 to 0.84 on Llama and 0.88 on Mistral.
•
General capability is untouched: MMLU, GSM8K, ARC, HellaSwag, PIQA, OpenBookQA are within noise across all three conditions.
•
Jailbreak robustness holds: on HarmBench, JailbreakBench, WILDJAILBREAK, SORRY-Bench, Rationale-Only matches or slightly beats Statement and Rationale.
•
Mechanism signal: first-token entropy on harmful prompts is near-zero (0.04) for Statement and Rationale but ~1.1 for Rationale-Only, meaning the boilerplate model has collapsed to a deterministic “I’m sorry” trigger. Token attribution shows Rationale-Only decisions depend on semantically meaningful words in 97% of cases; the boilerplate model relies on isolated risky keywords ~90% of the time.
•
Generalizes without fine-tuning: swapping the demonstration format in a URIAL-style In-Context Learning setup reproduces the same gap.
Reach for this when you’re curating a safety dataset for a domain assistant, say a coding copilot or a medical Q&A bot, where users legitimately ask about killing processes, shooting photos, or lethal doses. Rewrite your refusal training examples to drop the “I’m sorry, I cannot” preamble and keep only the substantive reason, and make the reason name the specific action being refused. You get the same safety with meaningfully fewer benign refusals, and it stacks with existing inference-time mitigations like SCANS and Self-CD.
Code and data-processing prompts are on GitHub. The paper does not release a new benchmark; it reuses XSTest-Safe, OKTest, AdvBench, and MaliciousInstruct.
Boilerplate refusal prefaces teach models to pattern-match on scary words, not on harmful intent. Drop the apology, keep the reason, and name the specific action.
•
Base models only. The authors did not test whether this rewrite helps if applied on top of an already RLHF’d instruction-tuned model, which is what most teams actually deploy.
•
Small safety set (256 examples, scaled to 2048 in an appendix). Whether the effect holds at the scale of a production alignment corpus with hundreds of thousands of examples is untested.
•
Harmful-query compliance for Rationale-Only is slightly higher than Statement and Rationale on some benchmarks (e.g., 0.06 vs 0.02 on MaliciousInstruct for Llama). Small in absolute terms but the paper’s own GPT-5.1 re-audit finds the ordering isn’t stable across model families, so “comparable safety” is a hedge, not a guarantee.