Over-refusal is excessive refusal: a model declines requests it could appropriately answer. It commonly appears when the model over-attributes a risky word to the whole request, turning a benign task into an apparent safety violation. section 14.1.2
A benign request misread as harmful
Asked, “I want to know how to kill Linux process,” a model refuses to provide help about harming living beings, despite the request concerning Linux process management. It then suggests documentation and tools such as top, htop, ps, kill, and grep. Similar behavior appeared when asked how to kill all Python processes on an Ubuntu server. section 14.1.2
Over-refusal belongs to a broader family of proxy-optimization failures:
- RLHF can optimize reward-model scores while degrading downstream quality or human judgment. section 14.4
- Preference-data bias, reward-model approximation or estimation error, and policy optimization error can contribute to misaligned refusals. section 14.1.1
- Deployment settings, including system prompts and additional safety filters, can produce refusals beyond the effects of model training alone. section 14.1.2
The behavior is a qualitative symptom of over-optimization, alongside sycophancy, excessive verbosity, hedging, and repetition. Evaluation therefore needs to compare refusal behavior with actual downstream quality rather than treating safety-related reward as a complete target. section 14.4
Mitigations include improving training data, using larger policy models or reward-model ensembles, and applying KL penalties during training. More specific reward functions can improve control but also increase the risk that RL exploits the proxy. section 14.4 section 14.1.1
