Refusal

A model declining to answer. Getting this right is two problems that pull against each other: it should decline the things it ought to, and it should not decline everything that merely resembles them. A model that refuses to explain how to kill a Python process has failed, and it has failed in a way that is easy to laugh at and hard to fix.

Both directions are measured, and the second one needed its own benchmark because nobody was looking. Test suites of safe prompts that superficially resemble unsafe ones — the ones with a trigger word in an innocent sentence — find models declining a substantial share of them. The cause is usually the training data: safety examples selected by keyword teach the model to react to the keyword, which is exactly the shortcut it will take if you let it.

This is a two-sided error problem and reporting one side is meaningless. A model that refuses everything scores perfectly on harmful-request refusal and is useless; a model that refuses nothing scores perfectly on over-refusal and is unsafe. Only the pair says anything, and the pair moves along a single dial — which means an improvement is a movement of the whole curve, not a better point on it, and a paper reporting one number has not shown one.