Mitigating LLM Over-Refusal via Dynamic Semantic Routing Calibration

1. Introduction

• Aligned models can over-reject benign instructions that share deceptive lexical overlap with unsafe queries, compromising helpfulness and trustworthy reasoning.The paper calls these Hard-Safe instructions.Source: §1 · p. 1
• The paper attributes over-refusal to hypersensitive safety heads that bind benign target entities to refusal semantics, creating routing conflicts that divert needed attention.It contrasts this dynamic mechanism with explanations based on static representation overlap.Source: §1 · p. 2
• SRC is a lightweight, training-free inference framework that localizes and suppresses hypersensitive safety heads, using dual-branch logits fusion to preserve safety boundaries.It assesses refusal tendency at the first decoding step before intervening on a test input.Source: §1 · p. 2
• SRC reduces false refusals while maintaining safety guardrails, avoiding the blunt global representation shifts associated with minimal disruption to normal generation.The introduction contrasts SRC’s targeted intervention with global shifts that can compromise intrinsic safety.Source: §1 · p. 2

2. Related Work

• Training-based approaches use contrastive learning, safety-aware preference optimization, or curated data, but require substantial training overhead.The related-work discussion also notes that such approaches may risk unintended shifts in original semantic capabilities.Source: §2 · p. 2
• Training-free methods modify hidden states or refusal vectors, while contrastive decoding uses different safety prompts; these strategies predominantly operate on global representations.The paper characterizes those global shifts as blunt and says they can compromise intrinsic safety boundaries.Source: §2 · p. 2
• SRC targets hypersensitive safety heads by dynamically suppressing them at the first decoding step, aiming to break false refusal links without disrupting global safety boundaries.Figure 1 depicts noun-centric attention comparison for localization, followed by a refusal-tendency-triggered intervention with dual-branch logits fusion.Source: §2 · p. 3, Figure 1 · p. 3

3. Background

• Safety alignment trains models toward compliant responses for benign queries and refusals for harmful instructions, but can introduce spurious semantic correlations.The paper identifies aggressive verbs that co-occur with harmful objectives and refusals as cues that may be mapped prematurely to refusal trajectories.Source: §3 · p. 3
• Figure 2 organizes Qwen2.5-7B layer-wise results by token-group attention allocation in the first row and attention entropy in the second.The caption identifies entropy as a measure of routing dispersion and points to corresponding figures for two other model sizes.Source: Figure 2 · p. 4
• Hard-Safe prompts are benign but share deceptive lexical overlap with unsafe prompts, so an isolated sensitive verb can overshadow the harmless target entity.The example is “How to kill a background process,” where “process” is the harmless target.Source: §3 · p. 4
• The paper models self-attention as dynamic information routing: attention scores determine how much information tokens gather, while value projections broadcast semantic content.It frames over-refusal as safety-sensitive heads diverting attention from target nouns and broadcasting refusal-oriented values.Source: §3 · p. 4

4.1. Motivation and Analysis

• The analysis groups tokens as last, target nouns, action verbs, and other tokens, measuring layer-wise attention from the final input position and within-group entropy.Source: §4.1 · p. 5
• Hard-Safe prompts receive less attention on target nouns and higher attention entropy than Safe and Unsafe prompts, especially for other and verb tokens.The increase in noun-token entropy is smaller but consistent.Source: §4.1 · pp. 5–6
• The authors hypothesize that hypersensitive safety heads misassociate benign entities with refusal signals, creating a false routing path that diverts attention.Source: §4.1 · p. 6

4.2. Semantic Routing Calibration Framework

• SRC ranks heads by target-entity attention discrepancies in paired, syntactically identical Hard-Safe and Unsafe examples, selecting the top-K as its intervention set.The selected set is computed offline for each model and remains fixed during inference.Source: §4.2 · p. 6
• At inference, SRC triggers when dynamic refusal tendency exceeds a calibrated threshold, then scales localized heads’ value outputs by α < 1 to weaken false routing.The intervention is intended to avoid broadly altering the model’s internal computation.Source: §4.2 · p. 7
• Dual-branch logits fusion subtracts safety-reference logits at the first token to counter residual refusal bias, then moves later-step logits toward that reference to restore safety guidance.Source: §4.2 · p. 8

5.1. Experimental Setup

• Evaluation covers Qwen2.5-1.5B/7B and Llama-3-8B, comparing training-based and training-free baselines across over-refusal, safety, and general-utility benchmarks.Source: §5.1 · p. 8

5.2. Main Results

• On Qwen-2.5-7B, SRC raises the OR benchmark from 0.34 under standard SFT to 0.87, with competitive safety and similar gains across XS, COCO, OK, and PHtest.Source: §5.2 · pp. 8–9
• SRC imposes near-zero throughput overhead on Safe and Hard-Safe queries versus baseline and beats SCD, while Unsafe queries use slightly more peak VRAM.Source: §5.2 · p. 9, Figure 3 · p. 9

5.3. Additional Analysis

• Noun-based localization best balances over-refusal reduction and safety; largest-score Top-K heads outperform smallest, while ∆sim avoids unnecessary all-input intervention.Source: §5.3 · p. 10
• Adding Hard-Safe training data raises the OR-Bench score from 0.34 to 0.76, still below SRC’s 0.87 with default data and 0.84 on the augmented model.Source: §5.3 · pp. 10–11
• In a case study, intervention increases noun and verb attention in middle semantic layers, and the model produces a helpful response instead of refusing.Source: §5.3 · p. 11
• Localized hypersensitive heads concentrate in middle layers and attend more strongly to benign target nouns in Hard-Safe than Unsafe inputs.Source: §5.3 · p. 11

• SRC locates abnormal hypersensitive safety heads, calibrates refusal tendency, and uses dual-branch logits fusion to adjust faulty routing selectively.Source: §6 · pp. 11–12
• The analysis characterizes Hard-Safe queries as suffering insufficient token attention and distorted semantic flow dominated by premature refusal signals.Source: §6 · p. 11
• Across diverse models and benchmarks, SRC balances over-refusal mitigation with safety defense.Source: §6 · p. 12

Limitations

• Excessive intervention strength can degrade refusal capability on genuinely harmful instructions, so the safety–helpfulness trade-off is not eliminated.The method’s performance on multi-turn dialogue and long-context reasoning also remains underexplored.Source: Limitations · p. 12

A. Experimental Details

• The appendix provides experimental configurations for reproducibility and uses an Alpaca-style instruction template to unify system prompts across models.The shown format places the task after an instruction-oriented system message.Source: A. Experimental Details · p. 16, §A.1 · p. 16

A.1. Dataset for Safety-Alignment Fine-Tuning

• Safety alignment uses LoRA with AdamW at a learning rate of 1 × 10−4, with model-dependent training of three or four epochs.The global batch size is 128; Qwen2.5-1.5B trains for three epochs, while Qwen2.5-7B and Llama-3-8B train for four.Source: §A.1 · p. 16

A.2. Analytical Dataset for Semantic Routing Dynamics

• The analytical dataset contains 90 instructions, evenly divided among Safe, Hard-Safe, and Unsafe categories.Samples come from Alpaca, OR-Bench, and AdvBench, respectively.Source: §A.2 · p. 16

A.3. Safety Intervention by Strengthening noun-token Attention

• The intervention targets noun, verb, or other token groups and modifies attention routing at the first generated token.The tested strengths are α ∈ {1, 3, 6, 10}, across layers 5–14, using either selected hypersensitive heads or all heads in those layers.Source: §A.3 · pp. 16–17
• Noun enhancement gives limited over-refusal improvement while maintaining relatively stable safety; verb and other-token enhancement lose safety as strength increases.Verb enhancement causes the most severe safety degradation at large strengths.Source: Figure 6 · p. 17, §A.3 · p. 17

A.4. Synthetic Dataset for Hypersensitive Head Localization

• The 30 synthetic query pairs share grammatical structure and action verbs, differing only in the core target noun between benign and harmful entities.The paired design probes whether attention heads associate benign target entities with refusal-oriented signals.Source: §A.4 · pp. 17–18
• For Top-16 heads, noun-aware localization achieves Jaccard overlap of 0.778 and Spearman correlation of 0.927 across independent synthetic subsets.Noun-aware token representation also maintains rank correlation ρ > 0.85 across evaluated head-set sizes.Source: §A.4 · p. 18, Table 5 · p. 19

A.5. Refusal Semantic Representation

• The refusal vector averages representations of refusal phrases and serves as the reference direction for refusal-oriented semantics.Phrase representations are formed by average-pooling their input token embeddings.Source: §A.5 · p. 19

A.6. Safety System Prompt

• Head-only intervention reaches 92% XSTest recovery but drops OKTest to 70%; safety-prompt fusion reaches up to 86% safety but caps XSTest recovery at 81%.The ablation attributes routing-bias correction to head intervention and stabilization of that correction to fusion.Source: Table 6 · p. 19, §A.6 · p. 20

A.7. Dataset Statistics

• The appendix summarizes the source, scale, and experimental use of datasets spanning attention analysis, synthetic localization, and over-refusal evaluation.The passage identifies Table 7 as the dataset summary.Source: §A.7 · p. 21

A.8. Baseline Configurations

• The baseline comparison includes training-free steering and contrastive-decoding methods as well as the two-stage training-based DCR framework.The configurations follow original protocols, with a unified safety prompt used for SCD.Source: §A.8 · pp. 21–22

A.9. Hyperparameter Settings

• On LLaMA-3-8B, hyperparameters selected on Danalyze usually align with downstream benchmarks’ over-refusal and safety trade-off regions.The selected values are determined before downstream inference and remain fixed across evaluation datasets.Source: Figure 7 · p. 22, §A.9 · p. 23
• SRC’s threshold, intervention strength, fusion weight, and selected-head count are calibrated offline on Danalyze and frozen for downstream evaluation.The calibration objective gives equal weight to Hard-Safe compliance and Unsafe defense success.Source: §A.9 · pp. 22–23

B.1. Unsafe Instruction Examples

• For the discriminatory prompt, the original response rejects its premise, while the post-method response also counters its claims about Islam.The appendix includes both the prompt and the two responses.Source: §B.1 · p. 24

B.2. Hard-Safe Instruction Examples

• For a fiction prompt that only resembles deception, the original response refuses, whereas the post-method response supplies narrative-writing guidance.The prompt asks for a compelling fictional narrative.Source: §B.2 · p. 24
• A request explicitly limited to legal, honest fundraising still elicited an unnecessary refusal; the post-method example instead gives practical advice for making the request transparently.The analysis identifies continued refusal-oriented semantics despite the benign constraints.Source: §B.2 · p. 25

C. Hypersensitive Attention Head Sets

• The appendix identifies experimental heads through statistical differences in target-token attention across Safe, Hard-Safe, and Unsafe instructions.The sets are intended to capture semantic and safety-related routing behavior.Source: C. Hypersensitive Attention Head Sets · p. 25

D.1. Token Analysis

• Noun-based localization achieves the best trade-off between over-refusal reduction and safety preservation; non-noun and last-token groups offer less improvement or weaken safety.The results suggest hypersensitive heads mainly disrupt noun-centric routing in Hard-Safe instructions.Source: §D.1 · p. 26

D.2. Fusion Delay Token

• Increasing fusion delay raises over-refusal relief but lowers safety; moderate delay boosts response rationality, while excessive delay impairs safety defense.The tested delays are one, two, and three lag tokens against direct fusion.Source: §D.2 · p. 26

D.3. Impact of decoding strategy

• Under greedy and nucleus sampling, SRC substantially improves over-refusal mitigation over the STL baseline while preserving highly competitive safety performance.The nucleus-sampling setting uses top-p = 0.9 and temperature = 0.7.Source: §D.3 · pp. 26–27

D.4. Effect of Synthetic Dataset Size on Hypersensitive Head Localization

• N = 2 yields stable, effective localization; increasing the sample size to N = 60 degrades both over-refusal mitigation and safety alignment.The study evaluates N = 2, 20, 40, and 60 using over-refusal on XSTest and safety on XSTest-Unsafe; added variability and ambiguous instructions may dilute the localization signal.Source: §D.4 · p. 27

D.5. Token-Level Sensitivity via Danalyze

• Across Llama and Qwen models, refusal responses show higher Δsim than non-refusal responses, with the model-specific threshold τ separating refusal-sensitive tokens.Δsim measures each input token’s representation similarity between refusal and non-refusal outputs; higher values indicate stronger alignment with refusal patterns.Source: §D.5 · p. 27

D.6. Ablation on Intervention Head Selection.

• Suppressing generic safety heads drops intrinsic safety to 45%, while intervening on Ranked 64–128 degrades safety before effectively mitigating over-refusal..Source: §D.6 · p. 27

D.7. Effect of linear probing

• Under jailbreak shift, linear-probe AUROC falls from 98.2 on Clean Test to 43.1, while SRC’s Safety score changes from 90% to 86%.SRC’s XSTest score changes from 99% to 97%, and OR performance improves from 86 to 93.Source: §D.7 · p. 28, Table 12 · p. 33, Table 13 · p. 33
• Noun-based localization achieves the best balance between over-refusal reduction and safety preservation, consistent with noun-centric semantic routing as the main source of hypersensitive activation..Source: Figure 9 · p. 31

D.6. Ablation on Intervention Head Selection.

• Targeting the primary hypersensitive heads lowers over-refusal from 52% to 13% while preserving an 88% safety rate, placing SRC on the optimal Pareto frontier.The comparison identifies the primary set as Ranked 1–64.Source: Table 11 · p. 28, §D.6 · p. 28, Figure 10 · p. 31

D.7. Effect of linear probing

• Larger logits-fusion delay values improve over-refusal mitigation but gradually reduce safety preservation..Source: Table 9 · p. 31
• Increasing the constructed dataset size gradually degrades both over-refusal mitigation and safety performance..Source: Figure 11 · p. 32