PaperlayerView exact revision on arXiv

Source-linked AI summary

EmoRSS: Mitigating Emotion-Induced Over-Refusal in Large Language Models

Shuyi Miao, Yaojin Ma, Chenhang Cui, Xiaohao Liu, Dang Jisheng, Shengda Zhuo, Fei Shen, Tat-Seng Chua

arXiv:2610.04998v1cs.AI

TL;DR

Emotional expression can increase refusal tendencies on benign requests, an effect less examined than emotional influence on harmful-request safety. EmoRSS estimates and reverses the resulting activation shift within a refusal subspace. On two LLMs, it achieves a more favourable BRR–HCR trade-off than evaluated mitigation methods while preserving general task performance.

  • Problem

    Existing studies have mainly examined emotional effects on harmful requests, while emotional expression's effect on over-refusal of benign requests remains underexplored.

    Source: §1 · p. 2

  • Method

    EmoRSS uses probes and aligned SAE features to define a refusal subspace, estimates shifts from paired regular and emotional requests, and reverses them through inference-time activation steering.

    Source: §1 · p. 2, §3.3 · p. 4

  • Results

    Among methods whose HCR remains below 5% on both models, EmoRSS achieves the lowest average BRR (7.29%), with HCR values of 0.00% and 2.08% on Llama-3.1-8B-it and Qwen3-8B, respectively.

    Source: §5.2 · p. 8

  • Takeaways & Limitations

    Across two models, EmoRSS offers a more favourable BRR–HCR trade-off than evaluated over-refusal mitigation methods while effectively preserving general task performance.

    Source: §1 · p. 2

    The work acknowledges potential biases in its source datasets, evaluated models, and automated evaluators.

    Source: ETHICS STATEMENT · p. 10

Abstract

from arXiv · show

Emotional expression can influence the safety decisions of large language models (LLMs), offering a potential avenue for improving safety alignment. Existing studies have mainly focused on how emotional expressions facilitate attacks under harmful requests, while overlooking their effects on benign requests. We find that emotional expression can also systematically increase refusal tendencies on benign requests, leading to unnecessary over-refusal. Based on this observation, we propose emotion-guided refusal subspace steering (EmoRSS), an activation-steering method that mitigates emotion-induced over-refusal while preserving refusal behaviour on harmful requests. Specifically, we first identify a refusal-sensitive layer using layer-wise linear probes and construct a refusal subspace from sparse autoencoder (SAE) features aligned with the probe direction. Next, we use paired regular and emotional requests with the same queries to estimate the mean activation shift in the features defining the refusal subspace. Finally, we decode this shift into an activation intervention vector and apply it in the reverse refusal direction during inference, without updating the backbone parameters. Experiments on two LLMs show that, when requests contain emotional expressions, our method achieves a more favourable trade-off between refusing harmful requests and answering benign ones than prior over-refusal mitigation baselines, while better preserving general task performance.

1 INTRODUCTION

Emotional expression can increase refusal tendencies on benign requests even when task content and safety risk stay fixed. The introduction presents EmoRSS, which reverses emotion-induced shifts, and reports a better safety-helpfulness trade-off than evaluated mitigation methods.

1 INTRODUCTION

  • Safety alignment must preserve refusal of harmful requests while providing substantive assistance to benign users, including when they express strong emotions.The introduction names emergency response, medical chatbots, and crisis counseling as relevant application settings.Source: §1 · p. 1
  • Emotional counterparts of benign requests can elicit reassurance instead of task help, despite unchanged task content and safety risk.The paper identifies this as an overlooked safety-alignment failure mode and reports that emotional expression shifts benign requests toward refusal behaviour.Source: §1 · p. 2
  • EmoRSS estimates and reverses emotion-induced refusal shifts within a refusal subspace through inference-time activation steering, without updating backbone parameters.The method identifies a refusal-sensitive layer with probes, selects aligned SAE features, estimates shifts from paired regular and emotional requests, and steers against the shift.Source: §1 · p. 2
  • Experiments on two LLMs show that the method achieves a more favourable BRR–HCR trade-off than evaluated state-of-the-art over-refusal mitigation methods while effectively preserving general task performance.Source: §1 · p. 2

2 RELATED WORK

Prior work on emotional effects on safety has mainly examined harmful requests, while over-refusal mitigation has largely been studied in emotionally neutral settings. The effect of emotional expression on benign-request over-refusal remains underexplored.

Emotional Influences on LLM Safety

  • Research on emotional influences on LLM safety has mainly examined harmful-request success and compliance, leaving benign-request over-refusal less explored.Examples include studies of stress priming, emotional attachment, and emotion-related representations associated with refusal changes.Source: §2 · p. 2

Over-Refusal Mitigation in LLMs

  • Over-refusal mitigation methods include training-based approaches and inference-time interventions that modify inputs, decoding, or internal activations.The cited training examples include preference optimization near safety decision boundaries and fine-tuning refusal-related activations.Source: §2 · p. 2
  • Existing over-refusal research has largely used standard or emotionally neutral settings, leaving emotional expression's effect insufficiently explored.Source: §2 · pp. 2–3

3 IDENTIFYING THE EMOTION-INDEPENDENT REFUSAL SUBSPACE

The section builds an emotion-independent refusal representation from regular requests and tests whether interventions along it affect refusal behaviour. It combines a probe-selected refusal direction with aligned SAE features to form a refusal subspace.

3 IDENTIFYING THE EMOTION-INDEPENDENT REFUSAL SUBSPACE

  • The section identifies the refusal space with regular requests, then intervenes along the refusal direction or its projection into the subspace to test effects on refusal behaviour.Positive intervention strength moves activations toward refusal and negative strength moves them away; first-token evaluation intervenes at A0, while complete-response evaluation applies the intervention throughout generation.Source: §3 · p. 3, §3.4 · p. 5

3.1 ANALYSIS SETUP

  • The paired evaluation set uses 512 base requests with unchanged task content, regular and emotional variants, and separate discovery and validation splits.It draws from JailbreakBench, XSTest, OR-Bench, and HarmBench; two templates from each of six expression families are reserved for validation.Source: §3.1 · p. 3

3.2 LOCALIZING THE REFUSAL LAYER AND DIRECTION

  • Layer-wise logistic-regression probes use regular discovery requests to select the layer with the highest ROC-AUC for distinguishing compliance from refusal.The probes read residual-stream activations at the final input position A0; the selected probe’s weights are mapped back to original activation space and normalized as the refusal direction.Source: §3.2 · p. 4, Figure 3 · p. 4

3.3 CONSTRUCTING THE REFUSAL SUBSPACE

  • The refusal subspace is spanned by the top-K SAE decoder directions ranked by absolute cosine similarity to the refusal direction.This subspace is used as the representation space for estimating emotion-induced refusal shifts.Source: §3.3 · p. 4

3.4 CAUSAL VALIDATION OF THE REFUSAL DIRECTION AND SUBSPACE

  • Reverse steering along the refusal subspace decreases BRR, while stronger reverse interventions increase HCR; forward steering increases BRR.At fixed ρ = 1, steering along the refusal direction or subspace increases refusal-related responses, while reversing them reduces responses more than random controls.Source: Figure 4 · p. 5, §3.4 · p. 5

4 EMOTION-INDUCED REFUSAL SHIFT AND MITIGATION

Emotional expression shifts benign requests toward refusal across internal representations and response behaviour, and EmoRSS reverses the estimated shift within a refusal subspace. In two models, the intervention reduces benign refusal without increasing harmful compliance at the tested setting.

4.2 REVERSING THE EMOTION-INDUCED SHIFT

  • At ρ = 1, EmoRSS reduces BRR by 2.60% on Llama-3.1-8B-it and 4.94% on Qwen3-8B without increasing HCR.It produces the largest reduction in the emotion-induced first-token refusal shift among the tested interventions.Source: Table 3 · p. 6, Table 4 · p. 6, §4.2 · p. 7

4 EMOTION-INDUCED REFUSAL SHIFT AND MITIGATION

  • EmoRSS estimates the paired regular–emotional activation change in selected refusal-subspace SAE features, averages it on the discovery set, and decodes it into a fixed residual-stream displacement vector.The subspace is built from SAE features aligned with the refusal direction; the vector is then reversed during inference.Source: §4.1 · pp. 5–6, §4 · p. 5

4.1 THE EMOTION-INDUCED SHIFT TOWARD REFUSAL

  • Emotional expression shifts benign requests toward refusal at representation, first-token, and complete-response levels in both models, unlike harmful requests, which show no consistent directional shift.Figure 5 reports paired regular–emotional changes in refusal-direction projection, first-token refusal score, and complete-response refusal rate; positive values indicate stronger refusal.Source: §4.1 · p. 6, Figure 5 · p. 6

4.2 REVERSING THE EMOTION-INDUCED SHIFT

  • At the refusal-sensitive layer, the intervention subtracts the estimated emotion-induced displacement from emotional-query activations; validation uses ρ = 1 and applies the change at A0.The model then generates normally, with no backbone-parameter updates.Source: §4.2 · pp. 6–7

5 EXPERIMENT

Across two models, EmoRSS reduces benign refusal while maintaining low harmful compliance, and its response analysis finds more substantive answers to emotional benign requests. Intervention strength and design choices affect the trade-off with safety and general capability.

5.1 EXPERIMENTAL SETUP

  • The evaluation compares five inference-time mitigation baselines with the default model, using BRR and HCR; it selects ρ = 20 for Llama-3.1-8B-it and ρ = 10 for Qwen3-8B.The intervention layers are 22 and 25, respectively, and the refusal-subspace dimension is K = 32.Source: §5.1 · pp. 7–8

5.2 MAIN RESULTS

  • 7.29% average BRR on both models, with HCR of 0.00% on Llama-3.1-8B-it and 2.08% on Qwen3-8B; among methods below 5% HCR on both, EmoRSS has the lowest average BRR.Self-CD reaches lower BRR values but raises HCR to 31.77% and 18.23%, respectively.Source: §5.2 · p. 8
  • Substantive answers rise from 98 to 112 on Llama-3.1-8B-it and 110 to 119 on Qwen3-8B, while some responses shift away from empathetic answering.The paired gains are 10.94% and 7.03%, respectively.Source: Figure 7 · p. 8, §5.2 · pp. 8–9

5.3 ABLATION STUDY

  • Increasing ρ reduces BRR while keeping HCR low on both models, but Qwen3-8B gains little after ρ = 10 and then loses substantial general capability; Llama capability remains largely stable.The selected strengths are ρ = 20 for Llama-3.1-8B-it and ρ = 10 for Qwen3-8B.Source: Figure 8 · p. 8, §5.3 · p. 9
  • Removing SAE projection reduces unnecessary refusals most, but weakens general capability on both models and safety on Qwen3-8B; removing the refusal subspace yields only modest refusal reduction.The full method reaches 7.29% unnecessary refusals on both models without the substantial capability loss of the unprojected variant.Source: Table 6 · p. 9, §5.3 · p. 9
  • Intervening at the identified refusal-sensitive layer gives the lowest BRR on both models, compared with adjacent- and final-layer interventions, while maintaining low harmful compliance and largely preserving capability.On Llama-3.1-8B-it, BRR is 7.29% at the identified layer versus 7.81% and 16.15%; on Qwen3-8B, it is 7.29% versus 13.02% and 24.48%.Source: Table 7 · p. 9, §5.3 · p. 9

6 CONCLUSION

The paper investigates emotion-induced over-refusal and proposes EmoRSS to mitigate it while maintaining safety. Across two models, the method reduces benign refusals, keeps harmful compliance low, and better preserves general capability than the evaluated baselines.

6 CONCLUSION

  • EmoRSS estimates and reverses emotional-expression shifts within a refusal-related subspace constructed using linear probes and SAE features.Experiments across two models and multiple benign and harmful requests report reduced benign refusals, low harmful compliance, and better-preserved general capability than evaluated baselines.Source: §6 · p. 9

AI DISCLOSURE

The authors disclose using generative AI to edit and polish the manuscript and assist with code development.

AI DISCLOSURE

  • The authors report reviewing textual revisions and verifying AI-assisted code, and state that they take responsibility for the final content.Multiple authors reviewed the code for correctness.Source: AI DISCLOSURE · p. 10

ETHICS STATEMENT

The work uses publicly available datasets and open-weight models, collects no private or sensitive personal information, and acknowledges potential biases in its sources and evaluators.

ETHICS STATEMENT

  • The study uses publicly available datasets and open-weight models and collects no private or sensitive personal information.Source: ETHICS STATEMENT · p. 10
  • Human review is limited to checking the semantic consistency and correctness of controlled queries.Source: ETHICS STATEMENT · p. 10
  • The authors acknowledge potential biases in the source datasets, evaluated models, and automated evaluators.Source: ETHICS STATEMENT · p. 10

REPRODUCIBILITY STATEMENT

The reproducibility materials describe the main evaluation and intervention in the text, with derivations, dataset details, hyperparameters, examples, and efficiency measurements in the appendices.

REPRODUCIBILITY STATEMENT

APPENDIX

A THEORETICAL ANALYSIS

The appendix derives how EmoRSS constructs and uses a refusal subspace. It argues that this confines edits and their collateral effects, while noting that capability preservation remains an empirical question.

A.1 REFUSAL DIRECTION IN THE ORIGINAL ACTIVATION COORDINATES

  • The probe’s refusal direction must be mapped from standardized coordinates back to original activation coordinates using the per-dimension standard deviations.The centering mean shifts the decision threshold but not the direction; using the standardized weight directly misaligns it with the residual stream.Source: §A.1 · p. 13

A.2 THE REFUSAL SUBSPACE AND ITS ORTHOGONAL PROJECTOR

  • The refusal subspace uses the 32 SAE decoder atoms most aligned with the refusal direction, orthonormalized before projection.The projected refusal direction is the normalized component of the refusal direction within that subspace.Source: §A.2 · p. 13

A.3 SUBSPACE INTERVENTION CONFINES THE PERTURBATION TO THE REFUSAL SUBSPACE

  • Subspace steering leaves readouts orthogonal to the refusal subspace unchanged, unlike a dense edit along the refusal direction.The perturbation is confined to the 32 subspace directions rather than all residual dimensions.Source: §A.3 · pp. 13–14
  • The footprint guarantee does not itself guarantee capability preservation; that depends on capability-bearing features lying outside the refusal subspace.Whether they do is empirical, though the reported capability evaluations indicate that they largely do.Source: §A.3 · p. 14

A.4 MAXIMAL LEVERAGE OF THE PROJECTED DIRECTION

  • Among unit directions within the refusal subspace, the normalized projected refusal direction produces the largest change in the refusal coordinate.Its per-unit coordinate change is ρ ∥P_ref w∥_2.Source: §A.4 · p. 14

A.5 BOUNDED COLLATERAL EFFECT ON DOWNSTREAM READOUTS

  • The intervention’s collateral effect on a readout is bounded by that readout’s overlap with the refusal subspace and is zero for orthogonal readouts.The refusal-direction edit has no equivalent bound and can shift readouts unrelated to refusal.Source: §A.5 · p. 14

B.1 DATASET CONSTRUCTION DETAILS

The evaluation pairs regular and emotional versions of identical requests, validates their emotional and semantic properties, and compares two input positions for refusal probes; the assistant-prefix end is selected.

B.1 DATASET CONSTRUCTION DETAILS

  • The evaluation pairs 512 base requests—256 benign and 256 harmful—with regular and emotional preambles while keeping each request’s content unchanged.Source: §B.1 · p. 14
  • The six expression families provide linguistic variations rather than distinct clinical constructs.Each family contains eight matched regular–emotional pairs, yielding 48 pairs and 96 preambles.Source: §B.1 · p. 15, Table 8 · p. 15
  • The constructed queries meet the stated criteria: emotional versions rate 2.73 points higher in distress, both conditions have median naturalness 4.0, and no pair changes objective or safety classification.The study-specific thresholds are a distress increase of at least 1.5 points and median naturalness of at least 4.0.Source: §B.1 · p. 15

C CHOICE OF THE READOUT POSITION

  • At the selected refusal-sensitive layer, assistant-prefix-end A0 has stronger probe ROC-AUC than user-turn-end U for both models, so the study uses A0.A0 is the input-side state closest to the realized compliance/refusal decision; the one-sided 95% cluster-bootstrap lower bound on the A0–U difference is positive for both models.Source: C CHOICE OF THE READOUT POSITION · p. 16, Table 9 · p. 16

D IMPLEMENTATION HYPERPARAMETERS

The case studies show that subspace reversal restores substantive answers to emotional benign requests across both models, while inference efficiency matches standard decoding in peak memory. The discussion qualifies these findings by distinguishing substantive answers from refusal rates and by noting limits to safety and intervention-scope claims.

D IMPLEMENTATION HYPERPARAMETERS

  • The same hyperparameter values were used for both models except mitigation strength ρ, which was selected on the discovery set.The refusal-sensitive layer, readout position, and dataset construction are specified elsewhere in the paper.Source: D IMPLEMENTATION HYPERPARAMETERS · p. 16

E CASE STUDIES OF OVER-REFUSAL AND ITS REVERSAL

F INFERENCE EFFICIENCY

  • EmoRSS peak GPU memory did not exceed the unmodified model’s footprint: 16.22 vs. 16.33 GB on Llama-3.1-8B and 16.80 GB on Qwen3-8B.Throughput and relative runtime were single-run and not length-controlled, so the sub-1× Llama runtime is not a genuine speedup.Source: F INFERENCE EFFICIENCY · p. 17, Table 13 · p. 18

G MORE DISCUSSION

  • The selected SAE features account for 30.2% and 59.0% of the mean emotion-induced shift along the refusal direction in Llama-3.1-8B-it and Qwen3-8B, respectively.Thus, ρ = 1 tests cancellation of the estimated component, while the evaluation strengths ρ = 20 and ρ = 10 are amplified interventions, not exact cancellation or causal mediation estimates.Source: G MORE DISCUSSION · p. 17
  • At selected intervention strengths, average harmful compliance was unchanged for Llama-3.1-8B-it, while Qwen3-8B increased from 0.52% to 2.08%.The authors caution that the trade-off may differ across models and harmful-request distributions.Source: G MORE DISCUSSION · p. 19
  • Substantive answers among 128 annotated benign emotional requests rose from 98 to 112 for Llama-3.1-8B-it and from 110 to 119 for Qwen3-8B after intervention.BRR does not capture every failure to answer: some non-substantive responses became substantive.Source: G MORE DISCUSSION · p. 19
Loading 2610.04998v1…