Risk and Refusal: Mechanisms of LLM Responses to Suicidal Ideation

• Refusing or only referring people elsewhere can leave suicidal-ideation disclosures of distress unaddressed, unlike requests for self-harm instructions.Suicide-prevention guidance instead emphasizes acknowledging distress, maintaining engagement, and connecting people with appropriate support.Source: §1 · p. 1
• Engaged responses can still overlook distress, give inaccurate information, affirm harmful beliefs, or provide advice that misses people’s needs.Prior evaluations cited in the introduction also report missed risk cues and coping suggestions lacking key safety-planning elements.Source: §1 · p. 2
• The paper asks how SI information and clinician guidance affect refusal and response risk, and how refusal-related mechanisms relate to response-level safety.It highlights the unresolved question of how generic refusal mechanisms operate when suicide-related language expresses distress and need for support.Source: §1 · p. 2
• The study evaluates eight instruction-tuned models across three disclosure datasets, varying SI information and clinician guidance, and analyzes refusal mechanisms in open-weight models.It also investigates the effects of directly suppressing refusal and of clinician-guided protocols.Source: §1 · p. 2

2.1 Refusal as an LLM Safety Mechanism

• Refusal helps prevent harmful assistance, but SI disclosures typically express distress rather than request such assistance, making context-sensitive engagement important.Over-refusal can reject benign requests that resemble unsafe content, while refusing or only referring may leave distress unaddressed.Source: §2.1 · p. 2

2.2 LLM Responses to Suicidal Ideation

• Research on SI has emphasized risk identification, while response quality remains distinct from recognition and cannot be inferred from empathy or fluency alone.Prior evaluations report stigma, inappropriate affirmation, misjudged risk, contextual errors, and other response problems; RubRIX measures several of these risks.Source: §2.2 · pp. 2–3

2.3 Mechanistic Accounts of Refusal

• Prior mechanistic work links refusal to residual-stream directions, but it remains unclear whether generic refusal mechanisms drive SI refusals or yield appropriate engagement.The literature also suggests harmfulness recognition and refusal can be separate processes, and that refusal may occupy richer subspaces.Source: §2.3 · p. 3

3 Methodology

• The study combines controlled prompting across eight models and three datasets with representational analyses and causal interventions on refusal mechanisms.The behavioral evaluation uses three disclosure datasets, while the mechanistic work tests generic refusal mechanisms and clinician guidance.Source: §3 · p. 3, §3.1.1 · p. 3, §3.1.2 · p. 3

3.1.1 Datasets

• The datasets include 1,504 r/SuicideWatch posts, a 1,500-post SH-Detection sample, and all 243 X-Sensitive posts labeled as self-harm.Posts shorter than 20 characters are excluded, and URLs and user identifiers are removed.Source: §3.1.1 · p. 3

3.2.1 SI classifications

• SI classifications use IPTS-derived constructs for Reddit SI and native self-harm annotations for SH-Detection and X-Sensitive; these labels are not clinical risk diagnoses.Because labels and the guidance tier they trigger differ by dataset, classification effects are interpreted within each dataset.Source: §3.2.1 · pp. 3–4

3.2.2 Clinician-developed response guidance

• The clinician-developed protocol defines crisis, elevated, and standard concern tiers, with instructions for acknowledgment, safety assessment, and appropriate support.It emphasizes supportive engagement rather than clinical assessment or treatment.Source: §3.2.2 · p. 4

3.3.2 Outcome Measures

• Independent judges classify responses for refusal and score response risk using a support-seeking RubRIX adaptation covering five risk dimensions.Risk includes inattention, bias and stigma, information inaccuracy, uncritical affirmation, and epistemic arrogance; refusal categories distinguish engagement from several forms of non-engagement.Source: §3.3 · p. 4, §3.3.2 · p. 4

3.3.1 Prompting Conditions

• A 2 × 2 prompting design varies dataset-specific classification labels and clinician guidance while keeping each disclosure constant.The four conditions are baseline, classification-only, guidance-only, and classification plus guidance.Source: §3.3.1 · p. 4

3.4.1 Identifying and probing generic refusal directions

• The refusal direction is estimated from generic harmful-versus-harmless instruction activations, then tested for its ability to distinguish refusals of SI disclosures.The analysis uses six open-weight models and excludes suicide- and self-harm-related instructions and evaluated SI disclosures from direction construction.Source: §3.4.1 · p. 5, §3.4 · p. 5

3.4.2 Causal interventions on refusal representations

• Causal tests ablate the refusal direction throughout the residual stream or add it at one layer, with matched-norm random-direction controls.Reciprocal interventions also test whether guidance-associated shifts along the direction change refusal and risk, without assuming complete mediation.Source: §3.4.2 · p. 5, §3.4.3 · p. 5

4.1 Effects of SI Classification and Clinician Guidance on Response Safety

• At baseline, refusal was concentrated in a subset of models, while substantial RubRIX risk appeared across a broader set of models and datasets.Risk ranged from 17.8–63.9% on SI-Reddit, 13.4–45.8% on SH-Detection, and 14.8–24.3% on X-Sensitive.Source: §4.1 · p. 6, Figure 2 · p. 6
• Classification reduced refusal but increased SI-Reddit risk for four models, with no significant risk reductions; Gemma-3-27B also shifted toward information inaccuracy on other datasets.On SI-Reddit, risk rose from 39.4% to 56.7% for GPT-4o-mini, 49.3% to 59.4% for Phi-4-mini, 55.5% to 71.8% for Llama-3.1-8B, and 51.7% to 64.4% for Gemma-3-27B.Source: §4.1 · p. 6
• Guidance-only reduced risk in 22 of 24 model–dataset comparisons while reducing refusal among higher-refusal models; adding classification yielded significant reductions in all 24.Most improvement was attainable without explicit classification labels.Source: §4.1 · pp. 6–7

4.2 Mechanistic Analysis of Refusal and Response Risk

• Across six open-weight models, a generic harmful-request refusal direction predicted SI refusals; ablating it sharply reduced refusal of both harmful requests and SI disclosures in Phi-4-mini and Llama-3.1-8B.The direction distinguished held-out harmful from harmless requests with AUROC 0.97–1.00 despite being estimated without SI examples.Source: §4.2 · p. 7
• Refusal-direction ablation reduced explicit SI acknowledgment in all six model–dataset comparisons and increased RubRIX-flagged responses in five of six.On Reddit SI, risk increased from 44.7% to 71.4% for Phi-4-mini and from 48.2% to 71.9% for Llama-3.1-8B.Source: §4.2 · p. 7
• Guidance reduced refusal-direction projections, but its behavioral effects differed by model and extended beyond that direction; restoring refusal in Phi-4-mini did not undo guidance’s broader safety benefit.In Phi-4-mini on Reddit SI, adding the guidance-associated shift back raised refusal while risk remained 3.7%, compared with 44.7% at baseline.Source: §4.2 · p. 7
• Exploratory attribution graphs suggest that distress and suicide-risk cues can feed into hedging, apology, or generic support structures that shape responses independently of recognizing risk.The analysis covered 20 high-Inattention responses from Gemma-2-2B, Llama-3.2-1B, and Qwen2.5-1.5B.Source: §4.2 · pp. 7–8

5 Discussion and Conclusion

• The paper studies LLM responses to SI disclosures behaviorally and mechanistically, including why models refuse and what risks arise when they engage.The evaluation covers eight models, three SI and self-harm datasets, and four prompting conditions.Source: §5 · p. 8
• The findings do not support eliminating refusal in SI contexts; boundaries should distinguish requests for self-harm instructions from disclosures of distress.Generic refusal representations contributed to refusing support-seeking disclosures, although this does not establish that models interpret them as harmful requests.Source: §5 · p. 8
• Identifying a sensitive disclosure does not ensure an appropriate response, and classification sometimes shifted risk from inattention toward information inaccuracy.The discussion calls for assessing acknowledgment, substantive and nonjudgmental engagement, accurate context-sensitive support pathways, and appropriate boundaries.Source: §5 · p. 8
• Ablating refusal directions reduced explicit refusal but also reduced explicit acknowledgment of suicide or self-harm risk; the interventions do not isolate recognition, boundary selection, and supportive response construction.The discussion identifies generalization beyond prescribed prompting protocols as a future research direction.Source: §5 · p. 8

Limitations

• Mechanistic interventions focused on open-source models with appreciable baseline refusal, and the generic refusal direction may not capture all representations involved in SI processing.Its behavioral and causal roles may differ across architectures, and findings may not generalize to untested models.Source: Limitations · pp. 8–9
• The datasets may not represent indirect, evolving, or multi-turn crisis disclosures, and controlled prompts cannot capture changing conversational context or user needs.IPTS-derived labels describe disclosure content rather than independently establishing an individual’s clinical state.Source: Limitations · pp. 8–9
• LLM-as-judge classifications do not establish whether responses feel supportive, facilitate help-seeking, or improve real-world outcomes for people experiencing SI.Refusal detection also may miss contextual appropriateness when refusal-like language appears alongside meaningful support.Source: Limitations · p. 9

Ethical Considerations

• The study examines publicly accessible social-media posts and reports data minimization and avoidance of personally identifiable information as privacy practices.The authors also state that the research team followed established ethical practices.Source: Ethical Considerations · p. 9
• The interdisciplinary team includes clinicians, and clinician coauthors reviewed and corroborated the findings to minimize misinterpretation.The team includes members with diverse gender, racial, and cultural backgrounds, including immigrants and people of color.Source: Ethical Considerations · p. 9
• The authors caution that findings should not replace clinical evaluation or be used for unsupervised safety checks without appropriate human or clinical oversight.They also caution that lower rubric-defined risk or mechanistic findings do not necessarily translate to improved outcomes for people experiencing SI.Source: Ethical Considerations · p. 9

AI Involvement Disclosure

• Generative AI tools were not used for study design, data collection, analysis, implementation, or scientific contributions.The disclosure specifically names Grammarly and ChatGPT as examples of language-editing tools.Source: AI Involvement Disclosure · p. 9
• Language-editing tools were used only to improve grammar and readability in certain manuscript sections.Source: AI Involvement Disclosure · pp. 9–10
• The authors state that all scientific content, interpretations, and decisions reflect the research team’s own work and judgment.Source: AI Involvement Disclosure · p. 10

A.1.1 SI Reddit Dataset

• 59,607 posts and 149,144 comments comprise the broader corpus, which includes 36,879 posting users and 37,751 commenting users.Source: §A.1.1 · p. 14
• 94 words is the median post length; the mean is 150.71 words (SD = 171.69).Source: §A.1.1 · p. 14
• 11 words is the median comment length; comments average 22.43 words (SD = 38.18), and 19.5% of posts have no comments.Posts receive an average of 2.50 comments (SD = 8.69).Source: §A.1.1 · p. 14

A.2 Prompting Conditions

• Prompting conditions use the same disclosure, while classification conditions receive dataset-specific labels and guidance conditions use the clinician-developed protocol.Reddit SI uses IPTS-derived labels; SH-Detection and X-Sensitive use their human self-harm annotations. Guidance-only models choose the concern level themselves, whereas Classification + Guidance derives it from labels.Source: §A.2 · p. 14, §A.3 · p. 14

A.3 Clinician-Developed Response Protocol

• The clinician-developed protocol reduces each response to a brief safety bridge to human help, with distinct crisis, elevated, and standard instructions.For crisis disclosures, it directs the model to validate distress, provide emergency and 988 options, encourage contact with a trusted person, and ask whether the user is safe; it also prohibits counselling and general advice.Source: §A.3 · pp. 14–15

A.4.1 Refusal Judge

• The refusal judge classifies responses by a precedence-ordered hierarchy and separately flags refusal, risk recognition, specificity, and referral.Both judges see only the disclosure and response, without the generating model or prompting condition; refusal categories distinguish nonresponse, explicit refusal, deferral or generic non-engagement, and specific engagement.Source: §A.4 · p. 15, §A.4.1 · p. 16

A.4.2 RubRIX Judge

• The RubRIX judge applies a support-seeking adaptation of RubRIX, scoring 29 items as flagged or not flagged with brief justifications.The judge assesses five harm dimensions, including inattention, bias and stigma, information inaccuracy, uncritical affirmation, and epistemic arrogance.Source: §A.4.2 · p. 16, Table 4 · p. 17

A.5 Statistical Analysis Details

• Statistical analyses apply Holm correction within dataset-specific outcome families, while refusal-enriched causal-intervention comparisons use uncorrected paired tests.The correction covers RubRIX and refusal-related outcomes, with separate stratified corrections for SH-Detection; intervention refusal uses exact McNemar tests and mean RubRIX item counts use Wilcoxon signed-rank tests.Source: §A.5 · p. 19

A.6 Mechanistic Analysis Details

• Mechanistic analyses construct generic refusal directions without suicide-related examples, then test ablation and addition interventions at selected model layers.Direction construction uses harmful and harmless instructions; interventions include guidance-induced shifts, refusal-enriched subsets, and matched-norm random-direction controls.Source: §A.6 · pp. 19–20

A.7 Semantic Attribution Graphs

• Semantic attribution graphs describe recurring concepts in responses rather than causal mechanisms, using three small open models and selected high-inattention responses.The analysis uses 20 lethal SI disclosures from ADRD without added instructions, with 20 high-inattention responses balanced across the models; Qwen2.5-1.5B responses use Qwen3-1.7B transcoders as a proxy.Source: §A.7 · p. 20, §A.7.1 · p. 20

A.7.2 Response-Level Attribution Graphs

• Response-level graphs explain observed tokens through teacher-forced token graphs, then aggregate them by shared feature identity across token positions.The analysis selects up to 10 distinctive content words per response and prunes token graphs to nodes carrying 90% and edges carrying 99% of total influence.Source: §A.7.2 · pp. 20–21
• Response-level graphs merge token graphs and annotate features, preserving groups for negation, tense, tone, sentiment, politeness, and discourse structure.Patel et al. (2026) report that their supernodes match or exceed human ones on Feature Detection (93.4% vs. 66.6%) and Text Detection (83.2% vs. 81.8%).Source: §A.7.2 · p. 21

A.7.3 Model-Level Concept Graphs

• Model-level graphs pool each response’s 100 most important features and align them to a shared vocabulary of 12–30 named concepts.The forced token matched the attribution model’s top prediction in 118 of 165 token graphs (median probability 0.38); Qwen used a proxy with 38-of-70 agreement, and edge weights are not causal effects.Source: §A.7.3 · pp. 21–23

A.8 Semantic Attribution Graph Results

• The analysis covers 20 high-inattention responses to lethal SI disclosures across Gemma-2-2B, Llama-3.2-1B, and Qwen2.5-1.5B, with Qwen attributed through a proxy model.The resulting graphs are descriptive: they show recurring concepts and their attributed connections, not what causes a response.Source: §A.8 · p. 23

A.8.1 Model-Specific Patterns

• Gemma’s graph centers on grammar and hedging, Llama’s on forum-style self-disclosure and apology, and Qwen’s on generic support weakly linked to risk.Source: §A.8.1 · pp. 23–24, Figure 4 · p. 24

A.8.2 Relation to the Refusal Results

• The graphs motivate—but do not establish—the hypothesis that representing risk content may be insufficient for targeted responses while generic response-writing patterns remain prominent.Source: §A.8.2 · p. 24