The paper investigates whether large language models’ refusal behavior in text transfers to tool‑calling contexts. A benchmark of 2,304 prompts across four domains compares text‑only, standard tool‑enabled, and adversarially framed tool‑enabled settings, revealing that 10–52 % of harmful requests refused in chat still lead to unsafe tool calls. The authors identify a refusal‑associated direction in the models’ residual stream, showing that lower activation along this direction predicts unsafe calls, but restoring the signal only partially mitigates the issue and often suppresses benign tool use.
By Ekagra Gupta, Raj Saha, Aniekan-Abasi Inyang, Adam Al Gharib
arXiv:2610.23093v1 Announce Type: new
Abstract: LLM agents increasingly use retrieval tools across languages, yet their safety evaluation remains English-centric. It remains unclear whether language...
By Aditya Nawal, Manit Baser, Mohan Gurusamy
The paper investigates how large language models balance helpfulness and safety by refusing harmful queries while responding to benign ones. It decomposes safety-tuning responses into a boilerplate refusal statement and a rationale, finding that the statement causes false refusals by relying on superficial cues. Training on rationales alone reduces false refusals without compromising safety performance, suggesting that fine‑grained safety supervision is essential for better alignment.
By Minji Kim, Hyounghun Kim
The paper introduces Weighted Refusal Direction Optimization (WRDO), a method that constructs a composite refusal direction by learning aggregation weights over per‑prompt refusal directions. WRDO aims to strengthen refusal interventions in aligned language models by allowing heterogeneous harmful prompts to contribute unequally. Experiments on three open‑weight models, using guard judges and HarmBench, demonstrate that weighted aggregation outperforms single‑direction methods and can also be used in reverse to restore refusal behavior in a damaged checkpoint.
By Grigoriy Evseev, Vladimir Solodkin, Dmitry Bylinkin, Daniil Medyakov, Vladimir Aletov, Aleksandr Beznosikov
The paper proposes adding an operative understanding rate (UR) alongside the traditional attack success rate (ASR) to better assess large language model safety. UR measures whether a model’s response both identifies and treats the evaluated task as the task to be answered, revealing variations in intent recovery that ASR alone masks. Experiments show that explicit prompts improve recovery rates while ASR remains unchanged, and that high recovery can still coincide with harmful assistance, underscoring the need for joint reporting.
By Haitong Jiang, Chunlin Liu, Sihan Tang, Chan Wu, Xiaoqing Su, Yuhong Feng
The paper introduces RiskCueBench, a benchmark designed to separate intent recovery from safety behavior in large language models. It evaluates 25 model groups on 640 prompts covering 160 latent intents across eight risk categories, revealing that higher contextual specificity can reduce refusal rates and safety scores even after intent recovery. The study highlights that safety behavior may be miscalibrated to prompt surface form, underscoring the need for evaluations that condition on semantic recoverability.
By Yuwei Wang, Xingwang Liang, Yu Xie, Haotian Chi, Haijun Geng