Refusal Rate Analysis in LLMs

Updated 25 December 2025

Refusal rate analysis is a systematic approach to quantify and mitigate instances where LLMs decline to provide answers, using precise metrics and canonical refusal patterns.
It employs rigorous statistical methods such as Monte Carlo estimation, copula modeling, and disaggregation across demographic and task factors to benchmark performance.
Calibration techniques like targeted ablation, logit bias tuning, and safety meta-algorithms ensure AI systems balance safety with utility, reducing over-refusal in sensitive contexts.

A refusal rate quantifies how frequently a machine learning model, particularly a LLM, declines to provide an output in response to an input—typically by generating a canonical refusal phrase or returning a designated refusal token. Refusal rate analysis encompasses the rigorous definition, measurement, disaggregation, and targeted mitigation of refusal behaviors across tasks, prompts, and deployable model variants. This analytic axis governs the dual imperatives of AI safety and utility: minimizing false refusals (erroneously declining safe requests) and securing true refusals (robustly rejecting unsafe, unanswerable, or out-of-scope queries). Recent research has advanced precise probabilistic metrics, Monte Carlo and copula-based estimation methods, granular dissection of demographic and compositional effects, and several methods for both auditing and flexibly calibrating refusal rates in neural models.

1. Formal Definitions and Metrics

Refusal rate is empirically defined for a dataset of $N$ model inputs (queries/prompts) as

$r = \frac{R}{N}, \quad R = \text{number of refusals} \in [0,1].$

A response is operationally classified as a refusal if it matches a pattern in a set of canonical refusal markers (e.g., “I’m sorry”, “I cannot”, or system-specific tokens) (Plaza-del-Arco et al., 9 Sep 2025). Uncertainty in $r$ is quantified via the standard Wald confidence interval:

$r \pm z_{1-\alpha/2}\sqrt{\frac{r(1-r)}{N}}.$

False refusal rate (FRR) is the proportion of refusals given to safe prompts, critical for measuring over-refusal:

$\hat r_\mathrm{false} = \frac{1}{N}\sum_{i=1}^N I(Y_i=1),$

where $Y_i$ indicates whether the $i$ th safe input was refused.

For knowledge-aware refusal—the selective refusal of inputs likely to be answered incorrectly—the Refusal Index (RI) is introduced (Pan et al., 2 Oct 2025), defined as the Spearman’s rank correlation between per-question refusal probability $R(x)$ and error probability $W(x)$ :

$\mathrm{RI} = \mathrm{Spearman}(\mathrm{Rank}\{R_i\}, \mathrm{Rank}\{W_i\}).$

2. Analytical and Experimental Methodologies

Refusal rate analysis leverages several rigorous experimental and statistical methods:

Monte Carlo Estimation: A nested procedure samples task inputs, personas, and prompt templates uniformly, measures refusal incidence, and computes the sample mean and variance for empirical $\hat r$ (Plaza-del-Arco et al., 9 Sep 2025). This supports high-confidence comparisons across demographic and prompt axes.
Disaggregation by Factor: Sensitivity analyses partition refusal rates along axes such as model choice, task type, prompt formulation, and sociodemographic persona to attribute variance (Plaza-del-Arco et al., 9 Sep 2025).
Category/Taxonomy Granularity: Comprehensive taxonomies (e.g., 16-category “Should-Not” vs. “Cannot” refusal, 44-topic “SORRY-Bench” safety grid) enable per-category refusal profiling and confusion analysis (Recum et al., 22 Dec 2024, Xie et al., 20 Jun 2024).
Two-Pass Copula Estimation (RI): The Refusal Index protocol collects binary refusal and correctness annotations, computes joint empirical refusal/error rates, and infers their latent correlation via tetrachoric (Gaussian copula) modeling, yielding a robust, rate-invariant metric (Pan et al., 2 Oct 2025).
Black-box and Activation-based Auditing: Embedding models, BERT classifiers, and cosine-similarity steering methods (COSMIC) enable refusal direction discovery, activation-based steering, and classification even in weakly aligned or adversarial environments (Siu et al., 30 May 2025).

3. Dissecting Factors Influencing Refusal

Systematic analyses have revealed:

Model and Task Effects: Model choice is the dominant factor, accounting for nearly half of refusal rate variance. Task sensitivity (especially subjective ones like offensiveness classification) is the next greatest contributor (Plaza-del-Arco et al., 9 Sep 2025).
Prompt Template and Format: Open-ended, unforced prompts yield higher false refusal. Forced-choice formats sharply reduce refusal rates on safe tasks (e.g., a drop from 74% to <20% in vintage Llama2-13B) (Plaza-del-Arco et al., 9 Sep 2025).
Demographic and Sociocultural Bias: Persona-based prompting inflates refusal—particularly for identities associated with higher alignment filter activation, such as “Black person” or “transgender woman” (Plaza-del-Arco et al., 9 Sep 2025). The magnitude of these effects declines with increasing model capability.
Category Composition: “Should-Not” categories (e.g., legal compliance, NSFW, privacy) elicit very high refusal rates (>80%), while “Cannot” (knowledge cutoff, missing context) refusals are more variable and model-dependent (Recum et al., 22 Dec 2024).
Multilingual and Format Sensitivity: Refusal behaviors are language- and style-dependent; models often under-refuse in low-resource languages or when confronted with persuasion, encoding, or mutation strategies (Xie et al., 20 Jun 2024).

Table: Sample Disaggregation of Refusal Rates (abridged from (Plaza-del-Arco et al., 9 Sep 2025))

Model	NLI (%)	Politeness (%)	Offensiveness (%)
Llama2-13B	12.6	35.7	87.4
Llama3.2-3B	0.0	0.0	0.1
Qwen2.5-32B	0.0	0.0	0.0
Mean	1.4	5.6	14.7

4. Mitigation and Calibration Approaches

Recent work has developed interventions for direct and nuanced control over refusal rates:

Single-vector Ablation: Targeted removal of activation features encoding false refusal, orthogonalized against true refusal subspace, can surgically lower over-refusal (e.g., decrease FRR by 30–60 pp with <1 pp change in true refusal) (Wang et al., 4 Oct 2024).
Refusal Tokens: Incorporating special refusal tokens into fine-tuning enables direct inference-time adjustment via logit bias or thresholding; per-category knob control supports flexible refusal calibration (ROC/F1 tradeoff) without retraining (Jain et al., 9 Dec 2024).
Benchmark-driven Alignment: Datasets such as ORFuzzSet and EvoRefuse-Test provide high-coverage, diverse pseudo-benign prompts that systemically surface over-refusal, supporting fine-tuning or preference optimization targeting lower false positives without loss of safety (Zhang et al., 15 Aug 2025, Wu et al., 29 May 2025).
SafePredict Meta-algorithm: In the online learning setting, SafePredict wraps arbitrary predictors, guaranteeing that the error rate on non-refused predictions remains below a prescribed $\epsilon$ , while adapting its refusal policy over time for validity and minimal abstention (Kocak et al., 2017).

5. Failure Modes, Diagnostic Insights, and Open Challenges

Empirical studies have highlighted key artifacts and vulnerabilities:

Training Data Generalization Gaps: Refusal guardrails may not generalize to simple reformulations (e.g., present→past tense), enabling successful jailbreaks unless past-tense refusals are included during fine-tuning (Andriushchenko et al., 16 Jul 2024).
Surface-level and Early-layer Filters: Over-refusal is often mediated by early-layer attention to sensitive keywords, rather than robust contextual analysis, resulting in unnecessary refusals to benign queries containing “dangerous” or “exploit” (Wu et al., 29 May 2025).
Entanglement of Refusal Features: Mechanistic approaches reveal that features responsible for refusal may be deeply entangled with factual/reasoning subsystems, so steering for safety can impair general model competence unless interventions are filtered or conditional (O'Brien et al., 18 Nov 2024).
Trade-offs in Safety vs. Usability: High overall refusal may protect against unsafe completions but incurs user-facing false positives and degraded utility (e.g., ~12%–43% over-refusal in English “emotional boundary” tasks) (Noever et al., 20 Feb 2025).

6. Recommendations and Practitioner Guidelines

Report Disaggregated Refusal Rates: Always report refusal and false-refusal rates by task, demographic axis, and prompt template (Plaza-del-Arco et al., 9 Sep 2025).
Prefer Forced-label Tasks: Structured output formats suppress unnecessary refusals.
Benchmark with Adversarial and Pseudo-benign Sets: Use ORFuzz, ORFuzzSet, EvoRefuse-Test as stress-tests to audit over-refusal (Zhang et al., 15 Aug 2025, Wu et al., 29 May 2025).
Tune Refusal Sensitivity to Application Context: Leverage refusal token logit bias or threshold vector to adjust category-wise refusal to meet safety, legal, or user experience demands (Jain et al., 9 Dec 2024).
Combine Statistical and Mechanistic Auditing: Employ both black-box refusal classifiers and activation-based evaluations for robust coverage of refusal pathways (Siu et al., 30 May 2025, Recum et al., 22 Dec 2024).
Monitor Knowledge-aware Refusal with RI: Use Refusal Index as a rate-invariant metric to ensure models refuse queries they would otherwise answer incorrectly (Pan et al., 2 Oct 2025).

Refusal rate analysis—anchored in precise metrics, stratified experimental methods, and targeted interventions—enables principled design and robust auditing of safety/usability boundaries in modern LLMs.