← Blog

The Refusal Nobody Measures

Cody Lee Walker · codylee.ca · 2026-07

There are two ways a language model can fail a safety test, and the industry only instruments one of them. It counts, obsessively, how often a model complies with a harmful request — the jailbreak axis, the red-team leaderboards, the whole HarmBench ecosystem. It barely counts how often a model refuses a legitimate one. That second failure has a name now — over-refusal, or exaggerated safety — and a growing pile of 2025–26 research arguing it is not politeness overhead but a genuine alignment failure.

The examples are not edge cases. A defensive-security engineer gets refused on the exact analysis their signed engagement authorizes. A clinician asking about overdose thresholds — the thing they need to prevent one — gets a lecture. A translator loses a historical war document to a keyword filter. The mechanism is well understood: safety training teaches models to fire on surface tokens ("kill," "exploit," "overdose") rather than on intent, so the benign query wearing a scary word gets rejected while the fluent bad actor rephrases around it. Papers this year put it bluntly — refusing legitimate defensive-cyber and clinical work is a way that "safety alignment actively fails" the people it should serve, and silence-based safety "creates a veneer of security while eroding trust and inviting circumvention."

So it matters. Why doesn't anyone sell a good measurement of it?

The number you can already get is the wrong number

You can, in fact, look up an over-refusal figure today. HELM publishes one per model, free. Every frontier lab reports one in its system card — Anthropic cites a fraction of a percent for its recent models; OpenAI redesigned its refusal behavior explicitly to reduce the friction. So the metric exists. The problem is that it is one scalar, and the scalar lies in three different ways.

It misranks the models. The most direct result in the recent literature is that raw refusal rate fundamentally misranks frontier models: a model can post a great "safe" score by refusing, while still leaking the usable content through a partial, hedged answer. Counting refusals as a single number rewards the model that says nothing over the model that answers correctly and carefully. The field has moved to three classes — direct refusal, safe partial compliance, full compliance — precisely because collapsing them hides the failure.

It's a single point where the truth is a neighborhood. Refusal boundaries are fragile: recent perturbation studies find refusal rates swinging by more than 0.25 under trivial paraphrase, and behavior differing materially between versions of the same model family. A number measured on one phrasing, one day, systematically overstates how stable the model actually is. The honest unit is a cluster of paraphrases and its consistency, not a single reading.

It is entirely a function of which prompts you asked. This is the one that should end the conversation about self-reported figures. The same model, in 2026, was measured at 0.07% over-refusal by its maker and 33.5% by an external audit on a specialized domain. Neither is wrong. The number is defined by the prompt distribution, so a lab's figure on the lab's prompts tells an enterprise nothing about the model's behavior on the enterprise's own legitimate use cases.

Where this goes if you take it seriously

Notice that "a self-graded number that changes completely with the prompt set, isn't stable across versions, and collapses a distinction that matters" is exactly the shape of problem we keep running into. It is the same shape as an image compressor reporting "95% accuracy on average" — true on average, wrong about your image. It is the same shape as an RL environment whose author grades their own reward function. In both of those cases the missing layer was never a better number. It was an independent, sealed, replayable measurement over a disclosed test set — a certificate, in the boring metrological sense: third-party, traceable, re-derivable by anyone who doubts it, and stamped with an expiry because the thing it measures moves.

Over-refusal is missing that layer. A trustworthy over-refusal measurement would report the three classes, not a rate; measure over paraphrase neighborhoods, not single prompts; pair every benign prompt with a genuinely-harmful control so that "refuses less" can be distinguished from "got more accurate" rather than smuggled in as a safety regression; and — above all — disclose and seal the prompt distribution it ran on, so the number means something for a specific deployment instead of a generic leaderboard. Do that and the fragility everyone treats as a nuisance becomes the product: because refusal behavior drifts between model versions, the interesting artifact is the dated, sealed, re-runnable reading — and the drift across releases, which no one currently tracks at all.

We haven't built this. This is a note about a gap, not a launch. But it is the gap our whole discipline is shaped to fill — measure a model-facing property, seal it, let anyone replay it, let it expire when the model moves — and the fact that the loudest safety metric in the field is a self-graded scalar that misranks its own subjects feels less like a solved problem than an unmeasured one.

Don't trust the number. Ask what it was measured on, and whether you can re-run it.