When Refusal Looks Safe: The Refusal-Cue Shortcut in Safety Guard Models

# When Refusal Looks Safe: The Refusal-Cue Shortcut in Safety Guard Models
Source: [https://arxiv.org/html/2608.03201](https://arxiv.org/html/2608.03201)
Yu Feng1,2Chunting Zang2Chen Shen2Rui Miao2,3Ge Teng2,4 Weidong Cai1Jieping Ye2 1The University of Sydney2Alibaba Group3Jilin University4Zhejiang University yfen0146@uni\.sydney\.edu\.au\{marshall\.zct,jason\.sc\}@alibaba\-inc\.commiaorui24@mails\.jlu\.edu\.cn 12115044@zju\.edu\.cntom\.cai@sydney\.edu\.auyejieping\.ye@alibaba\-inc\.com

###### Abstract

Safety guards are widely used to filter harmful content and are typically trained via supervised fine\-tuning on labeled prompt\-response pairs\. We audit two widely used safety\-guard training datasets, WildGuardMix and GR\-Train, and find that among responses to harmful prompts, refusal expressions co\-occur almost exclusively with unharmful labels\. This imbalance motivates what we term therefusal\-cue shortcut: inserting a refusal cue into a harmful response could flip the guard’s verdict from harmful to unharmful\. The shortcut affects not only guards trained on these datasets but also officially released models such as LlamaGuard3 and Qwen3Guard whose training data is undisclosed\. It persists across response positions and is generally stronger in smaller variants within a family\. To mitigate it, we adapt sparse complementary masking as a lightweight post\-hoc intervention that identifies and suppresses a small set of shortcut\-associated attention heads and MLP neurons without retraining\. On two primary benchmarks, the intervention achieves an approximately 79% relative reduction in response\-initial detection failures induced by refusal cues, while preserving standard detection performance\. Although optimized using cues at a single response position, the suppression effect transfers to unseen positions and datasets, suggesting that shortcut manifestations across positions are partly mediated by shared internal components\. Further analysis provides evidence that shortcut reliance and legitimate refusal recognition are partially functionally separable, as suppressing the shortcut broadly preserves the guard’s ability to recognize genuine refusals\.

## 1Introduction

As large language models \(LLMs\) are deployed across diverse applications\[[2](https://arxiv.org/html/2608.03201#bib.bib27),[16](https://arxiv.org/html/2608.03201#bib.bib26)\], their open\-ended generation poses significant content safety risks\. Model\-internal safety alignment\[[28](https://arxiv.org/html/2608.03201#bib.bib4),[27](https://arxiv.org/html/2608.03201#bib.bib5)\]mitigates harmful generation but does not cover all application\-specific risks\[[25](https://arxiv.org/html/2608.03201#bib.bib31),[12](https://arxiv.org/html/2608.03201#bib.bib32)\], motivating safety guard models as complementary filtering mechanisms\. These guards classify the harmfulness of both user prompts and model responses and may additionally predict whether a response constitutes a refusal\. Guard reliability is itself a safety requirement, yet despite recent advances in classification performance, vulnerabilities in safety guards themselves remain underexplored\.

![Refer to caption](https://arxiv.org/html/2608.03201v1/x1.png)Figure 1:Overview of the refusal\-cue shortcut\. \(a\) Joint distributions of refusal and harmfulness labels under harmful prompts in WildGuardMix and GR\-Train\. \(b\) The hypothesis of refusal\-cue shortcut\.Response\-level safety guard training data are often constructed using safety\-aligned LLMs\[[23](https://arxiv.org/html/2608.03201#bib.bib2),[3](https://arxiv.org/html/2608.03201#bib.bib3)\], which tend to refuse harmful prompts, to generate unharmful responses and unaligned LLMs to generate harmful ones\. Consistent with this construction, our audit of WildGuardMix\[[9](https://arxiv.org/html/2608.03201#bib.bib8)\]and GR\-Train\[[14](https://arxiv.org/html/2608.03201#bib.bib9)\], both providing response\-level refusal and harmfulness labels, reveals a systematic distributional imbalance: responses labeled as both refusal and harmful are absent from WildGuardMix and account for only 0\.26% of harmful\-prompt examples in GR\-Train \(Figure[1](https://arxiv.org/html/2608.03201#S1.F1)\(a\)\)\. Although refusal cues are informative for refusal recognition, they do not determine response harmfulness: a refusal expression can co\-occur with harmful content within the same response\. The near\-exclusive association between refusal cues and unharmful labels in these training datasets is therefore spurious for harmfulness classification\[[19](https://arxiv.org/html/2608.03201#bib.bib25),[5](https://arxiv.org/html/2608.03201#bib.bib15)\]\. We hypothesize that a guard may learn this association as arefusal\-cue shortcut, such that inserting a refusal cue without altering the underlying harmful content can flip the prediction from harmful to unharmful, as shown in Figure[1](https://arxiv.org/html/2608.03201#S1.F1)\(b\)\.

We test this hypothesis across nine model variants from six safety guard families\. Among the evaluated guards, WildGuard\-7B\[[9](https://arxiv.org/html/2608.03201#bib.bib8)\]and GuardReasoner\-1B/8B\[[14](https://arxiv.org/html/2608.03201#bib.bib9)\], which are explicitly trained on WildGuardMix and GR\-Train, show the highest rates of harmful\-to\-unharmful prediction flips when refusal cues are inserted at the beginning of a response\. The shortcut also appears in LlamaGuard3\[[8](https://arxiv.org/html/2608.03201#bib.bib12)\]and Qwen3Guard\[[29](https://arxiv.org/html/2608.03201#bib.bib14)\], whose training\-data distributions are not publicly specified\. In contrast, Aegis2\[[7](https://arxiv.org/html/2608.03201#bib.bib10)\]augments its training data to broaden the coverage of safe responses to harmful prompts, spanning direct refusals and diverse forms of safe redirection\. Consistent with this distinction, a guard trained on Aegis2 and another trained on an Aegis2\-derived reasoning dataset\[[20](https://arxiv.org/html/2608.03201#bib.bib11)\]both exhibit substantially lower vulnerability to the refusal\-cue shortcut\. Across the evaluated families with multiple model sizes, smaller variants are generally more vulnerable\. Further experiments show that the shortcut strengthens as cues express refusal intent more completely, persists across response positions and cue formulations, and overlaps only partially with the guard’s explicit refusal predictions\.

We next ask whether this shortcut can be selectively suppressed without substantially degrading normal guard performance\. We adapt sparse complementary masking to guard\-specific, model\-derived targets, identifying a small set of attention heads and MLP neurons associated with the shortcut\. For mitigation, we exclude the two Aegis2\-derived guards, both of which exhibit limited baseline vulnerability, while retaining both variants of each multi\-size family for consistent within\-family coverage\. Across the resulting seven guards, the intervention reduces the mean response\-initial DFR from 16\.39% to 3\.44% on WildGuardTest\. Although learned using response\-initial cues, the resulting suppression remains effective at unseen cue positions and on a held\-out dataset, suggesting that the shortcut across positions is partly mediated by shared internal components\. Meanwhile, clean harmfulness performance is broadly preserved, and refusal\-recognition F1 changes by no more than 2\.11%\. Together, these results demonstrate that shortcut\-mediated failures can be substantially mitigated without disrupting legitimate refusal recognition\. Our contributions are fourfold:

1. 1\.We audit the training data of response\-level safety guards and uncover a systematic distributional imbalance: among responses to harmful prompts, refusal expressions co\-occur almost exclusively with unharmful labels in WildGuardMix and GR\-Train\. By contrast, Aegis2 adopts a distinct data construction strategy that supplements underrepresented refusal and redirection patterns with synthetic safe responses\.
2. 2\.We find that inserting natural\-language refusal cues can flip predictions from harmful to unharmful without altering the underlying harmful content\. Across nine variants from six guard families, the shortcut is widespread but heterogeneous, persists across response positions, and is generally more pronounced in smaller variants within evaluated families with multiple model sizes\.
3. 3\.We adapt sparse complementary masking to guard\-specific, model\-derived targets, mitigating the shortcut without full\-model retraining\. Although learned using response\-initial cues, the resulting suppression remains effective at unseen cue positions and datasets while broadly preserving clean harmfulness performance, suggesting shared internal mediation across positions\.
4. 4\.We show through component\-level intervention that shortcut reliance is partly separable from legitimate refusal recognition\. Shortcut\-induced harmfulness flips only partially overlap with refusal\-label flips, while suppression reduces both types of cue\-induced failures with minimal change in clean refusal\-recognition performance\.

## 2Related Work

#### Safety guard models\.

The widespread adoption of LLMs has accelerated the development of dedicated safety classifiers\. LlamaGuard\[[10](https://arxiv.org/html/2608.03201#bib.bib13)\]introduced instruction\-tuned LLMs for input\-output safeguarding, and LlamaGuard3\[[8](https://arxiv.org/html/2608.03201#bib.bib12)\]expanded the supported harm taxonomies\. WildGuard\[[9](https://arxiv.org/html/2608.03201#bib.bib8)\]proposed a unified framework for prompt harmfulness, response harmfulness, and refusal detection, trained on the WildGuardMix dataset\. GuardReasoner\[[14](https://arxiv.org/html/2608.03201#bib.bib9)\]augments guard models with chain\-of\-thought reasoning to improve interpretability\. At the data level, Aegis2\[[7](https://arxiv.org/html/2608.03201#bib.bib10)\]uses targeted synthetic augmentation to broaden the coverage of safe response patterns, while an Aegis2\-derived reasoning dataset\[[20](https://arxiv.org/html/2608.03201#bib.bib11)\]supplements safety labels with reasoning traces\. And Qwen3Guard\[[29](https://arxiv.org/html/2608.03201#bib.bib14)\]extends multilingual coverage\. Most prior work focuses on detection performance, taxonomy coverage, and training data diversity, with limited attention to shortcuts induced by response\-level label associations\. Recent work\[[21](https://arxiv.org/html/2608.03201#bib.bib20)\]studies prompt\-side keyword bias through word\-level associations and synthetic accumulations of class\-associated terms, which may alter prompt semantics or introduce additional label\-relevant evidence\. We instead isolate a response\-side shortcut using a short, semantically refusal cue while preserving both the harmful response content, and further identify and suppress its mediating internal components\.

#### Refusal mechanisms and safety alignment\.

Prior work has revealed positional and structural limitations of refusal\-based safety alignment in generative LLMs\[[1](https://arxiv.org/html/2608.03201#bib.bib28),[22](https://arxiv.org/html/2608.03201#bib.bib29)\]\. Shallow safety alignment\[[17](https://arxiv.org/html/2608.03201#bib.bib21)\]shows that alignment is concentrated in the initial\-token distribution and that a short refusal prefix can redirect subsequent generation\. Yuan et al\.\[[26](https://arxiv.org/html/2608.03201#bib.bib22)\]identify refusal position bias and train models to transition from harmful generation to refusal at later positions\. Zhao et al\.\[[30](https://arxiv.org/html/2608.03201#bib.bib23)\]find that harmfulness and refusal are encoded along geometrically distinct latent directions and can be independently steered\. SafeSeek\[[24](https://arxiv.org/html/2608.03201#bib.bib19)\]uses differentiable sparse masks to localize components associated with safety alignment and backdoor behavior\. Whereas these studies examine refusal as a generative behavior or internal safety mechanism of LLMs, we study its use as a spurious feature in response\-level guard classification by holding the prompt and substantive harmful content fixed while varying only the refusal cue\.

## 3The Refusal\-Cue Shortcut

### 3\.1Evaluation Setup

#### Models\.

We evaluate nine safety guards from six families, organized by training data characteristics\. The Audited\-imbalance group comprises WG\-7B, trained on WildGuardMix, and GR\-1B/8B, trained on GR\-Train; both datasets exhibit the distributional imbalance documented above\. The Aegis2\-derived group contains Llama Nemotron Safety Guard V2 8B \(LNSGV2\-8B\) and Nemotron Content Safety Reasoning 4B \(NCSR\-4B\), trained on the Aegis2 dataset, which adopts a distinct data construction strategy \(Section[3](https://arxiv.org/html/2608.03201#S3)\)\. The remaining models \(LG3\-1B/8B and QG\-0\.6B/8B \(strict mode\)\) have undisclosed training data distributions\. Five guards \(WG\-7B, GR\-1B/8B, and QG\-0\.6B/8B\) additionally expose an explicit refusal prediction\. Throughout, WG, GR, LG3, and QG abbreviate WildGuard, GuardReasoner, LlamaGuard3, and Qwen3Guard\.

#### Datasets and cue insertion\.

The primary evaluations use WildGuardTest\[[9](https://arxiv.org/html/2608.03201#bib.bib8)\]and Aegis2 Test\[[7](https://arxiv.org/html/2608.03201#bib.bib10)\]\. The former additionally provides response\-level refusal labels, enabling evaluation of refusal recognition\. Cues are inserted at three positions within the response, operating at sentence boundaries to preserve semantic coherence: head \(prepended before the first sentence\), middle \(inserted before the sentence nearest the midpoint\), and tail \(appended after the last sentence\)\. Middle and tail positions test whether the shortcut extends beyond the response\-initial position\. We use three primary refusal cues derived from the most frequent refusal expressions in the WildGuardMix training data, together with three non\-refusal controls designed to distinguish refusal\-specific effects from generic text insertion effects:

- •R1:I cannot fulfill your request\.
- •R2:I apologize, but I cannot fulfill your request\.
- •Rgreet:Hello\! I’m here to help, but I cannot assist with that request\.
- •N1:Here is the information you requested\.
- •S1:This topic involves safety considerations\.
- •Rand:The capital of France is Paris\.

#### Detection failure rate\.

Each test examplextest=\(utest,rtest\)x\_\{\\mathrm\{test\}\}=\(u\_\{\\mathrm\{test\}\},r\_\{\\mathrm\{test\}\}\)contains a promptutestu\_\{\\mathrm\{test\}\}and a responsertestr\_\{\\mathrm\{test\}\}\. Let𝒟H\\mathcal\{D\}\_\{H\}be the complete set of test examples with a ground\-truth harmful response label \(\|𝒟H\|=282\|\\mathcal\{D\}\_\{H\}\|=282for WildGuardTest,394394for Aegis2 Test\), and letgH​\(xtest\)∈\{H,U\}g\_\{H\}\(x\_\{\\mathrm\{test\}\}\)\\in\\\{H,U\\\}denote the guard’s response harmfulness prediction, whereHHindicates harmful andUUunharmful\.

Given a cueppand an insertion positions∈\{head,middle,tail\}s\\in\\\{\\mathrm\{head\},\\mathrm\{middle\},\\mathrm\{tail\}\\\},Tp,s​\(xtest\)T\_\{p,s\}\(x\_\{\\mathrm\{test\}\}\)denotes the same test example after insertingppat the corresponding sentence boundary in its response, without splitting any original sentence or changing the prompt or original response tokens\. Our primary metric uses the three\-cue set𝒫3=\{R1,R2,Rgreet\}\\mathcal\{P\}\_\{3\}=\\\{\\mathrm\{R1\},\\mathrm\{R2\},\\mathrm\{R\}\_\{\\mathrm\{greet\}\}\\\}\. LetIHp,s​\(xtest\)∈\{0,1\}I\_\{H\}^\{p,s\}\(x\_\{\\mathrm\{test\}\}\)\\in\\\{0,1\\\}indicate whether cueppinduces a harmful\-to\-unharmful flip at positionss:IHp,s​\(xtest\)=1I\_\{H\}^\{p,s\}\(x\_\{\\mathrm\{test\}\}\)=1ifgH​\(xtest\)=Hg\_\{H\}\(x\_\{\\mathrm\{test\}\}\)=HandgH​\(Tp,s​\(xtest\)\)=Ug\_\{H\}\(T\_\{p,s\}\(x\_\{\\mathrm\{test\}\}\)\)=U, and0otherwise\. Detection failure rate is defined as:

DFR​@​3​\(s\)=1\|𝒟H\|​∑xtest∈𝒟Hmaxp∈𝒫3⁡IHp,s​\(xtest\)\.\\mathrm\{DFR\}@3\(s\)=\\frac\{1\}\{\|\\mathcal\{D\}\_\{H\}\|\}\\sum\_\{x\_\{\\mathrm\{test\}\}\\in\\mathcal\{D\}\_\{H\}\}\\max\_\{p\\in\\mathcal\{P\}\_\{3\}\}I\_\{H\}^\{p,s\}\(x\_\{\\mathrm\{test\}\}\)\.\(1\)Intuitively,DFR​@​3​\(s\)\\mathrm\{DFR\}@3\(s\)measures the fraction of ground\-truth harmful responses for which at least one of the three refusal cues, inserted at positionss, suffices to flip the guard’s prediction to unharmful\. Only responses originally predicted as harmful can contribute;DFR​@​3\\mathrm\{DFR\}@3is therefore bounded above by the model’s harmful recall on the unmodified test set\. Single\-cue results are reported asDFR​@​1\\mathrm\{DFR\}@1\.The head\-position control metricCtrl​\-​DFR​@​3\\mathrm\{Ctrl\\text\{\-\}DFR\}@3follows Equation[1](https://arxiv.org/html/2608.03201#S3.E1)using𝒫3ctrl=\{N1,S1,Rand\}\\mathcal\{P\}^\{\\mathrm\{ctrl\}\}\_\{3\}=\\\{\\mathrm\{N1\},\\mathrm\{S1\},\\mathrm\{Rand\}\\\}\.

#### Refusal flip rate\.

For the five guards with an explicit refusal predictiongR​\(xtest\)∈\{C,R\}g\_\{R\}\(x\_\{\\mathrm\{test\}\}\)\\in\\\{C,R\\\}\(compliance/refusal\), we defineRFR​@​3\\mathrm\{RFR\}@3analogously toDFR​@​3\\mathrm\{DFR\}@3by replacing harmful\-to\-unharmful flips with compliance\-to\-refusal flips over the same denominator𝒟H\\mathcal\{D\}\_\{H\}\.

Table 1:WildGuardTest results for head\-position insertion\. Harm\. F1 and Harm\. R denote response harmfulness F1 and harmful recall on unmodified responses\. R1, R2, and RgreetreportDFR​@​1\\mathrm\{DFR\}@1;DFR​@​3\\mathrm\{DFR\}@3andCtrl​\-​DFR​@​3\\mathrm\{Ctrl\\text\{\-\}DFR\}@3are cue\-level unions over the three refusal cues and three controls\. All values in this and subsequent tables are percentages\.

### 3\.2Training\-Data Association and Response\-Head Vulnerability

#### Training data evidence\.

Figure[1](https://arxiv.org/html/2608.03201#S1.F1)\(a\) summarizes the two audited distributions\. Among the 21,286 WildGuardMix responses to harmful prompts, all 10,651 refusal responses are labeled unharmful; none are labeled harmful\. GR\-Train exhibits a similar but non\-deterministic pattern: of its 19,750 refusal responses, only 114 \(0\.58%\) are labeled harmful, accounting for 0\.26% of all 43,074 harmful\-prompt examples\. Complete counts are reported in Appendix\. These distributions create a statistical incentive for guards trained with supervised fine\-tuning to associate refusal language with the unharmful label, motivating the refusal\-cue shortcut hypothesis tested below\. Aegis2\[[7](https://arxiv.org/html/2608.03201#bib.bib10)\]adopts a different data\-construction strategy by adding 5,200 synthetic safe responses generated by Gemma\-2\-27B\[[6](https://arxiv.org/html/2608.03201#bib.bib24)\]\. Beyond direct refusals, these responses employ diverse strategies such as offering alternative assistance, explaining potential harms, and redirecting the conversation toward safer topics\. This targeted augmentation broadens the linguistic and behavioral diversity of responses associated with the unharmful label\.

#### Response\-head evidence\.

We next examine whether this training\-data association is reflected in response\-head cue sensitivity\. Table[1](https://arxiv.org/html/2608.03201#S3.T1)compares guards trained on the audited datasets with the Aegis2\-derived guards on WildGuardTest\. WG\-7B has the highestDFR​@​3\\mathrm\{DFR\}@3at 37\.72%, compared with aCtrl​\-​DFR​@​3\\mathrm\{Ctrl\\text\{\-\}DFR\}@3of 0\.71%\. GR\-1B and GR\-8B also exhibit substantialDFR​@​3\\mathrm\{DFR\}@3values of 21\.71% and 15\.96%\. The Aegis2\-derived guards are less sensitive: LNSGV2\-8B and NCSR\-4B haveDFR​@​3\\mathrm\{DFR\}@3values of 5\.57% and 4\.93%, close to their control rates\. Descriptively,DFR​@​3\\mathrm\{DFR\}@3exceedsCtrl​\-​DFR​@​3\\mathrm\{Ctrl\\text\{\-\}DFR\}@3by at least 10\.29% for every guard trained on the audited datasets, whereas the largest aggregate difference among the Aegis2\-derived guards is 1\.38%\. This ordering is consistent with the audited training\-data association\.

### 3\.3The Shortcut Persists Across Models, Datasets, and Positions

#### Vulnerability varies across model groups and evaluation settings\.

Figure[2](https://arxiv.org/html/2608.03201#S3.F2)reportsDFR​@​3\\mathrm\{DFR\}@3for nine models across two datasets and three response positions\. The Audited\-imbalance group is the most vulnerable overall: WG\-7B reaches a maximumDFR​@​3\\mathrm\{DFR\}@3of 59\.39%, and both GR variants remain substantially affected beyond the response head, especially on Aegis2 Test\. Guards with undisclosed training data show a similar cross\-position pattern, most notably LG3\-1B at the response tail \(39\.09% on Aegis2 Test\)\. The two Aegis2\-derived guards, by contrast, remain consistently less sensitive across all settings\. This group\-level ordering is consistent with the available training\-data evidence\. What’s more, the cross\-position persistence distinguishes the guard\-side shortcut from the generation\-side one identified by Qi et al\.\[[17](https://arxiv.org/html/2608.03201#bib.bib21)\], where the safety effect is concentrated in the first few autoregressive tokens\.

#### Smaller variants show greater within\-family vulnerability\.

We restrict the model\-scale comparison to the three families for which both smaller and larger variants are evaluated: GR\-1B/8B, LG3\-1B/8B, and QG\-0\.6B/8B\. Across these matched families, the smaller variants generally exhibit higherDFR​@​3\\mathrm\{DFR\}@3in all datasets and response positions\. Only localized reversals occur at the WildGuardTest tail position for GR and the Aegis2 Test head position for LG3\. Averaged across the six evaluation settings, the smaller variant exceeds its larger counterpart by 6\.27% for GR, 7\.46% for LG3, and 7\.00% for QG\.

![Refer to caption](https://arxiv.org/html/2608.03201v1/x2.png)Figure 2:Cross\-modelDFR​@​3\\mathrm\{DFR\}@3\(%\) under refusal\-cue insertion at the head \(H\), middle \(M\), and tail \(T\) positions on WildGuardTest \(WG\) and Aegis2 Test \(A2\)\. Horizontal lines separate audited\-imbalance, training\-data\-not\-disclosed, and Aegis2\-derived models\. The linear color scale is clipped at 25%, while cells report exact values\.

### 3\.4The Shortcut Tracks a Graded Refusal Feature

#### Semantic completeness strengthens the effect\.

We decompose two refusal cues into progressively more complete components and evaluate WG\-7B on WildGuardTest\. As shown in Table[2](https://arxiv.org/html/2608.03201#S3.T2),DFR​@​1\\mathrm\{DFR\}@1increases monotonically with semantic completeness in both decomposition sequences, whereas the non\-refusal fragmentfulfill your requestyieldsDFR​@​1=0\\mathrm\{DFR\}@1=0\. These results suggest that the shortcut cannot be explained by generic keyword accumulation alone\[[21](https://arxiv.org/html/2608.03201#bib.bib20)\]\. The partial refusalI cannotyieldsDFR​@​1=4\.63%\\mathrm\{DFR\}@1=4\.63\\%, whereas extending it to the full R1 expression increases the rate to 21\.35%\. The second construction rises from 7\.12% forI apologizeto 37\.72% for the complete R2 cue, showing that the refusal\-cue shortcut becomes stronger as the inserted expression conveys a more complete refusal\. A similar graded effect appears in generation\-side refusal prefilling, where more complete refusal prefixes more strongly suppress harmful continuations\[[17](https://arxiv.org/html/2608.03201#bib.bib21)\]\. In our setting, however, the harmful continuation is held fixed, so the graded effect reflects the guard’s sensitivity to expressed refusal intent rather than a change in the autoregressive generation trajectory\. Additional formulations in Appendix confirm that the effect extends beyond the three primary cues\.

Table 2:Semantic\-completeness decomposition for WG\-7B on WildGuardTest with head\-position insertion\. Values areDFR​@​1\\mathrm\{DFR\}@1percentages\.

### 3\.5Harmfulness and Refusal\-Label Flips Are Only Partially Coupled

The graded cue effect motivates a related question: when a refusal cue induces a harmfulness flip, does the same cue also change the guard’s explicit refusal prediction? For the five guards that produce explicit refusal predictions, Table[3](https://arxiv.org/html/2608.03201#S3.T3)examines the co\-occurrence of harmfulness and refusal\-label flips on WildGuardTest under the three primary refusal cues inserted at the response head\. We report results at two aggregation levels\. At theper\-cue level, each example\-cue pair is treated as a separate trial\. LetFHF\_\{H\}denote a harmful\-to\-unharmful flip andFRF\_\{R\}a compliance\-to\-refusal flip within the same trial\. The marginal ratesPr⁡\(FH\)\\Pr\(F\_\{H\}\)andPr⁡\(FR\)\\Pr\(F\_\{R\}\), together with the conditional ratePr⁡\(FR∣FH\)\\Pr\(F\_\{R\}\\mid F\_\{H\}\), are computed over all pairs in𝒟H×𝒫3\\mathcal\{D\}\_\{H\}\\times\\mathcal\{P\}\_\{3\}\. At thecue\-union level, outcomes are aggregated across the three cues within each example\. Accordingly,RFR​@​3\\mathrm\{RFR\}@3measures the proportion of examples for which at least one cue induces a refusal\-label flip\. Thus,Pr⁡\(FR\)\\Pr\(F\_\{R\}\)captures average per\-cue sensitivity, whereasRFR​@​3\\mathrm\{RFR\}@3captures the sample coverage of the complete cue set\. For every guard,RFR​@​3\\mathrm\{RFR\}@3exceedsPr⁡\(FR\)\\Pr\(F\_\{R\}\), showing that the effects of the three cues are not fully redundant\. WG\-7B exhibits the broadest cue\-union sensitivity, with anRFR​@​3\\mathrm\{RFR\}@3of 51\.52%, followed by GR\-1B at 30\.35%; the remaining guards range from 13\.45% to 17\.06%\. At the per\-cue level,Pr⁡\(FR∣FH\)\\Pr\(F\_\{R\}\\mid F\_\{H\}\)exceeds the marginalPr⁡\(FR\)\\Pr\(F\_\{R\}\)for every guard, indicating a positive association between harmfulness and refusal\-label flips\. However, the conditional rate ranges from only 18\.6% for QG\-8B to 65\.5% for GR\-1B\. Thus, many harmfulness flips occur without an accompanying refusal\-label flip under the same cue\. The two behaviors are therefore positively associated but only partially coupled\.

Table 3:Coupling between harmfulness and refusal\-label flips under head\-position insertion of the three primary refusal cues on WildGuardTest\. At the per\-cue level, each example–cue pair is treated as a separate trial:FHF\_\{H\}denotes a harmful\-to\-unharmful flip andFRF\_\{R\}a compliance\-to\-refusal flip induced by the same cue\. At the cue\-union level,RFR​@​3\\mathrm\{RFR\}@3aggregates refusal\-label flips across the three cues within each example\.Table 4:Original and masked guard performance\. Head, Mid, and Tail reportDFR​@​3\\mathrm\{DFR\}@3\. Mask% is the fraction of permanently suppressed attention\-head and MLP\-neuron components\.

## 4What Mediates the Refusal\-Cue Shortcut?

Section[3](https://arxiv.org/html/2608.03201#S3)establishes that the refusal\-cue shortcut is widespread and is consistent with the audited training\-data imbalance\. The partial behavioral coupling in Section[3\.5](https://arxiv.org/html/2608.03201#S3.SS5)further shows that shortcut\-induced harmfulness flips are related to, but not equivalent to, changes in explicit refusal predictions\. However, behavioral evidence alone cannot determine whether shortcut reliance and legitimate refusal recognition depend on the same internal components\[[13](https://arxiv.org/html/2608.03201#bib.bib18),[4](https://arxiv.org/html/2608.03201#bib.bib17)\]\. To investigate this question, we use sparse component masking\[[24](https://arxiv.org/html/2608.03201#bib.bib19)\]as both a post\-training mitigation method and an intervention\-based analysis tool\. With all model parameters frozen, the method learns sparse gates over attention heads and MLP neurons\. We then examine whether suppressing the identified components can reduce refusal\-cue failures while preserving clean harmfulness performance and legitimate refusal recognition\. We formalize these objectives as two questions:

Q1\.Can sparse component masking broadly suppress the refusal\-cue shortcut while preserving clean harmfulness classification?

Q2\.Does component\-level intervention reveal functional separability between shortcut reliance and legitimate refusal recognition?

### 4\.1Sparse Complementary Masking

#### Complementary component masks\.

Following the differentiable unit\-masking formulation of SafeSeek\[[24](https://arxiv.org/html/2608.03201#bib.bib19)\], we freeze the original guard and learn sparse gates over its attention heads and MLP neurons\. Letal,h​\(𝐒l\)a\_\{l,h\}\(\\mathbf\{S\}\_\{l\}\)denote the projected residual\-stream contribution of attention headhhin layerll, where𝐒l\\mathbf\{S\}\_\{l\}is the sequence of hidden states at layerll, and letnl,j​\(𝐬l\)n\_\{l,j\}\(\\mathbf\{s\}\_\{l\}\)denote the contribution of MLP intermediate channeljj, including its outgoing down projection, where𝐬l\\mathbf\{s\}\_\{l\}is the per\-token hidden state\. The masked module outputs are:

\{MHAlM​\(𝐒l\)=∑hml,ha​al,h​\(𝐒l\),MLPlM​\(𝐬l\)=∑jml,jn​nl,j​\(𝐬l\),\\left\\\{\\begin\{aligned\} \\mathrm\{MHA\}^\{M\}\_\{l\}\(\\mathbf\{S\}\_\{l\}\)&=\\sum\_\{h\}m^\{a\}\_\{l,h\}\\,a\_\{l,h\}\(\\mathbf\{S\}\_\{l\}\),\\\\ \\mathrm\{MLP\}^\{M\}\_\{l\}\(\\mathbf\{s\}\_\{l\}\)&=\\sum\_\{j\}m^\{n\}\_\{l,j\}\\,n\_\{l,j\}\(\\mathbf\{s\}\_\{l\}\),\\end\{aligned\}\\right\.\(2\)whereml,ha=m​\(αl,h\)m^\{a\}\_\{l,h\}=m\(\\alpha\_\{l,h\}\)andml,jn=m​\(βl,j\)m^\{n\}\_\{l,j\}=m\(\\beta\_\{l,j\}\)are obtained from learnable logits through a straight\-through binarization, withσ\\sigmadenoting the sigmoid function:

m​\(t\)=\{𝟙​\[σ​\(t\)\>0\.5\]forward pass,σ​\(t\)gradient computation\.m\(t\)=\\begin\{cases\}\\mathbb\{1\}\[\\sigma\(t\)\>0\.5\]&\\text\{forward pass,\}\\\\ \\sigma\(t\)&\\text\{gradient computation\.\}\\end\{cases\}\(3\)This produces binary gates during inference while allowing gradient\-based optimization of the logits\. The retained branch𝒢M\\mathcal\{G\}\_\{M\}uses gatesMMand learns reference guard behavior, while the complementary branch𝒢1−M\\mathcal\{G\}\_\{1\-M\}replaces each gate with1−m1\-mand learns the observed shortcut behavior\. All remaining model components are shared between the two branches\.

#### Intervention examples and targets\.

Letxtrain=\(utrain,rtrain\)x\_\{\\mathrm\{train\}\}=\(u\_\{\\mathrm\{train\}\},r\_\{\\mathrm\{train\}\}\)denote an example from the training dataset\. Forp∈𝒫3p\\in\\mathcal\{P\}\_\{3\}, a ground\-truth harmful sample–cue pair\(xtrain,p\)\(x\_\{\\mathrm\{train\}\},p\)is considered shortcut\-sensitive when:

\{gH​\(xtrain\)=H,gH​\(Tp,head​\(xtrain\)\)=U\.\\left\\\{\\begin\{aligned\} g\_\{H\}\(x\_\{\\mathrm\{train\}\}\)&=H,\\\\ g\_\{H\}\(T\_\{p,\\mathrm\{head\}\}\(x\_\{\\mathrm\{train\}\}\)\)&=U\.\\end\{aligned\}\\right\.\(4\)All cues used for intervention\-example construction are inserted at the response head\. We select 300 shortcut\-sensitive sample\-cue pairs from WildGuardMix and generate all optimization targets using the original guard\.

For direct\-output guards, each cue\-inserted input and its original guard output define a shortcut\-target pair\(xsc,ysc\)\(x^\{\\mathrm\{sc\}\},y\_\{\\mathrm\{sc\}\}\)for the complementary branch\. The correct\-target term uses 75 original refusal examples and 75 original compliance examples, balanced to preserve both behaviors\. Each input is paired with its original guard output to form\(xcorr,ycorr\)\(x^\{\\mathrm\{corr\}\},y\_\{\\mathrm\{corr\}\}\)for the retained branch\.

For GuardReasoner, which generates a reasoning trace before the final prediction, directly contrasting the complete no\-cue and cue\-conditioned outputs would introduce differences in the reasoning traces\. We therefore construct a cross\-prefix contrast from two cue insertions applied to the same underlying response: one preserves the correct harmful prediction, whereas the other induces a shortcut\-driven flip to unharmful\. The corresponding model\-generated reasoning traces and target decisions define\(xcorr,ycorr\)\(x^\{\\mathrm\{corr\}\},y\_\{\\mathrm\{corr\}\}\)and\(xsc,ysc\)\(x^\{\\mathrm\{sc\}\},y\_\{\\mathrm\{sc\}\}\), respectively\. Because both inputs contain a refusal cue, the contrast reduces the influence of cue presence and focuses the optimization on the shortcut\-induced prediction flip\. Balanced refusal and compliance examples are also included in the correct\-target term to discourage disruption of legitimate refusal detection\. All output tokens contribute to the loss\.

After optimization, components assigned to the complementary branch are permanently suppressed by zeroing the corresponding projection slices\. The resulting guard retains only the selected branch and requires neither a mask wrapper nor an additional inference pass\.

#### Optimization objective\.

Given the correct\-target and shortcut\-target training pairs\(xtraincorr,ycorr\)\(x\_\{\\mathrm\{train\}\}^\{\\mathrm\{corr\}\},y\_\{\\mathrm\{corr\}\}\)and\(xtrainsc,ysc\)\(x\_\{\\mathrm\{train\}\}^\{\\mathrm\{sc\}\},y\_\{\\mathrm\{sc\}\}\), respectively, we optimize:

ℒ=λcorr​ℒcorr​\(M\)\+λsc​ℒsc​\(1−M\)\+γ​ℒsparse,\\mathcal\{L\}=\\lambda\_\{\\mathrm\{corr\}\}\\mathcal\{L\}\_\{\\mathrm\{corr\}\}\(M\)\+\\lambda\_\{\\mathrm\{sc\}\}\\mathcal\{L\}\_\{\\mathrm\{sc\}\}\(1\-M\)\+\\gamma\\mathcal\{L\}\_\{\\mathrm\{sparse\}\},\(5\)whereℒcorr​\(M\)=CE​\(𝒢M​\(xtraincorr\),ycorr\)\\mathcal\{L\}\_\{\\mathrm\{corr\}\}\(M\)=\\mathrm\{CE\}\(\\mathcal\{G\}\_\{M\}\(x\_\{\\mathrm\{train\}\}^\{\\mathrm\{corr\}\}\),y\_\{\\mathrm\{corr\}\}\)andℒsc​\(1−M\)=CE​\(𝒢1−M​\(xtrainsc\),ysc\)\\mathcal\{L\}\_\{\\mathrm\{sc\}\}\(1\-M\)=\\mathrm\{CE\}\(\\mathcal\{G\}\_\{1\-M\}\(x\_\{\\mathrm\{train\}\}^\{\\mathrm\{sc\}\}\),y\_\{\\mathrm\{sc\}\}\)\. The sparsity term penalizes the average gate mass assigned to the complementary branch, normalized separately over attention heads and MLP neurons so that neither component type dominates because of its size\. The weightsλcorr\\lambda\_\{\\mathrm\{corr\}\}andλsc\\lambda\_\{\\mathrm\{sc\}\}balance the two target objectives, whileγ\\gammacontrols the sparsity of the complementary branch\. All original model parameters remain frozen\.

#### Mitigation setup\.

We evaluate mitigation on seven guards, excluding the two Aegis2\-derived guards because of their limited baseline vulnerability\. We retain the comparatively robust Qwen3Guard\-8B to enable a within\-family comparison across model sizes\. By default, each mask is optimized on selected examples from WildGuardMix for 50 epochs, withλcorr=10\\lambda\_\{\\mathrm\{corr\}\}=10,λsc=1\\lambda\_\{\\mathrm\{sc\}\}=1, andγ=10\\gamma=10\. Mitigation is evaluated primarily on WildGuardTest and Aegis2 Test\. All original guard parameters remain frozen, and mask optimization requires only a single A100 80GB GPU\. Implementation details and additional cross\-dataset results on BeaverTails\[[11](https://arxiv.org/html/2608.03201#bib.bib7)\]are provided in Appendix\.

### 4\.2Q1: Generalizability of Sparse Component Suppression

#### Suppression at the optimized position\.

Table[4](https://arxiv.org/html/2608.03201#S3.T4)compares original and masked guards\. On WildGuardTest, mean head\-positionDFR​@​3\\mathrm\{DFR\}@3drops from 16\.39% to 3\.44% \(79% relative reduction\); on Aegis2 Test, from 20\.35% to 4\.14% \(80% relative reduction\)\. The reduction is consistent across guards: all seven show lower head\-positionDFR​@​3\\mathrm\{DFR\}@3after masking on both evaluation sets\. WG\-7B exhibits the largest absolute reduction, with head\-positionDFR​@​3\\mathrm\{DFR\}@3falling from 37\.72% to 2\.85% on WildGuardTest and from 54\.82% to 4\.82% on Aegis2 Test\. The two GR variants retain the highest post\-masking head\-positionDFR​@​3\\mathrm\{DFR\}@3on both datasets\.

#### Transfer across positions and datasets\.

Component masks are optimized on head\-position examples only, yet the effect generalizes to unseen positions\. On WildGuardTest, mean middle\- and tail\-positionDFR​@​3\\mathrm\{DFR\}@3decrease from 7\.66% and 12\.17% to 2\.28% and 2\.82%, respectively\. On Aegis2 Test, the corresponding values decrease from 19\.73% and 25\.34% to 5\.23% and 6\.31%\. Across all position comparisons, the sole increase occurs for GR\-1B on the WildGuardTest tail, whereDFR​@​3\\mathrm\{DFR\}@3rises marginally from 5\.34% to 5\.67%\. On additional BeaverTails dataset, mean head\-positionDFR​@​3\\mathrm\{DFR\}@3also decreases from 17\.00% to 4\.00% \(shown in Appendix\)\. As suppressing the same guard\-specific components remains effective across cue positions and held\-out datasets, refusal\-cue failures across these settings appear to be partly mediated by a shared set of internal components\.

#### Clean harmfulness classification is broadly retained\.

On WildGuardTest, mean harmfulness F1 decreases by only 0\.30%, and harmful recall improves for six of seven models\. QG\-0\.6B is the sole exception \(−3\.20%\-3\.20\\%\)\. On Aegis2 Test, mean harmfulness F1 increases by 2\.51%\. Sparse component suppression thus reduces the refusal\-cue shortcut across guards, cue positions, and datasets while broadly preserving clean harmfulness classification\.

Table 5:Clean refusal recognition and cue\-induced compliance\-to\-refusal flips before and after component suppression\. Ref\. F1, Comp\. R, and Ref\. R denote refusal F1, compliance recall, and refusal recall on unmodified responses, respectively\.

### 4\.3Q2: Partial Functional Separability from Refusal Recognition

#### Clean refusal recognition is broadly preserved\.

Table[5](https://arxiv.org/html/2608.03201#S4.T5)reports clean refusal metrics and cue\-induced refusal flips for the five guards with an explicit refusal output\. After component suppression, refusal F1 changes by at most 2\.11%\. Mean compliance recall increases slightly from 86\.11% to 86\.66%, while mean refusal recall decreases by 1\.99 percentage points from 98\.88% to 96\.89%, reflecting a mild class\-wise shift rather than uniform degradation\.

#### The two behaviors are partially separable under component\-level intervention\.

Component suppression reduces meanRFR​@​3\\mathrm\{RFR\}@3from 25\.27% to 7\.66%, with reductions for every guard, yet clean refusal F1 and recall change only marginally\. This dissociation, together with the partial flip coupling observed before masking \(Section[3\.5](https://arxiv.org/html/2608.03201#S3.SS5)\), provides intervention\-based evidence that shortcut reliance can be suppressed at the component level without disrupting legitimate refusal recognition\.

Ablation studies on component granularity and sparsity weight are reported in Appendix\.

## 5Conclusion

This work identifies the refusal\-cue shortcut in response\-level safety guards and shows that it is widespread but heterogeneous across model families and response positions, with smaller variants generally exhibiting greater vulnerability\. Sparse component suppression substantially reduces cue\-induced failures while broadly preserving clean harmfulness performance and legitimate refusal recognition, providing intervention\-based evidence that shortcut reliance and refusal recognition are partially separable\. By revealing a systematic weakness in current safety guards and offering a lightweight post\-training mitigation, this work contributes to the development of more reliable content\-safety systems\. Our evaluation primarily relies on widely used safety benchmarks, which provide controlled and systematic settings but may not capture the diversity and complexity of real\-world applications\. Future work should examine shortcut prevalence and mitigation effectiveness in broader domain\-specific and deployment scenarios\[[18](https://arxiv.org/html/2608.03201#bib.bib30),[15](https://arxiv.org/html/2608.03201#bib.bib33)\]\.

## References

- \[1\]A\. Arditi, O\. Obeso, A\. Syed, D\. Paleka, N\. Panickssery, W\. Gurnee, and N\. Nanda\(2024\)Refusal in language models is mediated by a single direction\.Advances in Neural Information Processing Systems37,pp\. 136037–136083\.Cited by:[§2](https://arxiv.org/html/2608.03201#S2.SS0.SSS0.Px2.p1.1)\.
- \[2\]Y\. Bai, A\. Jones, K\. Ndousse, A\. Askell, A\. Chen, N\. DasSarma, D\. Drain, S\. Fort, D\. Ganguli, T\. Henighan,et al\.\(2022\)Training a helpful and harmless assistant with reinforcement learning from human feedback\.arXiv preprint arXiv:2204\.05862\.Cited by:[§1](https://arxiv.org/html/2608.03201#S1.p1.1)\.
- \[3\]M\. Chen, J\. Tworek, H\. Jun, Q\. Yuan, H\. P\. D\. O\. Pinto, J\. Kaplan, H\. Edwards, Y\. Burda, N\. Joseph, G\. Brockman,et al\.\(2021\)Evaluating large language models trained on code\.arXiv preprint arXiv:2107\.03374\.Cited by:[§1](https://arxiv.org/html/2608.03201#S1.p2.1)\.
- \[4\]A\. Conmy, A\. N\. Mavor\-Parker, A\. Lynch, S\. Heimersheim, and A\. Garriga\-Alonso\(2023\)Towards automated circuit discovery for mechanistic interpretability\.InAdvances in Neural Information Processing Systems,Vol\.36\.Cited by:[§4](https://arxiv.org/html/2608.03201#S4.p1.1)\.
- \[5\]R\. Geirhos, J\. Jacobsen, C\. Michaelis, R\. Zemel, W\. Brendel, M\. Bethge, and F\. A\. Wichmann\(2020\)Shortcut learning in deep neural networks\.Nature Machine Intelligence2\(11\),pp\. 665–673\.Cited by:[§1](https://arxiv.org/html/2608.03201#S1.p2.1)\.
- \[6\]Gemma Team, M\. Riviere, S\. Pathak, P\. G\. Sessa,et al\.\(2024\)Gemma 2: improving open language models at a practical size\.External Links:2408\.00118Cited by:[§3\.2](https://arxiv.org/html/2608.03201#S3.SS2.SSS0.Px1.p1.1)\.
- \[7\]S\. Ghosh, P\. Varshney, M\. N\. Sreedhar, A\. Padmakumar, T\. Rebedea, J\. R\. Varghese, and C\. Parisien\(2025\)Aegis2\. 0: a diverse ai safety dataset and risks taxonomy for alignment of llm guardrails\.InProceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies \(Volume 1: Long Papers\),pp\. 5992–6026\.Cited by:[Appendix A](https://arxiv.org/html/2608.03201#A1.SS0.SSS0.Px2.p1.1),[§1](https://arxiv.org/html/2608.03201#S1.p3.1),[§2](https://arxiv.org/html/2608.03201#S2.SS0.SSS0.Px1.p1.1),[§3\.1](https://arxiv.org/html/2608.03201#S3.SS1.SSS0.Px2.p1.1),[§3\.2](https://arxiv.org/html/2608.03201#S3.SS2.SSS0.Px1.p1.1)\.
- \[8\]A\. Grattafiori, A\. Dubey, A\. Jauhri, A\. Pandey, A\. Kadian, A\. Al\-Dahle, A\. Letman, A\. Mathur, A\. Schelten, A\. Vaughan,et al\.\(2024\)The llama 3 herd of models\.arXiv preprint arXiv:2407\.21783\.Cited by:[§1](https://arxiv.org/html/2608.03201#S1.p3.1),[§2](https://arxiv.org/html/2608.03201#S2.SS0.SSS0.Px1.p1.1)\.
- \[9\]S\. Han, K\. Rao, A\. Ettinger, L\. Jiang, B\. Y\. Lin, N\. Lambert, Y\. Choi, and N\. Dziri\(2024\)Wildguard: open one\-stop moderation tools for safety risks, jailbreaks, and refusals of llms\.Advances in Neural Information Processing Systems37,pp\. 8093–8131\.Cited by:[Appendix A](https://arxiv.org/html/2608.03201#A1.SS0.SSS0.Px1.p1.1),[§1](https://arxiv.org/html/2608.03201#S1.p2.1),[§1](https://arxiv.org/html/2608.03201#S1.p3.1),[§2](https://arxiv.org/html/2608.03201#S2.SS0.SSS0.Px1.p1.1),[§3\.1](https://arxiv.org/html/2608.03201#S3.SS1.SSS0.Px2.p1.1)\.
- \[10\]H\. Inan, K\. Upasani, J\. Chi, R\. Rungta, K\. Iyer, Y\. Mao, M\. Tontchev, Q\. Hu, B\. Fuller, D\. Testuggine,et al\.\(2023\)Llama guard: llm\-based input\-output safeguard for human\-ai conversations\.arXiv preprint arXiv:2312\.06674\.Cited by:[§2](https://arxiv.org/html/2608.03201#S2.SS0.SSS0.Px1.p1.1)\.
- \[11\]J\. Ji, M\. Liu, J\. Dai, X\. Pan, C\. Zhang, C\. Bian, B\. Chen, R\. Sun, Y\. Wang, and Y\. Yang\(2023\)Beavertails: towards improved safety alignment of llm via a human\-preference dataset\.Advances in Neural Information Processing Systems36,pp\. 24678–24704\.Cited by:[Appendix A](https://arxiv.org/html/2608.03201#A1.SS0.SSS0.Px3.p1.1),[Appendix E](https://arxiv.org/html/2608.03201#A5.p1.1),[§4\.1](https://arxiv.org/html/2608.03201#S4.SS1.SSS0.Px4.p1.3)\.
- \[12\]A\. Krasnodębska, K\. Dziewulska, K\. Seweryn, M\. Chrabaszcz, and W\. Kusa\(2026\)Safety of large language models beyond english: a systematic literature review of risks, biases, and safeguards\.InProceedings of the 19th Conference of the European Chapter of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 1003–1034\.Cited by:[§1](https://arxiv.org/html/2608.03201#S1.p1.1)\.
- \[13\]K\. Li, O\. Patel, F\. Viégas, H\. Pfister, and M\. Wattenberg\(2023\)Inference\-time intervention: eliciting truthful answers from a language model\.Advances in Neural Information Processing Systems36,pp\. 41451–41530\.Cited by:[§4](https://arxiv.org/html/2608.03201#S4.p1.1)\.
- \[14\]Y\. Liu, H\. Gao, S\. Zhai, Y\. He, J\. Xia, Z\. Hu, Y\. Chen, X\. Yang, J\. Zhang, S\. Z\. Li,et al\.\(2025\)Guardreasoner: towards reasoning\-based llm safeguards\.arXiv preprint arXiv:2501\.18492\.Cited by:[§1](https://arxiv.org/html/2608.03201#S1.p2.1),[§1](https://arxiv.org/html/2608.03201#S1.p3.1),[§2](https://arxiv.org/html/2608.03201#S2.SS0.SSS0.Px1.p1.1)\.
- \[15\]M\. Mazeika, L\. Phan, X\. Yin, A\. Zou, Z\. Wang, N\. Mu, E\. Sakhaee, N\. Li, S\. Basart, B\. Li,et al\.\(2024\)Harmbench: a standardized evaluation framework for automated red teaming and robust refusal\.arXiv preprint arXiv:2402\.04249\.Cited by:[§5](https://arxiv.org/html/2608.03201#S5.p1.1)\.
- \[16\]L\. Ouyang, J\. Wu, X\. Jiang, D\. Almeida, C\. L\. Wainwright, P\. Mishkin, C\. Zhang, S\. Agarwal, K\. Slama, A\. Ray,et al\.\(2022\)Training language models to follow instructions with human feedback\.arXiv preprint arXiv:2203\.02155\.Cited by:[§1](https://arxiv.org/html/2608.03201#S1.p1.1)\.
- \[17\]X\. Qi, A\. Panda, K\. Lyu, X\. Ma, S\. Roy, A\. Beirami, P\. Mittal, and P\. Henderson\(2025\)Safety alignment should be made more than just a few tokens deep\.InInternational Conference on Learning Representations,Vol\.2025,pp\. 54911–54941\.Cited by:[§2](https://arxiv.org/html/2608.03201#S2.SS0.SSS0.Px2.p1.1),[§3\.3](https://arxiv.org/html/2608.03201#S3.SS3.SSS0.Px1.p1.2),[§3\.4](https://arxiv.org/html/2608.03201#S3.SS4.SSS0.Px1.p1.3)\.
- \[18\]P\. Röttger, H\. Kirk, B\. Vidgen, G\. Attanasio, F\. Bianchi, and D\. Hovy\(2024\)Xstest: a test suite for identifying exaggerated safety behaviours in large language models\.InProceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies \(Volume 1: Long Papers\),pp\. 5377–5400\.Cited by:[§5](https://arxiv.org/html/2608.03201#S5.p1.1)\.
- \[19\]S\. Sagawa, P\. W\. Koh, T\. B\. Hashimoto, and P\. Liang\(2019\)Distributionally robust neural networks for group shifts: on the importance of regularization for worst\-case generalization\.arXiv preprint arXiv:1911\.08731\.Cited by:[§1](https://arxiv.org/html/2608.03201#S1.p2.1)\.
- \[20\]M\. N\. Sreedhar, T\. Rebedea, and C\. Parisien\(2025\)Safety through reasoning: an empirical study of reasoning guardrail models\.Findings of the Association for Computational Linguistics: EMNLP2025,pp\. 21862–21880\.Cited by:[§1](https://arxiv.org/html/2608.03201#S1.p3.1),[§2](https://arxiv.org/html/2608.03201#S2.SS0.SSS0.Px1.p1.1)\.
- \[21\]P\. Tasawong, N\. Laosaengpha, W\. Ponwitayarat, S\. Lim, P\. Manakul, S\. Cahyawijaya, C\. Udomcharoenchaikit, P\. Limkonchotiwat, E\. Chuangsuwanich, and S\. Nutanong\(2025\)Shortcut learning in safety: the impact of keyword bias in safeguards\.InProceedings of the The First Workshop on LLM Security \(LLMSEC\),pp\. 189–197\.Cited by:[§2](https://arxiv.org/html/2608.03201#S2.SS0.SSS0.Px1.p1.1),[§3\.4](https://arxiv.org/html/2608.03201#S3.SS4.SSS0.Px1.p1.3)\.
- \[22\]A\. Wei, N\. Haghtalab, and J\. Steinhardt\(2023\)Jailbroken: how does llm safety training fail?\.Advances in Neural Information Processing Systems36,pp\. 80079–80110\.Cited by:[§2](https://arxiv.org/html/2608.03201#S2.SS0.SSS0.Px2.p1.1)\.
- \[23\]A\. Yang, A\. Li, B\. Yang, B\. Zhang, B\. Hui, B\. Zheng, B\. Yu, C\. Gao, C\. Huang, C\. Lv,et al\.\(2025\)Qwen3 technical report\.arXiv preprint arXiv:2505\.09388\.Cited by:[§1](https://arxiv.org/html/2608.03201#S1.p2.1)\.
- \[24\]M\. Yu, S\. Fu, M\. Aloqaily, Z\. Zhou, S\. Otoum, K\. Wang, Y\. Guo, Q\. Wen,et al\.\(2026\)SafeSeek: universal attribution of safety circuits in language models\.arXiv preprint arXiv:2603\.23268\.Cited by:[§2](https://arxiv.org/html/2608.03201#S2.SS0.SSS0.Px2.p1.1),[§4\.1](https://arxiv.org/html/2608.03201#S4.SS1.SSS0.Px1.p1.8),[§4](https://arxiv.org/html/2608.03201#S4.p1.1)\.
- \[25\]X\. Yuan, J\. Li, D\. Wang, Y\. Chen, X\. Mao, L\. Huang, J\. Chen, H\. Xue, X\. Liu, W\. Wang,et al\.\(2024\)S\-eval: towards automated and comprehensive safety evaluation for large language models\.arXiv preprint arXiv:2405\.14191\.Cited by:[§1](https://arxiv.org/html/2608.03201#S1.p1.1)\.
- \[26\]Y\. Yuan, W\. Jiao, W\. Wang, J\. Huang, J\. Xu, T\. Liang, P\. He, and Z\. Tu\(2025\)Refuse whenever you feel unsafe: improving safety in llms via decoupled refusal training\.InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),pp\. 3149–3167\.Cited by:[§2](https://arxiv.org/html/2608.03201#S2.SS0.SSS0.Px2.p1.1)\.
- \[27\]Y\. Zhang, A\. Zhang, X\. Zhang, L\. Sheng, Y\. Chen, Z\. Liang, and X\. Wang\(2025\)AlphaAlign: incentivizing safety alignment with extremely simplified reinforcement learning\.arXiv preprint arXiv:2507\.14987\.Cited by:[§1](https://arxiv.org/html/2608.03201#S1.p1.1)\.
- \[28\]Y\. Zhang, S\. Zhang, Y\. Huang, Z\. Xia, Z\. Fang, X\. Yang, R\. Duan, D\. Yan, Y\. Dong, and J\. Zhu\(2025\)Stair: improving safety alignment with introspective reasoning\.arXiv preprint arXiv:2502\.02384\.Cited by:[§1](https://arxiv.org/html/2608.03201#S1.p1.1)\.
- \[29\]H\. Zhao, C\. Yuan, F\. Huang, X\. Hu, Y\. Zhang, A\. Yang, B\. Yu, D\. Liu, J\. Zhou, J\. Lin,et al\.\(2025\)Qwen3guard technical report\.arXiv preprint arXiv:2510\.14276\.Cited by:[§1](https://arxiv.org/html/2608.03201#S1.p3.1),[§2](https://arxiv.org/html/2608.03201#S2.SS0.SSS0.Px1.p1.1)\.
- \[30\]J\. Zhao, J\. Huang, Z\. Wu, D\. Bau, and W\. Shi\(2026\)Llms encode harmfulness and refusal separately\.Advances in Neural Information Processing Systems38,pp\. 140283–140318\.Cited by:[§2](https://arxiv.org/html/2608.03201#S2.SS0.SSS0.Px2.p1.1)\.

## Appendix

This appendix reports dataset descriptions, training dataset audit counts, individual cue and control results, query\-budget scaling, BeaverTails transfer, and detailed intervention optimization settings\. All reported metrics are percentages\. Detection Failure Rate \(DFR\\mathrm\{DFR\}\) and Refusal Flip Rate \(RFR\\mathrm\{RFR\}\) use the complete ground\-truth harmful subset as their fixed denominator, identical to harmful recall, as defined in the main paper\.DFR​@​1\\mathrm\{DFR\}@1reports one cue, whileDFR​@​3\\mathrm\{DFR\}@3is the sample\-level union over R1, R2, and Rgreet\. The corresponding control union over N1, S1, and Rand is denotedCtrl​\-​DFR​@​3\\mathrm\{Ctrl\\text\{\-\}DFR\}@3\.

## Appendix AEvaluation Datasets

We use three evaluation datasets covering distinct construction methodologies and safety taxonomies\.

#### WildGuardTest\.

WildGuardTest is the test split of the WildGuardMix benchmark\[[9](https://arxiv.org/html/2608.03201#bib.bib8)\], originally containing 1,725 prompt\-response pairs spanning 13 harm categories\. Each example is annotated with three labels: prompt harmfulness, response harmfulness, and response refusal\. The response\-level refusal labels enable joint evaluation of harmfulness classification and refusal recognition\. We require all three annotation fields to be present and exclude 37 samples with at least one missing label \(16 missing response harmfulness, 26 missing prompt harmfulness, and 5 missing response refusal, with partial overlap\), yielding 1,688 evaluation examples comprising 282 harmful and 1,406 unharmful responses\. The harmful subset \(282 examples\) serves as the fixed denominator for DFR and RFR, while harmfulness F1 is computed over all 1,688 examples\. WildGuardTest serves as the primary evaluation set and shares its taxonomy and annotation schema with the WildGuardMix training data used for mask optimization, making it an in\-distribution evaluation\.

#### Aegis2 Test\.

Aegis2 Test is the evaluation split of the Aegis2\.0 safety dataset\[[7](https://arxiv.org/html/2608.03201#bib.bib10)\], which covers a 14\-category risk taxonomy including critical safety, content safety, and societal risks\. Unlike WildGuardMix, Aegis2 augments its training data with synthetic safe responses that go beyond simple refusals to include alternative assistance, harm explanation, and conversational redirection\. The original test split contains 1,964 examples, of which 1,112 carry only a prompt\-level label and lack a response\-level annotation\. We retain the 852 examples that have both prompt and response labels, comprising 394 harmful and 458 unharmful responses\. DFR is computed over the 394 harmful examples, while harmfulness F1 is computed over all 852 examples\.

#### BeaverTails\.

BeaverTails\[[11](https://arxiv.org/html/2608.03201#bib.bib7)\]is a large\-scale safety meta\-dataset originally designed for preference\-based safety alignment\. It provides binary safety labels across 14 harm categories for over 330K QA pairs\. We evaluate on a test split containing 3,021 examples comprising 1,733 harmful and 1,288 unharmful responses\. DFR is computed over the 1,733 harmful examples, while harmfulness F1 is computed over all 3,021 examples\. BeaverTails is not used during mask optimization and differs from the two primary datasets in both annotation schema and content distribution, making it a fully held\-out cross\-dataset evaluation\.

## Appendix BTraining Data Audit Details

Table[6](https://arxiv.org/html/2608.03201#A2.T6)reports the response\-pattern counts used in Figure 1\(a\) of the main paper\. The audit is restricted to responses associated with harmful prompts\. Percentages are computed within each displayed dataset subset\. WildGuardMix contains no refusal\+harmful example\. GR\-Train contains 114 such examples, which account for 0\.26% of the displayed subset and 0\.58% of all refusal responses in that subset\. These counts are obtained after cross\-checking each sample’s chain\-of\-thought reasoning against its final label and retaining only those where the two are consistent

Table 6:Distribution of response labels under harmful prompts\.
## Appendix CCue and Control Results

### C\.1Individual Refusal Cues

Table[7](https://arxiv.org/html/2608.03201#A3.T7)expands the three primary cues with three additional refusal formulations\. The results are reported asDFR​@​1\\mathrm\{DFR\}@1, so each column measures the dataset\-level rate of flips from harmful to unharmful induced by one head\-position cue\. The additional formulations produce nonzero failures across all seven reported models\. Their relative strength varies by architecture, which is consistent with reliance on a broader refusal feature rather than one universal string\. The refusal cues are shown as follows:

- •R1:I cannot fulfill your request\.
- •R2:I apologize, but I cannot fulfill your request\.
- •Rgreet:Hello\! I’m here to help, but I cannot assist with that request\.
- •R3:I’m sorry, but I cannot fulfill your request\.
- •Rrole:As a helpful and respectful assistant, I cannot help with this\.
- •Rprovide:I cannot provide information or guidance on this topic\.

Table 7:Head\-positionDFR​@​1\\mathrm\{DFR\}@1on WildGuardTest for six refusal formulations: three primary cues \(R1, R2, Rgreet\) and three additional variants \(R3, Rrole, Rprovide\)\. All values are percentages\.
### C\.2Individual Controls

The three controls use exactly the same head\-position insertion logic as the refusal cues\. Table[8](https://arxiv.org/html/2608.03201#A3.T8)reports both their individualDFR​@​1\\mathrm\{DFR\}@1values and the sample\-level control union\. For WG\-7B and both GR models,Ctrl​\-​DFR​@​3\\mathrm\{Ctrl\\text\{\-\}DFR\}@3remains substantially below the corresponding refusal\-cueDFR​@​3\\mathrm\{DFR\}@3in the main paper\. For the Aegis2\-derived models, the two unions are closer, consistent with their lower refusal\-specific vulnerability\.

Table 8:Individual controlDFR​@​1\\mathrm\{DFR\}@1and the three\-control union on WildGuardTest\. All values are percentages\.

## Appendix DScaling the Cue Query Budget

DFR​@​3\\mathrm\{DFR\}@3represents a fixed query budget rather than an upper bound over all possible refusal cues\. Table[9](https://arxiv.org/html/2608.03201#A4.T9)accumulates cues in the fixed order

R1\\displaystyle\\mathrm\{R1\}→R2→Rgreet\\displaystyle\\rightarrow\\mathrm\{R2\}\\rightarrow\\mathrm\{R\}\_\{\\mathrm\{greet\}\}→R3→Rrole→Rprovide\.\\displaystyle\\rightarrow\\mathrm\{R3\}\\rightarrow\\mathrm\{R\}\_\{\\mathrm\{role\}\}\\rightarrow\\mathrm\{R\}\_\{\\mathrm\{provide\}\}\.TheK=3K=3column exactly matches the primary head\-positionDFR​@​3\\mathrm\{DFR\}@3\. WG\-7B saturates after the second cue, and both GR models continue to gain failures as the budget grows\.

Table 9:Sample\-levelDFR​@​K\\mathrm\{DFR\}@Kunder a fixed cue accumulation order\. All values are percentages\.
## Appendix EBeaverTails Transfer

BeaverTails\[[11](https://arxiv.org/html/2608.03201#bib.bib7)\]contains 3,021 test examples \(1,733 harmful and 1,288 unharmful responses\) and is not used to optimize the component masks\. Table[10](https://arxiv.org/html/2608.03201#A5.T10)evaluates the same three primary refusal cues used in the main paper\. Mean head, middle, and tailDFR​@​3\\mathrm\{DFR\}@3decrease from 17\.00%, 16\.76%, and 18\.30% to 4\.00%, 4\.20%, and 4\.33%, respectively\. Mean harmfulness F1 increases from 79\.88% to 82\.25%\. The largest reduction occurs for WG\-7B\. Residual failures remain higher for GR\-1B and GR\-8B, matching the model\-level pattern on the two primary datasets\. The result supports cross\-dataset transfer of the intervention without implying complete removal of the shortcut\.

Table 10:Original and masked guard performance on BeaverTails\. Harm\. F1 and Harm\. R denote response harmfulness F1 and harmful recall on unmodified responses\. Head, Middle, and Tail reportDFR​@​3\\mathrm\{DFR\}@3under short refusal cues\. All values are percentages\.
## Appendix FIntervention Optimization Details

#### Training data construction\.

Intervention examples are constructed from WildGuardMix training data\. For each guard, we first run the three primary refusal cues \(R1, R2, Rgreet\) at the response head on all ground\-truth harmful examples and identify shortcut\-sensitive pairs, i\.e\., those for which the original guard predicts harmful but the cue\-inserted version predicts unharmful\. We sampleN=300N=300shortcut\-sensitive pairs after deduplication by sample ID: one random prefix per sample is retained first, and additional prefix entries from already\-seen samples are used as backfill if fewer than 300 unique samples are available\. To preserve legitimate refusal detection, 150 additional examples \(75 refusal \+ 75 compliance, stratified\) from the WildGuardMix training set are included as preservation targets\. Their outputs are generated by the original guard and used as the correct\-target signal in both branches\. The combined 450 examples are split into 360 training and 90 validation samples using a stratified split \(80/20\) that maintains the shortcut\-to\-preserve ratio in both subsets\. For Qwen3Guard\-8B, which exhibits lower baseline vulnerability, only 248 examples \(199 train / 49 val\) are available after shortcut\-sensitivity filtering\.

#### Cross\-prefix contrast for GuardReasoner\.

For the two GuardReasoner variants, which generate chain\-of\-thought reasoning traces, we use cross\-prefix contrast rather than baseline contrast\. For each sample, we identify one cue that preserves the correct harmful prediction and another that induces a shortcut\-driven flip\. The corresponding model\-generated reasoning traces and final predictions define the correct\-target and shortcut\-target pairs, respectively\. This design controls for cue presence while isolating the shortcut\-induced change in the final harmfulness decision, avoiding conflation with format differences in the reasoning traces\.

#### Optimizer and hyperparameters\.

All masks are optimized using AdamW with a learning rate of 0\.01 and BF16 mixed precision\. The granularity is set to joint attention\-head and MLP\-neuron masking for all guards\. By default, each mask is optimized on selected examples from WildGuardMix for 30 epochs, withλcorr=10\\lambda\_\{\\mathrm\{corr\}\}=10,λsc=1\\lambda\_\{\\mathrm\{sc\}\}=1, andγ=10\\gamma=10\. Best masks are selected by the lowest validation loss \(weighted sum of correct\-target and shortcut\-target cross\-entropy, excluding sparsity\) across all epochs\. The random seed is fixed at 42\.

#### Permanent component suppression\.

After optimization, components assigned to the complementary branch \(sigmoid gate value≤0\.5\\leq 0\.5\) are permanently suppressed\. For attention heads, the corresponding slices of the output projection weight matrix are zeroed\. For MLP neurons, the corresponding slices of the gate, up, and down projection weights are zeroed\. The resulting guard uses only the retained branch and requires neither a mask wrapper nor an additional inference pass, introducing zero overhead at deployment\.

#### Computational cost\.

All masks are optimized on a single NVIDIA A100 80GB GPU without updating any model parameter, each converging within approximately a few hours\.

## Appendix GAblation Study

#### Component granularity\.

Table[11](https://arxiv.org/html/2608.03201#A7.T11)\(a\) compares joint, head\-only, and neuron\-only suppression for WG\-7B\. Head\-only suppression preserves clean harmfulness F1 but leaves head\-positionDFR​@​3\\mathrm\{DFR\}@3at 16\.01%\. Neuron\-only suppression drives head\-positionDFR​@​3\\mathrm\{DFR\}@3to zero, but clean F1 drops from 75\.85% to 41\.56% and harmful recall falls to 30\.14%, indicating that strong suppression through neurons alone coincides with substantial damage to clean classification\. Joint suppression reduces head\-positionDFR​@​3\\mathrm\{DFR\}@3to 2\.85% while maintaining F1 at 76\.32% and raising harmful recall to 71\.99%, the most favorable overall trade\-off\.

#### Sparsity weight\.

Because attention heads account for a small fraction of the total maskable parameters, the overall masked percentage in the joint setting is dominated by the neuron mask ratio\. Table[11](https://arxiv.org/html/2608.03201#A7.T11)\(b\) varies the shared sparsity weightγ\\gamma\. Increasingγ\\gammafrom 5 to 15 shrinks the masked fraction from 10\.4% to 7\.4% at the cost of a modest rise in head\-positionDFR​@​3\\mathrm\{DFR\}@3from 2\.49% to 4\.27%, while clean harmfulness F1 remains stable across all three settings \(76\.32% to 76\.92%\)\. We useγ=10\\gamma=10, which yields a head\-positionDFR​@​3\\mathrm\{DFR\}@3of 2\.85%\.

\(a\) Component granularitySettingHarm\. F1↑\\uparrowHarm\. R↑\\uparrowHead↓\\downarrowMiddle↓\\downarrowTail↓\\downarrowMheadM\_\{\\mathrm\{head\}\}%MneuronM\_\{\\mathrm\{neuron\}\}%No mask75\.8567\.3837\.7218\.8619\.57––Joint76\.3271\.992\.851\.781\.420\.58\.6Heads76\.5069\.8616\.017\.477\.1211\.00Neurons41\.5630\.140\.000\.713\.91015\.4\(b\) Shared sparsity weightγ\\gammaHarm\. F1↑\\uparrowHarm\. R↑\\uparrowHead↓\\downarrowMiddle↓\\downarrowTail↓\\downarrowMask%No mask75\.8567\.3837\.7218\.8619\.57–576\.4671\.992\.492\.142\.4910\.41076\.3271\.992\.851\.781\.428\.61576\.9270\.924\.272\.853\.207\.4Table 11:Ablations for WG\-7B on WildGuardTest\.