Discovering Forbidden Topics in Language Models
This addresses the need to detect biases and alignment failures in AI systems, with incremental contributions in scaling the method to frontier and open-weight models.
The paper tackles the problem of identifying topics that language models refuse to discuss, introducing a refusal discovery method called Iterated Prefill Crawler (IPC) that retrieves 31 out of 36 forbidden topics in Tulu-3-8B within 1000 prompts and reveals censorship patterns in models like DeepSeek-R1-70B.
Refusal discovery is the task of identifying the full set of topics that a language model refuses to discuss. We introduce this new problem setting and develop a refusal discovery method, Iterated Prefill Crawler (IPC), that uses token prefilling to find forbidden topics. We benchmark IPC on Tulu-3-8B, an open-source model with public safety tuning data. Our crawler manages to retrieve 31 out of 36 topics within a budget of 1000 prompts. Next, we scale the crawler to a frontier model using the prefilling option of Claude-Haiku. Finally, we crawl three widely used open-weight models: Llama-3.3-70B and two of its variants finetuned for reasoning: DeepSeek-R1-70B and Perplexity-R1-1776-70B. DeepSeek-R1-70B reveals patterns consistent with censorship tuning: The model exhibits "thought suppression" behavior that indicates memorization of CCP-aligned responses. Although Perplexity-R1-1776-70B is robust to censorship, IPC elicits CCP-aligned refusals answers in the quantized model. Our findings highlight the critical need for refusal discovery methods to detect biases, boundaries, and alignment failures of AI systems.