When Safety Blocks Sense: Measuring Semantic Confusion in LLM Refusals
This addresses the issue for developers of safety-aligned LLMs by providing a diagnostic tool to reduce false refusals while maintaining safety, representing an incremental improvement in evaluation methods.
The paper tackled the problem of safety-aligned language models incorrectly refusing harmless prompts, introducing 'semantic confusion' to measure local inconsistency where models accept one phrasing but reject a close paraphrase, and developed ParaGuard, a 10k-prompt corpus, and three model-agnostic metrics that reveal hidden structure in refusal behavior across diverse models.
Safety-aligned language models often refuse prompts that are actually harmless. Current evaluations mostly report global rates such as false rejection or compliance. These scores treat each prompt alone and miss local inconsistency, where a model accepts one phrasing of an intent but rejects a close paraphrase. This gap limits diagnosis and tuning. We introduce "semantic confusion," a failure mode that captures such local inconsistency, and a framework to measure it. We build ParaGuard, a 10k-prompt corpus of controlled paraphrase clusters that hold intent fixed while varying surface form. We then propose three model-agnostic metrics at the token level: Confusion Index, Confusion Rate, and Confusion Depth. These metrics compare each refusal to its nearest accepted neighbors and use token embeddings, next-token probabilities, and perplexity signals. Experiments across diverse model families and deployment guards show that global false-rejection rate hides critical structure. Our metrics reveal globally unstable boundaries in some settings, localized pockets of inconsistency in others, and cases where stricter refusal does not increase inconsistency. We also show how confusion-aware auditing separates how often a system refuses from how sensibly it refuses. This gives developers a practical signal to reduce false refusals while preserving safety.