Elamur Research⌕
☰
home / papers / 2026 / SafeConstellations: Mitigating Over-Refusals in LLMs Through Task-Aware Representation Steering

SafeConstellations: Mitigating Over-Refusals in LLMs Through Task-Aware Representation Steering

Paper · 2026 · Utsav Maskey, Sumit Yadav, Mark Dras et al.

Summary

Safety-aligned LLMs often refuse harmless requests when the input text merely contains sensitive material. This is a problem for applications that wrap such text in a fixed NLP task, like sentiment analysis or translation. The authors call this "task over-refusal" and build a benchmark showing that refusal rates depend on the assigned task. Their mechanistic analysis finds that each task produces a stable layer-by-layer path through embedding space, which they call a "constellation." Within that path, refusing and non-refusing outputs occupy slightly shifted regions.

SafeConstellations uses this structure at inference time. It first computes per-task centroids for target and refusal behaviour from labeled data. For each new prompt, it identifies the task from hidden states. Only when that task is confidently recognized and marked benign does it nudge representations toward the non-refusal centroid at selected layers.

On LLaMA-3.1-8B-Instruct and Qwen-1.5-7B, the method substantially lowers over-refusal while keeping MMLU utility and refusals of generic harmful inputs. This makes it a conditional, retraining-free alternative to global steering.

Key points

  • Released resources: a task over-refusal dataset on Hugging Face (Sakonii/task-over-refusal-dataset) and code on GitHub (Sakonii/SafeConstellations).
  • Over-refusal reduction:
    • LLaMA-3.1-8B-Instruct, translation: 46.7% → 8.9%, an 81% relative reduction.
    • LLaMA-3.1-8B-Instruct, sentiment: 36.4% → 18.2%, a 50% relative reduction.
    • Qwen-1.5-7B, a cryptography-related task: 63.33% → 43.33%, a 29.41% relative reduction.
  • Gating and steering:
    • Steering is applied only if task-identification confidence reaches τ = 0.85 and the task is on a developer-defined benign list.
    • The steering vector is the target centroid minus the refusal centroid, computed separately for each layer.
  • Evidence for task-specific separation:
    • In layers L12–L19, per-task silhouette scores are about 0.13–0.16, compared with roughly 0.08–0.10 when all tasks are pooled.
    • Separation is strongest around L16.
  • Costs and limitations:
    • Overhead is about 0.2 s per short response, and the task embeddings for LLaMA-3.1-8B take about 847MB.
    • The method requires open weights, and its embeddings are static and specific to one model.
    • Batch steering is not supported.
    • Safety evaluation uses only JailbreakBench and Salad-Bench, and utility evaluation relies mainly on MMLU.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓Macquarie UniversitySydney · Australia44 works · 5,778 citations🎓Institute of EngineeringPulchowk · Nepal2 works · 2 citations🎓Pulchowk CampusPatan · Nepal2 works · 2 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksSocial Sciences · 1,954 worksSafety Research · 626 works

🧭 Topics 1Research subjects and languages the work is about.Language models & pretraining · 3,894 works

Cite

Cite as Utsav Maskey, Sumit Yadav, Mark Dras and Usman Naseem. 2026. SafeConstellations: Mitigating Over-Refusals in LLMs Through Task-Aware Representation Steering. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.acl-long.2056

@inproceedings{maskey2026safeconstellations,
  title = {{SafeConstellations: Mitigating Over-Refusals in LLMs Through Task-Aware Representation Steering}},
  author = {Utsav Maskey, Sumit Yadav, Mark Dras and Usman Naseem},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.2056},
  url = {https://doi.org/10.18653/v1/2026.acl-long.2056}
}

References

32 references, 16 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Andy Arditi, Oscar Obeso, Aaquib Syed, Daniel Paleka, Nina Panickssery, Wes Gurnee, and Neel Nanda. 2024. Refusal in language models is mediated by a single direction. Advances in Neural Information Processing Systems, 37:136037–136083.
  2. Yuntao Bai, Andy Jones, Kamal Ndousse, Amanda Askell, Anna Chen, Nova DasSarma, Dawn Drain, Stanislav Fort, Deep Ganguli, Tom Henighan, and 1 others. 2022. Training a helpful and harmless assistant with reinforcement learning from human feedback. arXiv preprint arXiv:2204.05862. find
  3. Abhilekh Borah, Chhavi Sharma, Danush Khanna, Utkarsh Bhatt, Gurpreet Singh, Hasnat Md Abdullah, Raghav Kaushik Ravi, Vinija Jain, Jyoti Patel, Shubham Singh, Vasu Sharma, Arpita Vats, Rahul Raja, Aman Chadha, and Amitava Das. 2025. Alignment quality index (AQI) : Beyond refusals: AQI as an intrinsi… find
  4. Bochuan Cao, Yuanpu Cao, Lu Lin, and Jinghui Chen. 2024. Defending against alignment-breaking attacks via robustly aligned LLM. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 10542–10560, Bangkok, Thailand. Association for Co…
  5. Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J. Pappas, Florian Tramèr, Hamed Hassani, and Eric Wong. 2024. Jailbreakbench: An open robustness benchmark for jailbreaking large language models. I…
  6. Hyeong Kyu Choi, Xuefeng Du, and Yixuan Li. 2024. Safety-aware fine-tuning of large language models. In Neurips Safe Generative AI Workshop 2024. find
  7. Justin Cui, Wei-Lin Chiang, Ion Stoica, and Cho-Jui Hsieh. 2025. Or-bench: An over-refusal benchmark for large language models. In Proceedings of the 42nd International Conference on Machine Learning, volume 267, Vancouver, Canada. PMLR.
  8. Josef Dai, Xuehai Pan, Ruiyang Sun, Jiaming Ji, Xinbo Xu, Mickel Liu, Yizhou Wang, and Yaodong Yang. 2023. Safe rlhf: Safe reinforcement learning from human feedback. arXiv preprint arXiv:2310.12773.
  9. Almog Gueta, Elad Venezian, Colin Raffel, Noam Slonim, Yoav Katz, and Leshem Choshen. 2023. Knowledge is a region in weight space for fine-tuned language models. In Findings of the Association for Computational Linguistics: EMNLP 2023, pages 1350–1370, Singapore. Association for Computational Lingui… find
  10. Peixuan Han, Cheng Qian, Xiusi Chen, Yuji Zhang, Heng Ji, and Denghui Zhang. 2025. SafeSwitch: Steering unsafe LLM behavior via internal activation signals. In Findings of the Association for Computational Linguistics: EMNLP 2025, pages 6936–6955, Suzhou, China. Association for Computational Linguis… find
  11. Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. 2021. Measuring massive multitask language understanding. Proceedings of the International Conference on Learning Representations (ICLR).
  12. Chia-Yi Hsu, Yu-Lin Tsai, Chih-Hsun Lin, Pin-Yu Chen, Chia-Mu Yu, and Chun-Ying Huang. 2024. Safe lora: The silver lining of reducing safety risks when finetuning large language models. In Advances in Neural Information Processing Systems, volume 37, pages 65072–65094. Curran Associates, Inc. find
  13. Shijia Huang, Jianqiao Zhao, Yanyang Li, and Liwei Wang. 2023. Learning preference model for LLMs via automatic preference data generation. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing, pages 9187–9199, Singapore. Association for Computational Linguistics… find
  14. Batuhan K Karaman, Ishmam Zabir, Alon Benhaim, Vishrav Chaudhary, Mert R Sabuncu, and Xia Song. 2025. Porover: Improving safety and reducing over-refusal in large language models with overgeneration and preference optimization. In Proceedings of the 42nd International Conference on Machine Learning,… find
  15. Aounon Kumar, Chirag Agarwal, Suraj Srinivas, Aaron Jiaxun Li, Soheil Feizi, and Himabindu Lakkaraju. 2024. Certifying LLM safety against adversarial prompting. In First Conference on Language Modeling.
  16. Amit LeVi, Rom Himelstein, Yaniv Nemcovsky, Avi Mendelson, and Chaim Baskin. 2025. Jailbreak attack initializations as extractors of compliance directions. In Findings of the Association for Computational Linguistics: EMNLP 2025, pages 6672–6705, Suzhou, China. Association for Computational Linguist… find
  17. Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, and 1 others. 2020. Retrieval-augmented generation for knowledge-intensive nlp tasks. Advances in neural information processing systems, 33:945…
  18. Lijun Li, Bowen Dong, Ruohui Wang, Xuhao Hu, Wangmeng Zuo, Dahua Lin, Yu Qiao, and Jing Shao. 2024. SALAD-bench: A hierarchical and comprehensive safety benchmark for large language models. In Findings of the Association for Computational Linguistics: ACL 2024, pages 3923–3954, Bangkok, Thailand. As…
  19. Utsav Maskey, Chencheng Zhu, and Usman Naseem. 2025. Benchmarking large language models for cryptanalysis and side-channel vulnerabilities. In Findings of the Association for Computational Linguistics: EMNLP 2025, pages 19849–19865, Suzhou, China. Association for Computational Linguistics. find
  20. Leland McInnes, John Healy, Nathaniel Saul, and Lukas Großberger. 2018. Umap: Uniform manifold approximation and projection. Journal of Open Source Software, 3(29):861. find
  21. Yutao Mou, Yuxiao Luo, Shikun Zhang, and Wei Ye. 2025. Saro: Enhancing llm safety through reasoning-based alignment. arXiv preprint arXiv:2504.09420.
  22. Usman Naseem. 2026. Mechanistic interpretability for large language model alignment: Progress, challenges, and future directions. arXiv preprint arXiv:2602.11180. — [arXiv:2602.11180](https://arxiv.org/abs/2602.11180) find
  23. Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, and 1 others. 2022. Training language models to follow instructions with human feedback. Advances in neural information processing systems, 35:27730–27744.
  24. Rafael Rafailov, Archit Sharma, Eric Mitchell, Christopher D Manning, Stefano Ermon, and Chelsea Finn. 2023. Direct preference optimization: Your language model is secretly a reward model. Advances in neural information processing systems, 36:53728–53741.
  25. Alexander Robey, Eric Wong, Hamed Hassani, and George J Pappas. 2023. Smoothllm: Defending large language models against jailbreaking attacks. arXiv preprint arXiv:2310.03684.
  26. Paul Röttger, Hannah Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. 2024. XSTest: A test suite for identifying exaggerated safety behaviours in large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational…
  27. John Schulman, Filip Wolski, Prafulla Dhariwal, Alec Radford, and Oleg Klimov. 2017. Proximal policy optimization algorithms. arXiv preprint arXiv:1707.06347. find
  28. Zhihong Shao, Peiyi Wang, Qihao Zhu, Runxin Xu, Junxiao Song, Xiao Bi, Haowei Zhang, Mingchuan Zhang, YK Li, Yang Wu, and 1 others. 2024. Deepseekmath: Pushing the limits of mathematical reasoning in open language models. arXiv preprint arXiv:2402.03300.
  29. Guobin Shen, Dongcheng Zhao, Yiting Dong, Xiang He, and Yi Zeng. 2025. Jailbreak antidote: Runtime safety-utility balance via sparse representation adjustment in large language models. In The Thirteenth International Conference on Learning Representations. find
  30. Rohan Taori, Ishaan Gulrajani, Tianyi Zhang, Yann Dubois, Xuechen Li, Carlos Guestrin, Percy Liang, and Tatsunori B. Hashimoto. 2023. Stanford alpaca: An instruction-following llama model. https://github.com/tatsu-lab/stanford alpaca. ↗
  31. Boyi Wei, Kaixuan Huang, Yangsibo Huang, Tinghao Xie, Xiangyu Qi, Mengzhou Xia, Prateek Mittal, Mengdi Wang, and Peter Henderson. 2024. Assessing the brittleness of safety alignment via pruning and low-rank modifications. In Proceedings of the 41st International Conference on Machine Learning, ICML’…
  32. Yueqi Xie, Minghong Fang, Renjie Pi, and Neil Gong. 2024. GradSafe: Detecting jailbreak prompts for LLMs via safety-critical gradient analysis. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 507–518, Bangkok, Thailand. Associ… find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/maskey-2026-safeconstellations-mitigating-over-refusals-llms/