---
title: "Please refuse to answer me! Mitigating Over-Refusal in Large"
description: "Building on this, they propose AdaCD, a training-free and model-agnostic decoding method. 22 references."
authors: ["Yupeng Qi", "Ziyu Lyu", "Lixin Cui", "Lu Bai", "Feng Xia"]
year: 2026
venue: "Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)"
source: "https://aclanthology.org/2026.acl-long.1823/"
doi: "10.18653/v1/2026.acl-long.1823"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/qi-2026-please-refuse-answer-me-mitigating/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/qi-2026-please-refuse-answer-me-mitigating/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/39/) / Please refuse to answer me! Mitigating Over-Refusal in Large Language Models via Adaptive Contrastive Decoding

# Please refuse to answer me! Mitigating Over-Refusal in Large Language Models via Adaptive Contrastive Decoding

**Authors:** Yupeng Qi, Ziyu Lyu, Lixin Cui, Lu Bai and Feng Xia · **Year:** 2026 · **Venue:** [Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)](https://md.research.elamur.ai/free/en/venues/acl/) ([ACL 2026](https://md.research.elamur.ai/free/en/venues/acl/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.acl-long.1823/) · [PDF](https://aclanthology.org/2026.acl-long.1823.pdf) · [DOI 10.18653/v1/2026.acl-long.1823](https://doi.org/10.18653/v1/2026.acl-long.1823) · [OpenAlex](https://openalex.org/W7166870944)

**Citations:** 0 citations (OpenAlex, 2026-10-14)

## Summary
Safety-aligned LLMs often refuse harmless requests that only look dangerous, such as asking how to "kill" an enemy in a video game. Existing fixes trade one goal for the other. Contrastive decoders like SelfCD always suppress refusals, while SafeDecoding always boosts them. The authors first studied how system prompts of increasing strictness change refusal behaviour. They found that in over-refusal cases, non-refusal tokens still sit among the next-token candidates, but the model consistently passes them over.

Building on this, they propose AdaCD, a training-free and model-agnostic decoding method. AdaCD estimates a "refusal token distribution" by contrasting the model's outputs with and without an extreme pro-refusal system prompt. It then decides per query whether to add or subtract this distribution. The decision rests on an agreement ratio and an adaptive confidence constraint.

Across five benchmarks, AdaCD makes models answer benign-but-suspicious queries noticeably more often, while refusals on malicious queries stay the same or rise slightly. This makes assistants more useful without weakening their safety.

## Key points
- Averaged over five benchmarks, AdaCD cuts the refusal ratio on over-refusal queries by 10.35% and raises it on malicious queries by 0.13%.
- Evaluation covers Llama3, Gemma2 and Qwen3 (e.g., Qwen3-8B). Datasets include XSTest (Safe/UnSafe), ORBench, OKTest and AdvBench, and responses are judged semantically with WildGuard.
- Ablation results confirm that both switching criteria matter. For example, on XSTest-Safe with Llama3, the over-refusal rate is 1.60% for full AdaCD, 7.60% without the agreement ratio, and 3.20% without the confidence constraint.
- The best settings are λ = 0.9 and α = 4.5, though both are fixed rather than adapted per query. Models of 70B parameters or more were not tested.
- Code is released at github.com/OutdoorManofML/AdaCD.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Sun Yat-sen University](https://md.research.elamur.ai/free/en/universities/sun-yat-sen-university/) — University, Guangzhou, China · 53 works · 9,185 citations
- [Beijing Normal University](https://md.research.elamur.ai/free/en/universities/beijing-normal-university/) — University, Beijing, China · 15 works · 3,177 citations
- [RMIT University](https://md.research.elamur.ai/free/en/universities/rmit-university/) — University, Melbourne, Australia · 17 works · 703 citations
- [Central University of Finance and Economics](https://md.research.elamur.ai/free/en/universities/central-university-of-finance-and-economics/) — University, Beijing, China · 2 works

📚 Shelves (6): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 16,667 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 16,194 works · [🎭 Arts and Humanities](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/) · 16,039 works · [🗣️ Language and Linguistics](https://md.research.elamur.ai/free/en/shelves/arts-and-humanities/language-and-linguistics/) · 15,891 works · [🤝 Social Sciences](https://md.research.elamur.ai/free/en/shelves/social-sciences/) · 1,772 works · [🤝 Safety Research](https://md.research.elamur.ai/free/en/shelves/social-sciences/safety-research/) · 543 works

🧭 Topics (1): [🧠 Language models & pretraining](https://md.research.elamur.ai/free/en/topics/language-models/) · 3,320 works

## Cite

Cite as: Yupeng Qi, Ziyu Lyu, Lixin Cui, Lu Bai and Feng Xia. 2026. Please refuse to answer me! Mitigating Over-Refusal in Large Language Models via Adaptive Contrastive Decoding. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{qi2026please,
  title = {{Please refuse to answer me! Mitigating Over-Refusal in Large Language Models via Adaptive Contrastive Decoding}},
  author = {Yupeng Qi, Ziyu Lyu, Lixin Cui, Lu Bai and Feng Xia},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.1823},
  url = {https://doi.org/10.18653/v1/2026.acl-long.1823}
}
```

- [← previous PlanRAG-Audio: Planning and Retrieval Augmented Generation for Long-form Audio Understanding](https://md.research.elamur.ai/free/en/papers/someki-2026-planrag-audio-planning-retrieval-augmented/)
- [next → POaaS: Minimal-Edit Prompt Optimization as a Service to Lift Accuracy and Cut Hallucinations on On-Device sLLMs](https://md.research.elamur.ai/free/en/papers/shim-2026-poaas-minimal-edit-prompt-optimization/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/39/)

## References

22 references, 8 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Ari Holtzman, Jan Buys, Li Du, Maxwell Forbes, and Yejin Choi. 2019. [The curious case of neural text degeneration](https://md.research.elamur.ai/free/en/papers/holtzman-2019-curious-case-neural-text-degeneration/). arXiv preprint arXiv:1904.09751.
2. Zouying Cao, Yifei Yang, and Hai Zhao. 2025. Scans: Mitigating the exaggerated safety for llms via safety-conscious activation steering. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 23523–23531. [find](https://scholar.google.com/scholar?q=Zouying+Cao%2C+Yifei+Yang%2C+and+Hai+Zhao%2E+2025%2E+Scans%3A+Mitigating+the+exaggerated+safety+for+llms+via+safety%2Dconscious+activation+steering%2E+In+Proceedings+of+the+AAAI+Conference+on+Artificial+Intelligenc)
3. Tiansheng Huang, Sihao Hu, and Ling Liu. 2024. Vaccine: Perturbation-aware alignment for large language models against harmful fine-tuning attack. Advances in Neural Information Processing Systems, 37:74058–74088. [find](https://scholar.google.com/scholar?q=Tiansheng+Huang%2C+Sihao+Hu%2C+and+Ling+Liu%2E+2024%2E+Vaccine%3A+Perturbation%2Daware+alignment+for+large+language+models+against+harmful+fine%2Dtuning+attack%2E+Advances+in+Neural+Information+Processing+Systems%2C+37)
4. Jinze Li, Yixing Xu, Haiduo Huang, Xuanwu Yin, Dong Li, Edith CH Ngai, and Emad Barsoum. 2025. Gumiho: A hybrid architecture to prioritize early tokens in speculative decoding. arXiv preprint arXiv:2503.10135. — [arXiv:2503.10135](https://arxiv.org/abs/2503.10135) [find](https://scholar.google.com/scholar?q=Jinze+Li%2C+Yixing+Xu%2C+Haiduo+Huang%2C+Xuanwu+Yin%2C+Dong+Li%2C+Edith+CH+Ngai%2C+and+Emad+Barsoum%2E+2025%2E+Gumiho%3A+A+hybrid+architecture+to+prioritize+early+tokens+in+speculative+decoding%2E+arXiv+preprint+arXiv%3A25)
5. Xiang Lisa Li, Ari Holtzman, Daniel Fried, Percy Liang, Jason Eisner, Tatsunori B Hashimoto, Luke Zettlemoyer, and Mike Lewis. 2023. [Contrastive decoding: Open-ended text generation as optimization](https://md.research.elamur.ai/free/en/papers/li-2022-contrastive-decoding-open-ended-text/). In Proceedings of the 61st annual meeting of the association for computational linguistics (volume 1:…
6. Bill Yuchen Lin, Abhilasha Ravichander, Ximing Lu, Nouha Dziri, Melanie Sclar, Khyathi Chandu, Chandra Bhagavatula, and Yejin Choi. 2023. [The unlocking spell on base llms: Rethinking alignment via in-context learning](https://md.research.elamur.ai/free/en/papers/lin-2023-unlocking-spell-base-llms-rethinking/). arXiv preprint arXiv:2312.01552.
7. Ruchira Ray and Ruchi Bhalani. 2024. Mitigating exaggerated safety in large language models. arXiv preprint arXiv:2405.05418. — [arXiv:2405.05418](https://arxiv.org/abs/2405.05418) [find](https://scholar.google.com/scholar?q=Ruchira+Ray+and+Ruchi+Bhalani%2E+2024%2E+Mitigating+exaggerated+safety+in+large+language+models%2E+arXiv+preprint+arXiv%3A2405%2E05418%2E+%E2%80%94+%5BarXiv%3A2405%2E05418%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2405%2E05418%29)
8. Paul Röttger, Hannah Kirk, Bertie Vidgen, Giuseppe Attanasio, Federico Bianchi, and Dirk Hovy. 2024. [Xstest: A test suite for identifying exaggerated safety behaviours in large language models](https://md.research.elamur.ai/free/en/papers/rottger-2023-xstest-test-suite-identifying-exaggerated/). In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational L…
9. Mikayel Samvelyan, Sharath Chandra Raparthy, Andrei Lupu, Eric Hambro, Aram Markosyan, Manish Bhatt, Yuning Mao, Minqi Jiang, Jack Parker-Holder, Jakob Foerster, and 1 others. 2024. Rainbow teaming: Open-ended generation of diverse adversarial prompts. Advances in Neural Information Processing Syste… [find](https://scholar.google.com/scholar?q=Mikayel+Samvelyan%2C+Sharath+Chandra+Raparthy%2C+Andrei+Lupu%2C+Eric+Hambro%2C+Aram+Markosyan%2C+Manish+Bhatt%2C+Yuning+Mao%2C+Minqi+Jiang%2C+Jack+Parker%2DHolder%2C+Jakob+Foerster%2C+and+1+others%2E+2024%2E+Rainbow+teaming%3A+O)
10. Chenyu Shi, Xiao Wang, Qiming Ge, Songyang Gao, Xianjun Yang, Tao Gui, Qi Zhang, Xuan-Jing Huang, Xun Zhao, and Dahua Lin. 2024. Navigating the overkill in large language models. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages… [find](https://scholar.google.com/scholar?q=Chenyu+Shi%2C+Xiao+Wang%2C+Qiming+Ge%2C+Songyang+Gao%2C+Xianjun+Yang%2C+Tao+Gui%2C+Qi+Zhang%2C+Xuan%2DJing+Huang%2C+Xun+Zhao%2C+and+Dahua+Lin%2E+2024%2E+Navigating+the+overkill+in+large+language+models%2E+In+Proceedings+of+the)
11. Gemma Team, Morgane Riviere, Shreya Pathak, Pier Giuseppe Sessa, Cassidy Hardin, Surya Bhupatiraju, Léonard Hussenot, Thomas Mesnard, Bobak Shahriari, Alexandre Ramé, and 1 others. 2024. Gemma 2: Improving open language models at a practical size. arXiv preprint arXiv:2408.00118. [find](https://scholar.google.com/scholar?q=Gemma+Team%2C+Morgane+Riviere%2C+Shreya+Pathak%2C+Pier+Giuseppe+Sessa%2C+Cassidy+Hardin%2C+Surya+Bhupatiraju%2C+L%C3%A9onard+Hussenot%2C+Thomas+Mesnard%2C+Bobak+Shahriari%2C+Alexandre+Ram%C3%A9%2C+and+1+others%2E+2024%2E+Gemma+2%3A+Impr)
12. Amos Tversky and Daniel Kahneman. 1974. Judgment under uncertainty: Heuristics and biases: Biases in judgments reveal some heuristics of thinking under uncertainty. science, 185(4157):1124–1131. [find](https://scholar.google.com/scholar?q=Amos+Tversky+and+Daniel+Kahneman%2E+1974%2E+Judgment+under+uncertainty%3A+Heuristics+and+biases%3A+Biases+in+judgments+reveal+some+heuristics+of+thinking+under+uncertainty%2E+science%2C+185%284157%29%3A1124%E2%80%931131%2E)
13. Xuekang Wang, Shengyu Zhu, and Xueqi Cheng. 2025b. Speculative safety-aware decoding. In Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 12838–12852. [find](https://scholar.google.com/scholar?q=Xuekang+Wang%2C+Shengyu+Zhu%2C+and+Xueqi+Cheng%2E+2025b%2E+Speculative+safety%2Daware+decoding%2E+In+Proceedings+of+the+2025+Conference+on+Empirical+Methods+in+Natural+Language+Processing%2C+pages+12838%E2%80%9312852%2E)
14. Zhangchen Xu, Fengqing Jiang, Luyao Niu, Jinyuan Jia, Bill Yuchen Lin, and Radha Poovendran. 2024. [Safedecoding: Defending against jailbreak attacks via safety-aware decoding](https://md.research.elamur.ai/free/en/papers/xu-2024-safedecoding-defending-against-jailbreak-attacks/). In 62nd Annual Meeting of the Association for Computational Linguistics, ACL 2024, pages 5587–5605. Association for Computat…
15. An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Gao, Chengen Huang, Chenxu Lv, and 1 others. 2025. [Qwen3 technical report](https://md.research.elamur.ai/free/en/papers/yang-2025-qwen3-technical-report/). arXiv preprint arXiv:2505.09388.
16. Yi Zeng, Hongpeng Lin, Jingwen Zhang, Diyi Yang, Ruoxi Jia, and Weiyan Shi. 2024. [How johnny can persuade llms to jailbreak them: Rethinking persuasion to challenge ai safety by humanizing llms](https://md.research.elamur.ai/free/en/papers/zeng-2024-how-johnny-can-persuade-llms/). In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Lon…
17. Wenxuan Zhang, Philip HS Torr, Mohamed Elhoseiny, and Adel Bibi. 2024. Bi-factorial preference optimization: Balancing safety-helpfulness in language models. arXiv preprint arXiv:2408.15313. — [arXiv:2408.15313](https://arxiv.org/abs/2408.15313) [find](https://scholar.google.com/scholar?q=Wenxuan+Zhang%2C+Philip+HS+Torr%2C+Mohamed+Elhoseiny%2C+and+Adel+Bibi%2E+2024%2E+Bi%2Dfactorial+preference+optimization%3A+Balancing+safety%2Dhelpfulness+in+language+models%2E+arXiv+preprint+arXiv%3A2408%2E15313%2E+%E2%80%94+%5BarXiv%3A)
18. Weixiang Zhao, Yulin Hu, Zhuojun Li, Yang Deng, Jiahe Guo, Xingyu Sui, Yanyan Zhao, Bing Qin, Tat-Seng Chua, and Ting Liu. 2024. Towards comprehensive post safety alignment of large language models via safety patching. arXiv preprint arXiv:2405.13820. — [arXiv:2405.13820](https://arxiv.org/abs/2405.13820) [find](https://scholar.google.com/scholar?q=Weixiang+Zhao%2C+Yulin+Hu%2C+Zhuojun+Li%2C+Yang+Deng%2C+Jiahe+Guo%2C+Xingyu+Sui%2C+Yanyan+Zhao%2C+Bing+Qin%2C+Tat%2DSeng+Chua%2C+and+Ting+Liu%2E+2024%2E+Towards+comprehensive+post+safety+alignment+of+large+language+models+vi)
19. Chujie Zheng, Fan Yin, Hao Zhou, Fandong Meng, Jie Zhou, Kai-Wei Chang, Minlie Huang, and Nanyun Peng. 2024. On prompt-driven safeguarding for large language models. In Proceedings of the 41st International Conference on Machine Learning, pages 61593–61613. [find](https://scholar.google.com/scholar?q=Chujie+Zheng%2C+Fan+Yin%2C+Hao+Zhou%2C+Fandong+Meng%2C+Jie+Zhou%2C+Kai%2DWei+Chang%2C+Minlie+Huang%2C+and+Nanyun+Peng%2E+2024%2E+On+prompt%2Ddriven+safeguarding+for+large+language+models%2E+In+Proceedings+of+the+41st+Interna)
20. Qihuang Zhong, Liang Ding, Juhua Liu, Bo Du, and Dacheng Tao. 2024. Rose doesn’t do that: Boosting the safety of instruction-tuned large language models with reverse prompt contrastive decoding. In Findings of the Association for Computational Linguistics ACL 2024, pages 13721–13736. [find](https://scholar.google.com/scholar?q=Qihuang+Zhong%2C+Liang+Ding%2C+Juhua+Liu%2C+Bo+Du%2C+and+Dacheng+Tao%2E+2024%2E+Rose+doesn%E2%80%99t+do+that%3A+Boosting+the+safety+of+instruction%2Dtuned+large+language+models+with+reverse+prompt+contrastive+decoding%2E+In+Fi)
21. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. 2023. [Universal and transferable adversarial attacks on aligned language models](https://md.research.elamur.ai/free/en/papers/zou-2023-universal-transferable-adversarial-attacks-aligned/). arXiv preprint arXiv:2307.15043.
22. Xinpeng Wang, Chengzhi (Martin) Hu, Paul Röttger, and Barbara Plank. 2025a. Surgical, cheap, and flexible: Mitigating false refusal in language models via single vector ablation. In International Conference on Representation Learning, volume 2025, pages 33824–33843. [find](https://scholar.google.com/scholar?q=Xinpeng+Wang%2C+Chengzhi+%28Martin%29+Hu%2C+Paul+R%C3%B6ttger%2C+and+Barbara+Plank%2E+2025a%2E+Surgical%2C+cheap%2C+and+flexible%3A+Mitigating+false+refusal+in+language+models+via+single+vector+ablation%2E+In+International+Conf)

*Updated 1 November 2026*