AI Safety Guards Vulnerable to "Refusal-Cue Shortcut"

Safety guard models, crucial for filtering harmful content, are often trained on datasets where refusal expressions are almost exclusively associated with unharmful labels. This creates a "refusal-cue shortcut," allowing malicious actors to bypass safety filters by simply adding a refusal phrase to harmful content. This vulnerability has been observed in widely used models like LlamaGuard3 and Qwen3Guard, regardless of their undisclosed training data.The shortcut persists across different response positions and is more pronounced in smaller model variants. To counter this, researchers developed a lightweight post-hoc intervention using sparse complementary masking. This technique identifies and suppresses specific attention heads and MLP neurons linked to the shortcut without requiring model retraining. The intervention significantly reduces detection failures caused by refusal cues, while preserving the guard's ability to recognize genuine refusals and transferring its effectiveness to unseen datasets and positions.