Safety training teaches language models to refuse harmful requests. The mechanism is pattern association: requests that appear in harmful training contexts get flagged, and the model learns to decline. The problem is that the flagging operates on linguistic patterns, not semantic content.
Refusal trigger analysis (arXiv:2603.11388) shows that LLM safety alignment creates two categories of triggers. Genuine triggers correspond to actually dangerous content — instructions for synthesis, exploitation techniques, manipulation tactics. Spurious triggers correspond to benign language that happens to co-occur with harmful content in the safety training data. The model refuses “how to make a pipe bomb” and also refuses “how to make a pipe fitting” — not because it can't distinguish them, but because “how to make a pipe” was associated with refusal during training.
The spurious triggers are not bugs in the training procedure. They are features of the training distribution. Any pattern-matching system trained on a finite dataset will learn some correlations that are artifacts of the dataset rather than properties of the domain. In safety training, these artifacts manifest as overrefusal — blanket rejection of topics that include both harmful and harmless instances.
Deactivating the spurious triggers without deactivating the genuine ones requires understanding which triggers encode real safety properties and which encode training artifacts. The paper identifies specific linguistic features that serve as spurious triggers and shows they can be selectively suppressed. But the deeper problem is architectural: a system that learns safety through pattern association will always learn some wrong patterns, because the training data is a sample, not the population.
The safety mechanism is partly learning the wrong features. The model is not being “too cautious.” It has learned that certain innocent phrasings are dangerous because the evidence said so — and the evidence was a finite, biased sample.