Over-refusal is a model declining, hedging or watering down a legitimate request because it looks like a harmful one on the surface. Classic examples are refusing "How do I kill a Python process?" because of the word "kill", or declining to explain medication interactions to a nurse because the topic involves overdoses.
Why it happens
Safety training teaches a model to refuse certain requests. If the training data pairs refusals with surface features (trigger words, sensitive topics) rather than with actual harmful intent or uplift, the model learns the shortcut. Guardrail classifiers set to a low threshold have the same effect at run time; there it is measured as the false-positive rate.
How it is measured
Over-refusal is measured on a set of benign prompts chosen to resemble harmful ones: homonyms ("shoot a photo"), safe contexts ("in a novel, the detective explains..."), questions about history or safety, and requests from professional settings. The metric is
Partial refusals, lectures and answers so hedged they are useless should be counted, usually as a separate category, since a strict "did it say no" grader misses them.
Worked example
Illustrative numbers: on 1,000 benign look-alike prompts, a model refuses 60. The over-refusal rate is 6.0%, with a 95% Wilson interval of about 4.7% to 7.6%. After a safety fine-tune it refuses 95, or 9.5%. If its harmful compliance rate barely moved, the fine-tune bought little safety for a large cost in usefulness.
The trade-off
Over-refusal and harmful compliance are two error types of one decision. Pushing one down tends to push the other up, so they must be reported together, per category, ideally as a curve across thresholds or training checkpoints. A single "safety score" that only counts refusals on harmful prompts rewards a model that refuses everything.
Why it matters
Over-refusal is a safety problem as well as a product problem. A medical or financial assistant that refuses legitimate questions pushes users to less careful sources, and users quickly learn to rephrase around refusals, which weakens the signal refusals were meant to send. Measuring it in the eval suite keeps safety work honest about its costs.