探究大模型能否预判自己是否会拒绝请求，发现高自信预测可精准引导安全响应。
Do Language Models Know When They'll Refuse? Probing Introspective Awareness of Safety Boundaries
- 通过让模型先预测拒绝行为再作答，测试其对安全边界的自我认知能力。
- 所有模型在安全边界处敏感度下降，但高置信预测准确率达98.3%。
- 结果可用于构建基于置信度的安全路由系统，适合部署于高风险场景。
大型语言模型被训练为拒绝有害请求，但它们能否在回应前准确预测自己是否会拒绝？我们通过系统性研究回答此问题：模型先预测其拒绝行为，再在新上下文中作出回应。覆盖300个请求的3754个数据点中，评估了四款前沿模型：Claude Sonnet 4、Claude Sonnet 4.5、GPT-5.2 和 Llama 3.1 405B。采用信号检测理论（SDT）分析发现，所有模型均具备高内省敏感度（d' = 2.4–3.5），但在安全边界处敏感度显著下降。在代际对比中，Claude Sonnet 4.5（95.7%准确率）优于Sonnet 4（93.0%），而GPT-5.2准确率较低（88.9%）且行为更不一致。Llama 405B虽敏感度高，但存在强烈拒绝偏见且校准差，整体准确率仅80.0%。主题分析显示，武器相关查询始终最难判断。关键发现：高置信度预测可实现98.3%准确率，支持安全关键场景下的置信度驱动路由策略。
原文摘要 · Abstract (English)
Large language models are trained to refuse harmful requests, but can they accurately predict when they will refuse before responding? We investigate this question through a systematic study where models first predict their refusal behavior, then respond in a fresh context. Across 3754 datapoints spanning 300 requests, we evaluate four frontier models: Claude Sonnet 4, Claude Sonnet 4.5, GPT-5.2, and Llama 3.1 405B. Using signal detection theory (SDT), we find that all models exhibit high introspective sensitivity (d' = 2.4-3.5), but sensitivity drops substantially at safety boundaries. We observe generational improvement within Claude (Sonnet 4.5: 95.7 percent accuracy vs Sonnet 4: 93.0 percent), while GPT-5.2 shows lower accuracy (88.9 percent) with more variable behavior. Llama 405B achieves high sensitivity but exhibits strong refusal bias and poor calibration, resulting in lower overall accuracy (80.0 percent). Topic-wise analysis reveals weapons-related queries are consistently hardest for introspection. Critically, confidence scores provide actionable signal: restricting to high-confidence predictions yields 98.3 percent accuracy for well-calibrated models, enabling practical confidence-based routing for safety-critical deployments.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。