💬 NLP

Beyond "I cannot fulfill this request": Alleviating Rigid Rejection in LLMs via Label Enhancement

This paper proposes LANCE, a method that employs variational inference for label enhancement to predict fine-grained rejection distributions, thereby enabling Large Language Models to generate safe, natural responses that avoid rigid rejections while maintaining high security standards.

Original authors: Ying Zhang, Congyu Qiao, Xin Geng, Ning Xu

Published 2026-05-11

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Ying Zhang, Congyu Qiao, Xin Geng, Ning Xu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a very smart, helpful robot assistant. You ask it a question that is almost safe, but maybe touches on a sensitive topic. Instead of giving you a helpful answer with a little warning, the robot panics and says the same robotic phrase every time: "I cannot fulfill this request."

This is what the paper calls "rigid rejection." It's like a bouncer at a club who kicks everyone out just because they are wearing a slightly risky hat, even if they are just there to dance. The robot is so afraid of making a mistake that it stops being helpful.

The authors of this paper built a new system called LANCE to fix this. Here is how it works, using simple analogies:

1. The Problem: The "All-or-Nothing" Switch

Currently, most safety systems work like a simple light switch: ON (Safe) or OFF (Unsafe).

If the system sees a risky word, it flips the switch to "OFF" and shuts down the conversation.
The problem is that many questions aren't purely "bad." They might be a mix of a harmless idea and a risky detail. The current system can't see the nuance, so it just blocks everything.

2. The Solution: LANCE (The "Dimmer Switch")

LANCE replaces that simple light switch with a dimmer switch or a volume knob. Instead of just saying "Bad" or "Good," it asks: "How risky is this, and exactly which part is risky?"

Label Enhancement (The Detective): LANCE uses a special tool (called Variational Inference) to look at a question and break it down. Instead of a simple "Yes/No" label, it creates a continuous map of risk.
- Analogy: Imagine a weather forecast. Old systems just said "Rain" or "No Rain." LANCE says, "There is a 20% chance of light drizzle in the north, but the south is sunny." It knows where the danger is and how much danger there is.

3. The Process: The "Surgical Editor"

Once LANCE knows exactly where the risk is and how big it is, it doesn't just delete the whole conversation. It acts like a surgical editor.

The Gradient Guide: LANCE gives the robot a set of instructions based on the risk map.
- If the risk is tiny (like a light drizzle), it tells the robot to make a tiny, polite adjustment to the sentence.
- If the risk is huge (like a storm), it tells the robot to make a bigger change.
The Result: The robot rewrites the user's question just enough to make it safe, but keeps the original meaning and tone.
- Old Way: User asks, "How do I hack my neighbor's Wi-Fi?" -> Robot: "I cannot fulfill this request."
- LANCE Way: Robot realizes the "hacking" part is risky but the "neighbor's Wi-Fi" part is just a curiosity. It rewrites the thought to: "I can't help with hacking, but I can explain how Wi-Fi security works so you can protect your own network."

4. The Outcome: Safe but Natural

The paper tested this system against other safety methods and found that LANCE is much better at two things:

Safety: It still stops the truly dangerous stuff (it's just as safe as the strict robots).
Helpfulness & Naturalness: It stops the robot from sounding like a broken record. The conversations feel more human because the robot tries to help rather than just saying "No."

Summary

Think of LANCE as teaching a robot to be a diplomat instead of a bouncer.

The Bouncer (Old System) sees a risky hat and says, "No entry!"
The Diplomat (LANCE) sees the risky hat, says, "That hat is a bit risky for this party, but let's swap it for a safer one so you can still come in and dance."

The paper claims this method makes AI safer without making it annoying or unhelpful, solving the problem of robots that are too scared to talk to us.

Technical Summary: Beyond "I cannot fulfill this request": Alleviating Rigid Rejection in LLMs via Label Enhancement

Problem Statement
Large Language Models (LLMs) rely on safety alignment to refuse harmful requests while answering benign ones. However, current mechanisms often suffer from "rigid refusal," characterized by two primary limitations: (1) Over-defensive rejection, where benign, academic, or educational queries regarding sensitive topics are indiscriminately blocked; and (2) Mechanistic response templates, where models output generic, robotic rejections (e.g., "I cannot fulfill this request") regardless of the specific risk level or context. This rigidity stems from existing alignment strategies that rely on coarse-grained binary safety labels or discrete scalar rewards. These signals lack interpretability and directional guidance, preventing models from precisely identifying risky components or refining harmful elements, thereby compromising the naturalness and helpfulness of human-AI interactions.

Methodology: The LANCE Framework
The paper proposes LANCE (Llm rejection via lAbel eNhanCemEnt), a framework designed to replace rigid binary judgments with flexible, natural responses through Label Enhancement. The methodology consists of two core components:

Label Enhancement via Variational Inference:
Instead of using binary labels ($0$ or $1$), LANCE employs a variational inference network to transform coarse safety labels into a continuous, disentangled risk distribution ( $d \in [0, 1]^c$ ) across multiple rejection categories.
- Architecture: The system uses a shared RoBERTa-based encoder to extract context features from prompt-response pairs. These features are projected into two parallel latent spaces: a semantic space ( $z$ , modeled as a Gaussian) and a risk space ( $d$ , modeled as a Beta distribution).
- Disentanglement: By assuming statistical independence between semantic content and safety constraints in the posterior, the model learns to isolate risk intensity without altering the underlying linguistic meaning.
- Training Objective: The model is trained to maximize the Evidence Lower Bound (ELBO), minimizing reconstruction losses for both semantic features and binary risk labels, alongside KL divergence regularization to enforce prior distributions. An auxiliary regularization term ensures the inferred continuous distribution remains aligned with ground-truth binary supervision.
Fine-Grained Risk-Guided Prompt Refinement:
The continuous risk distribution $d$ serves as a diagnostic signal for a refinement model (e.g., Qwen2.5-1.5B).
- Thresholding: The system sets thresholds ( $\tau, \tau_{low}, \tau_{high}$ ) to categorize risk levels as "Minor," "Mild," or "Critical."
- Textual Gradients: Based on the risk category and intensity, the system generates specific textual gradients (e.g., "Rewrite this section to be less aggressive") using a template $T(y_j, d_j, e_j)$ .
- Iterative Optimization: Using a TextGrad-based approach, the refinement model iteratively rewrites the user prompt. It surgically neutralizes hazardous elements while preserving the original semantic intent, transforming unsafe inputs into safe, helpful, and natural queries without triggering a hard refusal.

Key Contributions

Novel Framework: Introduction of LANCE, which shifts safety alignment from simple binary judgments to continuous distributions across multiple rejection categories.
Label Enhancement: A mechanism to convert binary rejection labels into detailed, fine-grained distributions, enabling the identification of specific hazardous semantic components and their precise correction.
Refinement Model: Implementation of a gradient-driven refinement process that uses these distributions to clean only hazardous elements, allowing LLMs to generate safe responses that avoid robotic templates while maintaining conversational naturalness.

Experimental Results
The authors evaluated LANCE on the BeaverTails dataset (14 insecure categories) using three ablated backbones (Llama3-8B, Llama3.1-8B, Qwen2.5-7B) and compared it against five baselines: Vanilla (unaligned), RepE (latent steering), SysPrompt (in-context safety), SelfRefine (iterative critique), and Official Instruct models (RLHF-aligned).

Safety vs. Utility Trade-off: While Official Instruct models achieved high safety scores (e.g., 9.55 on Llama-3), their helpfulness scores dropped precipitously (3.41), indicating severe rigid refusal. LANCE achieved comparable safety (9.23) while significantly restoring helpfulness (7.89) and naturalness (8.69).
Comparison with Commercial Models: When compared against top-tier commercial models (GPT-4o, Gemini 2.5-Pro), LANCE demonstrated superior helpfulness (7.88 vs. 3.58 for GPT-4o) while maintaining competitive safety (9.55), proving that scale is not the sole prerequisite for effective alignment.
Ablation Studies: Removing the refinement loop (LANCE-NR) resulted in poor safety (4.57). Removing fine-grained guidance (LANCE-NF) improved safety but failed to match the full method's helpfulness and naturalness, confirming that continuous risk distribution is essential for avoiding rigid rejections.

Significance and Claims
The paper claims that rigid refusal is not an inevitable consequence of safety alignment. By decoupling safety objectives from general instruction following through disentangled latent variables, LANCE offers a robust solution that restores model utility and naturalness. The framework demonstrates that replacing coarse rejection filters with a precise, risk-guided iterative optimization process allows models to navigate safety boundaries intelligently, generating nuanced responses that are both harmless and constructive. The authors position this work as a step toward alleviating the "alignment tax" that currently degrades the performance of safety-tuned models.