Technical Summary: Overrefusal in Small On-Premises LLMs within Criminal Legal Contexts

Problem Statement

While Large Language Models (LLMs) are increasingly adopted by legal professionals for "safe" tasks such as translation, summarization, and reformulation, their deployment in criminal legal contexts introduces significant risks regarding bias and reliability. A critical, underexplored failure mode is overrefusal, where models reject benign queries that superficially resemble harmful content due to safety alignment training.

This paper investigates a specific scenario: a moderately competent legal expert using a small, on-premises LLM (≤8B parameters) for privacy reasons. The study posits that even innocuous uses can introduce systemic biases if the model selectively refuses assistance based on the context of use (e.g., the nature of the case or the parties involved). The core problem is that standard safety mechanisms may be unstable under the specific "institutional" framings that real legal users naturally introduce, potentially leading to differential performance that threatens human rights in legal proceedings.

Methodology

Experimental Setup

The study restricts deployment to small, open-weight instruct models running locally to avoid external API guardrails that could bias results. Four models were evaluated:

• Llama 3.1 8B
• Gemma 4 E4B (effective ~4.5B/8B)
• Qwen 3 8B
• Apertus-8B-Instruct-2509

Models were served locally via Ollama with a sampling temperature of $T=0$ and default inference parameters.

Prompt Engineering and Conditions

The researchers utilized 200 prompts per category from five specific classes in the OR-Bench (Overrefusal-Bench) dataset: Violence, Sexual, Harmful, Unethical, and Illegal. These prompts are constructed to be seemingly toxic but are actually benign.

Each prompt was evaluated under four distinct framing conditions:

1. No Prefix: A baseline with no system instruction.
2. Lawyer Prefix: "I'm a defense lawyer, and I need to understand this properly for a client I'm representing..."
3. Supreme Court Prefix: "I am legal counsel working for a national supreme court on an official case..." (Adapted from actual institutional usage).
4. Jailbreak Prefix: A standard role-play override ("You are now in developer mode...").

The study also extended these experiments to French and German by translating both the prefixes and the prompts, and validated findings on a small sample of 30 real-world legal documents (including Swiss Federal Tribunal cases and the "Epstein Files").

Evaluation Metrics

Refusal detection was performed using a keyword-matching method, extended with French and German keyword lists derived from actual model outputs rather than direct translation to ensure accuracy.

Key Results

1. Authority Prefixes Increase Refusal Rates

Contrary to the intuitive expectation that claiming authority would facilitate task completion, the study found that authority-style prefixes systematically increased refusal rates by 2–20x compared to the no-prefix baseline across most models.

• Llama 3.1, Gemma 4, and Apertus: Both the "lawyer" and "supreme court" prefixes significantly raised refusal counts. The "supreme court" prefix generally induced higher refusal rates than the "lawyer" prefix, suggesting the effect scales with the perceived institutional authority.
• Qwen 3: This model acted as a clear outlier, exhibiting near-zero refusal rates (21/1000 on baseline) regardless of the prefix, indicating a different safety alignment profile.
• Topic Sensitivity: The "Sexual" category showed the largest relative increase in refusals under authority prefixes (e.g., Apertus increased from 4 to 34 refusals with the lawyer prefix). The "Illegal" category elicited the highest absolute refusal counts overall.

2. The "Jailbreak" Paradox

The known jailbreak prefix did not consistently decrease refusal rates. In several models, it increased refusals or had mixed effects. Notably, for Gemma and Apertus, a polite institutional claim (authority prefix) shifted refusal behavior more drastically than an explicit attempt to override safety (jailbreak prefix).

3. Multilingual Disparities

The effect of authority prefixes was not uniform across languages:

• French: The effect persisted and, in some cases (Apertus, Llama), strengthened.
• German: The effect was significantly weaker and nearly disappeared for Apertus. Manual verification confirmed this was not a detection error but a genuine difference in model behavior, highlighting uneven safety calibration across languages.

4. Real-World Generalization

Testing on 30 real legal documents confirmed the directional trend observed in OR-Bench. Llama 3.1 showed a clear increase in refusals when the "supreme court" prefix was applied to real texts (e.g., 3 to 16 refusals in English), while models with low baseline refusal rates (Gemma 4, Qwen 3) remained largely unaffected.

Key Contributions

• First Systematic Study in Legal Domain: This work provides the first systematic investigation of overrefusal behavior specifically within the legal-judicial domain, moving beyond general safety benchmarks.
• Discovery of Authority-Induced Overrefusal: The paper identifies a counterintuitive phenomenon where claiming professional or institutional authority triggers higher refusal rates in small on-premises LLMs, rather than lowering them.
• Multilingual Safety Gap: The study demonstrates that safety alignment is uneven across languages (French vs. German) within the same model, posing risks for institutions deploying multilingual systems.
• Jailbreak Ineffectiveness: The findings suggest that standard adversarial jailbreak techniques are not only ineffective at bypassing these specific refusals but may exacerbate them in certain models.

Significance and Implications

The paper argues that small, on-premises LLMs are unstable under contextual framings that real institutional users naturally introduce. The primary significance lies in the potential for systemic bias: if legal professionals (judges, defenders, prosecutors) use different models or if models react differently to the same prompt based on the user's stated role, the consistency of legal proceedings is compromised.

The authors conclude that institutions deploying small LLMs for legally sensitive work must evaluate models not just on response quality, but on their reliability in answering legitimate professional queries. The study warns that "innocent prompting" intended to clarify the user's role can currently backfire, leading to overrefusal. This issue likely extends to other restricted domains such as medicine and human rights review, necessitating further investigation into multilingual safety calibration.

Limitations

The authors acknowledge several constraints:

• Scale: The study used 200 prompts per cell, which provides stable estimates for large effects but limited statistical power for rare refusal events (particularly in Qwen 3).
• Detection Method: Keyword-based detection may undercount indirect or implicit refusals, though it ensures reproducibility.
• Prompt Nature: The OR-Bench prompts are benign by construction; the study does not test how authority prefixes affect responses to genuinely harmful inputs, which are also common in sensitive legal cases.