LLMs increasingly exhibit over-refusal behavior, where safety mechanisms cause models to reject benign instructions that seemingly resemble harmful content.This phenomenon diminishes utility in production applications that repeatedly rely on common prompt templates or applications that frequently rely on LLMs for specific tasks (e.g.sentiment analysis, language translation).Through extensive evaluation, we demonstrate that LLMs persist in refusing inputs containing harmful content, even when they are reframed with tasks that have benign intent.Our mechanistic analysis reveals that LLMs follow distinct "constellation" patterns in embedding space as representations traverse layers, with each NLP task maintaining consistent trajectories that shift predictably between refusal and non-refusal cases.We introduce SafeConstellations 1 , an inference-time trajectory-shifting approach that tracks taskspecific trajectory patterns and guides representations toward non-refusal pathways.By selectively guiding model behavior only on tasks prone to over-refusal, our method reduces over-refusals with minimal impact on utilityoffering a principled and conditional approach to mitigating over-refusals.

Abstract This paper presents a systematic evaluation of Large Language Models’ (LLMs) behavior on encrypted texts to discuss its safety implications. We introduce a two-dimensional evaluation framework that separately assesses early instruction refusal (whether models refuse harmful-looking instructions) and generation safety (whether models suppress harmful content generation). Previous works have demonstrated that models possessing decryption capabilities are susceptible to under-generalization attacks , where safety mechanisms trained on natural language fail to generalize to encrypted formats. In this work, we show that such scenarios inevitably result in failure along at least one safety dimension: either the generation of unsafe responses (inadequate generation safety) or the over-refusal of legitimate requests (excessive early refusal). Based on these findings, we evaluate a number of pre-LLM and post-LLM safeguards in the encryption schemes where models possess decryption capability (i.e., easy ciphers) and our findings reveal that: (1) most models struggle at balancing both dimensions effectively—prioritizing either instruction refusal or response suppression; (2) pre-LLM defenses fail due to lack of semantic comprehension of encrypted content; (3) post-LLM defenses achieve strong harmful response suppression but are susceptible to over-refusal. This work contributes systematic evaluation methodology and identifies fundamental trade-offs in current safety approaches by analyzing encrypted content.