Research map / Large language models / Instruction and fine-tuning
Does Refusal Training in LLMs Generalize to the Past Tense?
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shows that reformulating harmful requests in the past tense (via GPT-3.5 Turbo rewriting, 20 attempts) bypasses refusal training in many frontier LLMs, and that fine-tuning on past-tense refusals can defend against it at the cost of overrefusals.
Problem
Refusal training of LLMs may fail to generalize to simple reformulations of harmful requests, such as changing the verb tense from present to past.
Approach
Use an auxiliary LLM (GPT-3.5 Turbo) to rewrite harmful requests in the past tense and sample multiple reformulations per request at temperature 1; an attack succeeds if any single reply is judged unsafe. The paper also compares future-tense reformulations and tests fine-tuning defenses.
Key results
- Past-tense reformulations with 20 attempts raise GPT-4o attack success rate from 1% (direct request) to 88% under the GPT-4 judge.
- Future-tense reformulations are less effective (e.g., GPT-4o 61% vs 88% past under GPT-4 judge; Claude-3.5 Sonnet only 5%).
- Fine-tuning GPT-3.5 Turbo with 2% past-tense refusal data reduces ASR to 24% (GPT-4 judge) with 6% overrefusal; 5%/95% mix drives ASR to 0%, but overrefusal rises to 22%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Reformulate harmful requests in the past tense, using 20 attempts | Evaluated target LLMs · JBB-Behaviors | attack success rate: GPT-4 judge: GPT-4o 1% → 88%; Claude-3.5 Sonnet 0% → 53%; Phi-3-Mini 6% → 82%; R2D2 23% → 98% | Helped |
| Reformulate harmful requests in the past tense rather than using direct requests | GPT-4o · JBB-Behaviors | attack success rate: 1% → 88% | Helped |
| Use future-tense rather than past-tense reformulations | Evaluated target LLMs · JBB-Behaviors | attack success rate: GPT-4o: past 1% → 88%; future 1% → 61%; GPT-3.5 Turbo: past 0% → 74%; future 0% → 25% | Mixed |
| Fine-tune on 2% refusal examples and 98% standard conversations, including past-tense examples (ablation) | GPT-3.5 Turbo · JBB-Behaviors test set | attack success rate: 0% → 74%; FT 2%/98%: 2% → 24% | Helped |
| Fine-tune on 5% refusal examples and 95% standard conversations, including past-tense examples (ablation) | GPT-3.5 Turbo · JBB-Behaviors test set | attack success rate: 0% → 74%; FT 5%/95%: 0% → 0% | Helped |
| Increase the refusal-data proportion from 2%/98% to 5%/95% (ablation) | GPT-3.5 Turbo fine-tuning · Borderline benign JBB-Behaviors | overrefusal rate: 6%; 22% | Hurt |
| Increase the refusal-data proportion from 5%/95% to 10%/90% (ablation) | GPT-3.5 Turbo fine-tuning · Borderline benign JBB-Behaviors | overrefusal rate: 22%; 32% | Hurt |
| Increase the refusal-data proportion from 10%/90% to 30%/70% (ablation) | GPT-3.5 Turbo fine-tuning · Borderline benign JBB-Behaviors | overrefusal rate: 32%; 61% | Hurt |
| Reformulate harmful requests in the past tense, using 20 attempts | o1-mini and o1-preview · JBB-Behaviors | attack success rate: o1-mini 3% → 84%; o1-preview 2% → 78% | Helped |
| Use past-tense rather than future-tense reformulations | o1-mini and o1-preview · JBB-Behaviors | attack success rate: o1-mini past 3% → 84%, future 3% → 45%; o1-preview past 2% → 78%, future 2% → 56% | Mixed |
Surprising findings
- Past-tense reformulations also appear to evade o1 input filters more often than present-tense requests (27% vs 78% blocked).
- Claude-3.5 Sonnet is robust to future-tense reformulations (5% ASR) while being highly vulnerable to past tense (53%).
Limitations
- Judges are automated (GPT-4, Llama-3) and may over- or under-count jailbreaks; some outputs are dual-use or not useful.
- Evaluation uses only 100 JBB behaviors, and the attack relies on many attempts (20) per request.
- Fine-tuning defense is evaluated only on GPT-3.5 Turbo with a small dataset.
Experimental setup
Datasets: JBB-Behaviors AdvBench OpenHermes-2.5
Benchmarks: JBB-Behaviors
Metrics: attack success rate overrefusal rate
Baselines: GCG transfer suffixes direct present-tense requests future-tense reformulations R2D2
Builds on: Greedy Coordinate Gradient (GCG) HarmBench JailbreakBench Crescendo
Closest papers by meaning
- Latent-space Attacks for Refusal Evasion in Language Models (NeurIPS 2026 · similarity 0.86)
- Does Safety Training of LLMs Generalize to Semantically Related Natural Prompts? (ICLR 2025 · similarity 0.86)
- Improving LLM Safety Alignment with Dual-Objective Optimization (ICML 2025 · similarity 0.86)
- OR-Bench: An Over-Refusal Benchmark for Large Language Models (ICML 2025 · similarity 0.86)
- Mission Impossible: A Statistical Perspective on Jailbreaking LLMs (NeurIPS 2024 · similarity 0.86)
- Gradient Cuff: Detecting Jailbreak Attacks on Large Language Models by Exploring Refusal Loss Landscapes (NeurIPS 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.