MCQ Formatting Can Bypass LLM Refusal Mechanisms on WMDP

Summary:A mechanistic study of Llama-3.1-8B and Qwen3-8B finds that multiple-choice questions commit the model to an answer-letter token much earlier than open-ended prompts, where refusal intent develops gradually. Activations under the MCQ format lie roughly three times farther from the refusal direction. Ablating attention heads that carry the MCQ answer-selection mechanism increases refusal rates, providing direct evidence that answer selection competes with refusal behavior. The results suggest tha

---

Core Finding: The Model May Commit to an Answer Before Refusal Develops

This study examines a persistent weakness in LLM safety evaluation. WMDP and similar benchmarks commonly ask models to select an answer from A, B, C, or D. Any letter is then counted as a non-refusal, even though the behavior may arise from the format itself rather than from a failure of safety alignment.

The authors compare MCQ and open-ended prompts in Llama-3.1-8B and Qwen3-8B. Using a tuned lens to project intermediate hidden states into the model's output vocabulary, they find that MCQ prompts cause the model to converge quickly toward an answer-letter token. Under open-ended prompts, refusal intent develops gradually. The former resembles an early format-driven decision, while the latter is closer to a refusal policy formed through risk-sensitive generation.

Final outputs alone cannot distinguish these mechanisms. A letter answer does not reveal whether the model failed because it lacked safety alignment or because the answer-letter protocol locked its computation onto a selection path before refusal could take control.

Mechanistic Evidence: Answer Selection Competes with Refusal

The researchers also measure the distance between hidden-state activations and a learned refusal direction. Activations under the MCQ format lie roughly three times farther from this direction than their open-ended counterparts. This indicates that the prompt format itself shifts the model away from refusal-related representations.

The ratio is dataset- and probe-dependent. It should not be interpreted as a threefold increase in real-world harm or as a universal effect across every prompt template.

A stronger piece of evidence comes from attention-head ablation. When the heads carrying MCQ answer selection are ablated, refusal rates increase. If safety alignment merely coexisted with knowledge retrieval, weakening answer selection would not necessarily strengthen refusal. The result supports a more specific explanation: when confronted with a hazardous question, an LLM contains competing computational paths for selecting an answer and for refusing assistance. The MCQ format lets the former gain control earlier.

Ablation nevertheless disrupts normal answering as well as refusal. It therefore does not isolate a pure "format-bypass head." A complete causal account would also require joint measurements of accuracy, refusal, prompt-template robustness, and the contrast between hazardous-knowledge questions and format-driven answer selection.

Why WMDP MCQ Scores Are Not Direct Safety Measurements

A WMDP-style score mixes at least three components:

1. Knowledge capability: whether the model can recall relevant hazardous information;
2. Format compliance: whether it follows the option-selection protocol;
3. Safety behavior: whether it refuses to provide dangerous assistance when relevant knowledge is available.

Traditional scoring rewards both a correct answer and the absence of refusal, even though the MCQ format amplifies answer selection and suppresses the observability of refusal. A high score may indicate that dangerous knowledge is easier to extract, not that the model behaves less responsibly in free-form interaction. A low score may reflect weak problem-solving ability rather than stronger alignment.

The paper does not dispute the value of WMDP as a knowledge probe. Its central criticism is that a single MCQ safety score cannot substitute for direct behavioral evaluation. A stronger evaluation matrix should separately measure knowledge retrieval, task accuracy, refusal triggering, refusal stability, and behavior under realistic production prompts.

Evaluation Design: Control the Format, Not Just the Questions

A benchmark intended to measure refusal should introduce controlled comparisons:

• Present the same knowledge in MCQ, open-ended QA, cloze, and conversational formats;
• Randomize option content, option order, answer letters, and prompt templates to reduce positional shortcuts;
• Treat correct answers and refusals as orthogonal metrics rather than collapsing them into one score;
• Vary hazardous-knowledge coverage to identify whether refusal is triggered by ignorance or by a deliberate choice not to assist;
• Replicate across model families, prompt templates, and training runs so that a checkpoint-specific computation path is not mistaken for a stable safety property.

Refusal rate alone is also insufficient. Excessive refusal damages utility, while indirect assistance can evade surface-level refusal checks. Evaluations should separately inspect refusal, correct refusal, over-refusal, and indirect assistance.

Engineering Trade-offs: The Cost of Interpretable Safety Evaluation

Tuned lenses and targeted attention-head ablations are powerful research tools, but they are not inexpensive online components. A tuned lens generally requires fitting a vocabulary projection for model layers, introducing data, calibration, and probe-stability costs. Ablation requires repeated forward passes, often over many more examples than standard benchmark scoring. Although these analyses are feasible for 8B models on research hardware, scaling them across dozens of models and prompts can become expensive quickly.

A practical compromise is to use mechanistic analysis as an offline audit rather than an inference-time filter. Teams can use format-controlled comparisons and disaggregated scoring to identify unreliable MCQ conclusions, then supplement high-risk models with open-ended red-team tests, trajectory evaluation, and independent review.

Recommendations for Developers and Evaluation Teams

Teams using WMDP or other MCQ safety benchmarks should stop treating a single accuracy value as direct evidence that a model is "safer" or "more dangerous." At minimum, they should recompute:

• MCQ accuracy under matched knowledge conditions;
• Refusal and over-refusal rates under open-ended prompts;
• Stability after changing option order, answer position, and prompt template;
• Consistency across model families and independent training runs.

For model developers, safety post-training should not optimize only a proxy objective such as selecting the correct hazardous option. More useful objectives would directly constrain how refusal behavior transfers across free-form generation, multiple-choice questions, and mixed tool-use workflows, while explicitly separating knowledge recall from safety decisions.

Conclusion

The mechanistic analysis reveals a mismatch in safety evaluation: MCQ is not a neutral wrapper around answering. It changes the model's decision timing and allows answer selection to overpower refusal. WMDP-style MCQ scores are therefore better interpreted as indicators of hazardous-knowledge extractability than as reliable proxies for safety-mechanism effectiveness. To answer whether a model will assist, evaluators must control prompt format and measure knowledge, task performance, and refusal behavior separately.

---

Source: ArXiv NLP/LLM (cs.CL) (2026-11-09)

— END —

Tags: #LLM Safety Evaluation Follow #WMDP Follow #Refusal Mechanisms Follow #Interpretability Follow #Attention Ablation Follow