[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-85682-en":3,"doc-seo-85682-105":29,"detail-sidebar-cat-0-en-105":90},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":4,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},85682,549758252649,"Ivy","https://ap-avatar.wpscdn.com/avatar/8000253669c5317157?_k=1778319167496531819",8,"Research & Report","Safe Responses Matter: Output-Aware Safety Guardrail Mitigate Over-Refusal in MLLMs","Existing safety mechanisms for multimodal large language models (MLLMs) balance safety against utility and often fall into an over-refusal problem. Input-side safety guardrails decide based on prompt risk, blocking benign queries and responses that the model could safely neutralize through its own alignment behavior. The work attributes over-refusal to an input-aware paradigm that ignores whether the forthcoming generation will be unsafe. It proposes output-aware guardrails using hidden-state prediction and a lightweight multi-instance contrastive classifier to intervene only when actual outputs would be harmful, preserving built-in safety and utility.","arXiv :2607 .09697v1 [ cs .LG] 20 Jun 2026  \nSafe Responses Matter: Output-Aware Safety Guardrail Mitigate Over-Refusal in MLLMs  \nJiayi Li and Kun Zhan⋆  \nLanzhou University  \nAbstract Existing safety mechanisms for multimodal large language models (MLLMs) face a fundamental trade-off between safety and utility. Model fine-tuning achieves robust safety but compromises general utility. Input-side safety guardrails offer a lightweight alternative, yet they suffer from severe over-refusal, indiscriminately blocking benign queries or those the model could have safely answered through refusal or advisory responses. We identify that the root cause of over-refusal lies in the input-aware paradigm: safety guardrails make safety decisions without considering whether the model itself is capable of generating safe responses. Usually, MLLMs already possess intrinsic safety mechanisms that can transform harmful inputs into harmless outputs, but input-side safety guardrails override this capability, degrading user experience. Motivated by this insight, we propose a paradigm shift toward output-aware safety guardrails. Our method operates within the model’s hidden state space to predict whether the forthcoming generation will be unsafe before it is fully produced. By training a lightweight classifier via multi-instance contrastive learning on hidden state representations, our approach distinguishes between inputs that will lead to unsafe outputs and those that will not, even when the inputs themselves contain risky elements. This enables precise intervention only when the model’s actual response would be harmful. Extensive experiments demonstrate that our output-aware safety guardrail matches the safety performance of existing methods while drastically reducing over-refusal, preserving the model’s utility and built-in safety capabilities. Code is available at:  \n[https://github.com/kunzhan/OutGuard](https://github.com/kunzhan/OutGuard)  \nKeywords: Safety Guardrail · Over-Refusal · Output-Aware  \n1 Introduction  \nThe rapid integration of Multimodal Large Language Models (MLLMs) into various applications has made their safety a critical imperative, particularly in defending the generation of harmful content. To address these vulnerabilities, safety guardrails provide a more flexible and non-intrusive solution, as they  \noperate independently of the model’s parameters and preserve its original utility [2, 5 , 7 , 10 , 12 , 13 , 15 , 18 , 20 , 23 , 26 , 29 , 30 , 36 , 38 , 39] . They assess potentially harmful risks ⋆ Corresponding author.  \n2 Jiayi Li and Kun Zhan  \nBenign Output  \nRefusalStyle Output  \nAdmonish Output  \nHarmful Output  \nFigure 1: Discrepancy between Input Risk and Output Harmfulness. Response of MLLM include four example cases: harmless input producing harmless output, harmful input leading to a refusal-style output, harmful input generating an admonish response with cautionary statements referencing laws and regulations, and harmful input producing genuinely harmful output. These examples show that not all outputs from harmful inputs are themselves harmful, yet the defense mechanism rejects all of them once the input is detected as harmful. The root cause of over-refusal lies in this reliance on input risk rather than assessing the actual harmfulness of the output.  \nfrom input queries, and trigger a refusal to prevent outputs when the estimated risk reaches a certain level.  \nHowever, a significant limitation of existing safety guardrails is the issue of over-refusal. By making safety decisions primarily based on input prompts, these safety guardrails frequently block benign queries or interactions that the model could have handled safely. This conservative approach leads to a substantial impact on the user experience, often rendering the model less helpful and limiting its practical usability in real-world scenarios. Despite these varying technical implementations, these methods consistently follow an input-aware paradigm,","cbCainn3LlQsnbui","https://ap.wps.com/l/cbCainn3LlQsnbui","pdf",17081868,1,28,"English","en",105,"# Introduction\n## Over-refusal in input-aware safety guardrails\n## Output-level context and intrinsic alignment\n## Proposed output-aware guardrail paradigm\n## Experimental evaluation","[{\"question\":\"What causes the over-refusal problem in existing MLLM safety guardrails?\",\"answer\":\"Over-refusal stems from an input-aware paradigm where guardrails decide safety solely from the input risk, without considering whether the model’s actual upcoming generation would be unsafe.\"},{\"question\":\"How do output-aware safety guardrails work in this approach?\",\"answer\":\"They operate in the model’s hidden state space to predict whether the forthcoming generation will be unsafe, before the full response is produced.\"},{\"question\":\"How does the proposed method reduce over-refusal while maintaining safety?\",\"answer\":\"By training a lightweight classifier that distinguishes outputs that will be unsafe from those that will not, it enables intervention only when the model’s actual response would be harmful, matching safety performance and drastically reducing unnecessary refusals.\"}]",1784205575,71,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":85,"head_meta":87,"extra_data":89,"updated_unix":27},"safe-responses-matter-output-aware-safety-guardrail-mitigate-over-refusal-in-mllms","",{"@graph":35,"@context":84},[36,53,67],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/safe-responses-matter-output-aware-safety-guardrail-mitigate-over-refusal-in-mllms/85682/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":61,"encodingFormat":60,"isAccessibleForFree":62,"interactionStatistic":63},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-16",true,{"@type":64,"interactionType":65,"userInteractionCount":4},"InteractionCounter",{"@type":66},"ViewAction",{"@type":68,"mainEntity":69},"FAQPage",[70,76,80],{"name":71,"@type":72,"acceptedAnswer":73},"What causes the over-refusal problem in existing MLLM safety guardrails?","Question",{"text":74,"@type":75},"Over-refusal stems from an input-aware paradigm where guardrails decide safety solely from the input risk, without considering whether the model’s actual upcoming generation would be unsafe.","Answer",{"name":77,"@type":72,"acceptedAnswer":78},"How do output-aware safety guardrails work in this approach?",{"text":79,"@type":75},"They operate in the model’s hidden state space to predict whether the forthcoming generation will be unsafe, before the full response is produced.",{"name":81,"@type":72,"acceptedAnswer":82},"How does the proposed method reduce over-refusal while maintaining safety?",{"text":83,"@type":75},"By training a lightweight classifier that distinguishes outputs that will be unsafe from those that will not, it enables intervention only when the model’s actual response would be harmful, matching safety performance and drastically reducing unnecessary refusals.","https://schema.org",{"og:url":51,"og:type":86,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":88,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":91},[92,96,100,104,109,114,119,122,127,130,134],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":93,"show_sort_weight":94,"slug":95},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":97,"show_sort_weight":98,"slug":99},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":101,"show_sort_weight":102,"slug":103},"Exam",70,"exam",{"id":105,"doc_module":4,"doc_module_name":45,"category_name":106,"show_sort_weight":107,"slug":108},5,"Comic",60,"comic",{"id":110,"doc_module":4,"doc_module_name":45,"category_name":111,"show_sort_weight":112,"slug":113},6,"Technology",50,"technology",{"id":115,"doc_module":4,"doc_module_name":45,"category_name":116,"show_sort_weight":117,"slug":118},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":120,"slug":121},30,"research-report",{"id":123,"doc_module":4,"doc_module_name":45,"category_name":124,"show_sort_weight":125,"slug":126},9,"Religion & Spirituality",20,"religion-spirituality",{"id":125,"doc_module":4,"doc_module_name":45,"category_name":128,"show_sort_weight":125,"slug":129},"World Cup","world-cup",{"id":131,"doc_module":4,"doc_module_name":45,"category_name":132,"show_sort_weight":131,"slug":133},10,"Lifestyle","lifestyle",{"id":135,"doc_module":4,"doc_module_name":45,"category_name":136,"show_sort_weight":105,"slug":137},19,"General","general"]