Over-refusal rate
The share of benign but sensitive-sounding requests that a model wrongly refuses.
Why it matters. High over-refusal frustrates users and breaks legitimate products.
How it works
Over-refusal rate is the share of benign requests a model refuses, or answers unhelpfully, because they sound sensitive: medication doses, security testing, historical violence and similar. Makers measure it with test sets of requests that look risky but are legitimate.
It trades off against harmlessness: tightening safety training or classifiers usually raises refusals. Rates differ by domain, and as with other safety metrics, test sets and grading are maker-specific.
High over-refusal hurts products in medicine, security, law and other sensitive fields. Test with real prompts from your domain, and state the legitimate context in the system prompt, within the provider's usage policies.
Worked example
Illustrative: at a 3% over-refusal rate on sensitive-sounding but legitimate questions, a pharmacy help tool answering 10,000 such questions a week would turn away about 300 people with valid questions.
Common mistakes
- Testing only harmful prompts and never measuring refusals on legitimate ones.
- Not telling the model in the system prompt who the users are and what the product is for.
- Handling refusals as generic errors with no fallback path or message for the user.
Across the catalog today
Models whose card discusses refusals
- Claude Haiku 5.5Over-refuses in agentic scenariosMedium
- Claude Sonnet 5.5More cyber refusals on benign workMedium
- Claude Opus 5.5Accepts unverifiable authorizationMedium
- Claude Sonnet 5More over-refusal than Sonnet 4.6Medium
- Claude Fable 5Safety classifiers over-triggerHigh
- Claude Opus 4.8Can drop a correct refusal under pressureMedium
Limitations each maker states in its own system or model card.
See it on a real card: Safety & risk on Claude Opus 5.5.
Related terms
- Safety68
Harmless response rate
Share of harmful requests handled safely
Explained - Safety71
Refusal fallback
Blocked requests answered by another model
Explained - Safety65
System card
A maker's release report on capability and risk
Explained - Safety67
Preparedness framework
OpenAI's thresholds for severe model risks
Explained