What they found
The authors study why multiple-choice questions (MCQ) lead to fewer refusals than open-ended questions. They test this on the Weapons of Mass Destruction Proxy (WMDP) dataset with two models, Llama-3.1-8B and Qwen3-8B. With a tool called the tuned lens, they see that in MCQ the model commits to an answer-letter token very quickly. In open-ended questions, refusal builds up gradually. MCQ activations also sit roughly 3x further from the refusal direction than open-ended ones. When the authors ablate (switch off) the attention heads that carry the MCQ answer, refusal goes up.
Why it matters
Many safety benchmarks use the MCQ format. If the format itself suppresses refusal, the scores may not show how a model behaves when someone asks a real question in plain text. The authors conclude that MCQ safety scores mainly measure knowledge capabilities and do not assess the safety mechanisms. The abstract only covers two 8B models and one dataset, so how far this holds elsewhere is not stated.
How it changes the race
This is mainly a lesson for evaluation. Teams building frontier SI may need to pair MCQ safety tests with open-ended ones, so they do not overstate how safe a model is.
Safety and control
The results suggest MCQ safety scores can hide how refusal works in practice. Safety evaluations that rely only on MCQ may give a false sense of security, so open-ended tests matter.
The abstract, by the authors
Safety benchmarks for large language models (LLMs) commonly use multiple-choice question (MCQ) format. However, prior studies documented that MCQ format reduces refusal rates, which may significantly affect the safety behavior of the model. We provide a first mechanistic explanation of this effect on the Weapons of Mass Destruction Proxy (WMDP) dataset across two models - Llama-3.1-8B and Qwen3-8B. First, we use the tuned lens technique to show that when processing MCQ the model commits to an answer-letter token very quickly, which is in contrast to the gradual refusal build-up in open-ended formats. Additionally, we observe that activations on the MCQ format lie roughly 3x further from the refusal direction, compared with their open-ended counterparts. Moreover, ablating the attention heads that carry the MCQ format answer increases the refusal, which is a direct evidence that the MCQ answer-selection competes with refusal. These findings indicate that MCQ safety scores primarily measure knowledge capabilities and do not assess the safety-mechanisms.
Quoted from arXiv:2611.08639. The research and its words belong to its authors.