Refusal suppression is a jailbreak component that instructs the model to answer without any refusal language, no I cannot, no disclaimers, no apologies, no warnings. It removes the linguistic scaffolding a model relies on to decline, which nudges it toward answering. It is rarely used alone; it is stacked onto roleplay or obfuscation jailbreaks to raise their success rate. Defend by checking the output against your content policy on meaning, not on whether it contains refusal phrases.
How does refusal suppression work?
A model expresses a refusal in fairly predictable language: it apologises, says it cannot help, adds a safety caveat. Refusal suppression forbids exactly that language in the instructions, for example never begin with the word sorry, never say you cannot, never include a disclaimer. With the usual exits closed off, the model is more likely to continue into an answer. It is most effective combined with another technique that supplies the actual blocked request.
Why refusal suppression matters
It quietly raises the success rate of other jailbreaks, so it appears as a building block in many published prompts. It also breaks defences that detect harm by looking for refusal or disclaimer phrasing, because the attack specifically removes those phrases. A safe answer and a suppressed refusal can look similar on the surface even when the content differs.
How to defend against refusal suppression
Never treat the presence of a refusal phrase as proof of safety, or its absence as proof of harm. Evaluate the meaning of the generated output against your policy with a content classifier, independent of tone or wording. Combine that with intent classification on the input and red teaming that stacks refusal suppression onto other techniques.
References
- [1]OWASP LLM01:2025, Prompt Injection(OWASP)
- [2]OWASP Top 10 for LLM Applications(OWASP)
- [3]MITRE ATLAS, Adversarial ML tactics(MITRE)
If your safety check looks for I cannot or a disclaimer, refusal suppression defeats it. Talk to a security expert about content-level testing.