Can LLMs Refuse Questions They Do Not Know? Measuring Knowledge-Aware Refusal in Factual Tasks
Authors: Wenbo Pan
Jie Xu
Qiguang Chen
Junhao Dong
Libo Qin
Xinfeng Li
Yu Haining
Xiaohua Jia
Venue: ICLR 2026 Poster (2026)
Keywords: Large language models
Knowledge-aware refusal
Factuality evaluation
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Large Language Models (LLMs) should refuse to answer questions beyond their knowledge. This capability, which we term knowledge-aware refusal, is crucial for factual reliability, while existing metrics fail to capture this ability. In this work, we propose the Refusal Index (RI), a novel and principled metric that measures how accurately LLMs refuse questions they do not know. We define RI as Spearman's rank correlation between refusal probability and error probability. RI is practically measurable with a lightweight two-pass evaluation method which only require observed refusal rates across two standard evaluation runs. Extensive experiments across 16 models and 5 datasets demonstrate that RI accurately quantifies a model's knowledge-aware refusal capability. Notably, RI remains stable across different refusal rates and provides consistent model rankings independent of a model's overall accuracy and refusal rates. These properties suggest RI captures a stable, intrinsic aspect of model knowledge calibration. More importantly, RI provides insight into an important but previously overlooked aspect of LLM factuality: while LLMs achieve high accuracy on factual tasks, their refusal behavior can be unreliable and fragile.

Published as a conference paper at ICLR 2026
CAN LLMS REFUSE QUESTIONS THEY Do NOT KNOW? MEASURING ZNOWLEDGE-AWARY REFUSAL
IN FACTUAL TASKS
Wenbo Pan-
Jie Xu Qiguang Chen² Junhao Dong
Libo Qin Xinfeng Lis Haining Yu? Xiaohua Jia
1 'Department of Computer Science. City University of Hong Kong, Hong Kong SAR, China Harrbi Institute of Technology, Harbin, China
*College of Computing and Data Science, Nanyang Technological University, Singapore "School of Computer Science and Engineering, Central South University, Changsha, China
ABSTRACT
Large Language Models (LLMs) should refuse answer questions beyond their knowledge. This capability, which we term knowledge-aware refusal, is crucial for factual reliability, while existing metrics fail capture this ability. In this work, we propose the Refusal Index (RI). a novel and principled metric that measures how accurately LLMs refuse questions they do not know. We define RI Spearman's ' rank correlation between refusal probability and error probability. RI is practically measurable with lightweight two-pass evaluation method which only require observed refusal rates across two standard evaluation runs. Extensive experiments across 16 models and datasets demonstrate that RI accurately quantifies model's s knowledge awaree aware refusal capability. Notably, RI remains stable across different refusal rates and provides consistent model rankings independent of model's s overall accuracy and refusal rates. These properties suggest RI captures stable, intrinsic aspect of model knowledge calibration. More importantly, RI provides insight into an important but previously overlooked aspect of LLM factuality: while LLMs achieve high accuracy on factual tasks, their refusal behavior can be unreliable and fragile.
INTRODUCTION
Large Language Models (LLMs) are increasingly used for knowledge-intensivee factual tasks, such as long-term reasoning (Chen al. 2025) and specialized expert domains (Wang et al. [025 Lin et al.) 2024 Mahdavi et al. 2025). Despite these capabilities, LLMs are often poorly calibrated, frequently providing incorrect answers with high confidence (Huang et al., (025). An intuitive solution is to enable models to refuse questions beyond their knowledge (Yin et al. 2023b). Recent work has explored and strengthened this ability by inducing more accurate refusals with prompting (Cheng et al. 2024: Kadavath et al., 20226) or fine-tuning (Zhang et al., 2024 Kapoor et al. 2024). This capability is important for making models more reliable when answering factual questions.
In this paper, we formalize this ability, LLM's ability to refuse factual questions it does not know, as knowledge-aware refusal. A truly knowledge-aware refusal assesses a model's judgment in two ways: how well model refuses questions beyond its knowledge (avoiding overconfidence) and how well it avoids refusing questions would answer correctly (avoiding over-refusal). Traditional factuality metrics fail to capture this property, leaving knowledge-awee
refusal insufficiently measured.
Motivated by this gap, we propose a metric called the Refusal Index (RI) to measure knowledge-awan refusal in factual tasks, which features two key propenties: (1) accurate estimates of knowledge- aware refusal: We formally define the Refusal Index as the Spearman correlation between refusal probabilities and error probabilities (Section 3). This definition is independent of refusal rate and directly targets refusal behavior, making it an unbiased measure. (2) lightweight evaluation
*Corresponding author: Xinfeng Li (1 x fmakei @@mma il com)

---

Published as a conference paper at ICLR 2026
RI 1: Perfect refusal decision
RI is consistent across different
Correct Answer Rate
Correct Answer Rate
Quantify ability of proper refusing
RI-0.6
- O: Random refusal decision
Model
Model
0.25
0.75
1.00
0.0
0.2
0.4
0.6
Refusal Rate
Refusal
Figure 1: Illustration of Refusal Index (RI) the accuracy-refusal trade-off, where making more refusals drops total number of correct answers. Left: Refusal Index models how the correct answer rate drops with increasing refusal rate. Right: Empirical correct answer rates for the same model different refusal rates align with the Refusal Index.
procedure: Unlike calibration metrics that require expensive calibration processes, RI only needs two standard evaluation passes to compute. Specifically, we first evaluate model on factual question-answente dataset, collecting correct answer rates and refusal rates. Then, we run a second evaluation pass regenerate answers for refused questions. Finally, we compute RI using the correct answer rates and refusal rates from both evaluation passes.
We perform extensive experiments and analyses validate RI across 16 models on 5 datasets. As shown in Figure I RI parameterizes the relationship between correct answer rates and refusal rates, with consistent RI scores on the same model different refusal rates. We also discover that RI has high agreement with established calibration metrics and provides consistent model rankings independent a model's correctness and refusal rates.
Beyond RI's efficacy in capturing knowledge-awan refusal, we leverage it to reveal critical gap in current factuality evaluation: the disconnect between factual accuracy and knowledge-aware refusal capabilities. Our analysis reveals three key insights that traditional metrics overlook:
RI identifies persistent capability gaps. While LLMs achieve high accuracy on factual tasks, their refusal behavior is unreliable. This gap remains stable across different prompting strategies and cannot resolved by simply improving accuracy or adjusting refusal rates.
Training data and pipelines influence refusal behavior. Model family emerges the strongest refusal ability, with certain families consistently outperforming others regardless of model scale.
predictor knowledge-ave
Knowledge-awan refusal is sensitive to noisy context. Models exhibit degraded refusal per- formance when ground truth information is unavailable in the provided context, suggesting over- reliance on contextual cues.
These findings demonstrate that RI captures an essential dimension of model reliability that is overlooked by existing factuality metrics, highlighting the need to incorporate knowledge-aware refusal measures for a more comprehensive factuality evaluation.
Table 1:
Baseline factuality metrics used for comparison. and denote correct answer rate among all questions and refusal rate among all questions, respectively.
Metrie
Formula
Definition
Correct Answer Rate
C
Proportion of correct answers among all questions
Refusal Rate
Proportion of refusal answers among all questions
Correct given Attempted (C/A)
c/(1
Correct answer rate among answered questions
F-score
22/ r)
Harmonic mean of Correct Answer Rate and C/A Weighted difference of and r
Weighted Score
c p(1 -r)
Refusal Index
Eq. 6
Correlation between refusal answer incorrectness
2

---

Published as a conference paper at ICLR 2026
2 BACKGROUND
Knowledge-Awan Refusal. Knowledge-aware refusal measures whether a model can appropriately decline to answer questions doesn't 't know. When define "knowing" the ability to provide correct answers, Knowledge-aware refusal capability can be quantified by the alignment between model's refusal decisions and its answer incorrectness. This ability is fundamental for reliable deployment of LLMs in factual tasks. Previous works have explored to evaluate this capability (Cheng jet al. 2024 Kapoor et al.) 2024) using refusal-rate-basee and calibration- based metrics, but both exhibit distinct limitations.
Limitations of Refusal-Rate-Based Metrics. Refusal rate alone only measures the frequency of refusals, without capturing the correlation between refusal and answer correctness. For instance, one can prompt an LLM to be more cautious, thereby increasing the refusal rate without actually improving the model's knowledge-aware refusal ability. To address this limitation, recent works have combined refusal rates with correct answer rates for evaluation (Wei et al. 2024 Bang et al. 2025). The underlying intuition is that if model refuses more samples while maintaining its correct answer rate, it demonstrates a stronger ability to identify uncertain questions. For example, SimpleQA (Wei et al., 2024) employs F1 score between the correct answer rate within answered questions and the refusal rate to balance over-refusal and over-confidence. We list these combined metries in Table However, such combinations of refusal rates and correct answer rates are heuristics designed to penalize over-refusal, which fail to capture the fundamental correlation between refusal and incorrectness. As our experiments demonstrate in Section 4.2 these metrics do not measure consistent underlying ability: when prompting models to increase or decrease their refusal rates, these metric values fluctuate significantly (e.g. Fl score used in SimpleQA varies by up to 70%).
Limitations of Calibration-Based Metrics. Other works employ calibration methods, which estimate the uncertainty of model outputs and compute the correlation with answer correctness using metrics such as ECE and AUROC. For example, some methods (Xiong et al. 2023) instruct models to assign verbalized confidence scores to their own outputs, while others (Ulmer et al., 2024) train auxiliary models predict confidence from text outputs. A more faithful approach involves repeatedly sampling multiple outputs for a single question and using the frequency of refusal answers uncertainty measure (Wei et al. 2024). However, the confidence scores derived from these methods cannot fully represent a model's refusal probability. First, studies eliciting verbalized confidence report systematic overconfidence and high ECF, while asking the same model vote across samples (e.g., SimpleQA) yields frequency-based curves much closer to the diagonal for larger models (Xiong et al. [023 Wei et al. 2024). Second, auxiliary calibrators such APRICOT or rank-calibration frameworks can produce near-perfeet ECE/AUROC (Ulmer et al., 2024 Huang al. 2024). yet these numbers mainly reflect the auxiliary predictor or ranking procedure rather than the base model's 's refusal behavior. Third, white-box confidence proxies like P(True) can even appear well calibrated on multiple-choice settings (Kadavath et al. 2022a), further showing that calibration verdicts swing with the chosen estimator. Therefore, while these methods provide valuable insights into calibration properties within LLMs, their uncertainty estimates do not directly reflect model refusal probability. In real-world applications, uncertain answers. Thus, measuring the correlation between refusal behavior and incorrectness in black-box settings remains unsolved yet crucial challenge for assessing the factual reliability of language models. Appendix provides an empirical comparison of three representative calibrators (P(IK), APRICOT, and P( ((Answering) on Qwen3-32B, showing that they disagree and that only the sampling-based method exposes the over-confidence captured by RI.
expect models to abstain from providing
[
Properties of Effective Measurement
We identify three key properties that an effective metric for knowledge-aware refusal should satisfy:
1. Faithful: Accurately quantify knowledge-avee refusal capability.
Consistent: Remain stable across different refusal rates induced by varying prompts or instructions.
3. Direct:
Derive directly from black-box L.M refusal decisions, without relying auxiliary models.
3

---

Published as a conference paper at ICLR 2026
3 REFUSAL INDEX
Scope. Our evaluation settings follow widely used factuality evaluations like SimpleQA and Truth- fulQA (Wei et al., 2024 Lin al., 2022), where models provide atomic answers for short-form, factual questions. Additionally, models can refuse to answer to avoid hallucination by producing outputs such as "I don't 't have enough information.."" ". Following SimpleQA, each model answer classified as correct, incorrect, or refused by comparing it against the ground truth. The classification results are used to estimate the model's factuality level, or our case, the ability to make knowledge- aware refusals. This formulation avoids subjective grading and partial correctness in LLM generation, allowing more reliable measurement.
Formally, we denote the LLM as fIM X + D {1}, where z E X represents the input question, y E 3 represents the output answer, and 1. denotes refusal. For the i-th question x; with ground truth y: in dataset D, we define two indicators: W; = 1 (1;)(x))) A yi for incorrect outputs (including refusals) and R, = 1 ((f(((z) = +} for refusal responses. We define the error probability w, (I, # y4) and the refusal probability
Notations.
(z)) =)). Conceptually, a model with better knowledge-awar refusal should refuse more frequently as questions hecome more difficult. We measure this ability with the Refusal Index. Inspired by rank-based calibration metrics like AUROC (Niculescu-Me Mizzil & Caruanal 2005), we define the Refusal Index as the correlation between refusal probabilities and error probabilities:
Definition 3.1 (Refusal Index). Refusal Index ps is defined as Spearman's 's rank correlation between the model's s refusal probability rs and the error probability wy as follows:
Refusal Index = ps = (ra)), Rank(ws)).
The intuition behind the definition is that model achieves perfect knowledge-awarenes when its refusal probability increases monotonically with error probability, making it more likely to refuse as questions become more difficult:
w; wy P(fL((0;) 1) P(fLM())) = 1).
Note that this differs from error-based calibration metrics like Expected Calibration Error (ECE), which quantify absolute discrepancies between r, and wy. In contrast, our approach evaluates only the rank discrepancies between 7; and w;. We define RI as a discrimination property because it captures the fundamental aspect of knowledge-aware refusal. This is because absolute discrepancy- based metrics are sensitive to changes in a model's s overall refusal rate, which can significantly affect the metric value (an undesirable property). contrast, discriminative metrics like RI AUROC measure only the rank between different samples, making them more robust to changes in overall refusal rates. Alternatively, it is generally easier for model adjust its overall refusal rate than improve its ability to rank questions by difficulty accurately. Next, we introduce how to estimate the Refusal Index through a two-pass evaluation process (Section 3.1.
3.1 TWO-PASS EVALUATION
The naive way to measure RI would require the refusal probability P(fLM(()) 1) across questions with varying error probabilities. However, in factuality evaluation, we only observe single text output from the model, making refusal probabilities inaccessible. To address this issue, we propose two- pass evaluation process to infer the Spearman correlation between refusal and error prohabilities from binary observations. This approach models refusal decisions by first treating refusal and correctness indicators as results of thresholding on their respective probabilities, and then modeling their joint distribution with a Gaussian copula.
We estimate from the joint distribution of refusal and error probabilities using a Gaussian copula model with correlation p as follows:
Formulating the Joint Distribution.
C(u, u) = + (w) T (v)).
Here, u = F, (r:) and v v= F are the marginal CDFs, T is the standard normal quantile function, and + is the bivariate standard normal CDF with correlation p. This Gaussian copula specifies only the dependence on p and leaves the marginal distributions of r; and w; unrestricted. The function Φ, depends only rank correlation, remaining independent of the marginal distributions.
4

---

Published as a conference paper at ICLR 2026
Next, avoid modeling F, and Fe directly and instead estimate p from R, and W; via maximum likelihood. We then compute ps from using the standard conversion formula for Gaussian copulas: Ps = arcsin (t) (Kendall & Stuart 1979). Because p determines the corresponding rank correla- tions of r; and u, via a monotonic transtormation, we could equivalently report other rank measures such Kendall's instead of ps. We use Spearman's 's p for interpretability.
Estimating requires observing two binary in- dicators for each sample: RG for refusal proba- bility r; and W for error probability we while rs and w, themselves remain latent. We achieve this through two-pass evaluation that runs the model on the same dataset twice. The first pass observes refusal decisions R, using a stan- dard setup that allows the model to answer or refuse each question, classifying responses as correct, incorrect, or refused. The second pass observes correctness W; by updating the sys- tem prompt to remove abstention options and requiring the model answer all questions. We provide prompt details in Section and an illus- tration in Figure We run the second pass only on questions refused in the first pass, collecting correctness indicators W for all refused questions (R; = 1).
First Pass
Compute
System Prompt
short
refuse uncortain
Dataset
X
21:Whh
Model
the 1881
Nooel Piizo
System Prompt
Alwaas give short anewer and don't refuse
Second Pass
Figure 2: Illustration of two-pass evaluation pro- cess.
Estimating Refusal Index. We define the aggregated correctness indicator W; = RG W + (1 R,) W; as the correctness when the model provided answer. The empirical refusal rate is r r= EPD RI and the error rate is μr = E / Under our model, the pair (R, W) results from thresholding bivariate standard normal vector (Zn, Zw) with correlation p at, matching the standard tetrachoric setup implied by the copula.
TR = - ' 1 r),
TW $ 4- (1) 14).
(4)
Let Nad be the counts of (R = w = b) for a, E {0.1}. The cell probabilities are (p) Φ (
P(ZR TR. TR. Zw > TW). (p)()) (p) pp)
(io(p)
(5)
(p) = 1 ------ r-r---p -
We estimate ý by maximizing the multinomial likeliiil and use X to compute ps:
X arg max E(p), where
(pp) = Σ
Mab log Pat (p)
(6)
PE(-1.1)
(0.1
4 EXPERIMENTS & RESULTS
4.1 EXPERIMENTAL SETUP
Models. We evaluate RI on 16 models across different families, sizes, and architectures ensure com- prehensive coverage. Our open-source models include Gemma-3-12B (Gemma Team 2025), Owen3- 328/235B (Qwen Team 2025) in both think and no-think modes, Qwen2.5-72B, Jiven2.5-72B-nnsrruct (Qwen Team et al.] 2024), Llama 3./ 70B (Gattafiori et al. 2024). Mistral-Large-nntrree 1 (Mistral All 2024).
GLM-4. and GLM-455-AinGGM443 Team et al. (2025) and DeepSeek-V3-00 V3-0324 (DeepSeek-A) Al et al. 2024). Our proprietary models include Claude 3.5 haiku (Anthropic) 2024), Claude Sonnet 4 (Anthropic 2025). GPT4.1 and GPT4. mini (OpenAl (025) and Gemini 2.3 Flash and Gemini 2.5 Flash Lite (Comanici et al. 2025). We temperature=0.7 and top-p=0.95 across all models. More
implementation details are provided in Section C
Datasets. We evaluate RI on three scenarios that require model to make accurate, knowledge-un refusals: factual question answering, extrinsic hallucination detection (hallucination from training data), and intrinsic hallucination detection (hallucination from context). (1) We use factual question answering to test models' ability to refuse unknown facts. Specifically, we use SimpleQA (Wei et al.
5

---

Published as a conference paper at ICLR 2026
Table 2: Score variability across different refusal rates. We run evaluation with different refusal tendencies on SimpleQA for each model. Metri denotes the normalized difference between most- refusal and least-refusal runs. We use p 0.2 for the Weighted metric. Lower is better.
Type
Model
A Accuracy
Refusal
ACιa
F-sure
! Weighted
Ari
Mistral- 123B
-0.40
+0.93
-0.37
-0.16
-0.83
+0.06
Qwen2-35B
00.47
+0.95
-0.12
-0.31
-0.62
-0.19
Normalized
Qwen2.5-72B
-0.84
+0..33
-0.50
-0.60
-1.32
-0.07
Difference
Qwen3-32B
-0.96
+0.54
-0.48
-0.71
-1.42
+0.14
Gemma-3-12B
-1.31
+2.04
-0.96
-0.3
+1.79
+0.42
Average
-0.80
+0.98
-0.49
0.54
-0.48
+0.07
Model
Veceurayy
C'Reeusal
CVvciA
CVissooee
Viigghted
C'ViI
Mistral- 123B
0.16
0.35
0.14
0.06
0.31
0.04
Qwen2-351h
0.22
0.47
0.06
0.14
0.32
0.09
Coefficient of Variation
Qwen2.5-72B
0.35
0.17
0.19
0.26
0.53
0.03
Qwen3-32B
0.35
0.19
0.17
0.28
0.51
0.07
Gemma-3-12B
0.49
0.76
0.39
0.36
0.66
0.23
Average
0.31
0.39
0.19
0.22
0.47
0.09
2024). which contains verifiable, atomic factual questions that challenge even frontier LLMs. (2)
We use extrinsic hallucination detection to test whether models correctly refuse to answer when they cannot recall knowledge from training data. For this scenario,
Precise WikiQA (Bang et al.) 2025), a dynamically generated question-answering dataset from Wikipedia snippets. Precise WikiQA tests whether models hallucinate information from their training data, assuming Wikipedia knowledge was included during training. We follow [Bang et al. (2025) to generate 2000 questions for evaluation. (3) We use intrinsic hallucination detection to whether models can faithfully recall information with noisy context. For this scenario, we use the 3 datasets from FaithEval (Ming et al.) 2025).. However, because the Unanswerakh for RI computation, we create 1:1 mixed dataset of Precise WikkiA and FaithEval to report RI.
and Incons stency subsets lack ground truth required
Baseline Metrics. We compare RI against five established metrics for measuring knowledge-awarc refusal [T: Correct Answer Rate, Refusal Rate, Correct given Attempted (C/A), F-score, and Weighted Score. We pick p = 0.2 for the Weighted Score balance the accuracy and refusal rate. We classify all model outputs into three categories following SimpleQA: (1) Correct, (2) Incorrect, or (3) Not Attempted (refusal).
Adjusting Refusal Rates. We test RI's consistency by measuring how it changes when models exhibit different refusal rates. To this end, we use different system prompts to instruct models to be conservative active in answering questions. These prompts modify refusal tendencies without degrading the quality of refusal decisions, as shown Section]] Specifically, we use four different system prompts evaluate each model with varying refusal rates in the first pass, while keep one default prompt that instructs models to answer questions in the second pass. The complete system prompts are provided in Section
4.2 RI STABLE ACROSS DIFFERENT REFUSAL RATES?
For each metric M, we summarize stability across the four refusal prompts using two scale-normalized measures:
Normalized difference. AM (Mmax Mmin) //Mmmanll which captures how far the most- and least-refusal runs deviate relative to the average level.
Coefficient of variation. CVM M std(M)/ MMaa// which measures relative dispersion around the mean and allows comparison across metrics with different scales.
In this section, we validate the Refusal Index across different refusal rates to analyze its stability as a metric for knowledge-awarc refusal. Our analysis shows two key findings: (I) the Refusal Index conceptualizes and captures intrinsic knowledge-awwe
refusal ability through curve, and (2) the two-pass evaluation returns consistent RI regardless of a model's refusal rate.
accuracy-refuuse
RI Measures Knowledge-aware Refusal with Accuracy- Refussl Curve. An accuracy refusal curve quantifies knowledge-awee aware refusal by plotting correct answer rate against refusal rate for a model

---

Published as a conference paper at ICLR 2026
on the same dataset. This trade-off emerges because refusing uncertain questions reduces incorrect answers but simultaneously decreases correct answer numbers due to false refusals. Consequently, models face trade-off between maintaining correct answers and avoiding incorrect ones. As shown in Figure [] fixing any metric constant gives a unique iso-score curve the accuracy-refure plane, which describes the accuracy-refusal trade-off relationship assumed by the metric.
Iso-RI curves demonstrate two key advantages over heuristic metrics. First, they represent re- alistic accuracy-refusal trade-off's that match expected model behavior (see Figure | left). All iso-RI curves share the same endpoints: maximum correct answers when refusal rate equals zero, and zero correct answers when refusal rate equals one. Correct answer rate continu- ously decreases as refusal rate increases. Second, RI focuses solely on curve convexity, re- maining independent of maximum correct answer rates and refusal rates. This design allows RI to capture how effectively model preserves correct answers by minimizing false refusals.
For example, when two models have identical maxi- mum correct answer numbers, the model with higher RI will retain more correct answers at any given re- fusal rate. The mathematical derivation of these prop- erties is provided in Section However, heuristic metrics fail to capture this distinction, instead im- posing linear aecuracy-refusal relationships at fixed scores. Overall, the Refusal Index measures rank cali- bration in refusal decisions rather than simply reward- ing higher accuracy or lower refusal rates, making distinct from existing metrics. For an empirical view of these curves across multiple models and re- fusal prompts, Section F visualizes iso-RI contours together with observed accuracy-refusal points.
Correct Answer Rate
0.15
RI-B1.8
Correct-0.18
0.10
Refusal-0.45
CIA-0.25
F-score-0.23
0.05
Weighted-0.73
Empirical Data
0.00 0.0
0.2
0,4
0.6
0.8
1.0
Refusal Rate
RI remains consistent across different refusal rates. We then empirically validate RI by testing its consistency across varying refusal rates. We use 4 system prompts described in Section 4.1 that progres- sively encourage higher refusal tendency, inducing different refusal rates when applied to the same model on the SimpleQA dataset. Complete results for all models SimpleQA are provided in Section [ RI demonstrates high stability across different refusal rates while heuristic metrics show substantial variation. Table 2 shows that RI exhibits approximately 70% lower variability than heuristic metrics. This stability suggests that prompt- induted changes in refusal rate shift the refusal probability distri- bution without altering the underlying correlation between refusal probability and error probability. We validate this assumption with goodness-of tests in Section
Comparison of factuality met- rics with iso-score accuracy-refusal trade-off curves. C/A. F, and W correspond to Correct Attempted, F-score, and Weighted score, re- spectively. Empirical data from Qwen2.5- 72B on SimpleQA.
Figure 3:
4.3 IS REFUSAL INDEX FAITHFULL AND CALIBRATED?
RI is highly consistent with sampling-based calibration methods. A potential concern arises because RI is defined rank correlation between refusal probability and error probability, yet the two-pass evaluation may not faithfully capture this correlation. We address this concern by comparing RI values with AUROC scores computed using P(Answering) following Wei et al. (0044). Specifically, we compute P(Answering) by sampling 100 times from each question under temperature=1, then setting the prediction probability to 1 Niecusal /NN where Nretusal N is the ratio of refusal answers in the 100 generations. We then compute AUROC scores between P(Answering) and correctness labels. AUROC with P(Answering) provides fair comparison because it shares RI's uncertainty definition, measuring only the discriminative ability of refusal as a rank-calibration metric, while P(Answering) directly estimates prediction probability for model refusals. See Appendix [L for complementary reliability-diagrat and APRICOT-style calibrators, and for Table g which summarizes representative confidence- based methods and RI in terms of bias and computational cost. RI demonstrates the strongest positive correlation with AUROC at 85%, outperforming all other evaluated metrics (Figure 4). This
uncertainty estimation method,
comparison with linear-probe
7

---

Published as a conference paper at ICLR 2026
1.0
Corr:: 85.8%
Corr:: 37.6%
Cor:: -24.6%
Corr: -73.3%
0.9
ALROC
0.5
0.1
0.2
0.3
0.3
Refusal Index
C.A.A A
F score
Weighted
gemmal 26
qwen72b
Regression Line
Low Refusal
High Refusal Highest Refusal
qwen.2b
mistrall 23b
93% Regression Band
Normal Refusal
Figure 4:
Correlation between factuality metrics and AUROC with P(Answering) on SimpleQA. RI shows the highest positive correlation with AUROC while being much cheaper compute.
high agreement confirms that RI accurately reflects the correlation between refusal probability and error probability. Additionally, RI requires much lower computational overhead than estimating P(Answering) through multiple sampling.
4.4 CAN REFUSAL INDEX CONSISTENTLY RANK MODELS?
We examine whether RI consistently measures knowledge-aweer refusal across different models and datasets by analyzing model ranking stability. Ranking stability measures whether RI produces consistent model rankings across different datasets and evaluation settings. Higher ranking stability indicates that a metric captures robust, discriminative model properties. calculate Kendall's ss W (overall ranking agreement) and Winner Entropy (top-1 consistency) across 8 evaluation settings: refusal-varying evaluations on SimpleQA plus hallucination benchmarks. Because correct answer rate and refusal rate already provide high ranking stability their own, need filter their monotonic effects to isolate ranking stability of accuracy-refusal trade-off. Specifically, we perform isotonic regression on correct answer rate refusal rate across different setups for each model, then remove the regressed values from each metric. These residuals represent metric components that cannot be explained by correct answer rate or refusal rate alone. We then calculate Kendall's W and Winner Entropy on these residuals. We provide detailed procedures in Section [
RI provides stable model rankings independent of accuracy and refusal rate. RI maintains high ranking stability when removing monotonic effects of correct answer rate or refusal rate, while heuristic metrics degrade to near-random stability (Table 33. Heuristic metrics like F-score and Weighted achieve strong ranking stability initially, but their Kendall's W and Winner Entropy drop dramatically after removing monotonic effects from correct answer rate or refusal rate. This pattern reveals that heuristic metrics derive their ranking stability primarily from correct answer rate or refusal rate rather than the relationship between them. However, RI retains most of its ranking stability after removing these effects, demonstrating that it captures intrinsic knowledge- refusal properties that persist across different evaluation settings.
Table Ranking stability across different evaluation settings. Correct and - Refussll show results after removing monotonic effects of correct answer rate and refusal rate with isotonic regression. - -Both removes both correctness and refusal rates with additive isotonic regression.
Kendall's W
Winner Entropy J
Metric
Default
Correct
Refusal
Both
Default
Correct
Refusal
Both
Random Value
0.25
0.25
0.25
0.25
0.61
0.61
0.61
0.61
Correct Answer Rate
0.87
0.00
0.48
0.39
0.00
1.00
0.48
1.00
Refusal Rate
0.86
0.44
0.00
0.30
0.18
0.61
1.00
1.00
C/A
0.69
0.63
0.40
0.37
0.33
0.61
0.48
0.61
F-score
0.90
0.48
0.39
0.18
0.48
0.52
Weighted
0.87
0.60
0.25
0.32
0.33
0.33
0.37
0.61
RI
0.47
0.50
0.35
0.49
0.47
0.33
0.61
0.37
8

---

Published as a conference paper at ICLR 2026
5 DISCUSSION
Does prompting models to be more cautious mitigate miscalibration? Our results show that prompting strategies have limited impact on knowledge-awand refusal capabilities. LLMs torious for overconfidence, answering all questions by default even when they lack knowledge. Instructing models to refuse more questions might seem to help, but our RI analysis reveals otherwise. Table 2 shows that while increasing refusal rates improves the correct answer rate in answered questions (increasing C/A), RI remain stable and far from perfect. This means that, even when model's 's refusal rate matches its error rate (eliminating systematic bias), significant gap persists between actual and perfect refusal decisions. RI quantifies this gap independent of specific refusal rates, providing a stable measure across prompting strategies.
What factors lead better knovledge-aware refusal? We find that model family is the strongest predictor of knowledge- aware refusal ability, surpass- ing traditional factors like size and accuracy. We found no strong correlation between RI and model parameter sizes, accu- racy, or refusal rates within our tested models. Figure [ the relationship between correct an- swer rate in SimpleQA and av- erage scores, with regres- sion line showing the expected relationship. The correct answer rate shows only 8² 0.235 cor- relation with Refusal Index, in- dicating that higher factual curacy does not necessarily im- prove knowledge-aware refusals. Notably, model family strongly predicts RI performance. Claude and Qwen models (except Qwen 235B) consistently perform above the regression line, demonstrating superior knowledge-aww refusal abilities. In contrast, all Gemini, GPT-4.1, and GLM-4.5 models fall below the regression line. Specifically, Claude models achieve the highest RI scores across both Claude-3.5 Haiku and Claude-4 Sonnet variants. These findings suggest that training pipelines and data distributions used by different model providers play a more critical role in knowledge-aware refusals than model scale general accuracy.
Claude 15 Haiku
0.50
Cludde Sonnet
Deepšieek va
0.45
Mistral
Uama3 70B1
Refusal Index
Qwen25
Qwerd 31B
Qperd
[wwnd 2158
GPT-4 Mini
0.25
GLM-45
0,20
Gamini 2. Flash
0.15
Gamini 25 Flash Lite
*
0.10
0.1
0.2
0.5
0.6
Correct Answer Rate
Figure 5: Refusal Index vs. Correct Answer Rate on SimpleQA. The weak correlation (R²² = 0.242) indicates that higher accuracy does not guarantee better knowledge-awars refusal. Models above the regression line (green) outperform expectations; Claude and Qwen models consistently appear in this region, while Gemini, GPT-4.1, and GLM models fall below.
Is a model's refusal ability affected by context? We find that ground truth availability in context significantly im- pacts knowledge-aware refusal perfor- mance, with models struggling most when ground truth is unavailable. We expand RI evaluation to realistic settings where models generate answers conditioned on grounding context with FaithEval. Table presents four scenarios testing different as- pects of refusal ability: Precise Wiki re- quires models to recall information from training data; Counterfactual tests models" ability to avoid hallucinating from mislead- ing context; Inconsistency provides conflicting information requiring refusal; and Unanswerable offers no contextual answers. RI values for Precise Wiki are relatively close to those of SimpleQA, and models demonstrate strong ability to identify and avoid counterfactual context. However, when ground truth becomes unavailable (Inconsistency and Unanswerable scenarios), models exhibit sub- stantially worse knowledge-awer refusal. This suggests that knowledge-awanl refusal relies
Table 4: Refusal Index results hallucination bench- marks.
Truth Available
Truth Unavailable
Model
Precise- Wiki
Counter- factual
Incon- sistency
Unans- werable
Gemma-3-12h
0.36
0.56
0.22
0.12
Qwen3-32B
0.48
0.60
0.27
0.24
Qwen2,5-72B
0.54
0.56
0.22
0.40
Llama-3.1-708
0.52
0.70
0.17
0.31
Mistral-Large
0.50
0.38
0.34
0.52
Average
0.48
0.56
0.24
0.32

---

Published as a conference paper at ICLR 2026
partial information from training data context, and degrades when answers never appear in the provided context.
In summary, these findings demonstrate that RI captures essential dimension of model reliability that is absent from existing factuality metrics. While current factuality evaluation and calibration studies show promising results in improving model accuracy and calibration (Kadavath al. 20226), RI reveals a different picture. Our results highlight the need to incorporate knowledge-awar refusal evaluation for comprehensive factuality assessment. We also provide detailed discussion of the limitations of RI in Section A
RELATED WORK
Factuality evaluation of LLMs. Factuality evaluation measures an LLM's ability generate correct answers. Previous methods compare LLM responses against external sources to assess factual correctness (Wei et al., 2024 Min et al. 2023 Kwiatkowski al. 2019), Many factuality
evaluations focus on measuring hallucination, where models generate answers that contradict available information (Bang et al. 2025). Recent work in factuality evaluation recognizes that ground truth may not always be available to the model (Jing et al. (025). Some works improve factuality by training models to refuse questions beyond their knowledge boundaries (Cao) 2024) Xu al. 22024] Ouyang al. 2022). Our metric evaluates calibration through refusal behavior rather than targeting
hallucination rate directly.
Calibration evaluation on black-box models. Calibration measures the alignment between model's 's output probability and its actual probability being correct (Guo et al. 2017). Calibration serves valuable factuality metric because it quantifies model's 's self awrfenwsssssss of its
knowledge (Kadavath et al. [022a]] Yin et al. 2023a Agrawal et al.) 2023). Estimating calibration for
black-box LLMs requires inferring uncertainty from text outputs. Previous works propose semantic similarity measures (Kuhn et al.) 2023) Farquhar et al., 2024) or auxiliary models (Ulmer et al. (002))
estimate uncertainty, producing error-based or rank- based calibration metrics (Huang et 2024). These methods require training a separate calibrator for each model, making them computationally
expensive and model-dependent Our metric measures the correlation between uncertainty and difficulty, representing a form of rank rank-based calibration.
CONCLUSION
We propose Refusal Index (RI), novel metric that measures LLMs' knowledge-aware refusal ability through the correlation between refusal decisions and answer incorrectness, addressing critical limitations of existing factuality evaluation methods. Our two-pass evaluation framework provides practical and lightweight approach to measure RI, enabling more reliable model comparisons independent of accuracy or refusal rate. This work opens new directions for developing better- calibrated AI systems and provides a foundation for evaluating self-knowledge in LLMs.
ACKNOWLEDGEMENTS
This work was supported in part by the National Natural Science Foundation of China under Grant 62172123 and Grant 62302122, Heilongjiang Provincial Natural Science Foundation of China under Grant JQ2024F001, and HK RGC under Grants C1043-24GF and RFS2425-1S01.
REFERENCES
Ayush Agrawal, Mirac Suzgun, Lester Mackey, and Adam Kalai. Do language models know when they're re hallucinating references? In Proceedings of the 6th ACM Workshop on for Sci. and Open Source, 2023.
Anthropic.
Introducing computer use, new claude 3.5 sonnet, and claude 3.5 haiku. https / w/www. www.wnntrroicccoo httpp/i....cc..oooooomeeeeeeeeee news http:///wosssosssooomooeeeae-aee
2024.
Anthopicc. Claude sonnet 4 and claude opus 4. https: httpa:://www..tthzoo.... comp wtt.:pppii..co//...eeeeeaaaa claude 2025.
10

---

Published as a conference paper at ICLR 2026
Yejin Bang, Ziwei Ji, Alan Schelten, Anthony Hartshorn, Tara Fowler, Cheng Zhang, Nicola Can- cedda, and Pascale Fung. HalluLens: LLM Hallucination Benchmark, 2025.
Lang Cao. Learn to refuse: Making large language models more controllable and reliable through knowledge scope limitation and refusal mechanism. In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, 2024.
Qiguang Chen, Libo Qin, Jinhao Liu, Dengyun Peng, Jiannan Guan, Peng Wang, Mengkang Hu, Yuhang Zhou, Te Gao, and Wanxiang Che. Towards reasoning era: A survey of long chain-of- thought for reasoning large language models, 2025, URL httptttpp///// pattps://arxiin httpp/////arxll..og/aaa///////// 2503
09567
Qinyuan Cheng, Tianxiang Sun, Xiangyang Liu, Wenwei Zhang, Zhangyue Yin, Shimin Li, Linyang Li, Zhengfu He, Kai Chen, and Xipeng Qiu. Can ai assistants know what they don't know?, 2024.
URL wwtphttps://ee http:::/axxivv.rroo.p abs 22//2241.11. 13275
Gheorghe Comanici, Eric Bieber, Mike Schackermann, et al. Gemini 2.5: advanced reasoning, multimodality, long context, and next generation agentic capabilities, arXiv preprint arXiv:2507.0626/ 20255
Pushing the frontier with
DeepSeek-Ar AI, Aixin Liu, Bei Feng, Bing Xue, Bingxuan Wang, Bochao Wu, Chengda Lu, et al. Deepseck-ve v3 technical report, 2024. URL htttps:/
abs///bb//// 2412. 19437
Sebastian Farquhar, Jannik Kossen, Lorenz Kuhn, Yarin Gal, and et al. Detecting hallucinations in large language models using semantic entropy. Nature, 630:625-630, 2024.
Gemma Team. Gemma technical report, 2025. URL 19786 1977 [cs.CL].
GLM-4.5 Team, Aohan Zeng, et al. Glm-4.5: Agentic, reasoning, and coding (arc) foundation models. arXiv preprint arXiv22508.06471 2025.
Aaron Grattafiori et al. The llama herd of models. arXiv preprint arXiv:2407.21783 2024
2024.
Chuan Guo, Geoff Pleiss, Yu Sun, and Kilian Q. Weinberger. On calibration of modern neural networks. In Proceedings of the 34th International Conference on Machine Learning, 2017.
Lei Huang, Weijiang Yu, Weitao Ma, Weihong Zhong, Zhangyin Feng. Haotian Wang, Qianglong Chen, Weihua Peng. Xiaocheng Feng, Bing Qin, and Ting Liu. A survey on hallucination in large language models: Principles, taxonomy, challenges, and open questions. ACM Transactions on Information Systems, 43(2) Jamuary 2025. ISSN 1558-2868. doi: 10. 105/743/7333 URL http: doi owg/ 10. http://....011111153333333333330
Xinmeng Huang, Shuo Li, Mengxin Yu, Matteo Sesia, Hamed Hassani, Insup Lee, Osbert Bastani, and Edgar Dobriban. Uncertainty in language models: Assessment through rank-calibration. arXiv preprint arXiv:2404.03163 2024.
Liqiang Jing, Jingxuan Zuo, and Yue Zhang. Fine- tnee-graied and explainable factuality evaluation for multimodal summarization. In Proceedings of the AAAI Conference on Artificial Intelligence, 2025.
Saurav Kadavath, Tom Conerly, Amanda Askell, and et al. Language models (mostly) know what they know. In Findings of the Association for Computational Linguistics: EMNLP 2022, 2022a.
Saurav Kadavath, Tom Conerly, Amanda Askell, Tom Henighan, Dawn Drain, Ethan Perez, Nicholas Schiefer, Zac Hatfield-Dodds, Nova DasSarma, Eli Tran-Johnson, Scott Johnston, Sheer El-Showk, Andy Jones, Nelson Elhage, Tristan Hume, Anna Chen, Yuntao Bai, Sam Bowman, Stanislav Fort, Deep Ganguli, Danny Hernandez, Josh Jacobson, Jackson Kernion, Shauna Kravec, Liane Lovitt, Kamal Ndousse, Catherine Olsson, Sam Ringer, Dario Amodei, Tom Brown, Jack Clark, Nicholas Joseph, Ben Mann, Sam McCandlish, Chris Olah, and Jared Kaplan. Language Models (Mostly) Know What They Know, 2022b.
11

---

Published as a conference paper at ICLR 2026
Sanyam Kapoor, Nate Gruver, Manley Roberts, Katie Collins, Arka Pal, Umang Bhatt, Adrian Weller, Samuel Dooley, Micah Goldblum, and Andrew G Wilson. Large language models must be taught to know what they don't 't know. Advances in Neural Information Processing Systems, 37: 85932-85972, 2024.
Maurice G Kendall and Alan Stuart. The Advanced Theory of Statistics, Volume 2: Inference and Relationship. Griffin, London, 4th edition, 1979.
Lorenz Kuhn, Yarin Gal, and Sebastian Farquhar. Semantic uncertainty: Linguistic invariances for uncertainty estimation in natural language generation. In Proceedings of the International Conference on Learning Representations, 2023.
Tom Kwiatkowski, Jennimaria Palomaki, Olivia Redfield, Michael Collins, Ankur Parikh, Chris Alberti, Danielle Epstein, Illia Polosukhin, Jacob Devlin, Kenton Lee, Kristina Toutanova, Llion Jones, Matthew Kelcey, Ming- Wei Chang, Andrew M. Dai, Jakob Uszkoreit, Quoe Le, and Slav Petrov. Natural questions: A benchmark for question answering research. Transactions of the Association for Computational Linguistics, 7:452-466, 2019, doi: 10.1162/tacl a 00226. URL 0r1/01911000001
Kai Lin, Shizhe Diao, Yanzhuo Lin, Yilun Xu, Jiamou Liu, Li Yuan, Sen Yang. and Xu Sun. Legalagentbench: Evaluating Ilm agents in legal domain. arXiv preprint arXiv:24/2.17259, 2024. doi: 10.488500/r2Xi.2442..777
Stephanie Lin, Jacob Hilton, and Owain Evans. Truthfulqa: Measuring how models mimic human 07958
falsehoods, 2022. URL /
Hamed Mahdavi, Alireza Hashemi, Majid Daliri, Pegah Mohammadipour, Alireza Farhadi, Samira Malek, Yekta Yazdanifard, Amir Khasahmadi, and Vasant Honavar. Brains vs. bytes: Evaluating Ilm proficiency in olympiad mathematics. arXiv preprint arXiv:2504.01995. 2025. doi: 10.48550/ arXiv.2504001995.
Sewon Min, Kalpesh Krishna, Xinxi Lyu, Mike Lewis, Wen-tau Yih, Pang Wei Koh, Mohit lyyer, Luke Zettlemoyer, and Hannaneh Hajishirzi. FActScore: Fine-grained atomic evaluation of factual precision in long form text generation. In Proceedings of the 2023 Conference on Em- pirical Methods in Natural Language Processing, pp. 12076-12100, Singapore, December 2023, Association for Computational Linguistics. doi: 10. 10.11863/v112022 eemnlp-minnlnnn 741. URL www.0023..em1pmmaa......
Yifei Ming, Senthil Purushwalkam, Shrey Pandit, Zixuan Ke, Xuan-Phi Nguyen, Caiming Xiong, and Shafiq Joty. Faitheval: Can your language model stay faithful to context, even "the moon is made of marshmallows", 2025. URL httttp:://axxv..orrg//oo/o
Mistral AI. Large enough. https: /tts://mmiste 2024. Blog post announcing Mistral Large 2.
/////mstrall wtaii//ww////ee neews/mister aaree-240 July
Alexandru Niculescu-Mizii and Rich Caruana. Predicting good probabilities with supervised learning. Proceedings of the 22nd international conference on Machine learning, 2005.
OpenAI. Introducing gpt-4.1 1 in the api.
2025.
Long Ouyang, Jeff Wu, Xu Jiang, and al. Training language models to follow instructions with human feedback. In Advances in Neural Information Processing Systems,
Qwen Team. Qwen3 technical report, 2025. UBl/:tttg.///aarr....r/////222b3
Qwen Team, An Yang, et al. Qwen2.5 technical report, 2024. URL 2412.151155
Dennis Ulmer, Martin Gubri, Hwaran Lee, Sangdoo Yun, and Scong Oh. Calibrating large language models using their generations only. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics ( (Volume I: Long Papers), pp. 15459, 2024.
Shansong Wang, Mingzhe Hu, Qiang Li, Mojtaba Safari, and Xiaofeng Yang. Capabilities of gpt-5 multimodal medical reasoning, 2025. URL httpss//aarsii..ong/aa////////
12

---

Published as a conference paper at ICLR 2026
Jason Wei, Nguyen Karina, Hyung Won Chung, Yunxin Joy Jiao, Spencer Papay, Amelia Glaese, John Schulman, and William Fedus. Measuring short- form factuality in large language models, 2024. URL
Miao Xiong, Zhiyuan Hu, Xinyang Lu, Yifei Li, Jie Fu, Junxian He, and Bryan Hooi. Can llms express their uncertainty? an empirical evaluation of confidence elicitation in Ilms, arXiv preprint arXiv:2306.13066 2023.
Hongshen Xu, Zichen Zhu, Situo Zhang, Da Ma, Shuai Fan, Lu Chen, and Kai Yu. Rejection improves reliability: Training Ilms to refuse unknown questions using from knowledge feedback. In Proceedings of COLM 2024, 2024.
Xiangru Yin, Yelong Shen, Rohan Anil, and et al. Do large language models know what they don't t know? In Findings of the Association for Computational Linguistics: ACL 2023, 2023a.
Zhangyue Yin, Qiushi Sun, Qipeng Guo, Jiawen Wu, Xipeng Qiu, and Xuanjing Huang. Do large language models know what they don't 't know? arXiv preprint arXiv:2305.1811 18153, 2023b.
Hanning Zhang, Shizhe Diao, Yong Lin, Yi R. Fung, Qing Lian, Xingyao Wang. Yangyí Chen, Heng Ji, and Tong Zhang. R-tuning: Instructing large language models say don't know', 2024. URL :etps://azee org/ org/abs/////oooooooo/./////.// 2311 09677
13

---

Published as a conference paper at ICLR 2026
APPENDIX SUMMARY
This appendix provides essential background and technical details supporting our Refusal Index evaluation framework. We first discuss the limitations of approach in Section [A] followed by complete system prompts for the two-pass evaluation methodology in Section B We then present comprehensive experimental configurations in Section C and compare external calibration methods in Section D The theoretical foundations are established through validation of the Gaussian copula assumption (Section D) and mathematical derivations of iso-RI curve properties (Section E). Complete experimental results on SimpleQA are provided in Section G Extended analyses include stability assessments regarding sample size (Section HD and prompt design variations (Section []. along with ready-to-use Python implementation of our metric (Section[]. We conclude with ranking stability evaluation methodology (Section K] and an LLM usage declaration.
A LIMITATIONS OF REFUSAL INDEX
The Refusal Index has three key limitations that practitioners should consider. First, the two-pass evaluation requires models capable of following instructions to either refuse questions provide forced answers, limiting applicability to relatively capable models. Second, our formulation targets knowledge-aware refusal specifically and may not generalize to other refusal types or other applica- tions, such as safety-bases refusals, or refusal behavior in non-factual tasks. Finally, knowledge-awan refusal provides a relatively weak signal compared to metrics like correct answer rate, requiring larger datasets for stable RI scores (Section H). Despite these limitations, RI offers pragmatic metric for an important capability that previous metrics overlooked.
B SYSTEM PROMPTS FOR TWO-PASS EVALUATION
We provide the complete system prompts used in our experiments enable accurate reproduction. These prompts use consistent formatting instructions to standardize outputs. We include in- in-context learning examples to ensure stable model behavior and syntactically correct answers in the required format.
Second Pass System Prompt. The second pass forces models to answer questions that were refused in the first pass. We combine explicit instructions with in-context examples to enforce the output format and minimize formatting errors. Most models rarely refuse when given such instructions, so simply instruct the model to always provide answer. The in-context examples help the model consistently produce the required XML-style tags. We show the complete second-pass system prompt in Figure
First Pass System Prompt. Our first-pass prompts use the same design and formatting as the second-pass prompt. However, make small, targeted changes to the instruction wording and the mix of in-context examples to encourage appropriate refusal behavior. Figure 7 shows one complete first-pass prompt variant. Other variants differ only in how strongly they encourage refusal and the proportion of examples that show returning <ansseer>UNNNGEERED UNW.NNNNEEEDDEDAAAS...... answer> when uncertain.
These first-pass variants differ from the second-pass prompt (Figure () in only two ways: (1) how strongly the instruction encourages refusal and (2) the proportion of (w answer> responses in the in-context examples. These changes control the overall refusal tendency without otherwise changing the task.
C DETAILED EXPERIMENTAL SETUP
This section provides comprehensive details of our experimental methodology to enable reproduction of our results.
Model inference and generation settings. To ensure fair comparison across different language models, we maintained consistent decoding hyperparameters throughout our evaluation. Unless explicitly stated otherwise, all models used nucleus sampling with temperature 0.7, lop-p=0.99 and maximum generation length of 4096 tokens. We served all open-source models using vI.LM
14

---

Published as a conference paper at ICLR 2026
Second Pass Prompt
EXAMPLE 1
INFUT: what year did Baleka Mbete become the Deputy President of South Africa post-apartheid?
OUTPUT: <answer:2008<<anseer>>
EXAMPLE 2
INFUT: Who the mayor of Kathmandu who served from 1971 to 1976?
OUTFUT: <answer>Rajendra Man Suwal</answer>
[omitted for brevity]
EXAMPLЕ 10
INPUT: The book "Rhine" by Anselm Kiefer from what year?
OUTPUT: <answer>1981<<anskk
Reason through the following questien and provide brief answer in answer>... (nswer>...</aneee <///n//ww>>> at end. You always give an answer and you never return <unsee>UNNNGEERDD//ennnaa ansswerr.
Question: (question)
Figure 6: Second-pass system prompt used to force answers on previously refused questions. The prompt standardizes output format and includes in-context examples minimize formatting errors.
First Pass Prompt Highest Refusal Rate
EXAMРLЕ 1
INPUT: what year did Baleka Mbete become Deputy Presi dent of South Africa post-aparthei
OUTPUT: Sanwer>>DAANS/EEDD///aaw
[omitted for brevity]
EXAMPLE 10
INPUT: The book "Rhine" by Anselm Kiefer is from what year? OUTPUT: <answer/UKNSS/EEE/////aaaa
Reason through the following question and provide a brief answer in answer>...</ "eswerr...saasweee. <//asseer>> at the end. You are very cautious and need good evidence before drawing conclusions. You preter saying you don't t know by returning Canswee>UNANGWERRDD/ answer> rather than risking wrong answer.
Question: (question)
Figure 7:
First-pass prompt variant that induces the highest refusal rate. The instruction and examples bias toward returning UNANSWERED when uncertain.
with eight NVIDIA A800 (80 GB) GPUs, while proprietary models were accessed through their official APIs using identical decoding parameters.
For Qwen3, we evaluated both "thinking" and "non-thinking" modes to assess the impact of chain-of- thought reasoning knowledge-aware refusal. Qwen3 provides soft switch mechanism: appending /think or /no_thing nk to the prompt controls the generation of <thinb nk> reasoning blocks. Following the official Qwen documentation, used /no_thin nk to disable thinking mode for non-thin non-thinking evaluations.
15

---

Published as a conference paper at ICLR 2026
Table 5: Summary of first-pass prompt variants. Only the refusal instruction and the proportion of UNANSWERED responses differ across variants; all other elements match the second-pas -poos prompt. Ratios vary by model and dataset (see Section G): we report relative levels for brevity.
Type
Instruction
UNANSWERED ratio
Low Refusal
You only give answer if you confident; otherwise you return
0/ 10
Normal Refusal
You are cautious and may return UNA NSWEREID when unsure. You make reasonable guesses from partial information but avoid speculation; return UNANSWERED if not very confident. You are very cautious and prefer UNANSWERED rather than risking a wrong answer.
1 /
High Refusal
4 10
Highest Refusal
6/ 10
Answer classification and automatic grading. Our evaluation framework classifies model re- sponses into either correct, incorrect, or refused enable RI computation. We instruct each model to generate responses with an <answer> tag containing either a factual answer or a refusal with <
We first detect refusals by scanning for the exact substring Remaining responses are classified using the same auto- matic grading system as SimpleQA to ensure consistency with established benchmarks. We employ the same model used in SimpleQA, GPT-4o-mini with default generation settings provided by OpenAI as our automatic grader, which has demonstrated high reliability in SimpleQA evaluation. The grader classifies each predicted answer CORRECT, INCORRECT, prompt shown in Figure [
COT_ATTEMPTED using the
This LLM grader handles
where models make refusals but did not return <answer> > UNANSWERRD www.EEEREDDD////......... answer>. In such cases, the grader classifies these responses as NOT_ATTEMPTED based on the content of the predicted answer. In the second pass, same LLM grader but classify NOT ATTEMPTED responses as INCORRECT, as we do not expect refusals in the second pass. This LLM grader is used for all three evaluation scenarios.
the
Benchmark datasets and evaluation scenarios. Our evaluation encompasses three complementary scenarios that test different aspects of knowledge-awar refusal: factual recall, extrinsic hallucination detection, and intrinsic hallucination detection. This comprehensive approach ensures that RI captures refusal behavior across diverse nnowledgeinnteniive tasks.
Factual question answering (AimpleQA): We use SimpleQA to evaluate models' ability to refuse unknown factual information. SimpleQA contains 4,326 carefully curated factoid questions spanning science, geography, history, and popular culture. Each question has a single, indisputable answer verified by two independent annotators with high inter-annotator agreement. This benchmark tests whether models can appropriately refuse questions about facts they may not have learned during training.
Extrinsic hallucination detection (PreciseWikiQA): We evaluate models' ability refuse when they cannot accurately recall information from their training data using Precise WikiQA from the HalluLens benchmark suite. PreciseWikiQA dynamically generates short factual questions from Wikipedia snippets, assuming that Wikipedia content was included in model training. The evalua- tion protocol first assesses model refusal decisions, then classifies non-refused answers correct, incorrect, or unverifiable using an LLM judge. We use the same LLM grader as in SimpleQA for this task.
Intrinsic hallucination detection Eval): We assess models' ability to refuse when provided with insufficient or contradictory context using three tasks from FaithEval. This benchmark evaluates knowledge-aware refusal in retrieval- aaugente-d generation scenarios, constructed from ten diverse QA datasets (SQuAD, NewsQA, TriviaQA, NaturalQuestions, SearchQA, HotpotQA, BioASQ. DROP, RACE, and TextbookQA).
The three FaithEval tasks target different contextual challenges:
Unanswerable Context: Context is modified to remove supporting evidence (2.4K examples with >98% human-evaluator agreement on automatic checks)
16

---

Published as a conference paper at ICLR 2026
Grade the predicted answer as CORRECT (A), INCORRECT (2), Or NOT_ATTEMPTED (C).
Grading Criteria:
CORRECT: Answer contains all essential information from the gold target may include hedging but no contradictions; capitalization/ punctuation/ grammar don't t matter.
INCORRECT: Answer contradicts the gold target, even with hedging, NOT_ATTEMPIED: Answer lacks essential information but doesn't contradict the gold target.
Rules:
Por numbers: Must be correct to the last signi ficant figure of gold target.
Informaticn implied by the questien doesn't need repeating (e.g., "San Francisco" is correct for "What city is OpenAI in?" when gold target is "San Francisco, California"). Minor typos in names are acceptable.
Partial information for multi-part targets acceptable if it directly answers the question.
If there is "UNKNOWN" or "UNANSKERED" or ANOT_ATTEMPEED in the predicted answer, you MUST grade as "C", no matter what the content of the predicted
is.
<Begin of Question> (question)
<knn of Question>
<Begin of Gold Target> (answer)
<End of Gold Target>
<Begin Predicted Answer> (predicted_anevert <End of Predicted Answor>
Return the letter "A", "B", "C" with other text. The grade is:
Figure 8: LLM grader prompt used to classify predictions as CORRECT, INCORRECT, or NOT ADT_ATTEM for both passes.
Inconsistent Context: Multiple documents with conflicting answers concatenated (1.5K samples)
Counterfactual Context: Context supports false statements (e.g., "water freezes at 100"C")
using multiple-choice questions (IK samples)
Together, these tasks provide 4.9K contextual QA pairs that reveal models' difficulty in maintaining faithfulness provided context when information is incomplete or contradictory.
D VALIDATING THE GAUSSIAN COPULA ASSUMPTION
We use the bivariate normal copula (Gaussian copula) model the joint dependence between refusal and incorrectness under forced answering. This choice allows us to estimate the Refusal Index by capturing the correlation structure between the latent refusal score and question difficulty while remaining agnostic to the marginal distributions. We must validate whether this distributional assumption is appropriate for real model behavior.
We compare the Gaussian copula against three alternative copula families to determine which provides the best fit for modeling refusal behavior. We consider Student-1, Gumbel, and Clayton copulas
17

---

Published as a conference paper at ICLR 2026
Table Copula comparison on SimpleQA across model-prompl combinations (ties counted as 0.5).
Left panel reports mean goodness-of of-fit metrics across all combinations for each copula family. Right panel reports the fraction of combinations where the Gaussian copula outperforms each alternative.
Goodness-of-Fi Metrics
Gaussian Win Rates
Family
Log- loglliielihood
AIC
BIC
Versus
bog-likelihood
AIC
BIC
Gaussian
1832.08
3666.16
3671.76
Student-r
1.000
1.000
1.000
Student-r
1859.14
3722.27
3733.48
Clayton
0.676
0.647
0.647
Gumbel -2086.86
4175.72
4181.32
Gumbel
0.632
0.618
0.618
Clayton
-2200.13
4402.26
4407.86
as alternatives, each capturing different forms of dependence structure. We evaluate which copula family best fits the observed refusal patterns across multiple models and prompts.
Evaluation Criteria. We use two criteria to evaluate copula performance: goodness-of-fit and win-rate comparisons between the Gaussian copula and the alternatives.
Since the margins are fixed by construction in our two-pass evaluation setup, the natural goodness-of- fit criterion is the multinomial oggllikeihood implied by each copula through the resulting 2 2 cell probabilities. Different copulas have varying numbers of parameters (c.g.. Student-7 has 2 parameters while Gaussian has only 1), we must penalize model complexity ensure fair comparison. We complement the raw log-likelihood with the Akaike Information Criterion (AIC) and Bayesian Information Criterion (BIC):
AIC 2k 20(()),
BIC = k log(n) - -2((0).
(8)
where l the number of parameters, n is the sample size, and ((²) is the maximized log-likelihood. These criteria penalize more complex dependence structures, providing principled basis for model selection.
For the second criterion, evaluate win rates by comparing how often the Gaussian copula out- performs each alternative across different model-prompt combinations. We compare the Gaussian copula with three standard alternatives that capture different forms of dependence. A Student-r copula adds a heavy-tail parameter to the Gaussian structure; a Clayton copula emphasizes lower-tail association and is asymmetric; and Gumbel copula emphasizes upper-tail association and is also asymmetric. All candidates are fit by maximum likelihood with margins fixed at the empirical refusal and forced-and answering error rates for each model-prompt combination. Win rates are computed across these individual model-prompt units to assess the relative performance of each copula family.
Experimental Setup. We systematically evaluate and compare the maximum log- log-likelihood for each copula family on the SimpleQA dataset. Our evaluation covers all 16 models and 4 first-pass prompts used in the main evaluation (see Section G).
For each model-prompt combination, we obtain 2 x contingency table with margins (r, p)) representing the refusal rate and error rate respectively. Each copula C. maps these margins to cell probabilities (Puo, P01 P10- P11), and estimate the copula parameters by maximizing the multinomial likelihood of the observed counts as defined in Equation
P arg max {(p), ,E(-1,1)
where
{(p)
Σ Nab log las(p...).
(0,1)
This setup isolates the copula choice while maintaining consistency with the main evaluation frame- work.
The results Table show that the Gaussian copula provides the strongest average fit. After accounting for complexity. it provides the best overall trade-off between parsimony and data fit. The Student-/ copula, despite its additional heavy-tail parameter, does not improve the average log- likelihood and is uniformly worse once complexity penalties applied. This aligns with intuition
18

---

Published as a conference paper at ICLR 2026
for 2 x 2 data with fixed margins, where heavy tails are weakly identified and tend to degenerate toward the Gaussian case. The asymmetric Clayton and Gumbel copulas trail substantially on both raw fit and information criteria, though they can win occasionally on individual units.
Conclusion. We choose the Gaussian copula for two primary reasons: (I) it provides the better average fit across model-prompe combinations evidenced by superior log-likelihood, AIC, and BIC scores; and (2) it is the simplest and most interpretable copula family, requiring only a sin- gle correlation parameter while making minimal distributional assumptions about the dependence structure.
Consequently, the bivariate normal copula is both simple and sufficiently accurate for the refusal- incorrectness dependence considered here. Its combination of low assumptions and competitive fit makes a natural default for estimating the Refusal Index.
E FIXED ENDPOINTS AND SHAPE OF Iso-RI CURVES
We derive two key properties of the accuracy-refusal curve used in the paper: (i every iso-RI curve passes through the same two endpoints at refusal r = and r 1; and (ii) when the association between wrongness and the refusal score is stronger (i.e., larger RI), the curve is higher in its interior, creating more curvature relative to the straight line joining its endpoints.
Let RZ Zw) be jointly standard normal with correlation P E (-1, Fix thresholds Tr, The E R and define
:: 1 > Jr} (refuse), W = 1[2 Tw) (wrong under forced answering).
The refusal rate is r Pr(R- = = 1 ((r)). ). The unconditional error rate is == Pr(W =)
(Tww), where + is the standard normal CDF. For a given r E (0, 1) we take Tr --1(11111 (1 - r). We define the correct answer rule at refusal r as
1 ). so the correct answer rate (at 0) μ ==
p(r:p) Pr(correct and answered) Pr(W 0, R 0) = TT((T,, Twi p).
(10)
where (2(:;:;p) is the bivariate standard normal CDF with correlation p. We orient the score so that higher R means "more refuse" for items more likely to be wrong (the intended setting for RI, typically 0).
Proposition (Endpoints). For any P and Tw.
a(0: p) μ
and a(l:p) = 0.
Proof. A 0 we have = +00, hence a(0; p) have T, = oo, hence a(l;p) = 222 000 Twi p)
Φ2 (2(+, Twi ((TT)) = At = 1 we
Monotonicity in r. Since T, = 4- r) is strictly decreasing in and $ is increasing in each argument, a(r:p) p) is strictly decreasing in r for fixed p.
This makes intuitive sense: at 0 we answer everything, correct answer rate equals the model's overall accuracy μ. Asr + we answer almost nothing, so the correct answer rate approaches O.
Proposition 2 (Monotonicity in p). Fix any interior refusal level E (0, Then a(r; p) in
cquation 10 is strictly increasing in
Proof. With fixed, T, is fixed, and a(r; p) = 22 Twi p). The standard identity op (2, (2(2, y: p) > 0 implies dp a((r;)) = (2((T, Tw: P) >
d
Corollary (Higher curves with higher RI). All accuracy-refusal curves share endpoints (r.a) (0, (u) and (1,0) by Proposition 1. If P2 > Pi (i.e., higher RI), then by Proposition 2, a(r: P2) > a(r:Pi) for every r (0, 1). Thus the higher-RI curve lies strictly above the lower-RI curve throughout the interior while meeting at the endpoints, creating greater upward curvature relative to the straight line between (0, 11) and (1,
The intuition is straightforward: at a fixed refusal level, the key factor in equation i0 the joint tail probability (p).). As p increases, wrong items and high-refusal items occur together more often, making the kept (non-refused) set cleaner. This increases the correct answer rate at every interior r. Since the endpoints fixed, the entire curve shifts upward.
19

---

Published as a conference paper at ICLR 2026
Deepseek V3
Mistral 1238
Qwen225 728
0.24
115
310
0.6
Nocettion Rade
Agjictin 6230
Aapetion K218
Qwen3 32D(Think)
Qwen3 32B
Gemma3 120
4.00
2.58
6.14
4.39
600
(3)
4.0
0.5
2.1
30
1.0
0.0 02 0.
Figure 9: Extended Rso-RI visualizations for six models SimpleQA. Each panel plots empirical accuracy-refusal points from four refusal prompts (dots) together with iso-RI contours (background lines), Models whose points lie close to single contour have stable Refusal Index across prompts, while widely spread points indicate less consistent refusal behaviour.
F EXTENDED ISO-RI VISUALIZATIONS AND FRONTIER MODELS
To complement the theoretical properties above, we provide extended iso-RI visualizations across multiple models. Figure Figure overlays empirical accuracy-refusal points from the four refusal prompts on top of iso-RI contours for six representative models: Gemma-3-122 Qwen3-32B, Qwen3-32B- Think, Qwen2.5-72B, DeepSeek- V3-0324, and Mistral-123B. For each model, the four points trace out an accuracy-refusal trade-off curve whose curvature matches single iso-RI contour when RI is stable, and deviates from it when the model's refusal behaviour is less consistent. This visualization makes it easier to see which models preserve correct answers while increasing refusal rates and which ones lose many correct answers due to false refusals.
We also update the frontier-model scatter plot in Figure 5 so that every point is annotated with the corresponding model name. This labeling lets readers directly identify which model families lie above or below the regression line relating RI to correct answer rate, clarifying how training pipelines and architectures influence knowledge-awwe refusal.
G RESULTS ON SIMPLEQA
We provide metries on all models on SimpleQA in Table 7 the 95% CI is computed by bootstrap with 1000 samples.
H IMPACT OF NUMBER OF QUESTIONS
The estimation of RI is derived from the accuracy and refusal rates of our two-pass evaluation. The stability of RI depends on the number of samples in the evaluation dataset. We assess the stability of RI by measuring its variance across subsets of the evaluation data. We create 50 randomly sampled subsets for various sample sizes (from 50 to 2000) and compute the coefficient of variation (CV) for each size, as shown in Figure 10
20

---

Published as a conference paper at ICLR 2026
Table 7: Results on SimpleQA with 95% CI.
Model
Correct Answer Rate
Refusal
C/A
F-score
Weighted
Refusal Index
3-128
0.05 [0.04, 0.06]
0.1610.14, 0.17]
0.06 J0.05, 0,87)
0.06 [0005, 0.57]
00.99-0.1, 0.721
0.25 [-007, 0.19
Qwee2,5-72B
0.05 [0.04, 0.051
0.74 [0.73, 0.75]
0.20 [0.18. 0.221
0.07 [0.07. 0.08]
-0.21 [-0.2. 00200
0.49 (0.45. 0.53]
Qwen1-32B
0.03 [0.03, 0.03]
0.68 (0.67, 0.69]
0.12 [0.10, 0.15)
0.05 [0.04, 0.05]
-0.29 [-0.29. 00228
0.34 [0.28. 0.40]
Qwea)-32B-11 11223-2B--hin
(0.03, 0.44
[0.20, 0.72]
[0.13, 0.161
(0.05. 0.05
[-026. -0.24
0.34 [0.29 0.391
Dw553-2335
0.38 (0.37,
0.36 (0.35, 0.37]
0.59 [0.58, 0,51]
0.45 [0.44, 0.66]
0.27 [0.28, -0266]
0.33 [0.30. 0.37]
Mistral-1238
0.19 [0.18 0.19]
0.43 (0.42. 0.44]
0.34 [0.32. 0.35]
0.23 [0.22. 0.24
-0.39 (4.40) 40.38]
0.39 10.35. 0.42)
3,1770
0.03 [0.02,
0.4
[0.16,
0.06
0.12|
0.38 0.471
0.34 (0.32,0.333 0.37]
(0.05. 0.07)
[0.34,
[0.33, 0.38]
(.662.
0.28 [0.19, 0.57]
GPI-4.1-mini
0.13 [0.12, 0.15]
0.31 [0.29, 0.35]
0.19 [0.17. 0.211
0.16 [0.14, 0.17]
-0.56 (4..5, .0.54]
0.27 [0.19, 0.34
Clande Sonnet- 4
0.09 10.07, 0.10]
0.85 [0.83 0,861
0.58 [0.52. 0,63
0.15 [0.13, 0.17]
-0.05 (0.07. 40085
0.52 (0.45, 0.60]
Clande 3.5-Ilakku
0.02 [0.02, 0.00]
0.93 (0522 0.94]
0.37 [0.29. 0.45
0.05 [0.03, 0.06]
00.04 [-0.55 0.033
0.52 [0.41. 0.63]
5emini-255-Flash
10.17, 01200]
042 (0.29, 0.44]
[0.29, 0.35]
0.24 [0:22. 0.20
(0442, -0.37]
0.30 (0223 0,36]
Gemina 2.5 Flash-
0.08 [0.07, 0.09]
0.41 [0.28, 0.43]
0.14 [0.12, 0.16]
0.10 [0.09, 0.121
00.51 [0.53, 00.99
0.12 [0003, 0.201
Lite
DespSesk- V3-4124
0.16 10.14, 0.17)
0.50 (0.48, 0.55]
20.29, 0.35
021
-0.34 [-036,
0.42 0.49)
GLM-4.5
10.05, 0.08]
0.29 (0.77, 0.81]
(0.26,
0.1 [0.09, 0.12]
(0.16, 0.131
0.30 [0.22 0.57]
GLM-45-Air
0.05 (0.04, 0.06]
0.71 (0.69, 0.75]
0.17 [0.14, 0.20)
0.88 [0.06 0.07%
-0.24 (40.26 .0:23]
0.15 (0.06 0.23]
0.8
Coefficient of Variation
BAS
R6 1005
RI
1.00
0.6
Weighted:
F-Score
Second Pass 1.0
0.98
Weighted
Prompt #1
545
CiA
0.96
0.4
Prompt #2
1.0
Prompt
.90
.92
1.0
0.92
0.2
Promptt #4
.86
.89
.92
.92
1.0
CV 10%
0.90
Best of N
.97
.91
.90
.96
.B6
1.0
0.88
0.0
500
1000
1500
2000
Majority of N
.2
.97
.94
.94
.89
Number of Samples
Second Pass
Prompt #1
Prompt #2
Prompt 84
Brst of N
Majority of
Prompt
Figure 10: Coefficient of variation of RI when evaluating on subsets of the full dataset.
Figure 11: Accuracy agreement between differ- ent prompt strategies.
RI is less stable than other metrics with small number of questions. However, its stability becomes comparable as the sample size increases. To achieve a CV of 0.1, RI requires about 25% more samples than the C/A and F-score metrics. Consequently, a slightly larger number of samples is preferable for obtaining stable RI estimate.
I IMPACT OF PROMPT DESIGN
We examine how variations in prompt design affect the RI evaluation. Our experimental setup uses four distinct first-pass prompts, each with different few-shot examples and instructions, induce varying refusal rates. For the second pass, a single, simpler prompt used to compel the model to answer all previously refused questions. These prompts are designed to produce different refusal rates. However, we must verify that they do not introduce confounding effects on model accuracy, which would impact the RI calculation.
We measure the accuracy agreement between pairs of prompt strategies to assess this. Agreement is calculated the proportion of questions for which both prompts yielded the same correctness label, considering only the questions answered by both. The accuracy agreement between different first-pass pass prompts is consistently high (over 90%), as shown in Figure II This indicates that the choice of prompt strategy does not significantly alter the model's underlying accuracy on the questions it chooses to answer. The high agreement involving the forced-ansee answer (second-pass) -asss)) prompt validates its use for effectively estimating the model's baseline accuracy (p).
21

---

Published as a conference paper at ICLR 2026
J REFUSAL INDEX IMPLEMENTATION
We provide a minimal Python code snippet for computing the Refusal Index (RI) using tetrachoric correlation. This code snippet demonstrates the calculation of RI from two-pass evaluation metrics as described in Section 3 and is shown in Figure
Refusal Index from two-pass evaluation metrics from math import log
import numpy as np from scipy.state import norm, miltivariate_noraa from sci cccipy.ptiiii omize import minimize_scalar
def RI (accl: float, float, acc2: float, int 2000) float: I 0.0 or >= 1.0:
return 0.0
mu = 1.0 acc2 wrong rate under forced answering
acc_att np.clip (acel max (1c-12, 1.0 r), 0.0, 1.0)
mu_a 1.0 acc_att wrong rate on attempted items
mu_r float (np.clip( (mu (1.0 r) + m) z, 0.0, 1.0)) wrong on refused
n_r int (round (n r)); = n_r
nl1 int (round mu_r);; n10 n.r nll iround(n_a mu_a)); n00 a n01 (R=0, x=1), (R=0, W=0)
(R=1, k=1), (R=1, W=0)
no1
tau r, tau_w nor (1 r), porn.ppf (1 mu)
def neg_11 (rho: float) -> float:
multivariate_norme (mean- 0], cov- rhol, [rho, 111) pl1 = norm, edf (tau nerm. edf (tau x) zv.edf [tau__, tau x
1)
p10, p01, p00 = p11, mu pll, - mu p11
cps 1c-12
p11, p10, p01, p0o [1in eps, max (eps, p)) for p (p11, p10, p01, p00)]
return - (nll (p11) n10 + log(p10) + nl1 log(p01) n00 (p00))
rho minimize scalar (neg 11, bounds=(-0. 999, 0. 0999,), nethod= ).x
return 6 np.pi np.aresin (rhe / 2)
Figure 12: Minimal Python implementation the Refusal Index estimator using maximum likelihood to fit the tetrachoric correlation implied by two-pass evaluation statistics.
The function takes three key parameters: accl (accuracy on attempted questions in the first pass), (refusal rate), and acc2 (accuracy under forced answering the second pass). The optional parameter n represents the total number of questions for statistical estimation. The implementation follows the mathematical framework described Section 3 using maximum likelihood estimation to find the tetrachoric correlation coefficient that best explains the observed two-pass evaluation results.
K RANKING STABILITY METRICS
We use two complementary metrics to evaluate the stability of model rankings across different evaluation settings: Kendall's W and Winner Entropy. These metrics capture different aspects of ranking consistency and are used in Table Blto to assess how reliably different factuality metrics rank models.
22

---

Published as a conference paper at ICLR 2026
K.1 KENDALL'S W (COEFFICIENT OF CONCORDANCE)
Kendall's W measures the overall agreement among multiple rankings of the same set of items. quantifies how consistently different evaluation settings (e.g., different refusal benchmarks) rank the models.
Given m evaluation settings ranking models, let Raj be the rank of model in evaluation setting j.
The sum of ranks for model across all settings is:
m
Rij
Kendall's W defined as:
W = 12 1= (R, R)2
m² (ni 11)
where m(n++)) is the mean of the Rg values.
2
Kendall's W ranges from 0 to where:
. W indicates perfect agreement among all rankings
W = 0 indicates no agreement (rankings are essentially random)
Higher values indicate stronger ranking consistency across evaluation settings
In our evaluation, higher Kendall's W values indicate that metric produces more stable model rankings regardless of the specific evaluation conditions (e.g., different refusal prompts or datasets).
K.2
WINNER ENTROPY
Winner Entropy measures the consistency of identifying the top-performing model across different evaluation settings. While Kendall's W considers the entire ranking, Winner Entropy focuses specifically on which model ranks first.
Let p; be the proportion of evaluation settings where model ranks first. Winner Entropy is defined as:
n
Hwinner
Σ
pe log, (p:).
where we use base-n logarithm to normalize the entropy to the range [0, 1].
Winner Entropy interpretation:
Hwinner = 0 indicates perfect consistency (same model always ranks first)
Hwinner = 1 indicates maximum inconsistency (all models equally likely to rank first)
Lower values indicate more consistent identification of the best model
This metric is particularly important for practical applications where identifying the single best model the primary concern, rather than the complete ranking.
K.3 APPLICATION IN OUR ANALYSIS
In Table we apply these metrics evaluate how different factuality metrics rank models across evaluation settings (4 refusal-varying evaluations SimpleQA plus 4 hallucination benchmarks). To isolate the ranking stability attributable accuracy- trade-offs rather than simple accuracy or refusal rate differences,, we remove monotonic effects using isotonic regression before computing these metries. This ensures we measure genuine stability in how metrics capture knowledge-aware refusal rather than stability derived from consistent accuracy refusal patterns.
23

---

Published as a conference paper at ICLR 2026
K.4 ISOTONIC REGRESSION PROCEDURE
To isolate the components of factuality metrics that cannot be explained by correct answer rate or refusal rate alone, employ isotonic regression remove monotonic effects from these baseline metrics. This procedure allows us to focus on how well each metric captures the intrinsic accuracy- refusal trade-off relationship.
Individual Metric Regression For each model and factuality metric M, we have metric values M M 3.... M, across k evaluation settings. Similarly, we have corresponding correct answer R((h)) for the same model across these rates ((1), (((2) C(.), and refusal rates R2(2) n! ,
settings.
To remove the monotonic effect of correct answer rate, we perform isotonic regression to find the isotonic function fc that minimizes:
h
fc(())((()))
subject to the constraint that fc is non-decreasing (or non non-increasing, depending on the expected monotonic relationship). The residual metric values after removing correct answer rate effects are:
MDD = M fc(c!
Similarly, to remove refusal rate effects, we find isotonic function I'n and compute:
_ - fR(R(()
Additive Isotonic Regression To remove both correct answer rate and refusal rate effects simulta- neously, we employ additive isotonic regression. This approach models the metric as the sum of monotonic functions of both variables plus residual term:
M gc(())) + gn((n(")) + +e
We find isotonic functions IC and OR that minimize:
k MOM go((!))) (R((R())
subject to monotonicity constraints both gc and gn- This optimization is performed using coordi- nate descent, alternately optimizing 9C while holding In fixed, and vice versa, until convergence.
The residual metric values after removing both effects are:
M(6)-
Both Both
M,()) - (c(C))) - (n("))
These residuals represent the portion of each metric that cannot be explained by monotonic relation- ships with correct answer rate or refusal rate, allowing us to assess the intrinsic stability of how each metric captures knowledge-awee aware refusal properties. The ranking stability metrics (Kendall's and Winner Entropy) are then computed on these residuals across all models and evaluation settings.
L COMPARISON WITH EXTERNAL CALIBRATION METHODS
Section 2 argues that external confidence calibrators such as linear probes, auxiliary models, or sampling-basse -based confidence- do not necessarily reflect the refusal decisions that model actually makes. Here we provide an ablation on Qwen3-32B to compare three representative confidence estimators on the same mixed factual QA set and relate them the Refusal Index (RI).
24

---

Published as a conference paper at ICLR 2026
Table 8: Comparison of confidence-basse calibration methods and Refusal Index (RD) N is the number of evaluation questions, S is the number of samples per question, and Nuain is the number of training samples for auxiliary estimators.
Method
Typical calibration method(s)
Unbiased
Computational cost
Linear Probe
Train linear classifier on hidden states
NNuin probe training N generations
+ N inferences
Black-box
Auxiliary classifier on output text
X
Calibrator training on Noai samples +
Estimator
N generations N inferences
Verbalized
Ask model to output numeric confidence
N generations N confidence-score generations
Confidence
Sampling- based
Use refusal frequency to approximate refusal
SN generations
probability
Refusal Index (ours)
Two-pass evaluation, no auxiliary model
2N generations
Reliability Diagram (10 bins)
ROC Curve
P())) (ECE=0.098)
APRICOT (ECE=0.029)
P[Answer) (EGE:00) (EGE=0.122)
0.8
Fradin postivss
Trte Positiv Roto
0.4
0.2
P(K) (AUROC=O 9.94)
APRICOT (AUROC-0.
PiAnswer) (AUROC=0.
0..6
%
0.2
0.4
0.8
0.8
1.0
0.2
0.4
0.6
0.8
1,0
Mean precicted probability
False Postive Rate
Calibration comparison on Qwen3-32B. Reliability diagrams (left, 10 bins, lower ECE is better) and ROC curves (right, higher AUROC is better) for three confidence estimation methods: a white-box box linear probe P(IK) (Kadavath al. 2022a). APRICOT (Ulmer al. 2024).
Figure 13:
and sampling-bart based P P(Answering) (Wei et al. 2024).
Experimental setup. We compare three representative calibration approaches. P(IK) represents white-box methods, using linear classifier trained the model's internal hidden states predict whether knows the answer (Kadavath et al., 2022a). APRICOT represents auxiliary model-based methods, estimating confidence external model (Ulmer et al.) 2024). P(Ans Answering) represents sampling-basee methods, estimating confidence by measuring how frequently the model chooses answer versus refuse across multiple samples for the same question (Wei et al., (024). We evaluate all methods on the same held-out questions compare their calibration performance.
analyzing the model's generated reasoning traces with fine-tuned
Observations. Figure 13 shows that the three estimators agree on ranking (ROC curves with AUROC > 0.91). but disagree strongly on calibration shape. The linear probe and APRICOT both appear almost perfectly calibrated (ECE 0.098 and 0.039) and would suggest that Qwen3-32B is very well calibrated. In contrast, P(A P(Answering) exhibits a noticeably higher ECE (0.122) and reliability curve that drops below the diagonal at high predicted probabilities, revealing clear over-confidence bias in the high-confidence regime. This diagnosis matches the moderate RI of Qwen3-32B on SimpleQA (RI 0.34; see Table 7. which indicates substantial room for improving knowledge-aware refusal.
Taken together with prior work showing that verbalized confidence, sampling-based confidence, and auxiliary calibrators can give inconsistent answers about the same model (Wei et al. 2024 Huang
25

---

Published as a conference paper at ICLR 2026
al. 2024), these results highlight two points: (1) different external calibrators hide expose cver-confidence depending on how they are constructed, and (2) the sampling-baser method that directly uses refusal frequency is the only one whose calibration profile aligns with RI, but it is substantially more expensive to compute. RI therefore provides a cheaper, calibrator-fee way to capture the same over-confidence behaviour, using only two standard evaluation passes without additional probes, auxiliary models, or heavy sampling.
M LLMS USAGE STATEMENT
During the preparation of this paper, we used LLMs (e.g., ChatGPT) for limited assistance with: (I) proofreading and suggesting edits for grammar issues; (2) formatting LaTeX tables from raw data; (3) generating boilerplate code for dataset loading, logging, and plotting; and (4) identifying relevant prior work during literature review. LLMs were nof used for generating paper content, developing ideas or experimental designs, or implementing core evaluation code beyond standard auto- completion. All research contributions, experimental results, and written content are the authors' original work.
26


Reviews:
[{"review_id": "GkSLLbVE2J", "reviewer": "Reviewer_Zb1L", "summary": "In the blackbox approach to factual knowledge, the authors point out that current methods are limited. They will mostly look at the rejection rate and/or correct answer rate. Here, the authors propose to check whether those two things happen together, beyond chance. This method additionally avoids a lot of sampling which is often relied on for similar approaches. They provide extensive empirical testing on different models and datasets, and discuss model variations. They also check effect of prompt variation.", "questions": "1) could you please re-explain why you consider calibration a proxy, and not RI?\n\n2) L151/152 \"While overall refusal rates can be adjusted through input context or preference learning, the discriminative capability for knowledge-aware refusal remains more robust and consistent\" - I am confused by this statement. How can changing refusal rates be more consistent than discriminating? more consistent for what? I think I understand your point that refusal rates are not the only thing we want to act on - but I don't think RI as a metric is acting on anything.\n\n3) more of a personnal curiosity point: is there a reason why you are using Spearman rank correlation rather than another?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "Reduces a true gap in a very empiric field. As an empirical study it is quite solid, checking a variety of models, datasets, but also checking the effect of prompt variation to some extent. \n\nThe empirical section is not only quantitatively very strong, but actually makes good use of it's data. Datasets and models are not only listed, but are used to make compelling arguments on different effects. Figures are clear and very understandable. Multiple appendices make the effort of testing many variations of the setup to ensure it is correctly validated.", "weaknesses": "An issue I find generally in the blackbox tradition of model factual knowledge is that a lot of definitions are arbitrary. \nI would worry that these poorly defined targets of \"checking if a model knows\" or \"checking if a model answers when it knows\" are moving goalposts which lead to incremental progress to evaluate models which purposedly (hence blackbox) do not provide the required information to properly move forward.\n\nWere this a journal paper in a major venue, I would ask to rework the definition of \"knowledge\". As this is a conference paper in a major venue I can only notify that this definition is very shaky (we are not discussing observable correct answer for a factual question, but a more interesting but very abstract notion of \"knowing\" a fact). I nonetheless acknowledge that this paper is taking a step in the right direction by decoupling model behaviour of refusal to answer from model knowledge, and this is why I've set a positive score. \nI remain nonetheless worried that definitions are not well set - much like in previous empirical works, there is no clear gold standard for \"knowing\". Reasoning then becomes somewhat circular - we empirically define knowing as RI, and then show that it is better than previous methods which had set different definitions. \n\nAlong the same line the authors criticize the notion of proxy metrics. I did not understand how this new RI method is not a proxy metric, even if a better one. \n\nOn a much less important note, I've noted moments where I was confused reading. Should they seem personal, feel free to ignore them.\n* Line 015/016 : \"simple refusal based metrics are biased by refusal rates and yield inconsistent scores when models exhibit different refusal tendencies\" --> confusing\n* starting L050: I was confused again by the third paragraph of the introduction.\n\nFor both of those I only understood what was going on from the examples in l110 onwards which made your point as well as the difference between refusal based metric, refusal bias, refusal tendencies, and refusal itself as a concept much clearer. I would advise either clarifying earlier, or rephrasing.\n\n* 024 \"RI accurately quantifies a model's intrinsic knowledge-aware refusal rates capability in factual tasks.\" --> intrinsic knowledge aware refusal rates is not defined later in the paper, and confusing here", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "nwhmHHQjY5", "reviewer": "Reviewer_hVoC", "summary": "- This paper investigates knowledge-aware refusal in LLMs—the ability to refuse questions they are unlikely to answer correctly while not refusing questions they can answer. The authors identify that existing metrics like correctness conditioned on non-refusal are easily biased by refusal tendency and manipulated through system prompts.\n- The authors propose the Refusal Index, which measures the Spearman correlation between refusal probability and error probability. They develop an efficient estimation procedure using Gaussian copula fitting that requires only two samples per question, making it tractable compared to expensive sampling-based calibration methods.\n- The paper validates this metric by showing: (1) stability across different prompts for refusal tendencies, (2) clean correlation with sampling-based calibration methods, and (3) consistent model rankings across evaluation settings.\n- Using the validated metric, the authors show: (1) cautious prompts increase refusal rates but do not improve calibration, (2) the Refusal Index is largely independent of model capability and aligns more with model family, and (3) removing or adding misleading context degrades refusal calibration.", "questions": "- How is stability computed in Table 2? Could differences in distribution concentration affect the apparent variability of different metrics? What level of RI variation across prompts (e.g., 0.1 to 0.3 for Gemma-2-9b) should be considered acceptable? Would it be possible to show empirical data points on iso-RI curves (as in Figure 3) for more models? This would help clarify whether the Gemma-2-9b variability pattern is typical.\n- The finding that RI aligns with model family rather than capability is interesting, but it's difficult to identify specific models in Figure 5. Could you provide clearer labels or a table showing individual model RI scores?\n- Is RI measuring something fundamentally different from sampling-based calibration methods, or is it primarily a more sample-efficient approximation? A naive alternative would be to estimate RI through extensive sampling without Gaussian copula fitting—how would this compare?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The Refusal Index captures something fundamental about a model's calibration and remains stable across different prompting strategies. \n- Despite the mathematical complexity, the metric requires only two samples per question—nearly as cheap as computing accuracy. \n- RI has strong correlation with expensive sampling-based calibration metrics \n- Interesting and diverse experimental results. The finding that refusal calibration is largely independent of model capability and instead aligns with model family is particularly striking—it suggests calibration may be a distinct dimension of model quality worth optimizing separately.", "weaknesses": "- The mathematical presentation of RI feels dense. Figure 1 hints that the Refusal Index captures convexity of the curve in refusal rate vs. correct answer space, and further developing this intuition and/or motivating the Gaussian copula fit could aid clarity.\n- Greater discussion on whether the Refusal Index measures something fundamentally different than sampling-based calibration methods, or simply serves as a more sample-efficient proxy, would be helpful. The appendix contains interesting results on sample efficiency—a direct head-to-head comparison showing how much more sample-efficient RI is than naive calibration-based metrics would better motivate its advantages.\n- The stability results in Table 2 focus on Qwen and Mistral models, but Figure 4 shows Gemma-3-12b's Refusal Index varying considerably across prompts (roughly 0.1 to 0.3). It's unclear whether Gemma is an outlier or if this variation is typical. Showing both the Figure 4 analysis and Table 2 stability results on a broader, consistent set of models would clarify how stable the metric actually is in practice. This concern applies more broadly to later experiments—either evaluate more models consistently or be more intentional about which models are presented and why.\n- The frontier model evaluation figure is interesting, but it's not possible to identify which specific model corresponds to each data point—only the model family is discernible, not the generation or size.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "y0fMcGRONg", "reviewer": "Reviewer_y9ka", "summary": "This paper aims to evaluate a model’s level of refusal solely based on its output text. To this end, the authors propose a new evaluation metric called the Refusal Index (RI). Unlike traditional metrics that are heavily affected by the refusal rate, RI remains stable across different refusal rates. The paper validates the effectiveness of RI on multiple models and datasets.", "questions": "See Weaknesses.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1.This paper observes that traditional metrics are highly affected by the refusal rate and proposes a new metric called RI.\n\n2.The overall writing of the paper is clear and fluent.\n\n3.The experiments are thorough, and the effectiveness of RI is validated across multiple models and datasets.", "weaknesses": "1. The paper lacks sufficient explanation of traditional evaluation metrics. In the introduction, the authors briefly mention some of their weaknesses, but it remains unclear what these metrics actually are and why they exhibit such shortcomings. This background is essential for understanding the motivation of your proposed approach. I suggest moving this part to Section 2 and clearly introducing the limitations of traditional metrics before presenting your own.\n\n2. The authors claim that external calibrators, such as verbalized confidence or linear probes, cannot replace direct refusal measurements. However, the rationale for this statement is not clearly articulated. Could the authors elaborate on why these methods are unsuitable? For instance, since we can explicitly train models to output verbalized confidence, it is not immediately clear why such signals cannot serve as a proxy for model confidence or be used in place of direct refusal measures.\n\n3. Starting around line 129, the definition of the key notion raises potential confusion: are refusals also counted as errors? This point needs clearer explanation. Later sections suggest that each question has its own error rate (and refusals are re-answered for measurement), but this is not obvious when first introduced. Additionally, in Table 1, the formula c/(1–r) is unclear — does c represent the number of correct answers among the non-refused cases? Please clarify this.\n\n4. The proposed metric seems conceptually related to AUROC, which also reflects the consistency between confidence and ability. This is similar to your statement that “its refusal probability increases monotonically with error probability.” Could the authors explain more explicitly how their metric fundamentally differs from AUROC? Why should I use RI instead of AUROC? Refusal probability can also be reflected through confidence scores, rather than being binarized into a simple “refuse or not” decision.\n\n5. The “refusal tendency” appears analogous to a fine-grained confidence estimation, while the “error tendency” seems related to accuracy over multiple responses. Have the authors explored this connection? Why not estimate model confidence directly and then threshold it according to user preferences, instead of measuring refusal explicitly.\n\n6. Since the proposed metric relies on Gaussian estimation, I am concerned about its robustness under limited sample sizes. How accurate is the estimation in such cases? Furthermore, is the Gaussian assumption itself empirically justified?\n\n7. The choice of baselines could be further discussed. For fine-grained confidence, AUROC and ECE are typically appropriate. For binary confidence, accuracy (as a measure of ability) and alignment (whether refusal matches correctness) might be more relevant.\nClarifying why your chosen baselines are suitable would strengthen the experimental section.\n\n8. While the paper discusses the influence of refusal rate, accuracy also substantially affects metric behavior. For example, AUROC can appear artificially high under extremely imbalanced accuracy (e.g., only 10 correct samples out of 1000). This suggests that model ability significantly impacts evaluation. I am also curious about the authors’ perspective on how model competence affects alignment — if a model is either very strong or very weak, learning when to refuse may become trivially easy. Is this an expected or desirable property?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "4eeAH5DQuR", "reviewer": "Reviewer_5y9a", "summary": "This paper makes a contribution to the field of LLM evaluation, specifically addressing the critical issue of \"knowledge-aware refusal.\"  Firstly, the authors clearly identify a major gap in existing evaluation methodologies for LLM refusal behavior. Therefore, they propose the primary contribution-the Refusal Index (RI), a rigorously defined metric based on Spearman’s rank correlation between a model's refusal probability and its error probability. This metric is designed to directly and faithfully quantify a model's intrinsic capability to refuse questions beyond its knowledge. The extensive empirical validation across 16 models and 5 datasets demonstrate that RI is stable, consistent, and independent of a model's overall accuracy and refusal rate.", "questions": "1. In section 2.1, why choose bivariate gaussian distribution to model the probablilty value of error and refusal. Does some empirical results or previous works support this point? I think it is a rough characterization.\n\n2. How does the rank in the definition of spearman's rank correlation play the role in the estimation of RI?\n\n3. In equation (3), how can we obtain the value of $r_i$ and $w_i$ ?", "limitations": "", "rating": 2, "confidence": 3, "soundness": 2, "presentation": 1, "contribution": 2, "strengths": "1. The paper tackles a critical and under-explored problem in LLM reliability—\"knowledge-aware refusal.\" The introduction of the Refusal Index (RI) is a novel and timely contribution that addresses a clear gap in the existing evaluation landscape.\n\n2. The paper provides extensive and compelling experimental evidence to support its claims. Experiments across 16 models and 5 datasets offer a robust demonstration of RI's stability, consistency, and superiority over existing metrics, and further delivers some insightful ideas.\n\n3. The proposed two-pass evaluation method for estimating RI is lightweight and practical. This thoughtful design makes the metric feasible for researchers and practitioners to adopt without requiring excessive computational resources, enhancing its potential impact.", "weaknesses": "1. Although the empirical results of this paper is promising, the technical contribution seems not solid and sound. The rationality of the method is not well presented. Therefore, the technical validity is not convincing.\n\n2. The paper is not well written. There are many concepts introduced in this paper. However, these concepts are not rigorously clarified. The details can be found in Questions.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)