Mechanistic analysis of Llama-3.1-8B and Qwen3-8B shows that multiple-choice formats suppress safety refusals on the WMDP dataset. Activations in MCQ formats sit 3x further from the refusal direction, as the model commits to an answer-letter token before the refusal signal can build up.
HOW THIS AFFECTS YOU
●
researcherYou can see how the model's internal attention heads compete between selecting an answer and refusing a prompt.
●
policyYou should be aware that safety testing using multiple-choice questions might underestimate how often a model will provide harmful information in open-ended chats.