Safety Guard Vulnerability: The Refusal-Cue Shortcut

Audits of LlamaGuard3 and Qwen3Guard reveal a refusal-cue shortcut where inserting refusal language into harmful responses can trick guards into marking them as safe. This vulnerability stems from imbalanced training data where refusal expressions co-occur almost exclusively with unharmful labels.