Safety tests for (LLMs) often use multiple-choice questions because they are easy to score. But recent work found that models refuse to answer harmful questions far less often when the questions are multiple-choice than when they are open-ended. This is a problem because safety scores based on multiple-choice tests may overstate how safe a model really is.
The researchers studied two models, Llama-3.1-8B and Qwen3-8B, on a dataset of hazardous knowledge about weapons. They used interpretability tools to watch how the models' internal neurons processed multiple-choice questions versus open-ended ones. They found that multiple-choice questions make the model quickly latch onto a letter choice in middle processing layers, before the brain circuit that triggers refusal has time to build up.
The main finding is that correct multiple-choice performance does not predict whether the model will refuse in an open-ended setting. This means multiple-choice safety scores mostly measure knowledge, not the model's safety mechanisms. Therefore, safety evaluations should always include open-ended tests to get a real picture of refusal behavior.