license: apache-2.0
task_categories:

• text-classification
  language:
• en
  tags:
• moderation
• content-moderation
• safety
• hard-negatives
• calibration
  size_categories:
• n<1K
  configs:
• config_name: default
  data_files: refusal_negatives.jsonl

Refusal Negatives

846 hand written examples that are full of harmful vocabulary and are not violations.

Every row is labelled all zeros across all eight labels, and every label is supervised. They exist to teach a moderation classifier the difference between using harmful language and talking about it.

The problem this fixes

Moderation classifiers trained on comment data learn vocabulary, not intent. Ours did too. When we used opus-moderation-1 as a safety judge for another model, it flagged things like:

• a clean refusal, because the refusal repeated the words of the request it was declining
• an SFW reply about juggling "4chan style", because of the word

This is the echo false positive. The model sees the shape of a violation and never learns that a sentence rejecting something is not the same as a sentence doing it. It is a real deployment problem, because the text a safety classifier reads most often is your own model refusing things.

The fix is not more positives. It is negatives that look like positives.

What is in it

Four framings, all all zero:

Mean length is 78 characters. They are short on purpose, so the harmful vocabulary is a large fraction of each example and the model cannot lean on surrounding context to get the answer right.

Format

{
  "text": "I won't provide content that breaks your guidelines, and I don't want to give you ideas for it either.",
  "labels": [0, 0, 0, 0, 0, 0, 0, 0],
  "mask":   [1, 1, 1, 1, 1, 1, 1, 1]
}

Label order:

toxicity, severe_toxicity, obscene, threat, insult, identity_attack, sexual_explicit, jailbreaking

mask marks which labels are supervised. Every entry here is fully supervised, so the mask is all ones. It is included so the file drops directly into a masked loss that mixes datasets with different label coverage:

per  = F.binary_cross_entropy_with_logits(logits, labels, reduction="none")
loss = (per * mask).sum() / mask.sum().clamp(min=1.0)

Measured effect

Folded into an otherwise unchanged recipe, upweighted 8x, held out data identical:

Same architecture, same base data, same thresholds. The only differences were this file and extra jailbreak positives.

How to use it

Mix it into training rather than training on it alone. It has no positives, so on its own it teaches a model to say no to everything. We repeated it 8x against roughly 300k rows of real data, which is aggressive but the set is small and the failure it fixes is expensive.

from datasets import load_dataset
ds = load_dataset("opus-research/refusal-negatives", split="train")

Limitations

• English only.
• 846 examples is small. It is a targeted patch for a specific failure, not a general safety corpus.
• Written by us, so it carries our phrasing habits. A model trained on it will handle refusals that sound like ours better than refusals that do not. If your assistant has a distinct voice, write a few dozen in that voice and add them.
• All zero by construction. We did not include near miss cases that genuinely are borderline, so it will not teach fine grained judgement, only the coarse distinction between mention and use.
• Not adversarially tested. Someone trying to write a violation that looks like a refusal would probably succeed.

Provenance

Written by hand for opus-moderation-2. No scraping, no model generated text, no personal data. Generated by build_refusal_negatives.py, which is open in our training code.

Citation

@misc{opus-refusal-negatives,
  title  = {Refusal Negatives: hard safe examples for moderation classifiers},
  author = {opus-research},
  year   = {2026},
  url    = {https://huggingface.co/datasets/opus-research/refusal-negatives}
}