language:
- en
pretty_name: Lexical Fear — data release
tags: - safety
- over-refusal
- interpretability
- activation-steering
size_categories: - 10K<n<100K
license: cc-by-nc-4.0
Lexical Fear — data release
Data for the paper Language Models "Fear" Harmful Words: Causally Reducing a
Lexically Triggered Driver of Over-Refusal by Boyuan Zhang, Ata Dundar Yigit,
Mohammad Zandsalimy and Shanu Sushmita, accepted at the NeurIPS 2026 workshop
on Foundations of Language Model Security.
Code, environment setup and the full reproduction guide:
https://github.com/zboyr/lexical-fear.
Content warning. This dataset contains harmful and adversarial prompts,
a lexicon of harm-associated words, and model responses, some of which
comply with harmful requests. It is released only for research on
language-model safety and over-refusal. Do not use it to train models to
produce harmful content or deploy it in any user-facing setting.
Layout
This repository is the full data/ tree of the code repository. Download it
into data/ of a checkout:
git clone https://github.com/zboyr/lexical-fear && cd lexical-fear
huggingface-cli download vhboyr/lexical-fear --repo-type dataset --local-dir data
| Directory | Contents |
|---|---|
datasets/ |
The frozen harmful-prompt set (prompts.jsonl, excluded.jsonl, manifest.json). |
prompts/ |
The 13,527-prompt set the labels are aligned to. |
labels/ |
Per-model refusal2 / comply2 label files (v4, v5). |
judged/ |
LLM-judge outputs behind the labels. |
pools/ |
The 15,000-row harmful source pool with per-row responses and llm_clustering records (cp_15k_clustered_v2.json), the benign confusable pool, and mined pools. |
runs/ |
Per-experiment artifacts (x66–x89, x102, x104): cohorts, manifests, generations, judge outputs and reasoning traces, labels, directions, probes. |
results/ |
Final aggregate result files cited in the paper (also in the GitHub repo). |
See the GitHub README for what each experiment does, which files it reads and
writes, and what is not included.
License
CC BY-NC 4.0: non-commercial
research use, subject to the content warning above. Prompts derived from
third-party datasets (WildJailbreak, OR-Bench, FalseReject, PHTest, CoCoNot,
XSTest, JailbreakBench, ToxicChat, Salad-Data, ALERT, StrongREJECT) and outputs
of third-party models also remain under their original licenses and terms of
use. The code is MIT-licensed (see the GitHub repository).