@inproceedings{xu-etal-2026-explication,
title = "Explication of Refusal: Jailbreaking {LLM}s by Exploiting Refusal Explanations",
author = "Xu, Qishen and
Jin, Ruochun and
Wang, Ting and
Cai, Zhongxuan and
Chen, Ruxin and
Chen, Huan",
editor = "Lee, Hung-Yi and
Dev, Sunipa and
Li, Jessy and
Elliott, Desmond",
booktitle = "Findings of the {A}ssociation for {C}omputational {L}inguistics: {EMNLP} 2026",
month = oct,
year = "2026",
address = "Budapest, Hungary",
publisher = "Association for Computational Linguistics",
url = "https://aclanthology.org/2026.findings-emnlp.410/",
pages = "8658--8677",
ISBN = "979-8-89176-462-0",
abstract = "Safety-aligned large language models (LLMs) face a dilemma between helpfulness and harmlessness, where LLMs are expected to refuse harmful requests while remaining helpful by explaining their decisions. In this work, we observe a phenomenon caused by this dilemma. When asked to explain a refusal triggered by a harmful query, LLMs disclose exploitable elements in their refusal explanations. These elements allow attackers to induce the generation of harmful content. We formalize this vulnerability as Induced Refusal Explication (IRE). To identify and exploit IRE, we propose Explication of Refusal (EoR), a black-box and multi-turn jailbreak method with a dual-agent framework. EoR induces and analyzes refusal explanations from victim models and then generates follow-up queries to jailbreak them. We evaluate EoR across nine victim models. EoR achieves an average attack success rate (ASR) of **37.05** within five turns. When we apply EoR to the queries that PAIR fails to jailbreak, EoR reaches an average ASR of **66.0** across the nine victim models, which demonstrates that exploiting refusal explanations is complementary to existing automated jailbreak methods. We release our data and code at https://anonymous.4open.science/r/EoR-6234."
}<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="xu-etal-2026-explication">
<titleInfo>
<title>Explication of Refusal: Jailbreaking LLMs by Exploiting Refusal Explanations</title>
</titleInfo>
<name type="personal">
<namePart type="given">Qishen</namePart>
<namePart type="family">Xu</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Ruochun</namePart>
<namePart type="family">Jin</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Ting</namePart>
<namePart type="family">Wang</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Zhongxuan</namePart>
<namePart type="family">Cai</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Ruxin</namePart>
<namePart type="family">Chen</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Huan</namePart>
<namePart type="family">Chen</namePart>
<role>
<roleTerm authority="marcrelator" type="text">author</roleTerm>
</role>
</name>
<originInfo>
<dateIssued>2026-10</dateIssued>
</originInfo>
<typeOfResource>text</typeOfResource>
<relatedItem type="host">
<titleInfo>
<title>Findings of the Association for Computational Linguistics: EMNLP 2026</title>
</titleInfo>
<name type="personal">
<namePart type="given">Hung-Yi</namePart>
<namePart type="family">Lee</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Sunipa</namePart>
<namePart type="family">Dev</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Jessy</namePart>
<namePart type="family">Li</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<name type="personal">
<namePart type="given">Desmond</namePart>
<namePart type="family">Elliott</namePart>
<role>
<roleTerm authority="marcrelator" type="text">editor</roleTerm>
</role>
</name>
<originInfo>
<publisher>Association for Computational Linguistics</publisher>
<place>
<placeTerm type="text">Budapest, Hungary</placeTerm>
</place>
</originInfo>
<genre authority="marcgt">conference publication</genre>
<identifier type="isbn">979-8-89176-462-0</identifier>
</relatedItem>
<abstract>Safety-aligned large language models (LLMs) face a dilemma between helpfulness and harmlessness, where LLMs are expected to refuse harmful requests while remaining helpful by explaining their decisions. In this work, we observe a phenomenon caused by this dilemma. When asked to explain a refusal triggered by a harmful query, LLMs disclose exploitable elements in their refusal explanations. These elements allow attackers to induce the generation of harmful content. We formalize this vulnerability as Induced Refusal Explication (IRE). To identify and exploit IRE, we propose Explication of Refusal (EoR), a black-box and multi-turn jailbreak method with a dual-agent framework. EoR induces and analyzes refusal explanations from victim models and then generates follow-up queries to jailbreak them. We evaluate EoR across nine victim models. EoR achieves an average attack success rate (ASR) of **37.05** within five turns. When we apply EoR to the queries that PAIR fails to jailbreak, EoR reaches an average ASR of **66.0** across the nine victim models, which demonstrates that exploiting refusal explanations is complementary to existing automated jailbreak methods. We release our data and code at https://anonymous.4open.science/r/EoR-6234.</abstract>
<identifier type="citekey">xu-etal-2026-explication</identifier>
<location>
<url>https://aclanthology.org/2026.findings-emnlp.410/</url>
</location>
<part>
<date>2026-10</date>
<extent unit="page">
<start>8658</start>
<end>8677</end>
</extent>
</part>
</mods>
</modsCollection>
%0 Conference Proceedings
%T Explication of Refusal: Jailbreaking LLMs by Exploiting Refusal Explanations
%A Xu, Qishen
%A Jin, Ruochun
%A Wang, Ting
%A Cai, Zhongxuan
%A Chen, Ruxin
%A Chen, Huan
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Findings of the Association for Computational Linguistics: EMNLP 2026
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-462-0
%F xu-etal-2026-explication
%X Safety-aligned large language models (LLMs) face a dilemma between helpfulness and harmlessness, where LLMs are expected to refuse harmful requests while remaining helpful by explaining their decisions. In this work, we observe a phenomenon caused by this dilemma. When asked to explain a refusal triggered by a harmful query, LLMs disclose exploitable elements in their refusal explanations. These elements allow attackers to induce the generation of harmful content. We formalize this vulnerability as Induced Refusal Explication (IRE). To identify and exploit IRE, we propose Explication of Refusal (EoR), a black-box and multi-turn jailbreak method with a dual-agent framework. EoR induces and analyzes refusal explanations from victim models and then generates follow-up queries to jailbreak them. We evaluate EoR across nine victim models. EoR achieves an average attack success rate (ASR) of **37.05** within five turns. When we apply EoR to the queries that PAIR fails to jailbreak, EoR reaches an average ASR of **66.0** across the nine victim models, which demonstrates that exploiting refusal explanations is complementary to existing automated jailbreak methods. We release our data and code at https://anonymous.4open.science/r/EoR-6234.
%U https://aclanthology.org/2026.findings-emnlp.410/
%P 8658-8677
Markdown (Informal)
[Explication of Refusal: Jailbreaking LLMs by Exploiting Refusal Explanations](https://aclanthology.org/2026.findings-emnlp.410/) (Xu et al., Findings 2026)
ACL