Probabilistic refusal is a learned behavior in which a language model estimates that a request should be declined and responds with a refusal. Unlike a hard technical block, it is not an absolute restriction: the model may respond differently to altered wording, context, or instructions.
In cyber security, this matters because a refusal is a safety signal, not a security boundary. Jailbreaks and prompt injection may try to steer a model around its learned behavior, while dual-use requests can be difficult to classify reliably. Defenders should not rely on refusal alone when a model can access tools, files, or services. Apply least privilege, validate outputs and actions outside the model, and require human review for sensitive operations.