When you run an F5 AI Red Team campaign, the system checks whether your target LLM refused a prompt before deciding if it's vulnerable. Custom refusal phrases let you extend that check to cover domain-specific refusal language.

What is a refusal phrase

A refusal phrase is a string a target LLM returns when it declines to answer a prompt, such as, "I cannot help with that" or "I am unable to assist."

Refusal phrases are not a failed response. A refusal means the model actively declined the prompt. A vulnerability evaluation only runs when the refusal check finds no match.

Custom refusal phrases extend the built-in detection set. They don't replace it.

---

Background

AI Red Team evaluation works in two ways:

1. Refusal check: The system checks whether the target LLM refused the prompt.
   1. Deterministic refusal gate: The system runs a regex against a set of known refusal strings.
   2. LLM refusal judge: If the regex finds no match, an LLM-based judge evaluates the response.
2. Intent evaluation: If no refusal is detected, the system checks whether the model complied with the original intent of the attack.

Use cases

Add domain-specific refusal language

You're running red team campaigns against a model fine-tuned for a specific domain. The model returns a short refusal token, such as: [no]. The built-in phrases don't cover that use case. Without a custom phrase, those responses pass the refusal check and are incorrectly flagged as potential vulnerabilities. Adding [no] as a custom refusal phrase makes sure the deterministic gate catches it before the LLM judge runs.

---

How matching works

Behavior	Detail
Case sensitivity	Case-insensitive
Match position	Phrase can appear anywhere in the response
Input format	Plain strings only — regex patterns are not supported
Scope	Applies to all red team runs in your organization
Default behavior	If no custom phrases are set, the built-in phrases still run

---

References

For more information, see:

• Add and retrieve custom refusal phrases