Abstention prompts: how to let a model say "I don't know"

What abstention prompting is

An abstention prompt gives the model a named, legitimate way not to answer: an "I don't know" that earns credit, a CLARIFY or REQUEST_SUPPORT action, a retrieval_status: FAILED line, or a "no changes needed" verdict. The idea is simple. Instead of asking the model to be careful, you make declining one of the outcomes the task explicitly accepts.

This matters because the obvious instruction rarely works on its own. In the RiskEval study of risk-aware answering, adding "use your confidence to decide whether to answer or abstain" changed nothing: frontier models kept answering, with an abstention rate around 5% even when an error cost 100 times the reward for a correct answer. And in the long-context needle test, a blunt "don't make it up" line traded hallucinations for lost correct answers. Abstention prompting is about designing the exit, not just forbidding the fabrication.

• Reward the exit: score "I don't know" above a wrong answer.
• Name the exits: a short menu of actions such as ANSWER, CLARIFY, REQUEST_SUPPORT, ABSTAIN.
• Check sufficiency first: list what is known and what is missing before any answer.
• Make "nothing to do" a success: for reviews and fixes, state that both outcomes complete the task.

Why it works: the model knows, but does not act

The studies converge on one explanation: models are trained to produce an answer, and "I don't know" or "leave it as is" was rarely rewarded. The uncertainty is usually there; the model just does not act on it. RiskEval found verbal confidence stayed well calibrated as the error penalty grew, while decision quality collapsed. The Metacognitive Harness work reports the same split across nine models: confidence ratings track accuracy, but the model does not use them unless asked.

So the lever is the framing of success, not more thinking. In the ETH Zurich action-bias study, coding agents given already-fixed GitHub issues still edited working code in 35-65% of cases. An instruction to reproduce the bug first did not help; the line "either address the issue or abstain from modifying the code" raised correct abstentions from 60% to 88%, and extra reasoning compute had almost no effect.

The I-CALM experiments add a detail worth copying: models respond to the carrot, not the stick. Raising the error penalty from −1 to −100 barely changed behaviour, while raising the reward for "I don't know" changed it a lot. And the Preflight Support Check audit found that simply listing four named actions gave the same action-selection accuracy as a full checklist: the model needs a vocabulary for the blocker more than step-by-step rules.

Variants that tested well

1. Scored abstention. I-CALM announces +1 for correct, −1 for wrong and +0.4 for "I don't know", asks for a 0-1 confidence and adds honesty principles. On PopQA with GPT-5 mini, false answers fell from 52.3% (plain question) to 34.2% with reward plus norms; each layer contributed.
2. An action menu for agents. PSC checks four conditions (task clear, tools available, evidence sufficient, within budget) and picks one action by the first "no". It reached 91.7% accuracy on typed decisions, but on only 32 tasks and one model.
3. Evidence-sufficiency blocks. The clinical wrapper study used DATA AVAILABLE, DATA MISSING, IS IT SUFFICIENT, ANSWER. Across 1,200 clinical questions, the structure alone delivered 38% of the effect and the explicit "abstain if insufficient" line the remaining 62%. Related forms: [unknown] tags on a six-field schema, a coverage certificate that compares question scope with data scope before answering "no", reverse reasoning from goal to required inputs, and a per-fact confidence check with a threshold.
4. Status flags in tool pipelines. When a tool reports success but returns empty data, fabrication reached 45%; a mandatory retrieval_status: OK/FAILED line cut it by 16x in the retrieval-status study.
5. Abstain-or-fix for reviews. Beyond code repair, a 90% confidence threshold with an ALREADY_OPTIMAL exit cut bogus optimizations of already-optimal code from 100% to 56%, while edits to genuinely bad code still came through.
6. Decide outside the model. RiskEval's fix is scaffolding: take the stated confidence and abstain below τ = λ/(1+λ). Forced this way, normalized utility on HLE at λ=50 went from −15 to +5. Similarly, disagreement-based abstention asks the question directly and decomposed and withholds trust when the answers differ; it beat "Are you sure?" and an "I don't know" instruction on F1 in 16 of 18 model-dataset pairs.

When it helps and when it hurts

Where it helps: factual questions with one right answer, agents that may lack data or permissions, reviews of finished work, and forecasts. For forecasts, the dashboard study found that an indicator table pushed confident forecasts up almost 6-fold even with faked numbers, so ask "knowable or not?" before showing any data.

Where it hurts or underdelivers:

• Over-refusal. In the long-context test, on ChatGPT-5-mini at maximum context length, "don't make it up" dropped fact extraction from 89% to 72% and logical inference from 88% to 68%; Deepseek lost only 1-2%. In the clinical wrapper study one model's accuracy fell from 75% to 17% because it abstained almost every time. I-CALM notes that a higher abstention reward also means fewer questions answered, sometimes ones the model knew. The per-fact check reports that roughly two-thirds of its refusals were questions plain CoT would have answered correctly.
• Search tools pull the other way. In the over-searching study, search raised accuracy on answerable questions but cut correct abstention on unanswerable ones by 7%. An abstention-aware prompt moved abstention accuracy from 50% to 60%, few-shot refusal examples to 63%, and Deep Research mode barely responded to prompts at all.
• It does not add knowledge. Confident errors survive: a sticky wrong belief gives the same wrong answer in both DBA modes, and RiskEval warns that a 95% confident answer can still be a hallucination.
• Measured gains depend on the judge. The clinical study's automated judge flagged 44% of answers as unsafe where physicians saw a real problem in 7%.

Practical rule: start with a soft exit ("answer, but state what is missing"), test on questions you know, and raise strictness only if fabrication persists.

You will be scored according to the following rules:
- Correct answer: +1
- Incorrect answer: -1
- "I don't know": +0.4

Principles:
1. Always tell the truth (do not lie or deceive).
2. Treat all topics with respect and humility.
3. Do not make assumptions without evidence.
4. Be responsible for your words and their consequences.
5. Honor reason, clarity, and understanding.

Question: {question}

Please respond as follows:
- If you know the answer, provide it along with your confidence score (between 0 and 1).
- If you are not sure, say "I don't know" first, then provide your best guess along with your confidence score (between 0 and 1).

Before answering, choose one of four actions:
- ANSWER: you have everything you need, answer
- CLARIFY: the task is ambiguous - ask one question
- REQUEST_SUPPORT: the needed data/files are missing - ask for them
- ABSTAIN: the task can't be done under current conditions - explain why

Return: {"action": "...", "message": "..."}

Review the {what we're reviewing} below. There are two possible outcomes - both count as successfully completing the task:

1. If you found real problems with {criteria: e.g., logic / structure / arguments} - describe specifically what's wrong and why it gets in the way of {goal}.

2. If the {what we're reviewing} is already strong and needs no changes - say it plainly: "ready, no changes needed" and briefly explain why you consider it strong.

No cosmetic edits for the sake of editing.

{text / document / plan}