LatentRefusal: Latent-Signal Refusal for Unanswerable Text-to-SQL Queries

TL;DR

LatentRefusal addresses the safety risk of unanswerable queries in Text-to-SQL by introducing a pre-generation gate that predicts answerability from a frozen LLM’s hidden activations. The Tri-Residual Gated Encoder (TRGE) is a lightweight probe designed to suppress schema noise and amplify sparse evidence of question-schema mismatch, enabling a single forward pass without generating or executing SQL. Empirical results across four benchmarks and two backbones show LatentRefusal achieving an average F1 of 88.5% with only ~2 ms probe overhead, outperforming prompt-based and uncertainty-based baselines and offering a scalable, execution-free safety layer for production systems. The work demonstrates robust performance across linguistic ambiguity, efficient training (≈300 samples in ~10 minutes), and cross-backbone consistency, highlighting practical impact for deploying safe Text-to-SQL solutions in real-world domains.

Abstract

In LLM-based text-to-SQL systems, unanswerable and underspecified user queries may generate not only incorrect text but also executable programs that yield misleading results or violate safety constraints, posing a major barrier to safe deployment. Existing refusal strategies for such queries either rely on output-level instruction following, which is brittle due to model hallucinations, or estimate output uncertainty, which adds complexity and overhead. To address this challenge, we formalize safe refusal in text-to-SQL systems as an answerability-gating problem and propose LatentRefusal, a latent-signal refusal mechanism that predicts query answerability from intermediate hidden activations of a large language model. We introduce the Tri-Residual Gated Encoder, a lightweight probing architecture, to suppress schema noise and amplify sparse, localized cues of question-schema mismatch that indicate unanswerability. Extensive empirical evaluations across diverse ambiguous and unanswerable settings, together with ablation studies and interpretability analyses, demonstrate the effectiveness of the proposed approach and show that LatentRefusal provides an attachable and efficient safety layer for text-to-SQL systems. Across four benchmarks, LatentRefusal improves average F1 to 88.5 percent on both backbones while adding approximately 2 milliseconds of probe overhead.

Figures (3)

• Figure 1: Comparison of refusal paradigms. Top: Traditional prompt-based methods rely on the LLM's output, which often fails under uncertainty or hallucination. Bottom: Our approach detects refusal signals directly from the frozen LLM's internal hidden states before generation, ensuring a safe and efficient refusal mechanism without generating or executing any SQL. This enables a single-pass, low-latency refusal decision and avoids the need to run potentially harmful queries.
• Figure 2: Overview of LatentRefusal. (a) Refusal gating: given the question and schema, a frozen base LLM produces hidden states; a lightweight probe predicts answerability before any SQL is generated, and a binary gate either triggers SQL generation or returns a safe refusal. (b) TRGE probe: a Tri-Residual Gated Encoder layer augments a standard Transformer block with an additional SwiGLU-gated residual branch to suppress schema noise and amplify localized mismatch cues.
• Figure 3: Running screenshot of LatentRefusal in a financial deployment. The system correctly identifies a complex, constraint-heavy query as answerable ($p=0.996$) while rejecting a subjective, out-of-scope research request ($p=0.000$). Inference latency is stable ($\approx 467$ms).