Safety for Whom? Refusing the Right Subset of a Topic, Not the Whole Topic

Safety for Whom? Refusing the Right Subset of a Topic, Not the Whole Topic

Published September 8, 2026

Most safety-alignment work treats harm as a property of a topic. A prompt is considered unsafe because it belongs to a broad category such as weapons, fraud, or self-harm. Guard models such as LlamaGuard-3 encode this kind of topic-level taxonomy. Benchmarks including XSTest and OR-Bench examine the resulting failure mode: models may refuse safe prompts because they contain dangerous-looking words. Refusal-calibration methods attempt to reduce these unnecessary refusals.

Real deployments are more specific. The same base model may be adapted for a general assistant, an educational product, an enterprise system, or a public-sector service. Each use case can require different boundaries within the same topic.

For example, a civics tutor and a public-sector assistant may use the same model but require different behaviour around politics. Both should answer factual questions about an election, while only one may need to refuse a request to write targeted political manipulation. A topic-level guard cannot represent this distinction. LlamaGuard-3, for example, addresses elections through “factually incorrect information about electoral systems and processes.” That definition excludes persuasion and manipulation, while also excluding some factual prompts that a deployment should continue answering.

The paper Safety for Whom? Boundary-Aware Self-Distillation for Controlled LLM Safety Refusal examines this narrower problem. The question is not whether an entire topic should be refused, but which subset of that topic conflicts with a deployment policy and how a model can be trained and evaluated against that boundary.

Narrow-boundary safety

The setting can be formalised as a topic universe, represented in the experiments by political prompts, containing a target-harmful subset that a deployment should refuse. The intended policy is therefore not to reject all political prompts, but to refuse the harmful subset while answering the benign complement.

The ideal behaviour resembles a sharp step: refuse prompts inside the harmful subset and answer prompts everywhere else in the topic. A trained model does not learn such a perfectly sharp boundary. Instead, it produces a refusal probability that approximates the target. Cross-entropy training that increases refusal inside the harmful subset can also extend refusal into benign territory.

The practical challenge is therefore not only to increase refusal for harmful prompts, but also to shape model behaviour near the boundary. The boundary is operationalised as pairs of prompts that share a topic anchor but differ in intent: one should be refused and the other should be answered.

Political persuasion provides the test case. Manipulative persuasion can cause real harm, while factual political information remains legitimate. This is precisely the situation in which topic-level refusal is too broad.

Where self-generated safety tuning breaks

A natural way to create training data is self-generation. The target model is steered toward a refusal for each harmful prompt, and traces verified by a guard model as genuine refusals are retained. This is the approach used by methods such as ThinkSafe. Applying the method to political prompts and examining each component reveals three weaknesses in the standard pipeline.

1. Coverage gaps

A single steering attempt does not always produce an accepted refusal. In the audited pool, single-shot generation drops 19.88% of prompts, or 8,009 examples. The discarded prompts may include some of the most difficult cases.

An escalating retry strategy addresses this problem by resampling the same prompt with progressively stronger steering. This reduces residual failures to 0.20%, or 79 prompts. Coverage repair leaves 40,293 harmful training prompts that the naive pipeline would have discarded.

2. Downside reactions

Safety tuning can create false refusals for benign prompts that appear superficially dangerous. To compensate, the training data includes in-distribution benign examples. These include 11,955 verified surface-dangerous benign prompts spanning 18 semantic types. As a result, the model encounters safe prompts with dangerous-looking wording during training, rather than only during evaluation.

3. Incomplete evaluation

Ordinary harmful and benign splits do not measure the shape of the boundary. A model can improve its harmful-refusal rate simply by expanding refusal into nearby permissible prompts, while a topic-level metric reports this as an improvement.

Held-out harmful-benign pairs address this limitation. The evaluation uses 1,539 prompts on each side, allowing refusal and compliance to be measured directly around the intended boundary.

The trade-off, and the trap it hides

Training on political refusal data increases refusal as expected. On Qwen3-8B, the escalated-coverage model raises in-distribution political refusal from 9.47% to 84.75%.

The effect also transfers to broader harmfulness benchmarks. Across HarmBench, StrongREJECT, and WildJailbreak, with responses scored by LlamaGuard-3, the mean unsafe-response rate falls from 26.26% to 0.14% in the strongest configuration.

These figures alone suggest a clear improvement, but they omit the benign side of the trade-off. At the same checkpoint, over-refusal on XSTest increases from 2.00% to 74.00%. The configuration with the lowest harmful-response rate also refuses nearly three quarters of plainly safe prompts.

This is not simply a safer model. It is a model with a much broader refusal boundary. The result is visible only when both harmful responses and benign over-refusals are measured. Training-data composition determines where a checkpoint falls in the space defined by these two outcomes, so both axes must be reported together.

Two data components reduce over-refusal while preserving much of the safety gain. First, replacing externally adopted compliance responses with verified responses generated by the target model lowers XSTest over-refusal from 15.20% to 5.20% under single-shot generation, with a modest cost in harmfulness performance.

Second, harmful-benign boundary pairs provide a more targeted correction. Adding benign boundary data reduces over-refusal on the comply-worthy side of held-out pairs from 32.94% to 4.16%. Refusal on the harmful side decreases only from 91.88% to 87.72%.

Most false refusals near the boundary therefore disappear while most genuine refusals remain. There is a measurable recall cost, but it is limited. Measuring both sides makes it possible to manage that trade-off deliberately.

What this changes

Safety tuning should not be assessed by harmful-refusal rate alone. A model that refuses more is not automatically safer. Within a narrow boundary, the same training change that increases refusal for harmful prompts can make the model ineffective on legitimate prompts immediately beside them.

Training-data composition, coverage repair, in-distribution compensation, and boundary pairs all influence this trade-off. Both sides of the intended boundary must be evaluated for the results to be meaningful.

The work examines how model behaviour can be controlled and measured at the level required by real deployments, rather than only through broad topic categories. The same generation pipeline can be applied to topics beyond politics, and the paper reports the complete set of data-composition ablations supporting these results.