Safety for Whom? Refusing the Right Subset of a Topic, Not the Whole Topic

A new Hugging Face blog post argues that most AI safety work is still thinking too broadly. The usual setup treats an entire topic as dangerous, so a model learns to refuse anything that smells like weapons, fraud, self-harm, or politics. That works badly when a deployment needs to answer some questions in a topic and reject others.

The paper behind the post, Safety for Whom? Boundary-Aware Self-Distillation for Controlled LLM Safety Refusal, starts from that narrower problem. A civics tutor and a public-sector assistant can share the same base model but need different rules around politics. Both should answer factual election questions. Only one may need to refuse targeted political manipulation. A topic-level guard cannot express that split, and the authors say LlamaGuard-3’s election category is too coarse for it.

So they frame safety as a boundary inside a topic, not a topic-level ban. In their setup, the model should refuse the harmful subset and answer the benign part around it. The tricky bit is that training does not learn a hard line. It learns a smoother probability curve, which can spill refusal into safe prompts near the edge.

That boundary shows up sharply in their data pipeline. A single steering attempt failed to produce an accepted refusal for 19.88% of prompts, or 8,009 examples, so those were silently dropped in the naive setup. An escalating retry strategy cut the residual failures to 0.20%, or 79 prompts, leaving 40,293 harmful training prompts in place. They also added 11,955 verified benign prompts that look surface-dangerous, spread across 18 semantic types, and used 1,539 held-out harmful-benign pairs per side to measure both halves of the boundary.

The results are a warning as much as a win. On Qwen3-8B, the escalated-coverage model pushed in-distribution political refusal from 9.47% to 84.75%, and the mean unsafe-response rate across HarmBench, StrongREJECT, and WildJailbreak fell from 26.26% to 0.14% in the strongest setup. But over-refusal on XSTest jumped from 2.00% to 74.00%. That is the ugly trade-off the post wants people to see: if you only watch harmful refusal, a model can look better while becoming nearly unusable for safe prompts.

The finer-grained fixes help. Using verified responses generated by the target model itself lowered XSTest over-refusal from 15.20% to 5.20% under single-shot generation, and adding the benign boundary data cut over-refusal on the held-out pairs from 32.94% to 4.16% while harmful-side refusal slipped only from 91.88% to 87.72%. The point is simple and unfashionable: safety tuning has to be measured on both sides of the line, or it is just refusal theater.