Safety for Whom? Boundary-Aware Self-Distillation for Controlled LLM Safety Refusal

Safety for Whom? Boundary-Aware Self-Distillation for Controlled LLM Safety Refusal. By Alejo López-Ávila and four others, from Multiverse Computing. Published on the third of September. No code repository is linked to it.

Safety alignment is usually framed at the level of a topic: is this subject harmful or not? Real deployments ask something narrower. A civics tutor and a public-sector assistant might share one base model, yet each needs its own boundary inside the same topic. Both should refuse targeted political manipulation. Both should still answer factual questions about the very same election. A topic-level switch cannot draw that line.

The authors name this narrow-boundary safety, and build an offline framework in which the training data is self-generated. It has four ingredients: controlled generation of topics, repair of gaps in coverage, compensation data drawn from the same distribution, and pairs of harmful and benign prompts, used both for training and for evaluation.

The first obstacle is simply getting refusal data for every prompt, which is what the coverage repair addresses. Generating once per prompt leaves nineteen point eight eight percent of prompts without an accepted refusal trace. Escalating retries, a procedure named Escalate, bring that down to zero point two percent. The harmful-benign pairs, meanwhile, sit on either side of the boundary, so that a model can be trained and tested on where the line falls rather than only on which side is dangerous.

On political persuasion with Qwen3-8B, training on refusal data completed through Escalate raises refusal in the target domain from nine point four seven percent to eighty-four point seven five percent. Across three broader harmfulness benchmarks, the mean unsafe-response rate falls from twenty-six point two six percent to zero point one four percent. The cost shows up on XSTest, where over-refusal climbs from two percent to seventy-four percent.

The remaining ingredients go after that cost. In a separate matched comparison, swapping external responses for verified responses from the target model itself cuts over-refusal from fifteen point two percent to five point two percent. Boundary-pair data cuts over-refusal on the comply side of held-out pairs from thirty-two point nine four percent to four point one six percent, while refusal on the harmful side slips only from ninety-one point eight eight percent to eighty-seven point seven two.

Two conclusions are drawn. Data composition is what controls the trade-off between safety and usability. And safety alignment should be evaluated on both sides of the refusal boundary it intends, because a model that refuses everything nearby looks perfectly safe until someone asks it an ordinary question.