Safety for Whom? Boundary-Aware Self-Distillation for Controlled LLM Safety Refusal
The paper argues that refusal training has to learn the exact boundary a deployment needs, not just the broad topic label.
The authors test “narrow-boundary safety” on cases like political persuasion, where a model should refuse manipulation but still answer factual election questions. Their self-distillation setup uses generated refusal data, retry repair, compensation data, and harmful-benign boundary pairs. On Qwen3-8B, one training path sharply raises target-domain refusals and lowers unsafe responses on broader benchmarks, but also causes heavy over-refusal on XSTest. The paper’s main result is that data composition can move that safety-usability trade-off, so evaluation has to check both sides of the intended refusal line. HF Daily Papers' note
The authors test “narrow-boundary safety” on cases like political persuasion, where a model should refuse manipulation but still answer factual election questions. Their self-distillation setup uses generated refusal data, retry repair, compensation data, and harmful-benign boundary pairs. On Qwen3-8B, one training path sharply raises target-domain refusals and lowers unsafe responses on broader benchmarks, but also causes heavy over-refusal on XSTest. The paper’s main result is that data composition can move that safety-usability trade-off, so evaluation has to check both sides of the intended refusal line. HF Daily Papers' note
score 4