Safety for Whom? Refusing the Right Subset of a Topic, Not the Whole Topic
huggingface ·
Most safety alignment work treats harm as a property of a whole topic, but real deployments usually need to refuse only a specific subset of a topic while still answering benign prompts within it. The authors study this narrow-boundary problem using political persuasion as a testbed, aiming to refuse manipulative or targeted persuasive content but keep answering factual political questions. They identify three weaknesses in typical self-generated safety tuning: coverage gaps from dropped failed refusal attempts, false refusals on benign but surface-dangerous prompts, and evaluation metrics that ignore the shape of the boundary. Their proposed repairs include escalating retry strategies, adding in-distribution benign data, and using harmful-benign boundary pairs for training and measurement. Experiments on Qwen3-8B show that training on harmful prompts alone sharply reduces unsafe-response scores but also drives over-refusal on safe prompts up dramatically, from 2.00% to 74.00% on XSTest. Adding benign boundary data cuts over-refusal on the comply-worthy side of held-out pairs from 32.94% to 4.16%, while refusal on the harmful side falls only slightly from 91.88% to 87.72%. The article concludes that safety tuning must be evaluated on both the refusal and over-refusal sides of the intended boundary, because training-data composition determines the trade-off between safety and usefulness.
huggingface