Teaching a model to refuse the harmful half of a topic, not the whole thing

Most safety filters work at the level of a whole topic: block politics, block anything that looks like weapons, and so on. A team from Multiverse Computing argues this is the wrong unit. A single topic holds both harmless questions and genuinely harmful ones, and a topic-level guard cannot tell them apart, so it either lets bad requests through or refuses safe ones. Their proposed fix is a training method they call boundary-aware self-distillation, which teaches a model to refuse only the harmful subset while still answering benign questions in the same area.

The numbers show why the boundary matters. Training Qwen3-8B to refuse harmful political content pushed its political refusal rate from 9.47% to 84.75% and cut harmful responses across benchmarks from 26.26% to 0.14%. But the same training made the model paranoid: over-refusal on the XSTest safe-prompt set climbed to 74%, meaning it started rejecting ordinary questions. To fix that they added 11,955 safe-but-scary-looking prompts across 18 semantic types, plus 1,539 held-out pairs that differ only in intent, one harmful and one benign. That brought over-refusal down from 32.94% to 4.16% while barely touching the model's willingness to refuse the harmful side. One smaller detail worth stealing: instead of throwing away failed refusal examples, they resampled them with progressively stronger steering, which cut generation failures from 19.88% to 0.20%. Full writeup on Hugging Face.

Why it matters

If you fine-tune models for safety, this puts numbers on a trap you have probably hit: crank up refusals and you also start rejecting legitimate users. The boundary-pair recipe is a concrete way to measure and recover that lost precision before it reaches the people who use your product.