Safety for Whom? Refusing the Right Subset of a Topic, Not the Whole Topic

Rethinking AI Safety Beyond Topic-Level Refusals

Researchers from Multiverse Computing have published a new paper arguing that the AI industry's standard approach to safety is fundamentally flawed. Current guard models, like LlamaGuard-3, treat harm as a property of a broad topic, leading to models that refuse safe prompts simply because they contain a sensitive keyword. In their paper, "Safety for Whom?," the team introduces a "narrow-boundary" safety framework designed to refuse only a specific harmful subset of a topic, such as political manipulation, while continuing to answer legitimate queries within the same domain, like factual questions about an election.

Shaping the Refusal Boundary

The team's method addresses critical weaknesses in standard safety tuning pipelines, which often create overly blunt models. Using political persuasion as a test case on a Qwen3-8B model, they refined the training process to precisely control model behavior at the boundary between harmful and benign prompts. Their key interventions focus on improving the quality and composition of the safety training data.

• Coverage Repair: Instead of discarding prompts that failed a single refusal generation attempt (19.88% of their data), they implemented an escalating retry strategy, reducing data loss to just 0.20%.
• In-Distribution Benign Data: To combat false refusals, they trained the model on 11,955 specially crafted benign prompts that contain superficially dangerous wording, teaching it to distinguish intent from keywords.
• Boundary-Pair Evaluation: The model was trained and evaluated on 1,539 pairs of prompts that share a topic but differ in intent (one harmful, one benign), allowing for direct measurement of the model's precision.

The Over-Refusal Trap

The research highlights a critical trade-off that is often ignored: tuning for safety can make a model useless. One configuration successfully lowered the unsafe response rate on benchmarks like HarmBench and StrongREJECT from 26.26% to 0.14%. However, this came at the cost of raising over-refusal on the safe XSTest benchmark from 2.00% to 74.00%. The paper's central message is that safety cannot be assessed by harmful refusal rates alone. By using their boundary-aware data, the team demonstrated it's possible to dramatically reduce false refusals near the boundary (from 32.94% to 4.16%) while only slightly decreasing the refusal rate for genuinely harmful prompts (from 91.88% to 87.72%), proving that a measurable, controllable trade-off is achievable.

The pursuit of LLM safety cannot be measured by harmful refusal rates alone. Multiverse Computing's research shows that without concurrently measuring and optimizing against over-refusal on benign prompts, safety fine-tuning risks creating blunt, unusable models. Effective safety requires precise, boundary-aware data composition tailored to specific deployment policies, not just broad topic exclusion.