Hugging Face paper proposes boundary-aware safety tuning to reduce over-refusal in LLMs

A new paper published on Hugging Face's research blog introduces a method to train large language models (LLMs) to refuse only harmful subsets of a topic, rather than the entire topic, addressing a key limitation of current safety alignment approaches. The work, titled 'Safety for Whom? Boundary-Aware Self-Distillation for Controlled LLM Safety Refusal,' is authored by researchers from MultiverseComputingCAI and frames safety not as a binary property of a topic, but as a nuanced boundary within a topic that varies by deployment context.

The paper argues that topic-level safety taxonomies, such as those used in guard models like LlamaGuard-3, are too blunt for real-world deployments. For example, a civics tutor and a public-sector assistant may share the same base model but require opposite behaviors on political topics: both should answer factual questions about an election, but only one may need to refuse requests for targeted political manipulation. Topic-level refusal cannot express such distinctions.

To operationalize this boundary-aware approach, the authors formalize the problem as a topic universe containing a target-harmful subset that a deployment wants to refuse, while allowing the benign complement to be answered. They use political persuasion as a testbed, where manipulative persuasion is harmful but factual political information is legitimate. The ideal behavior is a sharp step function: refuse inside the harmful subset, answer everywhere else. However, trained models approximate this boundary with a smoother refusal probability, which can spill into benign territory.

The paper identifies three weaknesses in standard self-generated safety tuning pipelines. First, a coverage gap: single-shot generation fails to produce refusals for 19.88% of harmful prompts (8,009 prompts), which may include the hardest examples. The authors address this with an escalating retry strategy, reducing residual failures to 0.20% (79 prompts) and expanding the harmful training set to 40,293 prompts where a naive pipeline would have discarded thousands.

Second, the paper highlights downside reactions: safety tuning can increase false refusals on benign prompts that superficially resemble harmful content. To mitigate this, the authors curate 11,955 verified benign prompts with dangerous-looking wording across 18 semantic types, ensuring the model encounters such prompts during training rather than only at evaluation.

Third, the authors note that ordinary harmful and benign splits do not measure the shape of the boundary. They introduce held-out harmful-benign boundary pairs (1,539 per side) to directly assess both refusal on harmful prompts and over-refusal on benign prompts near the boundary. Without such boundary-aware evaluation, models can appear to improve by expanding refusal into permissible territory, masking a decline in utility.

The paper demonstrates the approach on Qwen3-8B, showing that with escalated coverage, in-distribution political refusal improves from 9.47% to 84.75%, and unsafe-response rates across broader harmfulness benchmarks (HarmBench, StrongREJECT, WildJailbreak) fall from 26.26% to 0.14% in the strongest configuration. However, this configuration also increases over-refusal on XSTest from 2.00% to 74.00%, illustrating the trade-off between safety and utility. The authors show that two data components—replacing externally adopted compliance responses with verified responses generated by the target model, and using boundary-aware data—significantly reduce over-refusal without sacrificing safety gains. Specifically, adding benign boundary data reduces over-refusal on the comply-worthy side of held-out pairs from 32.94% to 4.16%, while refusal on harmful prompts drops only slightly from 91.88% to 87.72%.

The authors emphasize that data composition determines where a model sits in the safety-over-refusal trade-off space, and both axes must be reported together to avoid misleading conclusions about safety improvements.