Safety for Whom? Refusing the Right Subset of a Topic, Not the Whole Topic

Summary

Topic-level safety systems can conflate a dangerous subject with dangerous intent, causing models to refuse legitimate requests alongside harmful ones. The paper studies deployment-specific boundaries using political persuasion as a testbed: refuse manipulation or targeted persuasion while answering factual political questions. Its training pipeline repairs self-generation coverage through escalating retries, adds verified surface-dangerous benign examples, and evaluates held-out harmful-benign prompt pairs rather than relying on aggregate refusal rates. On Qwen3-8B, escalated coverage raises in-distribution political refusal from 9.47% to 84.75%, while the strongest configuration reduces unsafe responses across three broader benchmarks from 26.26% to 0.14%; however, XSTest over-refusal rises to 74.00%. Adding benign boundary data reduces over-refusal on comply-worthy held-out prompts from 32.94% to 4.16%, with harmful-side refusal declining from 91.88% to 87.72%.

Takeaways

1. 1

   Single-shot self-generation dropped 19.88% of harmful prompts, while escalating retries reduced residual failures to 0.20% and retained 40,293 harmful training prompts.

2. 2

   On Qwen3-8B, the strongest configuration reduced unsafe responses across HarmBench, StrongREJECT, and WildJailbreak from 26.26% to 0.14%, but XSTest over-refusal rose to 74.00%.

3. 3

   Benign boundary data reduced over-refusal on comply-worthy held-out prompts from 32.94% to 4.16%, while harmful-side refusal declined from 91.88% to 87.72%.