---
title: "Safety for Whom? Refusing the Right Subset of a Topic, Not the Whole Topic"
description: "Topic-level safety systems can conflate a dangerous subject with dangerous intent, causing models to refuse legitimate requests alongside harmful ones. The paper studies deployment-specific boundaries using political persuasion as a testbed: refuse manipulation or targeted persuasion while answering factual political questions. Its training pipeline repairs self-generation coverage through escalating retries, adds verified surface-dangerous benign examples, and evaluates held-out harmful-benign prompt pairs rather than relying on aggregate refusal rates. On Qwen3-8B, escalated coverage raises in-distribution political refusal from 9.47% to 84.75%, while the strongest configuration reduces unsafe responses across three broader benchmarks from 26.26% to 0.14%; however, XSTest over-refusal rises to 74.00%. Adding benign boundary data reduces over-refusal on comply-worthy held-out prompts from 32.94% to 4.16%, with harmful-side refusal declining from 91.88% to 87.72%."
---

# Safety for Whom? Refusing the Right Subset of a Topic, Not the Whole Topic

[Hugging Face](https://yomu.fyi/company/hugging-face) · Antonio Tiene, Alejo Lopez Avila, Iker García-Ferrero · Sep 8, 2026

**Type:** Explainer

## Summary

Topic-level safety systems can conflate a dangerous subject with dangerous intent, causing models to refuse legitimate requests alongside harmful ones. The paper studies deployment-specific boundaries using political persuasion as a testbed: refuse manipulation or targeted persuasion while answering factual political questions. Its training pipeline repairs self-generation coverage through escalating retries, adds verified surface-dangerous benign examples, and evaluates held-out harmful-benign prompt pairs rather than relying on aggregate refusal rates. On Qwen3-8B, escalated coverage raises in-distribution political refusal from 9.47% to 84.75%, while the strongest configuration reduces unsafe responses across three broader benchmarks from 26.26% to 0.14%; however, XSTest over-refusal rises to 74.00%. Adding benign boundary data reduces over-refusal on comply-worthy held-out prompts from 32.94% to 4.16%, with harmful-side refusal declining from 91.88% to 87.72%.

## Context

Broad topic-level safety policies cannot express deployment-specific boundaries within a topic. The stated setting requires refusing political prompts that request manipulation or targeted persuasion while continuing to answer benign political prompts, including factual questions.

## Approach / What changed

The work uses boundary-aware self-distillation on political prompts. It repairs self-generation coverage with progressively stronger steering retries, adds verified surface-dangerous benign examples, and trains and evaluates on harmful-benign prompt pairs that share a topic anchor but differ in intent.

## Takeaways

- Single-shot self-generation dropped 19.88% of harmful prompts, while escalating retries reduced residual failures to 0.20% and retained 40,293 harmful training prompts.
- On Qwen3-8B, the strongest configuration reduced unsafe responses across HarmBench, StrongREJECT, and WildJailbreak from 26.26% to 0.14%, but XSTest over-refusal rose to 74.00%.
- Benign boundary data reduced over-refusal on comply-worthy held-out prompts from 32.94% to 4.16%, while harmful-side refusal declined from 91.88% to 87.72%.

**Tags:** [AI Security](https://yomu.fyi/topic/ai-security), [LLMs](https://yomu.fyi/topic/llm), [Model Evaluation](https://yomu.fyi/topic/model-evaluation)

- Source: [Hugging Face](https://huggingface.co/blog/MultiverseComputingCAI/safety-for-whom)
- Source URL: https://huggingface.co/blog/MultiverseComputingCAI/safety-for-whom
- Ingested by Yomu: 2026-09-08T16:00:54.630Z

[Read original post](https://huggingface.co/blog/MultiverseComputingCAI/safety-for-whom)