Boundary-Aware Self-Distillation Reframes LLM Refusal as a Data-Composition Problem

This paper proposes narrow-boundary safety: instead of topic-level harm classification, a deployed model must respect a per-use-case boundary that can vary within the same topic. On Qwen3-8B political-persuasion prompts, the Escalate retry protocol cuts unanswerable prompts from 19.88% to 0.20%; target-domain refusal rises from 9.47% to 84.75%, mean unsafe-response rate across three broader benchmarks falls from 26.26% to 0.14%, and XSTest over-refusal rises from 2.00% to 74.00%. Self-distillation from verified model responses reduces over-refusal from 15.20% to 5.20%, and boundary-pair training cuts comply-side over-refusal from 32.94% to 4.16% while harmful-side refusal falls modestly from 91.88% to 87.72%. The paper argues that safety alignment should be measured on both sides of the intended refusal boundary.

Hugging Face Daily Papers — Safety for Whom? Boundary-Aware Self-Distillation for Controlled LLM Safety Refusal

September 9, 20261 source50% confidence

62Strategic

Strategic score

Evidence strength42

Technical novelty72

Commercial potential62

What is new is not the observation that safety and usefulness conflict, but the framing of that conflict as a boundary-selection problem: the same factual question may need to be answered in one deployment context and refused in another. The claimed mechanism is data composition, especially retry-completed refusal traces, self-distilled target-model responses, and harmful-benign pairs. Independent measurements of refusal and over-refusal would shift the assessment if they do not reproduce the abstract's asymmetry.¹

Context

The document is an arXiv listing in Computation and Language whose substantive content is an abstract describing an offline, self-generated framework. It reports results for Qwen3-8B on political-persuasion prompts, with evaluation spanning a target refusal domain, three broader harmfulness benchmarks, and XSTest over-refusal.¹

Assessment

The quantitative pattern supports the central claim that data composition controls the safety-usability trade-off. Escalate's near-complete refusal-trace coverage is reflected in a large target-domain refusal gain, while the sharp XSTet over-refusal increase shows the same trained boundary is far too wide on benign inputs. The later matched comparison is the strongest causal evidence: swapping external completions for verified target-model responses reduced over-refusal from 15.20% to 5.20% with no stated loss in target-domain refusal, indicating that distribution shift, not model capacity, drove much of the false-positive behaviour.¹

Caveats

The abstract's strongest reported result also carries its clearest warning: target-domain refusal reaches 84.75% while XSTest over-refusal reaches 74.00%. In a deployed assistant that trade-off may be unacceptable, and the paper does not show an operating point that maximizes boundary precision. Full method details, the exact definitions of accepted refusal traces and harmful-benign pairs, and public evaluation sets would materially raise confidence; without them the contribution is promising but not conclusive.¹

Source text

Hugging Face Daily Papers — Safety for Whom? Boundary-Aware Self-Distillation for Controlled LLM Safety Refusal · September 3, 2026

Computer Science > Computation and Language

Title:Safety for Whom? Boundary-Aware Self-Distillation for Controlled LLM Safety Refusal

Abstract:Safety alignment is usually posed as a topic-level question: is this subject harmful? Deployments ask a narrower one. A civics tutor and a public-sector assistant may share a base model yet need different boundaries inside the same topic, refusing targeted political manipulation while still answering factual questions about the same election. We formulate this as narrow-boundary safety and introduce an offline self-generated framework combining controlled topic generation, coverage repair, in-distribution compensation data, and harmful-benign pairs for training and evaluation. Single-shot generation leaves 19.88% of prompts without accepted refusal traces, whereas escalating retries leave 0.20%. On political persuasion with Qwen3-8B, training on refusal data completed through Escalate increases target-domain refusal from 9.47% to 84.75% and reduces the mean unsafe-response rate across three broader harmfulness benchmarks from 26.26% to 0.14%, but increases XSTest over-refusal from 2.00% to 74.00%. In a separate matched comparison, replacing external responses with verified target-model responses reduces over-refusal from 15.20% to 5.20%. Boundary-pair data reduces comply-side over-refusal on held-out pairs from 32.94% to 4.16%, while harmful-side refusal decreases only from 91.88% to 87.72%. These results show that data composition controls the safety and usability trade-off, and that safety alignment should be evaluated on both sides of the intended refusal boundary.

Bookmark

Bibliographic and Citation Tools

Code, Data and Media Associated with this Article

Demos

Recommenders and Search Tools

arXivLabs: experimental projects with community collaborators

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.

The source text above remains the property of its publisher and is reproduced for commentary.

Hugging Face Daily Papers — Safety for Whom? Boundary-Aware Self-Distillation for Controlled LLM Safety Refusal

September 3, 2026endistinct angle

Safety for Whom? Boundary-Aware Self-Distillation for Controlled LLM Safety Refusal

↑ Back to top