Safety for Whom? Boundary-Aware Self-Distillation for Controlled LLM Safety Refusal

• URL: http://arxiv.org/abs/2609.04482v1
• Date: Thu, 03 Sep 2026 21:03:45 GMT
• Title: Safety for Whom? Boundary-Aware Self-Distillation for Controlled LLM Safety Refusal
• Abstract summary: A civics tutor and a public-sector assistant may share a base model yet need different boundaries inside the same topic.<n>We formulate this as narrow-boundary safety and introduce an offline self-generated framework combining controlled topic generation, coverage repair, in-distribution compensation data, and harmful-benign pairs for training and evaluation.
• Score: 1.8531140061496822
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Safety alignment is usually posed as a topic-level question: is this subject harmful? Deployments ask a narrower one. A civics tutor and a public-sector assistant may share a base model yet need different boundaries inside the same topic, refusing targeted political manipulation while still answering factual questions about the same election. We formulate this as narrow-boundary safety and introduce an offline self-generated framework combining controlled topic generation, coverage repair, in-distribution compensation data, and harmful-benign pairs for training and evaluation. Single-shot generation leaves 19.88% of prompts without accepted refusal traces, whereas escalating retries leave 0.20%. On political persuasion with Qwen3-8B, training on refusal data completed through Escalate increases target-domain refusal from 9.47% to 84.75% and reduces the mean unsafe-response rate across three broader harmfulness benchmarks from 26.26% to 0.14%, but increases XSTest over-refusal from 2.00% to 74.00%. In a separate matched comparison, replacing external responses with verified target-model responses reduces over-refusal from 15.20% to 5.20%. Boundary-pair data reduces comply-side over-refusal on held-out pairs from 32.94% to 4.16%, while harmful-side refusal decreases only from 91.88% to 87.72%. These results show that data composition controls the safety and usability trade-off, and that safety alignment should be evaluated on both sides of the intended refusal boundary.

Related papers

• EvoSafeHarness: Evolving Model- and Domain-Specific Harnesses for Securing Agents [74.54929751174289]
  EvoSafeHarness is a safety-specific optimization framework that synthesizes a deployable harness for a frozen model in a target domain.<n>It reduces average attack success rate from 45.6% to 10.0% at a 3.3-point utility cost.<n>It also achieves the best score on Agent-SafetyBench for every victim.
  arXiv  Detail & Related papers  (2026-09-05T05:56:41Z)
• Barrier Function Conformal Safety Clearance Certification with CVaR for Driving Trajectory Selection [0.0]
  The framework evaluates the trajectory selected by ant planners and calibrates the gap between its plan time margin and realized safety clearance.<n>Across all evaluated statistics, exact-clearance coverage remains above the 90% target at 93.3--96.7%.
  arXiv  Detail & Related papers  (2026-08-27T02:11:43Z)
• Mark, Don't Erase: Token Inoculation for Dual-Use Knowledge in LLMs [54.96236442484317]
  We show that hazardous knowledge can be retained in the model and behaviorally gated by a privileged control token.<n>Our method, Token Inoculation, introduces a binding-and-branching approach.
  arXiv  Detail & Related papers  (2026-07-21T02:15:39Z)
• PsychoSafe: Eliciting Psychologically-Informed Refusals in Large Language Models [20.805546078350524]
  PsychoSafe reframes refusal as structured supportive communication grounded in evidence-based intervention strategies.<n>On a validation set of 500 prompts, PsychoSafe prompting improves overall refusal quality by 28.1% over a generic baseline.<n>Fine-tuning achieves near-perfect refusal and resource-referral rates but reduces response relevance.
  arXiv  Detail & Related papers  (2026-06-08T16:19:18Z)
• SafeDiffusion-R1: Online Reward Steering for Safe Diffusion Post-Training [47.04114541434947]
  Diffusion models have been widely studied for removing unsafe content learned during pre-training.<n>Existing methods require expensive supervised data, either unsafe-text paired with safe-image groundtruth or negative/positive image pairs, making them impractical to scale.<n>We propose a novel online reinforcement learning framework that addresses both data scarcity and model degradation through post-training.
  arXiv  Detail & Related papers  (2026-05-18T17:50:04Z)
• Owner-Harm: A Missing Threat Model for AI Agent Safety [0.0]
  Existing AI safety benchmarks focus on generic criminal harm.<n>We propose Owner-Harm, a formal threat model with eight categories of agent behavior damaging the deployer.
  arXiv  Detail & Related papers  (2026-04-20T10:11:26Z)
• DART: Mitigating Harm Drift in Difference-Aware LLMs via Distill-Audit-Repair Training [18.22030439716779]
  Large language models (LLMs) tuned for safety often avoid acknowledging demographic differences.<n>This identity-blindness yields incorrect responses, unnecessary refusals, or generic "equal-treatment" defaults.<n>We introduce DART (Distill--Audit-Repair Training), which distills label-conditioned reasoning from a teacher.
  arXiv  Detail & Related papers  (2026-04-18T05:28:53Z)
• Measuring the Permission Gate: A Stress-Test Evaluation of Claude Code's Auto Mode [9.116800340266066]
  Claude Code's auto mode is the first deployed permission system for AI coding agents.<n>Anthropic reports a 0.4% false positive rate and 17% false negative rate on production traffic.<n>We evaluate 253 state-changing actions at the individual action level against oracle ground truth.
  arXiv  Detail & Related papers  (2026-04-04T17:56:30Z)
• AI Security Beyond Core Domains: Resume Screening as a Case Study of Adversarial Vulnerabilities in Specialized LLM Applications [71.27518152526686]
  Large Language Models (LLMs) excel at text comprehension and generation, making them ideal for automated tasks like code review and content moderation.<n>LLMs can be manipulated by "adversarial instructions" hidden in input data, such as resumes or code, causing them to deviate from their intended task.<n>This paper introduces a benchmark to assess this vulnerability in resume screening, revealing attack success rates exceeding 80% for certain attack types.
  arXiv  Detail & Related papers  (2025-12-23T08:42:09Z)
• Refusal Falls off a Cliff: How Safety Alignment Fails in Reasoning? [68.82210578851442]
  We investigate why safety alignment fails in reasoning models through a mechanistic interpretability lens.<n>Using a linear probing approach to trace refusal intentions across token positions, we discover a phenomenon termed as textbfrefusal cliff<n>We propose textbfCliff-as-a-Judge, a novel data selection method that identifies training examples exhibiting the largest refusal cliff to efficiently repair reasoning models' safety alignment.
  arXiv  Detail & Related papers  (2025-10-07T15:32:59Z)
• A Granular Study of Safety Pretraining under Model Abliteration [64.24346997570275]
  We study model abliteration, a lightweight projection technique designed to remove refusal-sensitive directions.<n>We issue 100 prompts with balanced harmful and harmless cases, classify responses as **Refusal** or **Non-Refusal** using multiple judges, and validate judge fidelity.<n>Our study produces a checkpoint-level characterization of which data-centric safety components remain robust under abliteration.
  arXiv  Detail & Related papers  (2025-10-03T07:01:45Z)
• G$^2$uardFL: Safeguarding Federated Learning Against Backdoor Attacks through Attributed Client Graph Clustering [116.4277292854053]
  Federated Learning (FL) offers collaborative model training without data sharing. FL is vulnerable to backdoor attacks, where poisoned model weights lead to compromised system integrity. We present G$2$uardFL, a protective framework that reinterprets the identification of malicious clients as an attributed graph clustering problem.
  arXiv  Detail & Related papers  (2023-06-08T07:15:04Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.