Safety alignment is typically framed as a topic-level question: is this subject harmful? A new paper posted on Hugging Face argues that real deployments ask something narrower. A civics tutor and a public-sector assistant might share the same base model yet require different boundaries within the same topic, refusing targeted political manipulation while still answering factual questions about the same election.
The authors call this problem narrow-boundary safety and propose an offline, self-generated framework that combines controlled topic generation, coverage repair, in-distribution compensation data, and harmful-benign pairs for both training and evaluation.
Data generation proved to be a key variable. Single-shot generation left 19.88% of prompts without accepted refusal traces, whereas escalating retries reduced that figure to 0.20%. On political persuasion with Qwen3-8B, training on refusal data completed through the escalation process raised target-domain refusal from 9.47% to 84.75% and cut the mean unsafe-response rate across three broader harmfulness benchmarks from 26.26% to 0.14% — but pushed XSTest over-refusal from 2.00% to 74.00%.
The paper reports that data composition, not refusal volume, drives the safety-usability trade-off. In a separate matched comparison, replacing external responses with verified target-model responses lowered over-refusal from 15.20% to 5.20%. Adding boundary-pair data reduced comply-side over-refusal on held-out pairs from 32.94% to 4.16%, while harmful-side refusal fell only slightly, from 91.88% to 87.72%.
The authors conclude that safety alignment should be evaluated on both sides of the intended refusal boundary, warning that a configuration with the lowest harmful-response rate may still refuse a large share of plainly safe prompts — appearing safe only because the benign side was never checked.