Safety for Whom? Boundary-Aware Self-Distillation for Controlled LLM Safety Refusal

Summary

This paper reframes safety alignment as a narrow-boundary problem: rather than refusing an entire topic, a deployment should refuse only a target-harmful subset - say, political manipulation - while still answering the benign complement, such as factual election questions. The authors build an offline, self-generated data framework around Qwen3-8B: hierarchical, persona- and length-controlled political prompt generation; coverage repair, where escalating retries cut the share of prompts left without accepted refusal traces from 19.88% under single-shot generation to 0.20%; in-distribution compensation data, including verified target-model responses (SC2) replacing external SafeChain responses and 11,955 surface-dangerous-but-benign FakeHarm prompts; and harmful-benign boundary pairs for training and held-out evaluation (1,539 pairs per side). Escalate-trained LoRA adapters raise in-distribution refusal from 9.47% to 84.75% and cut the mean LlamaGuard-3 unsafe rate on HarmBench, StrongREJECT, and WildJailbreak from 26.26% to 0.14%, but XSTest over-refusal jumps from 2.00% to 74.00%. SC2 and FakeHarm lower over-refusal at a modest safety cost; boundary pairs cut held-out comply-side over-refusal from 32.94% to 4.16% at a recall cost (PR-OOD refusal 91.88% -> 87.72%), a direction replicated on DeepSeek-R1-Distill-Qwen-7B. Main limitations: point estimates only (no confidence intervals, two seeds), reliance on LlamaGuard-3 as sole judge for headline safety numbers with missing WildGuard cross-checks, an incomplete train/eval near-duplicate audit, a single topic and main model, and no general-capability regression evaluation.