Safety for Whom? Refusing the Right Subset of a Topic, Not the Whole Topic
Safety for Whom? Refusing the Right Subset of a Topic, Not the Whole Topic
为了谁的安全？拒绝主题的特定子集，而非整个主题
Most safety alignment work treats harm as a property of a topic. A prompt is unsafe because it falls into a general category such as weapons, fraud, or self-harm, and guard models like LlamaGuard-3 encode exactly this kind of topic-level taxonomy. Benchmarks like XSTest and OR-Bench then probe the failure mode this creates, models that refuse safe prompts because they contain a dangerous-looking word, and refusal-calibration work tries to pull that number back down.
大多数安全对齐工作将“危害”视为主题的一种属性。一个提示词（prompt）之所以不安全，是因为它属于武器、欺诈或自残等通用类别，而像 LlamaGuard-3 这样的防护模型正是基于这种主题层面的分类法进行编码的。XSTest 和 OR-Bench 等基准测试随后会探测由此产生的故障模式——即模型因为提示词中包含看似危险的词汇而拒绝回答安全问题，而拒绝校准（refusal-calibration）工作则试图降低这种拒绝率。
Real deployments rarely fit the topic-level picture. The same base model may be adapted for a general assistant, an educational product, an enterprise system, or a public-sector service, and each setting needs different boundaries within the same topic. A civics tutor and a public-sector assistant can share a model yet require opposite behaviour on politics: both should answer factual questions about an election, but only one may need to refuse a request to write targeted political manipulation. A topic-level guard cannot express that split.
实际部署场景很少符合这种“主题层面”的设定。同一个基础模型可能被适配为通用助手、教育产品、企业系统或公共服务系统，而每个场景在同一主题下都需要不同的边界。例如，公民课导师和公共部门助手可以共享同一个模型，但在政治问题上却需要截然不同的行为：两者都应该回答关于选举的事实性问题，但只有后者可能需要拒绝编写针对性政治操纵内容的请求。主题层面的防护机制无法表达这种差异。
LlamaGuard-3, for example, covers elections only as “factually incorrect information about electoral systems and processes,” which excludes persuasion and manipulation and, at the same time, excludes the factual prompts a deployment must keep answering. Our latest paper, Safety for Whom? Boundary-Aware Self-Distillation for Controlled LLM Safety Refusal, studies this narrower problem directly. The question is not whether an entire topic should be refused, but which subset of that topic is incompatible with a given deployment policy, and how to train and measure a model against that boundary.
以 LlamaGuard-3 为例，它对选举的覆盖仅限于“关于选举制度和流程的事实错误信息”，这既排除了说服和操纵行为，同时也排除了部署场景中必须持续回答的事实性提示词。我们最新的论文《为了谁的安全？用于受控大模型安全拒绝的边界感知自蒸馏》（Safety for Whom? Boundary-Aware Self-Distillation for Controlled LLM Safety Refusal）直接研究了这一更细分的问题。核心问题不在于是否应该拒绝整个主题，而在于该主题的哪个子集与特定的部署策略不兼容，以及如何针对该边界来训练和评估模型。
Narrow-boundary safety
窄边界安全
We formalise the setting as a topic universe, all political prompts in our experiments, that contains a target-harmful subset the deployment wants to refuse. The intended policy is not to refuse all of politics, but to refuse the harmful subset while continuing to answer the benign complement. The ideal behaviour is a sharp step: refuse inside the subset, answer everywhere else in the topic.
我们将该设定形式化为一个“主题宇宙”（在我们的实验中即所有政治提示词），其中包含部署方希望拒绝的目标有害子集。预期的策略不是拒绝所有政治内容，而是拒绝有害子集，同时继续回答良性的补充部分。理想的行为是一个清晰的阶跃：在子集内拒绝，在主题的其他部分则回答。
A trained model’s refusal is smoother than the ideal split and can spill into benign territory near the boundary. A trained model never learns that sharp step. It learns a refusal probability that only approximates the target, and cross-entropy training that raises refusal inside the harmful subset can also push refusal outward into the benign complement. So the real problem is not only raising refusal on harmful prompts, but shaping the behaviour near the boundary itself.
训练后的模型其拒绝行为比理想的分割要平滑，可能会溢出到边界附近的良性区域。训练后的模型永远无法学会那种“清晰的阶跃”。它学到的是一种仅能近似目标的拒绝概率，而旨在提高有害子集内拒绝率的交叉熵训练，也可能将拒绝行为推向良性的补充部分。因此，真正的问题不仅在于提高对有害提示词的拒绝率，还在于塑造边界本身的行为。
We operationalise that boundary as pairs of prompts that share a topic anchor and differ only in intent, one that should be refused and one that should be answered. We use political persuasion as the testbed, since manipulative persuasion can cause real harm while factual political information stays legitimate, which is exactly the case where topic-level refusal is too blunt.
我们将该边界操作化为成对的提示词：它们共享一个主题锚点，仅在意图上有所不同——一个应该被拒绝，另一个应该被回答。我们使用政治说服作为测试平台，因为操纵性的说服可能造成实际伤害，而事实性的政治信息依然是合法的，这正是主题层面拒绝机制显得过于粗糙的典型案例。
Where self-generated safety tuning breaks
自生成安全微调的局限性
The natural way to build training data here is self-generation: take the target model, steer it toward a refusal on each harmful prompt, and keep the traces a guard model verifies as genuine refusals. This is the recipe behind methods like ThinkSafe, and we adopt it as our reference, applied to political prompts and measured component by component.
构建训练数据的自然方式是“自生成”：获取目标模型，引导其对每个有害提示词进行拒绝，并保留经防护模型验证为真实拒绝的记录。这是 ThinkSafe 等方法背后的配方，我们将其作为参考，应用于政治提示词，并逐个组件进行测量。
Framing the problem as a boundary rather than a topic exposes three weaknesses in that standard pipeline. The first is a coverage gap. A single steering attempt does not always produce an accepted refusal, and those prompts are silently dropped from the training set. In our audited pool, single-shot generation drops 19.88% of prompts, 8,009 of them, and these failed prompts may well be the hardest examples. We repair this instead of discarding it: an escalating retry strategy, resampling the same prompt through progressively stronger steering, brings the residual failures down to 0.20%, or 79 prompts. Coverage repair leaves 40,293 harmful training prompts where the naive pipeline would have thrown thousands away.
将问题定义为“边界”而非“主题”，揭示了标准流程中的三个弱点。首先是覆盖率缺口。单次引导尝试并不总能产生被接受的拒绝，这些提示词会被悄悄地从训练集中剔除。在我们的审计池中，单次生成丢弃了 19.88% 的提示词（共 8,009 个），而这些失败的提示词很可能就是最难的样本。我们通过“升级重试策略”来修复而非丢弃它们：通过逐渐增强的引导对同一提示词进行重采样，将剩余失败率降低至 0.20%（即 79 个提示词）。覆盖率修复保留了 40,293 个有害训练提示词，而原始流程本会丢弃数千个。
The second is downside reactions. Safety tuning tends to produce false refusals on benign prompts that look superficially dangerous. To compensate, we build in-distribution benign data, including 11,955 verified surface-dangerous benign prompts across 18 semantic types, so the model sees safe prompts with dangerous-looking wording during training rather than only at evaluation.
第二个弱点是负面反应。安全微调往往会对表面上看起来危险的良性提示词产生错误拒绝。为了补偿这一点，我们构建了分布内的良性数据，包括 18 个语义类型中 11,955 个经核实的“表面危险但实际良性”的提示词，这样模型在训练过程中就能看到带有危险措辞的安全提示词，而不是仅在评估时才遇到。
The third is that ordinary harmful and benign splits do not measure the shape of the boundary at all. A model can improve its harmful-refusal rate simply by expanding refusal into nearby permissible prompts, and a topic-level metric will call that an improvement. Held-out harmful-benign pairs, 1,539 per side, let us measure both sides of the boundary directly.
第三个弱点是，普通的有害/良性划分根本无法衡量边界的形状。模型可以通过将拒绝范围扩大到附近的合规提示词来提高其有害拒绝率，而主题层面的指标会将其称为“改进”。通过保留 1,539 对有害-良性配对，我们可以直接衡量边界的两侧。
The trade-off, and a trap it hides
权衡及其隐藏的陷阱
Training on political refusal data works in the obvious sense. On Qwen3-8B, the escalated-coverage model raises in-distribution political refusal from 9.47% to 84.75%, and it also transfers: the mean unsafe-response rate across three broader harmfulness benchmarks, HarmBench, StrongREJECT, and WildJailbreak, scored by LlamaGuard-3, falls from 26.26% to 0.14% in the strongest configuration. Reported alone, those numbers look like a clean win. They are not. At the same checkpoint, over-refusal on XSTest rises from 2.00% to 74.00%. The configuration with the lowest harmful-response rate is also the one that refuses nearly three quarters of plainly s…
在政治拒绝数据上进行训练在直观上是有效的。在 Qwen3-8B 模型上，采用升级覆盖策略的模型将分布内政治拒绝率从 9.47% 提高到了 84.75%，并且具有迁移性：在 HarmBench、StrongREJECT 和 WildJailbreak 这三个更广泛的危害基准测试中，经 LlamaGuard-3 评分的平均不安全响应率在最强配置下从 26.26% 降至 0.14%。如果单独报告这些数字，看起来是一场完胜。但事实并非如此。在同一个检查点，XSTest 上的过度拒绝率从 2.00% 上升到了 74.00%。有害响应率最低的配置，同时也是拒绝了近四分之三明显安全内容的配置……