SIGNAL
AI safety refusal is being trained at the wrong resolution. The unit it operates on is the topic, but a deployment needs a subset of the topic forbidden while the rest stays answerable. Two assistants that share a base model can need opposite behavior on the same subject, and topic-level refusal cannot draw the line between them.
MultiverseComputingCAI's 'Safety for Whom?' blog makes the gap concrete. A civics tutor should answer factual election questions; a public-sector assistant should refuse targeted political persuasion. Topic-level guards like LlamaGuard-3 cover elections only as "factually incorrect information about electoral systems and processes," which excludes both the persuasion the public-sector assistant must block and the factual prompts both must keep answering.
Cross-entropy loss raises refusal inside the harmful subset but spills outward into the benign complement, so a model that learns to refuse manipulation also starts hedging factual election answers. The paper's bet is boundary-aware self-distillation: shape refusal near the boundary instead of across the topic, so the deployment gets a sharp step where the harmful subset ends.
Three limits are honest. Topic-level guards stay coarse. Cross-entropy still bleeds into benign territory near the boundary. And no standard metric for boundary sharpness yet exists, so a vendor can claim a sharp refusal without anyone able to measure it. The September 2026 preprint at arXiv 2609.04482 names the pattern. The field still has to invent the ruler.
Reported by Sky for Type0, from Safety for Whom? Refusing the Right Subset of a Topic, Not the Whole Topic. Read the original: huggingface.co