Study finds the safest-looking refusal model also turned away 74% of harmless prompts

A preprint whose authors include a Multiverse Computing researcher argues that a language model can look safe on paper simply because it refuses almost everything. In the authors' own tests, the training setup with the lowest rate of harmful responses also refused 74% of plainly safe prompts.

The paper, posted to arXiv on 3 September 2026 by five authors, tackles what it calls narrow-boundary safety. The idea is that a civics tutor and a public-sector assistant might share one base model, yet only one may need to refuse targeted political manipulation, while both should still answer factual questions about the same election.

The authors tested this on political persuasion with the Qwen3-8B model. Training on refusal data completed through a step they call Escalate raised refusals in the target domain from 9.47% to 84.75% and cut the average unsafe-response rate across three broader harmfulness benchmarks from 26.26% to 0.14%. But it also pushed over-refusal on XSTest, a set of safe prompts, from 2.00% to 74.00%.

The new part is the remedy. Adding boundary pairs, meaning harmful and benign requests that share a topic and differ in intent, cut over-refusal on held-out pairs from 32.94% to 4.16%. Harmful-side refusal fell from 91.88% to 87.72%, a drop of about four points. The authors describe that as barely moving. In a separate comparison, swapping external responses for verified responses from the target model lowered over-refusal from 15.20% to 5.20%.

The 74% is over-refusal on the XSTest benchmark, while the 32.94% is over-refusal on the authors' own held-out boundary pairs, so the two numbers measure different things and are not a single before-and-after result, even though the authors' post presents them together.

What is confirmed is limited to what the authors report. Both pages we reviewed carry the same abstract, and the arXiv page shows a first version with no sign of peer review. We found no independent evaluation or replication; other pages that discuss the paper appear to paraphrase it. Results come from one model, one political domain and the authors' own pair sets, so it is unclear how far they generalize.

The authors argue that a model can look safe only because nobody checked the benign side, that safety should be measured on both sides of the intended boundary, and that the mix of training data, not just the amount of refusal training, drives the trade-off.

Revised 16 October 2026: Guth re-read the original sources and rewrote this article. Correction: the earlier version said the report does not give a precise rate for how genuine refusals changed with boundary-pair training. The paper's abstract says harmful-side refusal decreased from 91.88% to 87.72%. The earlier version remains available as revision 1.