Multiverse Computing Stops Qwen3-8B Over-Refusal
Multiverse Computing has developed a boundary-aware training method that prevents large language models from over-refusing safe prompts while still blocking harmful requests.
Researchers at Multiverse Computing have introduced a new training framework called Boundary-Aware Self-Distillation to address the issue of over-refusal in large language models. Traditional safety guardrails like LlamaGuard-3 block entire topics, such as politics, which prevents models from answering benign, factual questions. By focusing on the narrow boundary between harmful and safe prompts within the same topic, the researchers aim to make safety alignment more precise for specific enterprise and educational deployments.
The team used political persuasion as their testbed, training a Qwen3-8B model. Standard self-generation pipelines often suffer from a coverage gap, dropping 19.88 percent of prompts, or 8,009 prompts, during single-shot generation. Multiverse Computing resolved this with an escalating retry strategy that reduced residual failures to 0.20 percent, or just 79 prompts, leaving 40,293 harmful training prompts. To prevent downside reactions where the model falsely refuses safe prompts, they integrated 11,955 verified surface-dangerous benign prompts across 18 semantic types. They also evaluated the model using 1,539 held-out harmful-benign pairs per side.
Initially, training the Qwen3-8B model raised its in-distribution political refusal rate from 9.47 percent to 84.75 percent. On broader benchmarks like HarmBench, StrongREJECT, and WildJailbreak, the mean unsafe-response rate dropped from 26.26 percent to 0.14 percent. However, this aggressive safety tuning caused over-refusal on the XSTest benchmark to spike from 2.00 percent to 74.00 percent.
To mitigate this, the researchers replaced external compliance responses with target-model-generated responses, which lowered XSTest over-refusal from 15.20 percent to 5.20 percent. Furthermore, incorporating benign boundary data reduced over-refusal on the comply-worthy side of the held-out pairs from 32.94 percent to just 4.16 percent, while harmful-side refusal only dipped slightly from 91.88 percent to 87.72 percent. This demonstrates that models can maintain high safety standards without becoming overly restrictive.
This is our own summary of reporting by Hugging Face Blog
