Cross-entropy is where the blunt behaviour comes from. Steer the model to refuse a harmful political prompt, keep the trace a guard model accepts as a genuine refusal, train on it, and refusal probability rises inside the harmful subset [10]. According to the paper, the same update can also push refusal outward into the benign complement of the topic [7]. The target is a step at the boundary; what a trained model learns is a ramp that spills into benign territory nearby [6]. That is why the unit of training here is a pair of prompts sharing a topic anchor and differing only in intent, one to be refused and one to be answered [8].
The audited pool can be reconstructed from the counts. Coverage repair leaves 40,293 harmful training prompts [13] alongside 79 residual failures [12], so roughly 40,372 prompts went in [1]. The retry ladder therefore recovered 7,930 of the 8,009 prompts a single steering attempt had dropped, about 99 percent of them [2]. That rate, 19.88 percent, implies a pool nearer 40,287, some 85 short of the sum, so the percentage and the counts are probably drawn from slightly different pools [3]. Twenty percent of a training set going missing without a log line is the sort of thing an audit finds and a leaderboard does not.
The mixture is a knob, and it belongs to whatever base model and steering method the authors used. Setting 40,293 harmful prompts against 11,955 verified surface-dangerous benign ones is about 3.4 to 1 [4]. Copy that ratio onto a different checkpoint and you are asserting that its prior rate of false refusal on dangerous-sounding safe wording matches theirs. The posted text does not report post-training results at all, since it breaks off mid-sentence in the training section [17], so the three repairs are so far audited on the data rather than on model behaviour.
For the data construction to transfer, the illegitimate use in your topic has to differ from the legitimate one by intent rather than by subject, as manipulative persuasion does from factual political information [9]; you have to be able to author both halves of a pair so that only intent varies [8]; and a guard model has to distinguish a genuine refusal from a hedge in your domain [10]. The held-out pairs, 1,539 per side, are what let both sides be scored at once [16], which is 3,078 prompts of evaluation data that exist only because someone wrote them in matched form [5].
The part that carries without any of that is the taxonomy reading. LlamaGuard-3's election category is written as factually incorrect information about electoral systems and processes [4]. That text is the spec. A deployment that must keep answering factual election questions while refusing requests to write targeted political manipulation gets nothing from it in either direction [3], which is the case for putting the boundary in the training data instead of in a category name.
