1
00:00:00,300 --> 00:00:05,540
Imagine someone asking for help with an application that
repeatedly restarts on their own laptop.
设想有人求助：自己笔记本上的应用反复重启。

2
00:00:06,280 --> 00:00:12,900
The phrase stop this runaway process needs context, even though
our example is entirely benign computer help.
“停止失控进程”需要上下文，但示例完全是无害电脑求助。

3
00:00:13,860 --> 00:00:19,600
A useful clarification keeps the troubleshooting goal and
specifies that unsaved work should be preserved.
有用澄清保留排障目标，并说明应保留未保存工作。

4
00:00:20,340 --> 00:00:25,180
It should not invent a different objective or turn a legitimate
request into an automatic refusal.
它不应虚构不同目标，也不应自动拒绝合法请求。

5
00:00:26,320 --> 00:00:32,040
This original example is not an attack prompt, real guard
prediction, or measured rewriting outcome.
原创示例不是攻击提示、真实防护预测或测量的改写结果。

6
00:00:32,680 --> 00:00:38,580
It introduces IntentionReasoner's attempt to connect query
assessment with selective, helpful refinement.
它引出 IntentionReasoner 将请求评估与选择性有用改写相连的尝试。

7
00:00:39,200 --> 00:00:46,820
The dedicated guard first analyzes the query, considering its
benign aspects and possible risks in context.
专用防护模型先分析请求，结合上下文考虑无害方面与潜在风险。

8
00:00:47,800 --> 00:00:53,680
It then emits a structured safety label and, when applicable, a
refined version of the request.
随后输出结构化安全标签，并在适用时生成改写请求。

9
00:00:54,800 --> 00:01:00,560
The source treats those stages together, rather than making
rewriting independent of the safety decision.
源方法把阶段结合起来，而非让改写独立于安全判断。

10
00:01:01,820 --> 00:01:07,620
An inferred label is not certain knowledge of a person's true
intentions beyond the supplied text.
推断标签并不等于确定知道文字之外的真实意图。

11
00:01:08,660 --> 00:01:14,920
In our laptop example, the stated ownership and troubleshooting
context are part of what must remain intact.
笔记本示例中的自身设备与排障背景，是需要保留的信息。

12
00:01:16,260 --> 00:01:22,060
The guard is intended to support a downstream assistant without
replacing the meaning of the user's request.
防护旨在帮助下游助手，而非替换用户请求的含义。

13
00:01:22,767 --> 00:01:29,667
The paper's actual taxonomy contains four levels, with two
separate borderline categories between the endpoints.
论文实际有四级分类，在两个端点之间区分两种边界类别。

14
00:01:30,647 --> 00:01:38,307
Completely Unharmful means clearly benign; Borderline Unharmful
allows slight potential misuse or misunderstanding.
完全无害指明确无害请求；边界无害允许潜在误用或误解。

15
00:01:39,347 --> 00:01:47,587
Borderline Harmful means higher risk or ambiguous intent;
Completely Harmful denotes explicitly harmful requests.
边界有害指高风险或意图模糊情况；完全有害指明确有害请求。

16
00:01:48,747 --> 00:01:53,767
The two borderline labels are not interchangeable, because they
lead to different refinement priorities.
两种边界标签不可互换，因为其改写优先级不同。

17
00:01:55,007 --> 00:02:00,687
Our visuals show only category names and a benign example,
without operational harmful content.
画面仅显示类别名与无害示例，不包含可操作有害内容。

18
00:02:01,667 --> 00:02:07,007
Keeping the four labels explicit avoids misrepresenting the
method as a simple three-way classifier.
明确四个标签，避免把方法误表示成简单三分类器。

19
00:02:07,813 --> 00:02:14,813
For unharmful labels, refinement improves clarity or information
while preserving the original request's meaning.
两种无害标签主要改进清晰度与信息量，同时保留请求含义。

20
00:02:15,433 --> 00:02:22,693
For Borderline Harmful, refinement reduces potential risks while
avoiding excessive refusal of the request.
边界有害改写重点降低潜在风险，避免过度拒绝原请求。

21
00:02:23,593 --> 00:02:29,993
Completely Harmful queries are rejected, without preserving an
explicitly harmful goal through rewriting.
完全有害请求被拒绝，不改写成保留明确有害目标的指令。

22
00:02:30,833 --> 00:02:35,873
The laptop clarification is benign; it does not demonstrate
rewriting dangerous content.
虚构笔记本澄清属于无害示例，不演示改写危险内容。

23
00:02:36,833 --> 00:02:43,573
The method can also restrict refinement to selected borderline
labels instead of modifying every incoming query.
方法也可只对所选边界标签改写，不修改每个输入请求。

24
00:02:44,393 --> 00:02:49,933
Selective variants have separate efficiency trade-offs; do not
mix them with default evaluation settings.
这些选择性变体有自己的效率取舍，不应混用默认评估设置。

25
00:02:50,673 --> 00:02:57,853
After deduplication, the supervised corpus contains
approximately one hundred sixty-three thousand unique queries.
构建监督语料去重后约有十六万三千条独特请求。

26
00:02:58,913 --> 00:03:05,593
Structured annotations provide reasoning, safety labels, and
rewriting examples for cold-start supervised training.
结构化标注提供推理轨迹、安全标签和冷启动改写示例。

27
00:03:06,953 --> 00:03:13,353
Online reinforcement learning then uses several components
rather than one undifferentiated quality reward.
随后在线强化学习使用多个组成项，而非单一笼统质量奖励。

28
00:03:14,453 --> 00:03:21,733
The components cover output format, label classification,
rewrite safety, rewrite utility, and length.
组成项包括输出格式、标签分类、改写安全性、效用与长度。

29
00:03:22,673 --> 00:03:28,873
Utility is intended to reward helpful changes while preserving
semantic consistency with the original query.
效用旨在奖励有帮助的变化，同时保留原请求的语义一致性。

30
00:03:29,913 --> 00:03:35,513
These training rewards guide the model; they do not certify
every future safety decision as correct.
训练奖励指导模型，但不认证每个未来安全决定都正确。

31
00:03:36,200 --> 00:03:43,740
The detection evaluation spans six datasets, comparing F one
with attack success and over-refusal rates.
检测评估覆盖六个数据集，比较 F1、攻击成功率与过度拒绝率。

32
00:03:44,820 --> 00:03:49,700
Overall metrics combine evaluated samples to account for
differences in dataset size.
总体指标合并评估样本，以考虑数据集大小差异。

33
00:03:50,840 --> 00:03:56,840
Over-refusal counts harmless queries that this method labels
Completely Harmful, triggering direct refusal.
过度拒绝计数被此方法标为完全有害、触发拒绝的无害请求。

34
00:03:58,220 --> 00:04:04,460
The paper uses method-specific safety criteria, which must
remain explicit in comparisons with binary guards.
论文使用方法特定安全规则，比较二元防护时需保留指标定义。

35
00:04:05,400 --> 00:04:11,640
A separate jailbreak experiment has its own protocol and
attack-success values, distinct from the detection table.
独立越狱实验有自己的协议和攻击成功值，与检测表不同。

36
00:04:12,820 --> 00:04:18,580
The next numbers concern Table Two's detection evaluation rather
than a general guarantee of deployment safety.
接下来的数值对应表二检测评估，不是通用部署安全保证。

37
00:04:19,160 --> 00:04:25,580
The evaluated IntentionReasoner variants use corresponding Qwen
two point five Instruct base models.
被评估变体使用对应的 Qwen2.5-Instruct 基础模型。

38
00:04:26,540 --> 00:04:32,260
The one-point-five-billion-parameter variant reports F one of
ninety-seven point zero in the detection table.
十五亿参数变体在检测表报告 F1 为九十七点零。

39
00:04:33,280 --> 00:04:38,620
The seven-billion-parameter variant reports ninety-nine point
four under the same reported evaluation.
七十亿参数变体在同一报告评估下为九十九点四。

40
00:04:39,680 --> 00:04:45,660
Its attack-success rate is one point two percent, and its
reported over-refusal rate is zero point zero.
其攻击成功率为百分之一点二，报告过度拒绝率为零点零。

41
00:04:46,680 --> 00:04:52,400
The smaller row reports two point six percent attack success and
one point eight percent over-refusal.
较小行报告攻击成功率百分之二点六，过度拒绝率百分之一点八。

42
00:04:53,460 --> 00:05:00,540
A zero reported rate describes these evaluated samples and
rounding; it does not guarantee zero refusals everywhere.
零报告值描述评估样本与舍入，不保证所有场景都零拒绝。

43
00:05:01,120 --> 00:05:08,000
Refinement is useful only when it keeps the legitimate task
intact while making the request clearer or safer.
改写需保留合法任务，同时让请求更清楚或安全，才有价值。

44
00:05:08,880 --> 00:05:14,980
For our laptop example, the task remains troubleshooting a
restarting app and preserving the requester's work.
笔记本示例仍是排查反复重启应用，并保留请求者的工作。

45
00:05:15,780 --> 00:05:22,120
Changing the subject or adding an unsupported goal would not be
faithful clarification of that original request.
改变主题或添加无依据目标，不是忠实澄清原请求。

46
00:05:23,300 --> 00:05:29,320
The source also reports that refinement gains can be limited or
slightly negative for a stronger downstream model.
源结果也报告：更强下游模型的改写收益可能有限或略负。

47
00:05:30,240 --> 00:05:36,200
That supports selective use rather than assuming every rewritten
prompt helps every assistant equally.
这支持选择性使用，而非假设每次改写对所有助手同样有益。

48
00:05:37,320 --> 00:05:42,320
The routing decision and the rewriting quality therefore remain
separate things to inspect.
因此，路由决定与改写质量仍是需要分别检查的两件事。

49
00:05:42,867 --> 00:05:50,327
Return to the original request: understanding context matters
before deciding whether and how the query should change.
回到原请求：决定是否及如何改写之前，需要理解上下文。

50
00:05:51,047 --> 00:05:58,367
IntentionReasoner combines intent analysis, four safety labels,
and selective refinement in one guard-model interface.
IntentionReasoner 将意图分析、四级标签和选择性改写结合到防护接口。

51
00:05:59,327 --> 00:06:06,267
A clear benign goal should remain recognizable after refinement,
rather than disappearing behind a generic response.
明确无害目标改写后应仍可识别，不被笼统回答掩盖。

52
00:06:07,067 --> 00:06:12,247
Reported benchmark safety metrics do not establish perfect
knowledge or universal protection.
同时，基准安全指标不能变成完美认知或普遍保护的主张。

53
00:06:12,967 --> 00:06:19,887
The useful distinction is between interpreting a request,
choosing its route, and producing a faithful helpful rewrite.
有用的区分是解释请求、选择路径，以及生成忠实有用改写。

54
00:06:20,707 --> 00:06:26,587
Each stage needs its own evidence and scope, even when the
complete pipeline looks promising in evaluation.
即使流程在评估中表现有希望，每个阶段仍需自己的证据与范围。