WEBVTT

1
00:00:00.300 --> 00:00:05.540
Imagine someone asking for help with an application that
repeatedly restarts on their own laptop.
设想有人求助：自己笔记本上的应用反复重启。

2
00:00:06.280 --> 00:00:12.900
The phrase stop this runaway process needs context, even though
our example is entirely benign computer help.
“停止失控进程”需要上下文，但示例完全是无害电脑求助。

3
00:00:13.860 --> 00:00:19.600
A useful clarification keeps the troubleshooting goal and
specifies that unsaved work should be preserved.
有用澄清保留排障目标，并说明应保留未保存工作。

4
00:00:20.340 --> 00:00:25.180
It should not invent a different objective or turn a legitimate
request into an automatic refusal.
它不应虚构不同目标，也不应自动拒绝合法请求。

5
00:00:26.320 --> 00:00:32.040
This original example is not an attack prompt, real guard
prediction, or measured rewriting outcome.
原创示例不是攻击提示、真实防护预测或测量的改写结果。

6
00:00:32.680 --> 00:00:38.580
It introduces IntentionReasoner's attempt to connect query
assessment with selective, helpful refinement.
它引出 IntentionReasoner 将请求评估与选择性有用改写相连的尝试。

7
00:00:39.200 --> 00:00:46.820
The dedicated guard first analyzes the query, considering its
benign aspects and possible risks in context.
专用防护模型先分析请求，结合上下文考虑无害方面与潜在风险。

8
00:00:47.800 --> 00:00:53.680
It then emits a structured safety label and, when applicable, a
refined version of the request.
随后输出结构化安全标签，并在适用时生成改写请求。

9
00:00:54.800 --> 00:01:00.560
The source treats those stages together, rather than making
rewriting independent of the safety decision.
源方法把阶段结合起来，而非让改写独立于安全判断。

10
00:01:01.820 --> 00:01:07.620
An inferred label is not certain knowledge of a person's true
intentions beyond the supplied text.
推断标签并不等于确定知道文字之外的真实意图。

11
00:01:08.660 --> 00:01:14.920
In our laptop example, the stated ownership and troubleshooting
context are part of what must remain intact.
笔记本示例中的自身设备与排障背景，是需要保留的信息。

12
00:01:16.260 --> 00:01:22.060
The guard is intended to support a downstream assistant without
replacing the meaning of the user's request.
防护旨在帮助下游助手，而非替换用户请求的含义。

13
00:01:22.767 --> 00:01:29.667
The paper's actual taxonomy contains four levels, with two
separate borderline categories between the endpoints.
论文实际有四级分类，在两个端点之间区分两种边界类别。

14
00:01:30.647 --> 00:01:38.307
Completely Unharmful means clearly benign; Borderline Unharmful
allows slight potential misuse or misunderstanding.
完全无害指明确无害请求；边界无害允许潜在误用或误解。

15
00:01:39.347 --> 00:01:47.587
Borderline Harmful means higher risk or ambiguous intent;
Completely Harmful denotes explicitly harmful requests.
边界有害指高风险或意图模糊情况；完全有害指明确有害请求。

16
00:01:48.747 --> 00:01:53.767
The two borderline labels are not interchangeable, because they
lead to different refinement priorities.
两种边界标签不可互换，因为其改写优先级不同。

17
00:01:55.007 --> 00:02:00.687
Our visuals show only category names and a benign example,
without operational harmful content.
画面仅显示类别名与无害示例，不包含可操作有害内容。

18
00:02:01.667 --> 00:02:07.007
Keeping the four labels explicit avoids misrepresenting the
method as a simple three-way classifier.
明确四个标签，避免把方法误表示成简单三分类器。

19
00:02:07.813 --> 00:02:14.813
For unharmful labels, refinement improves clarity or information
while preserving the original request's meaning.
两种无害标签主要改进清晰度与信息量，同时保留请求含义。

20
00:02:15.433 --> 00:02:22.693
For Borderline Harmful, refinement reduces potential risks while
avoiding excessive refusal of the request.
边界有害改写重点降低潜在风险，避免过度拒绝原请求。

21
00:02:23.593 --> 00:02:29.993
Completely Harmful queries are rejected, without preserving an
explicitly harmful goal through rewriting.
完全有害请求被拒绝，不改写成保留明确有害目标的指令。

22
00:02:30.833 --> 00:02:35.873
The laptop clarification is benign; it does not demonstrate
rewriting dangerous content.
虚构笔记本澄清属于无害示例，不演示改写危险内容。

23
00:02:36.833 --> 00:02:43.573
The method can also restrict refinement to selected borderline
labels instead of modifying every incoming query.
方法也可只对所选边界标签改写，不修改每个输入请求。

24
00:02:44.393 --> 00:02:49.933
Selective variants have separate efficiency trade-offs; do not
mix them with default evaluation settings.
这些选择性变体有自己的效率取舍，不应混用默认评估设置。

25
00:02:50.673 --> 00:02:57.853
After deduplication, the supervised corpus contains
approximately one hundred sixty-three thousand unique queries.
构建监督语料去重后约有十六万三千条独特请求。

26
00:02:58.913 --> 00:03:05.593
Structured annotations provide reasoning, safety labels, and
rewriting examples for cold-start supervised training.
结构化标注提供推理轨迹、安全标签和冷启动改写示例。

27
00:03:06.953 --> 00:03:13.353
Online reinforcement learning then uses several components
rather than one undifferentiated quality reward.
随后在线强化学习使用多个组成项，而非单一笼统质量奖励。

28
00:03:14.453 --> 00:03:21.733
The components cover output format, label classification,
rewrite safety, rewrite utility, and length.
组成项包括输出格式、标签分类、改写安全性、效用与长度。

29
00:03:22.673 --> 00:03:28.873
Utility is intended to reward helpful changes while preserving
semantic consistency with the original query.
效用旨在奖励有帮助的变化，同时保留原请求的语义一致性。

30
00:03:29.913 --> 00:03:35.513
These training rewards guide the model; they do not certify
every future safety decision as correct.
训练奖励指导模型，但不认证每个未来安全决定都正确。

31
00:03:36.200 --> 00:03:43.740
The detection evaluation spans six datasets, comparing F one
with attack success and over-refusal rates.
检测评估覆盖六个数据集，比较 F1、攻击成功率与过度拒绝率。

32
00:03:44.820 --> 00:03:49.700
Overall metrics combine evaluated samples to account for
differences in dataset size.
总体指标合并评估样本，以考虑数据集大小差异。

33
00:03:50.840 --> 00:03:56.840
Over-refusal counts harmless queries that this method labels
Completely Harmful, triggering direct refusal.
过度拒绝计数被此方法标为完全有害、触发拒绝的无害请求。

34
00:03:58.220 --> 00:04:04.460
The paper uses method-specific safety criteria, which must
remain explicit in comparisons with binary guards.
论文使用方法特定安全规则，比较二元防护时需保留指标定义。

35
00:04:05.400 --> 00:04:11.640
A separate jailbreak experiment has its own protocol and
attack-success values, distinct from the detection table.
独立越狱实验有自己的协议和攻击成功值，与检测表不同。

36
00:04:12.820 --> 00:04:18.580
The next numbers concern Table Two's detection evaluation rather
than a general guarantee of deployment safety.
接下来的数值对应表二检测评估，不是通用部署安全保证。

37
00:04:19.160 --> 00:04:25.580
The evaluated IntentionReasoner variants use corresponding Qwen
two point five Instruct base models.
被评估变体使用对应的 Qwen2.5-Instruct 基础模型。

38
00:04:26.540 --> 00:04:32.260
The one-point-five-billion-parameter variant reports F one of
ninety-seven point zero in the detection table.
十五亿参数变体在检测表报告 F1 为九十七点零。

39
00:04:33.280 --> 00:04:38.620
The seven-billion-parameter variant reports ninety-nine point
four under the same reported evaluation.
七十亿参数变体在同一报告评估下为九十九点四。

40
00:04:39.680 --> 00:04:45.660
Its attack-success rate is one point two percent, and its
reported over-refusal rate is zero point zero.
其攻击成功率为百分之一点二，报告过度拒绝率为零点零。

41
00:04:46.680 --> 00:04:52.400
The smaller row reports two point six percent attack success and
one point eight percent over-refusal.
较小行报告攻击成功率百分之二点六，过度拒绝率百分之一点八。

42
00:04:53.460 --> 00:05:00.540
A zero reported rate describes these evaluated samples and
rounding; it does not guarantee zero refusals everywhere.
零报告值描述评估样本与舍入，不保证所有场景都零拒绝。

43
00:05:01.120 --> 00:05:08.000
Refinement is useful only when it keeps the legitimate task
intact while making the request clearer or safer.
改写需保留合法任务，同时让请求更清楚或安全，才有价值。

44
00:05:08.880 --> 00:05:14.980
For our laptop example, the task remains troubleshooting a
restarting app and preserving the requester's work.
笔记本示例仍是排查反复重启应用，并保留请求者的工作。

45
00:05:15.780 --> 00:05:22.120
Changing the subject or adding an unsupported goal would not be
faithful clarification of that original request.
改变主题或添加无依据目标，不是忠实澄清原请求。

46
00:05:23.300 --> 00:05:29.320
The source also reports that refinement gains can be limited or
slightly negative for a stronger downstream model.
源结果也报告：更强下游模型的改写收益可能有限或略负。

47
00:05:30.240 --> 00:05:36.200
That supports selective use rather than assuming every rewritten
prompt helps every assistant equally.
这支持选择性使用，而非假设每次改写对所有助手同样有益。

48
00:05:37.320 --> 00:05:42.320
The routing decision and the rewriting quality therefore remain
separate things to inspect.
因此，路由决定与改写质量仍是需要分别检查的两件事。

49
00:05:42.867 --> 00:05:50.327
Return to the original request: understanding context matters
before deciding whether and how the query should change.
回到原请求：决定是否及如何改写之前，需要理解上下文。

50
00:05:51.047 --> 00:05:58.367
IntentionReasoner combines intent analysis, four safety labels,
and selective refinement in one guard-model interface.
IntentionReasoner 将意图分析、四级标签和选择性改写结合到防护接口。

51
00:05:59.327 --> 00:06:06.267
A clear benign goal should remain recognizable after refinement,
rather than disappearing behind a generic response.
明确无害目标改写后应仍可识别，不被笼统回答掩盖。

52
00:06:07.067 --> 00:06:12.247
Reported benchmark safety metrics do not establish perfect
knowledge or universal protection.
同时，基准安全指标不能变成完美认知或普遍保护的主张。

53
00:06:12.967 --> 00:06:19.887
The useful distinction is between interpreting a request,
choosing its route, and producing a faithful helpful rewrite.
有用的区分是解释请求、选择路径，以及生成忠实有用改写。

54
00:06:20.707 --> 00:06:26.587
Each stage needs its own evidence and scope, even when the
complete pipeline looks promising in evaluation.
即使流程在评估中表现有希望，每个阶段仍需自己的证据与范围。