1
00:00:00,300 --> 00:00:05,540
Imagine someone asking for help with an application that
repeatedly restarts on their own laptop.

2
00:00:06,280 --> 00:00:12,900
The phrase stop this runaway process needs context, even though
our example is entirely benign computer help.

3
00:00:13,860 --> 00:00:19,600
A useful clarification keeps the troubleshooting goal and
specifies that unsaved work should be preserved.

4
00:00:20,340 --> 00:00:25,180
It should not invent a different objective or turn a legitimate
request into an automatic refusal.

5
00:00:26,320 --> 00:00:32,040
This original example is not an attack prompt, real guard
prediction, or measured rewriting outcome.

6
00:00:32,680 --> 00:00:38,580
It introduces IntentionReasoner's attempt to connect query
assessment with selective, helpful refinement.

7
00:00:39,200 --> 00:00:46,820
The dedicated guard first analyzes the query, considering its
benign aspects and possible risks in context.

8
00:00:47,800 --> 00:00:53,680
It then emits a structured safety label and, when applicable, a
refined version of the request.

9
00:00:54,800 --> 00:01:00,560
The source treats those stages together, rather than making
rewriting independent of the safety decision.

10
00:01:01,820 --> 00:01:07,620
An inferred label is not certain knowledge of a person's true
intentions beyond the supplied text.

11
00:01:08,660 --> 00:01:14,920
In our laptop example, the stated ownership and troubleshooting
context are part of what must remain intact.

12
00:01:16,260 --> 00:01:22,060
The guard is intended to support a downstream assistant without
replacing the meaning of the user's request.

13
00:01:22,767 --> 00:01:29,667
The paper's actual taxonomy contains four levels, with two
separate borderline categories between the endpoints.

14
00:01:30,647 --> 00:01:38,307
Completely Unharmful means clearly benign; Borderline Unharmful
allows slight potential misuse or misunderstanding.

15
00:01:39,347 --> 00:01:47,587
Borderline Harmful means higher risk or ambiguous intent;
Completely Harmful denotes explicitly harmful requests.

16
00:01:48,747 --> 00:01:53,767
The two borderline labels are not interchangeable, because they
lead to different refinement priorities.

17
00:01:55,007 --> 00:02:00,687
Our visuals show only category names and a benign example,
without operational harmful content.

18
00:02:01,667 --> 00:02:07,007
Keeping the four labels explicit avoids misrepresenting the
method as a simple three-way classifier.

19
00:02:07,813 --> 00:02:14,813
For unharmful labels, refinement improves clarity or information
while preserving the original request's meaning.

20
00:02:15,433 --> 00:02:22,693
For Borderline Harmful, refinement reduces potential risks while
avoiding excessive refusal of the request.

21
00:02:23,593 --> 00:02:29,993
Completely Harmful queries are rejected, without preserving an
explicitly harmful goal through rewriting.

22
00:02:30,833 --> 00:02:35,873
The laptop clarification is benign; it does not demonstrate
rewriting dangerous content.

23
00:02:36,833 --> 00:02:43,573
The method can also restrict refinement to selected borderline
labels instead of modifying every incoming query.

24
00:02:44,393 --> 00:02:49,933
Selective variants have separate efficiency trade-offs; do not
mix them with default evaluation settings.

25
00:02:50,673 --> 00:02:57,853
After deduplication, the supervised corpus contains
approximately one hundred sixty-three thousand unique queries.

26
00:02:58,913 --> 00:03:05,593
Structured annotations provide reasoning, safety labels, and
rewriting examples for cold-start supervised training.

27
00:03:06,953 --> 00:03:13,353
Online reinforcement learning then uses several components
rather than one undifferentiated quality reward.

28
00:03:14,453 --> 00:03:21,733
The components cover output format, label classification,
rewrite safety, rewrite utility, and length.

29
00:03:22,673 --> 00:03:28,873
Utility is intended to reward helpful changes while preserving
semantic consistency with the original query.

30
00:03:29,913 --> 00:03:35,513
These training rewards guide the model; they do not certify
every future safety decision as correct.

31
00:03:36,200 --> 00:03:43,740
The detection evaluation spans six datasets, comparing F one
with attack success and over-refusal rates.

32
00:03:44,820 --> 00:03:49,700
Overall metrics combine evaluated samples to account for
differences in dataset size.

33
00:03:50,840 --> 00:03:56,840
Over-refusal counts harmless queries that this method labels
Completely Harmful, triggering direct refusal.

34
00:03:58,220 --> 00:04:04,460
The paper uses method-specific safety criteria, which must
remain explicit in comparisons with binary guards.

35
00:04:05,400 --> 00:04:11,640
A separate jailbreak experiment has its own protocol and
attack-success values, distinct from the detection table.

36
00:04:12,820 --> 00:04:18,580
The next numbers concern Table Two's detection evaluation rather
than a general guarantee of deployment safety.

37
00:04:19,160 --> 00:04:25,580
The evaluated IntentionReasoner variants use corresponding Qwen
two point five Instruct base models.

38
00:04:26,540 --> 00:04:32,260
The one-point-five-billion-parameter variant reports F one of
ninety-seven point zero in the detection table.

39
00:04:33,280 --> 00:04:38,620
The seven-billion-parameter variant reports ninety-nine point
four under the same reported evaluation.

40
00:04:39,680 --> 00:04:45,660
Its attack-success rate is one point two percent, and its
reported over-refusal rate is zero point zero.

41
00:04:46,680 --> 00:04:52,400
The smaller row reports two point six percent attack success and
one point eight percent over-refusal.

42
00:04:53,460 --> 00:05:00,540
A zero reported rate describes these evaluated samples and
rounding; it does not guarantee zero refusals everywhere.

43
00:05:01,120 --> 00:05:08,000
Refinement is useful only when it keeps the legitimate task
intact while making the request clearer or safer.

44
00:05:08,880 --> 00:05:14,980
For our laptop example, the task remains troubleshooting a
restarting app and preserving the requester's work.

45
00:05:15,780 --> 00:05:22,120
Changing the subject or adding an unsupported goal would not be
faithful clarification of that original request.

46
00:05:23,300 --> 00:05:29,320
The source also reports that refinement gains can be limited or
slightly negative for a stronger downstream model.

47
00:05:30,240 --> 00:05:36,200
That supports selective use rather than assuming every rewritten
prompt helps every assistant equally.

48
00:05:37,320 --> 00:05:42,320
The routing decision and the rewriting quality therefore remain
separate things to inspect.

49
00:05:42,867 --> 00:05:50,327
Return to the original request: understanding context matters
before deciding whether and how the query should change.

50
00:05:51,047 --> 00:05:58,367
IntentionReasoner combines intent analysis, four safety labels,
and selective refinement in one guard-model interface.

51
00:05:59,327 --> 00:06:06,267
A clear benign goal should remain recognizable after refinement,
rather than disappearing behind a generic response.

52
00:06:07,067 --> 00:06:12,247
Reported benchmark safety metrics do not establish perfect
knowledge or universal protection.

53
00:06:12,967 --> 00:06:19,887
The useful distinction is between interpreting a request,
choosing its route, and producing a faithful helpful rewrite.

54
00:06:20,707 --> 00:06:26,587
Each stage needs its own evidence and scope, even when the
complete pipeline looks promising in evaluation.