WEBVTT

1
00:00:00.300 --> 00:00:05.540
Imagine someone asking for help with an application that
repeatedly restarts on their own laptop.

2
00:00:06.280 --> 00:00:12.900
The phrase stop this runaway process needs context, even though
our example is entirely benign computer help.

3
00:00:13.860 --> 00:00:19.600
A useful clarification keeps the troubleshooting goal and
specifies that unsaved work should be preserved.

4
00:00:20.340 --> 00:00:25.180
It should not invent a different objective or turn a legitimate
request into an automatic refusal.

5
00:00:26.320 --> 00:00:32.040
This original example is not an attack prompt, real guard
prediction, or measured rewriting outcome.

6
00:00:32.680 --> 00:00:38.580
It introduces IntentionReasoner's attempt to connect query
assessment with selective, helpful refinement.

7
00:00:39.200 --> 00:00:46.820
The dedicated guard first analyzes the query, considering its
benign aspects and possible risks in context.

8
00:00:47.800 --> 00:00:53.680
It then emits a structured safety label and, when applicable, a
refined version of the request.

9
00:00:54.800 --> 00:01:00.560
The source treats those stages together, rather than making
rewriting independent of the safety decision.

10
00:01:01.820 --> 00:01:07.620
An inferred label is not certain knowledge of a person's true
intentions beyond the supplied text.

11
00:01:08.660 --> 00:01:14.920
In our laptop example, the stated ownership and troubleshooting
context are part of what must remain intact.

12
00:01:16.260 --> 00:01:22.060
The guard is intended to support a downstream assistant without
replacing the meaning of the user's request.

13
00:01:22.767 --> 00:01:29.667
The paper's actual taxonomy contains four levels, with two
separate borderline categories between the endpoints.

14
00:01:30.647 --> 00:01:38.307
Completely Unharmful means clearly benign; Borderline Unharmful
allows slight potential misuse or misunderstanding.

15
00:01:39.347 --> 00:01:47.587
Borderline Harmful means higher risk or ambiguous intent;
Completely Harmful denotes explicitly harmful requests.

16
00:01:48.747 --> 00:01:53.767
The two borderline labels are not interchangeable, because they
lead to different refinement priorities.

17
00:01:55.007 --> 00:02:00.687
Our visuals show only category names and a benign example,
without operational harmful content.

18
00:02:01.667 --> 00:02:07.007
Keeping the four labels explicit avoids misrepresenting the
method as a simple three-way classifier.

19
00:02:07.813 --> 00:02:14.813
For unharmful labels, refinement improves clarity or information
while preserving the original request's meaning.

20
00:02:15.433 --> 00:02:22.693
For Borderline Harmful, refinement reduces potential risks while
avoiding excessive refusal of the request.

21
00:02:23.593 --> 00:02:29.993
Completely Harmful queries are rejected, without preserving an
explicitly harmful goal through rewriting.

22
00:02:30.833 --> 00:02:35.873
The laptop clarification is benign; it does not demonstrate
rewriting dangerous content.

23
00:02:36.833 --> 00:02:43.573
The method can also restrict refinement to selected borderline
labels instead of modifying every incoming query.

24
00:02:44.393 --> 00:02:49.933
Selective variants have separate efficiency trade-offs; do not
mix them with default evaluation settings.

25
00:02:50.673 --> 00:02:57.853
After deduplication, the supervised corpus contains
approximately one hundred sixty-three thousand unique queries.

26
00:02:58.913 --> 00:03:05.593
Structured annotations provide reasoning, safety labels, and
rewriting examples for cold-start supervised training.

27
00:03:06.953 --> 00:03:13.353
Online reinforcement learning then uses several components
rather than one undifferentiated quality reward.

28
00:03:14.453 --> 00:03:21.733
The components cover output format, label classification,
rewrite safety, rewrite utility, and length.

29
00:03:22.673 --> 00:03:28.873
Utility is intended to reward helpful changes while preserving
semantic consistency with the original query.

30
00:03:29.913 --> 00:03:35.513
These training rewards guide the model; they do not certify
every future safety decision as correct.

31
00:03:36.200 --> 00:03:43.740
The detection evaluation spans six datasets, comparing F one
with attack success and over-refusal rates.

32
00:03:44.820 --> 00:03:49.700
Overall metrics combine evaluated samples to account for
differences in dataset size.

33
00:03:50.840 --> 00:03:56.840
Over-refusal counts harmless queries that this method labels
Completely Harmful, triggering direct refusal.

34
00:03:58.220 --> 00:04:04.460
The paper uses method-specific safety criteria, which must
remain explicit in comparisons with binary guards.

35
00:04:05.400 --> 00:04:11.640
A separate jailbreak experiment has its own protocol and
attack-success values, distinct from the detection table.

36
00:04:12.820 --> 00:04:18.580
The next numbers concern Table Two's detection evaluation rather
than a general guarantee of deployment safety.

37
00:04:19.160 --> 00:04:25.580
The evaluated IntentionReasoner variants use corresponding Qwen
two point five Instruct base models.

38
00:04:26.540 --> 00:04:32.260
The one-point-five-billion-parameter variant reports F one of
ninety-seven point zero in the detection table.

39
00:04:33.280 --> 00:04:38.620
The seven-billion-parameter variant reports ninety-nine point
four under the same reported evaluation.

40
00:04:39.680 --> 00:04:45.660
Its attack-success rate is one point two percent, and its
reported over-refusal rate is zero point zero.

41
00:04:46.680 --> 00:04:52.400
The smaller row reports two point six percent attack success and
one point eight percent over-refusal.

42
00:04:53.460 --> 00:05:00.540
A zero reported rate describes these evaluated samples and
rounding; it does not guarantee zero refusals everywhere.

43
00:05:01.120 --> 00:05:08.000
Refinement is useful only when it keeps the legitimate task
intact while making the request clearer or safer.

44
00:05:08.880 --> 00:05:14.980
For our laptop example, the task remains troubleshooting a
restarting app and preserving the requester's work.

45
00:05:15.780 --> 00:05:22.120
Changing the subject or adding an unsupported goal would not be
faithful clarification of that original request.

46
00:05:23.300 --> 00:05:29.320
The source also reports that refinement gains can be limited or
slightly negative for a stronger downstream model.

47
00:05:30.240 --> 00:05:36.200
That supports selective use rather than assuming every rewritten
prompt helps every assistant equally.

48
00:05:37.320 --> 00:05:42.320
The routing decision and the rewriting quality therefore remain
separate things to inspect.

49
00:05:42.867 --> 00:05:50.327
Return to the original request: understanding context matters
before deciding whether and how the query should change.

50
00:05:51.047 --> 00:05:58.367
IntentionReasoner combines intent analysis, four safety labels,
and selective refinement in one guard-model interface.

51
00:05:59.327 --> 00:06:06.267
A clear benign goal should remain recognizable after refinement,
rather than disappearing behind a generic response.

52
00:06:07.067 --> 00:06:12.247
Reported benchmark safety metrics do not establish perfect
knowledge or universal protection.

53
00:06:12.967 --> 00:06:19.887
The useful distinction is between interpreting a request,
choosing its route, and producing a faithful helpful rewrite.

54
00:06:20.707 --> 00:06:26.587
Each stage needs its own evidence and scope, even when the
complete pipeline looks promising in evaluation.