IntentionReasoner: Facilitating Adaptive LLM Safeguards through Intent Reasoning and Selective Query Refinement

Paper: IntentionReasoner: Facilitating Adaptive LLM Safeguards through Intent Reasoning and Selective Query Refinement (v1) https://arxiv.org/html/2508.20151v1

This explainer follows the mechanism before interpreting its reported results.

A request to stop a repeatedly restarting application can be ordinary computer help. Useful clarification would keep that goal intact and ask for context while preserving unsaved work. Our original benign example illustrates meaning preservation; it is not an attack or a measured model response.

IntentionReasoner assesses a query before selectively refining it. Its label is an inference from the text and context available to the safeguard, not certain knowledge of a person’s private intent. The source distinguishes four levels: Completely Unharmful, Borderline Unharmful, Borderline Harmful and Completely Harmful.

These labels route different actions. Unharmful requests can be clarified while keeping their meaning. Borderline harmful requests call for risk mitigation without excessive refusal. Completely harmful requests are rejected. The aim is to connect the safeguard decision to a useful response rather than rewrite every query in the same way.

The training pipeline uses approximately 163,000 deduplicated queries for supervised fine-tuning. Reinforcement learning then rewards structured format, classification, rewrite safety and utility, with a length component. That combination trains assessment and the behavior of a refinement together.

The reported detection comparison uses six datasets and separates F1, attack success rate and over-refusal rate from a distinct jailbreak experiment. For the corresponding Qwen2.5-Instruct bases, IR-1.5B reports F1 of 97.0, attack success of 2.6%, and over-refusal of 1.8%. IR-7B reports 99.4, 1.2%, and 0.0%. The last number is a rounded observation in the stated evaluation samples, not a universal promise of zero refusals.

Refinement utility also depends on the downstream model. The reported gains are limited or slightly negative for some stronger models, supporting selective use. The useful lesson is to preserve the legitimate task while making the safeguard’s assessment and chosen route explicit. Safety and helpfulness remain separate outcomes that need their own evidence.