Refusing Intent, Not Form: Wrapper-Based Intent-Group Supervision for LLM Safety

arXiv:2608.13304v2 Announce Type: replace Abstract: A common way to improve jailbreak robustness is to train on harmful requests rewritten as role-play, translation, or other forms. When used only for harmful requests, these forms may become refusal shortcuts, weakening unseen-attack robustness and increasing benign over-refusal. We propose Wrapper-Based Intent-Form Augmentation (WIFA), which applies shared wrapper families to harmful and benign requests and groups variants by intent, encouraging decisions based on underlying intent rather than wrapper cues. WIFA supports two independent routes: WIFA-Boost prioritizes safety through two-stage training, while A-GCRT enforces consistent decisions across wrappers to mitigate over-refusal. Across three model families and two harmful training sources, both routes consistently improve safety while largely retaining capability. On Qwen--AdvBench, WIFA-Boost raises SB-avg5 from 22.1\% to 63.7\%, the best among compared methods; A-GCRT raises it to 46.7\% while reducing OR-Bench over-refusal from 25.7\% to 17.4\%, unlike reproduced defenses whose safety gains increase over-refusal. Across three AdvBench-trained backbones, both routes substantially reduce ASR on 15 unseen attack families and under model-adaptive GCG and RandomSearch. Overall, WIFA provides reusable intent-group supervision across models and training sources, supporting high safety through WIFA-Boost and substantial safety gains with less unnecessary refusal through A-GCRT.

Abstract:A common way to improve jailbreak robustness is to train on harmful requests rewritten as role-play, translation, or other forms. When used only for harmful requests, these forms may become refusal shortcuts, weakening unseen-attack robustness and increasing benign over-refusal. We propose Wrapper-Based Intent-Form Augmentation (WIFA), which applies shared wrapper families to harmful and benign requests and groups variants by intent, encouraging decisions based on underlying intent rather than wrapper cues. WIFA supports two independent routes: WIFA-Boost prioritizes safety through two-stage training, while A-GCRT enforces consistent decisions across wrappers to mitigate over-refusal. Across three model families and two harmful training sources, both routes consistently improve safety while largely retaining capability. On Qwen--AdvBench, WIFA-Boost raises SB-avg5 from 22.1\% to 63.7\%, the best among compared methods; A-GCRT raises it to 46.7\% while reducing OR-Bench over-refusal from 25.7\% to 17.4\%, unlike reproduced defenses whose safety gains increase over-refusal. Across three AdvBench-trained backbones, both routes substantially reduce ASR on 15 unseen attack families and under model-adaptive GCG and RandomSearch. Overall, WIFA provides reusable intent-group supervision across models and training sources, supporting high safety through WIFA-Boost and substantial safety gains with less unnecessary refusal through A-GCRT.

Computation and Language (cs.CL)

arXiv:2608.13304 [cs.CL]

(or arXiv:2608.13304v2 [cs.CL] for this version)

https://doi.org/10.48550/arXiv.2608.13304 Focus to learn more arXiv-issued DOI via DataCite

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.

aiqbench analysis

Refusing Intent, Not Form: Wrapper-Based Intent-Group Supervision for LLM Safety

Related coverage