Refusing Intent, Not Form: Wrapper-Based Intent-Group Supervision for LLM Safety

2026-08-13

AI Summary

This work addresses the vulnerability of large language models to surface-form perturbations in safety alignment, which often leads to harmful requests being erroneously approved while harmless ones are incorrectly rejected. To mitigate this issue, the authors propose WIFA, an automatic intent-grouping data augmentation method that requires no external teacher models or human annotations. WIFA constructs pairs of structurally similar but semantically opposite samples to disentangle surface form from underlying intent. Combined with a two-stage fine-tuning strategy (WIFA-Boost) and Anchor-group Consistency-based Rejection Training (A-GCRT), the approach significantly enhances the model’s ability to discern true user intent. Experiments on Qwen demonstrate that WIFA-Boost effectively improves rejection of adversarially reformulated harmful queries, while A-GCRT reduces over-rejection on OR-Bench from 25.7% to 17.4%, outperforming existing baselines.

Abstract

Safety tuning can improve harmful refusal, but models may learn surface-form shortcuts: wrapped harmful prompts bypass safety, while similarly wrapped benign prompts are over-refused. We propose Wrapper-Based Intent-Form Augmentation (WIFA), an automatic intent-group augmentation method that pairs wrapped harmful examples with structurally matched wrapped benign counterexamples, requiring no external teacher or manual per-wrapper intent labels. We use WIFA as a common data layer for two complementary fine-tuning routes: WIFA-Boost, a two-stage high-safety recipe, and Anchored Group-Consistent Refusal Training (A-GCRT), which regularizes refusal/compliance decision scores across same-intent wrappers and anchors harmful and benign groups on opposite sides of a margin. In the Qwen setting, WIFA-Boost reaches the strongest transformed-harmful refusal, while A-GCRT reduces OR-Bench over-refusal from 25.7\% for the base model to 17.4\%; reproduced baselines do not match these operating points. Llama results and ablations over data structure, two-stage order, and A-GCRT components support this intent-group interpretation without claiming universal below-base over-refusal.

Problem

• harmful refusal
• surface-form shortcuts
• wrapper-based prompts
• over-refusal
• intent-group supervision

Innovation

• Wrapper-Based Intent-Form Augmentation
• Intent-Group Supervision
• Refusal Consistency
• Safety Tuning
• Over-Refusal Reduction