Training target models for intent-consistent safety under surface variation

Determine how to train the target language model itself so that surface variants expressing the same underlying intent receive consistent, directionally separated refusal or compliance decisions.

Background

The paper distinguishes training-time methods that modify model parameters from prompt-time defenses, external safety systems, and broader group-robustness approaches. Although these existing approaches motivate intent-aware and robustness-oriented safety training, the paper identifies an unresolved methodological question: how to train the target LLM itself to avoid treating surface wrappers as safety labels and instead produce consistent decisions for prompts sharing an underlying intent.

The proposed WIFA framework and its WIFA-Boost and A-GCRT training routes are presented as responses to this gap, but the cited sentence explicitly frames the general problem as still unresolved rather than claiming that all possible solutions have been established. The open problem concerns achieving both within-intent consistency across surface forms and directional separation between harmful and benign intent groups.

References

These approaches motivate intent-aware and robustness-oriented safety training, but leave open how to train the target model itself so that same-intent surface variants receive consistent, directionally separated refusal/compliance decisions.

— Refusing Intent, Not Form: Wrapper-Based Intent-Group Supervision for LLM Safety  (2608.13304 - Wu et al., 13 Aug 2026) in Section 2, paragraph 'Prompt-time defenses, group robustness, and external safety systems'

Finally, developing unlearning methods that explicitly optimize for contextual separation, rather than treating forgetting and retention independently, remains a key open challenge.

— ConceptGuard: Benchmarking Context-Sensitive Unlearning in Large Language Models  (2608.20338 - Kale et al., 20 Aug 2026) in Section Conclusion and Future Work