BIID: Bidirectional Intention Inference Defense

• BIID is an external plug-and-play defense for LLMs that mitigates both single-turn and multi-turn jailbreak attacks by combining forward intention inference with backward response retrospection.
• It processes dialogue turn-by-turn using pre-generation screening and post-generation analysis to detect concealed harmful intent across multiple dialogue turns.
• Empirical evaluations show that BIID reduces attack success rates to near 0% while outperforming seven baseline methods and maintaining practical utility.

Searching arXiv for BIID and related intention-inference defense papers. arxiv_search(query="Bidirectional Intention Inference Defense BIID jailbreak", max_results=10) Bidirectional Intention Inference Defense (BIID) is an external, plug-and-play defense for LLMs that addresses jailbreak attacks by combining forward request-based intention inference with backward response-based intention retrospection. It was proposed to counter both single-turn and multi-turn jailbreaks, especially attacks in which malicious intent is concealed through semantic drift, obfuscation, or tactical manipulation across dialogue turns. In the reported evaluation, BIID was compared with a no-defense baseline and seven representative defense methods across three LLMs, two safety benchmarks, and 10 different attack methods; it significantly reduced Attack Success Rate (ASR) across both single-turn and multi-turn settings while effectively maintaining practical utility (Tong et al., 25 Sep 2025).

1. Threat model and problem formulation

BIID is motivated by the observation that most defense research has concentrated on single-turn jailbreaks, whereas multi-turn jailbreak attacks progressively break through safeguards by concealing malicious intent and exploiting accumulated dialogue context. In this setting, static prompt-based or single-step defenses are described as largely ineffective because they do not dynamically interpret user intent throughout a dialogue (Tong et al., 25 Sep 2025).

The underlying challenge is intention inference rather than only surface-level content filtering. A later study on Intent Shift Attack (ISA) sharpened this point by showing that minimal linguistic modifications—such as shifts in person, tense, voice, mood, or question form—can cause LLMs to misperceive harmful requests as benign knowledge-seeking inquiries. That work explicitly identifies intent inference as the core weakness and recommends a future Bidirectional Intention Inference Defense that combines input-based intent analysis with output-based harm assessment (Ding et al., 1 Nov 2025).

This positioning places BIID within a broader class of safety mechanisms that attempt to reason about why a request is being made and what a model is about to reveal, rather than relying exclusively on prompt syntax, refusal templates, or lexical indicators. A plausible implication is that BIID targets the failure mode exposed by multi-turn attacks and intent-shift attacks from complementary directions: latent user intent before generation and latent harmfulness after generation.

2. Formal architecture and dialogue-level operation

BIID models a dialogue turn by turn. At turn $i$, the user prompt is $P_i$, the dialogue history is

$$H_{i-1} = \{ P_{sys}, P_1, R_1, ..., P_{i-1}, R_{i-1} \},$$

and the model response is

$R_i = L(P_i, H_{i-1}).$

The attack goal is to induce a response $R_i$ that matches a harmful objective $G$, with jailbreak success defined as

$$J(R_i, G) = \begin{cases} 1, & \text{if } R_i \text{ satisfies } G \ 0, & \text{otherwise.} \end{cases}$$

For a defense $D$, the defended model output is written as

$R_i = D * L(P_i, H_{i-1}).$

These definitions make BIID a dialogue-level control mechanism rather than a one-shot classifier (Tong et al., 25 Sep 2025).

The defense itself has two phases:

Phase	Computation	Decision effect
Forward request-based intention inference	$I, d = L'(P_{pre}(P_i))$	If $P_i$0, the request is blocked and generation is aborted
Backward response-based intention inference	$P_i$1	If $P_i$2, harmful intent is identified and unsafe output is withheld or detected

In the forward phase, BIID applies a prompt template $P_i$3 to an external defense model $P_i$4 in order to extract latent intent $P_i$5 and a binary decision $P_i$6. A value of $P_i$7 means the prompt should be refused. In the backward phase, for responses not blocked in advance, BIID applies a retrospection template $P_i$8 to the generated response $P_i$9, again producing $$H_{i-1} = \{ P_{sys}, P_1, R_1, ..., P_{i-1}, R_{i-1} \},$$0 and $$H_{i-1} = \{ P_{sys}, P_1, R_1, ..., P_{i-1}, R_{i-1} \},$$1. This creates a dual-phase filtering pipeline in which pre-generation screening and post-generation retrospection are explicitly coupled (Tong et al., 25 Sep 2025).

The paper characterizes this arrangement as plug-and-play, context-sensitive, and scalable across models and dialogue lengths. Because BIID does not require fine-tuning or retraining, it is architecturally closer to an external guardrail than to intrinsic alignment modification (Tong et al., 25 Sep 2025).

3. Bidirectional synergy and intention inference

The defining property of BIID is the bidirectional synergy mechanism between request analysis and response retrospection. The forward check is intended to detect overt or weakly disguised adversarial intent before the target model answers. The backward check is intended to detect harmful responses that emerge from subtle, contextually obfuscated, or multi-step attacks that were not blocked initially (Tong et al., 25 Sep 2025).

The stagewise analysis reported for BIID distinguishes the functional contribution of the two phases. Forward inference is dominant for overt attacks and for attacks using aggressive suffixes or context build-up. Backward retrospection is crucial for role-playing and persona-based techniques that mimic legitimate intent in the prompt but reveal harmful intent in the response. The paper also reports residual “safe acceptances,” in which attacks dilute their aggression enough to evade detection yet still result in safe, non-harmful outputs (Tong et al., 25 Sep 2025).

This structure is notable because it reframes jailbreak defense from a unidirectional moderation task into a closed-loop inference process. The system does not only ask whether the current prompt looks unsafe; it also retrospectively asks whether the model’s own answer discloses a hidden harmful objective. That distinction is central in multi-turn settings, where malicious intent may only become legible after several benign-seeming exchanges.

A useful comparison comes from multimodal defense. AMIA for LVLMs introduces joint intention analysis in which the model explicitly produces both an intention analysis and a final response in a single forward pass,

$$H_{i-1} = \{ P_{sys}, P_1, R_1, ..., P_{i-1}, R_{i-1} \},$$2

after masking text-irrelevant image patches. Although AMIA targets image-text jailbreaks rather than text-only multi-turn attacks, it similarly treats explicit intention articulation as a mechanism for re-activating intrinsic safety behavior (Zhang et al., 30 May 2025). This suggests that intention inference is becoming a general defense primitive across modalities, while BIID specializes it to bidirectional, dialogue-aware filtering.

4. Experimental design and empirical results

BIID was evaluated on both single-turn and multi-turn benchmarks. The single-turn datasets were JailBreakBench and HarmBench, with HarmBench reported as $$H_{i-1} = \{ P_{sys}, P_1, R_1, ..., P_{i-1}, R_{i-1} \},$$3. The multi-turn datasets were MHJ (Multi-Turn Human Jailbreaks, DERTA subset $$H_{i-1} = \{ P_{sys}, P_1, R_1, ..., P_{i-1}, R_{i-1} \},$$4), SafeDialBench (balanced subset, $$H_{i-1} = \{ P_{sys}, P_1, R_1, ..., P_{i-1}, R_{i-1} \},$$5), and CoSafe (balanced subset, $$H_{i-1} = \{ P_{sys}, P_1, R_1, ..., P_{i-1}, R_{i-1} \},$$6). Utility was evaluated on AlpacaEval (Tong et al., 25 Sep 2025).

The attack set covered 10 different attack methods. For single-turn attacks, the paper lists AIM, BetterDAN, GCG, PAIR, ICA, RandomSearch, and tense rewriting (Future/Past). For multi-turn attacks, it lists Crescendo and ActorAttack. The baseline defenses were In-Context Defense (ICD), Paraphrase, RPO (Robust Prompt Optimization), SelfReminder, SelfDefense, SmoothLLM, and SemanticSmoothLLM. The target LLMs were Llama-3.1-8B-Instruct, Llama-3.3-70B-Instruct, and Qwen3-8B. Automated jailbreak success adjudication used GPT-4o-2024-11-20 with the PAIR method template as the judge model (Tong et al., 25 Sep 2025).

The principal empirical claim is that BIID reduces ASR to near- or exactly $$H_{i-1} = \{ P_{sys}, P_1, R_1, ..., P_{i-1}, R_{i-1} \},$$7 for both single-turn and multi-turn attacks across all tested LLMs, outperforming all baseline methods. On the three multi-turn safety datasets, comparative experiments further validate significant advantages over other defenses. For the hardest attacks, including ActorAttack multi-turn on Llama3-8B, the summary reports that all other defenses leave ASR approximately $$H_{i-1} = \{ P_{sys}, P_1, R_1, ..., P_{i-1}, R_{i-1} \},$$8, whereas BIID achieves approximately $$H_{i-1} = \{ P_{sys}, P_1, R_1, ..., P_{i-1}, R_{i-1} \},$$9 (Tong et al., 25 Sep 2025).

The utility evaluation indicates that BIID achieves the best trade-off between safety and general utility. Its AlpacaEval win rate is reported as comparable to, or just below, the no-defense baseline, whereas many competing defenses sacrifice utility for safety or vice versa (Tong et al., 25 Sep 2025). Within the scope of the reported experiments, BIID is therefore presented not merely as a stronger blocker but as a defense that maintains practical usefulness under deployment conditions.

5. Relation to jailbreak taxonomies, defenses, and mechanistic views of safety

BIID is best understood against the background of attacks and defenses that expose deficiencies in LLM intent processing. ISA shows that contemporary safety mechanisms can be bypassed by reframing a harmful request with minimal linguistic edits, without adding adversarial tokens or lengthy distracting context. It reports over $R_i = L(P_i, H_{i-1}).$0 improvement in attack success rate compared to direct harmful prompts, and notes that existing training-free and training-based defenses are inadequate against intent-shift obfuscation. The paper’s proposed future direction is explicitly a Bidirectional Intention Inference Defense combining input-based intent analysis and output-based harm assessment, with the goal of refusing only if both input and likely output indicate harm (Ding et al., 1 Nov 2025).

This places BIID in direct conceptual continuity with the diagnosis that harm detection based on surface linguistic markers is brittle. Whereas ISA demonstrates the failure mode, BIID provides an operational defense template for catching concealed malicious intent in conversational settings. The two works converge on the claim that more robust guardrails require deeper intent-aware analysis than prompt paraphrasing, self-reminders, or one-pass moderation (Tong et al., 25 Sep 2025).

A different but relevant perspective comes from mechanistic safety analysis. DBDI decomposes aligned refusal into a Harm Detection Direction and a Refusal Execution Direction, arguing that safety alignment is not a single linear feature but a pair of functionally distinct processes. Its ablations show that neither direction alone suffices for robust jailbreaks, and it suggests that defenses should monitor and harden both harm detection and refusal execution subspaces (Zhang et al., 10 Nov 2025). This suggests a mechanistic interpretation of BIID’s bidirectionality: forward intention inference is naturally aligned with harm detection, while backward retrospection can be viewed as an external check on whether refusal execution has failed or been bypassed.

The broader intellectual backdrop extends beyond LLMs. In cybersecurity games, ToM-augmented Instance-Based Learning has been used to model bidirectional intention inference in which both attackers and defenders form beliefs about the other’s intentions, actions, and hidden state, enabling transfer of learning across roles (Malloy et al., 2023). That work does not define BIID as an LLM defense, but it provides an antecedent for the idea that defense quality improves when intention modelling is explicitly reciprocal rather than unilateral.

6. Limitations, trade-offs, and future research directions

The reported limitations of BIID are tied to its external inference architecture. First, the method depends on the external inference model $R_i = L(P_i, H_{i-1}).$1. If attackers learn or adapt to the intention inference prompts or templates, new bypass techniques might emerge. Second, dual-phase inference increases latency, which may be significant in high-traffic systems. Third, as with external filtering generally, false positives remain possible, although the utility evaluation is reported to suggest that this is minimal (Tong et al., 25 Sep 2025).

The main future directions proposed for BIID emphasize adaptation across time and context. These include intention inference that adapts over the course of interactions, possibly through user profiles or adaptive filters matched to ongoing dialogue context; endowing LLMs with inherent, learnable Theory of Mind; and using intention inference not only for blocking harm but also for improving alignment and usefulness in ambiguous or sensitive scenarios (Tong et al., 25 Sep 2025).

Related work reinforces these priorities. ISA argues for more robust intent-aware training, context-aware analysis beyond prompt surface form, and semi-automated risk annotation (Ding et al., 1 Nov 2025). AMIA shows that explicit intention analysis can be integrated into a single-pass multimodal defense without retraining, while maintaining a strong safety-utility trade-off in LVLMs (Zhang et al., 30 May 2025). A plausible implication is that future BIID variants may combine external bidirectional screening with internal intent-aware supervision, or extend from text-only dialogue to multimodal and mechanistically monitored systems.

In the current literature, BIID therefore occupies a specific and technically consequential niche: it is a dialogue-aware jailbreak defense that treats intention inference as a two-sided process, using both what the user asks and what the model is about to disclose—or has disclosed—to detect hidden harmful goals more robustly than conventional single-turn guardrails (Tong et al., 25 Sep 2025).