New method trains LLMs to refuse intent, not prompt formatting tricks

WIFA targets a specific failure mode: models that learn to refuse based on cosmetic formatting cues rather than actual harmful intent. This is distinct from hallucination or confidence miscalibration. The framework uses intent-matched pairs (harmful wrapped + benign wrapped) to force the model to ground refusal decisions in semantic content, not surface patterns.

This connects directly to the August safety work on model uncertainty and alignment. The Gricean retreat paper showed that models possess internal signals to degrade gracefully when uncertain, yet fail to coordinate those signals in practice. WIFA addresses a parallel coordination failure: models can distinguish intent from form, but safety training doesn't enforce that distinction consistently. Similarly, the instruction tuning confidence paper revealed that alignment techniques can mask actual model limitations. WIFA's group-consistent refusal training is an attempt to make safety training more honest about what the model actually knows versus what it merely refuses to say.

If Qwen or other labs report that WIFA-trained models maintain refusal rates on intent-matched benign examples while improving performance on legitimately wrapped queries (e.g., academic research requests in obfuscated formats), the method has real teeth. If refusal rates collapse across both categories, the approach has merely shifted the problem rather than solved it.