Intent Laundering: AI Safety Datasets Are Not What They Seem

1. Problem Statement

The paper addresses a critical flaw in the current ecosystem of AI safety evaluation: widely used adversarial safety datasets (specifically AdvBench and HarmBench) do not faithfully represent real-world adversarial behavior.

The authors argue that these datasets rely heavily on "triggering cues"—overt words or phrases with negative/sensitive connotations (e.g., "commit suicide," "without getting caught," "steal sensitive information"). These cues are designed to explicitly trigger safety refusal mechanisms rather than simulating the subtle, well-crafted, and ulterior-intent-driven attacks used by real-world adversaries. Consequently, current safety evaluations may produce optimistic bias, falsely labeling models as "safe" because they successfully refuse obvious, trigger-heavy prompts, while failing to detect malicious intent when those triggers are removed.

2. Methodology

The study employs a three-pronged approach: Isolation Analysis, Intent Laundering, and Iterative Jailbreaking.

A. Isolation Analysis (Dataset Quality Check)

Before testing models, the authors analyzed the datasets themselves to determine if they reflect real-world attacks based on three defining properties:

1. Ulterior Intent: Attacks should conceal harm behind benign requests.
2. Well-crafted: Attacks should be carefully designed to bypass filters.
3. Out-of-distribution: Attacks should differ significantly from standard user prompts.

• N-gram Word Clouds: The authors generated word clouds for unigrams, bigrams, and trigrams from AdvBench and HarmBench. They found an unnatural overrepresentation of "triggering cues" (inherent negative words like "steal" and contextual phrases like "without getting caught").
• Data Duplication Analysis: Using Sentence-BERT embeddings, they calculated pairwise similarity. They found that >45% of AdvBench data points were near-identical at a 0.95 similarity threshold, and >11% were exact copies at 0.99. This high duplication rate undermines the "out-of-distribution" property, suggesting the datasets evaluate the same few intents repeatedly.

B. Intent Laundering (The Core Procedure)

To test if models are truly safe or just sensitive to triggers, the authors introduced Intent Laundering. This is a procedure that abstracts away overt triggering cues while strictly preserving the malicious intent and all relevant details. It consists of two components:

1. Connotation Neutralization: Replacing triggering words with neutral or positive alternatives (e.g., changing "steal" to "acquire" or "transfer").
2. Context Transposition: Mapping real-world sensitive referents (e.g., "immigrants," "charities") to non-real-world contexts (e.g., fictional game worlds or narratives) while keeping the operational logic identical.

This process is automated using an Intent Launderer (an LLM with few-shot In-Context Learning) trained on manually crafted examples.

C. Evaluation Framework

The authors evaluated 10 diverse models (including frontier models like Gemini 3 Pro, Claude Sonnet 3.7/4, and GPT-4o) on three datasets: AdvBench, HarmBench, and StrongREJECT.

• Metrics:
  • Safety Evaluation (SE): Rated on a 5-point Likert scale (Extremely Unsafe to Safe).
  • Practicality Evaluation (PE): Rated on a 5-point scale regarding real-world applicability.
  • Attack Success Rate (ASR): Defined as the percentage of responses that are both Unsafe (SE) and Practical (PE).
• Experimental Settings:
  1. No Revision: Original prompts (with triggers).
  2. First Revision: Single pass of Intent Laundering (triggers removed).
  3. Iterative Revision: Using Intent Laundering as a jailbreaking technique with a revision–regeneration loop. If a revision fails, the system uses the failed attempts as feedback to generate an improved revision.

3. Key Contributions

1. Empirical Evidence of Dataset Flaws: Demonstrated that major safety datasets rely on unrealistic triggering cues and suffer from high data duplication, failing to capture the "well-crafted" and "ulterior intent" nature of real attacks.
2. Introduction of Intent Laundering: A novel procedure that empirically verifies that removing triggers causes a massive spike in attack success rates, proving that current "safety" is often just "trigger sensitivity."
3. A New Jailbreaking Technique: Adapted Intent Laundering into a standalone, fully black-box jailbreaking method that achieves near-perfect success rates across all tested models.
4. Generalization: Showed that the findings and the Intent Laundering technique generalize to datasets outside the original design (e.g., StrongREJECT), indicating a systemic weakness in safety alignment.
5. Gap Identification: Highlighted a critical disconnect between how models are evaluated (via public datasets) and how they behave against real-world adversaries.

4. Key Results

The results reveal a stark contrast between "triggered" safety and "intent-based" safety:

• Explosion of Attack Success Rates (ASR):

  • AdvBench: ASR jumped from a mean of 3.86% (original) to 87.54% (after first intent laundering).
  • HarmBench: ASR jumped from 10.55% to 79.10%.
  • StrongREJECT: ASR jumped from 3.54% to 88.06%.
  • Implication: Models previously rated as "reasonably safe" are actually highly vulnerable when triggers are removed.

• Iterative Jailbreaking Performance:

  • When Intent Laundering was used with a revision-regeneration loop, the ASR reached 90.00% to 100.00% across all 10 models within just a few iterations.
  • This included models known for strong safety alignment, such as Gemini 3 Pro and Claude Sonnet 3.7/4.

• Practicality:

  • Despite the abstraction (neutralization and context transposition), the model responses remained highly practical. The mean Practicality Evaluation (PE) scores ranged from 98.08% to 100.00%, confirming that the laundered attacks provided actionable, real-world harmful instructions.

• Internal vs. External Consistency:

  • The paper notes that internal safety evaluations by model developers (e.g., Anthropic, Google) often conclude these models are safe. However, the authors' external evaluation using Intent Laundering contradicts this, suggesting that internal evaluations likely suffer from the same over-reliance on triggering cues found in public datasets.

5. Significance and Conclusion

The paper fundamentally challenges the validity of the current AI safety evaluation paradigm.

• Safety Illusion: The "safety" demonstrated by frontier models in standard benchmarks is largely an artifact of their ability to detect specific, overt keywords rather than a robust understanding of malicious intent.
• Systemic Vulnerability: The reliance on triggering cues in dataset design means that safety alignment techniques trained on these datasets are inheriting a weakness: they are brittle against attacks that disguise intent through linguistic abstraction.
• Call to Action: The authors conclude that safety evaluations must evolve to capture adversarial behavior more realistically (focusing on intent rather than keywords) and that current safety alignment efforts are not yet robust against real-world threats.

The study suggests that without addressing the "intent laundering" vulnerability, the deployment of AI systems in high-stakes environments remains risky, as current benchmarks provide a false sense of security.