Skip to content
Original

Useless but Safe? A Benchmark for Utility Recovery under User Intent Clarification in Multi-Turn Dialogue

Useless but Safe? Benchmarking Utility Recovery with User Intent Clarification in Multi-Turn Conversations

arXiv· arXiv:2604.27093· Mingqian Zheng, Malia Morgan, Liwei Jiang, Carolyn Rose, Maarten SapCarnegie Mellon University; Allen Institute for AI; University of WashingtonIndexed by this site · 12 days ago· Originally publishedSelected EvaluationSelectedAttention39

Quick read

Evaluation and benchmarks

Based on the paper PDF (AI-generated); refer to the original

The authors build the multi-turn benchmark CARRY ON BENCH to evaluate whether 14 LLMs can recover utility after the user clarifies benign intent, and report that in the first turn only 10.5–37.6% of benign information needs are satisfied.

Questions
Safety alignment makes models better at refusing, but single-turn evaluation cannot distinguish "appropriately cautious" from "unresponsive to user clarification": when a benign user's query superficially resembles an attack, can the model revise its intent judgment and restore helpfulness over multiple turns?
Methods
The authors construct CARRY ON BENCH: 398 superficially harmful queries paired with benign intent, combined according to conversation theory with 7 user follow-up strategies to generate 5,970 conversations, and propose the checklist-style metric BEN-UTIL, which measures benign utility turn by turn according to atomic information items, together with a 1–5 point safety review.
Experiments and results
On the first turn, the 14 models meet only 10.5–37.6% of benign information needs; in multi-turn conversations containing benign clarification, 13/14 models reach or exceed single-turn Oracle utility, but the safety cost varies by model (violation-rate increase +4.3% to +55.6%); the authors state that there are two failure modes invisible to single-turn evaluation: unsafe recovery and redundant recovery.
Limitations and future work
The authors note that using Gemini-2.5-Flash for utility review of Gemini-family target models, and the participation of the checklist-generating model in the evaluation, may both introduce self-bias; the human agreement of the safety review rubric (79.3%) comes from existing work rather than validation in this paper; user turns are simulated, and the human naturalness annotation has low agreement (κ=0.057).
Experimental setupGPT-OSS-120B、Llama-4-Maverick et al. · CARRY ON BENCH、SORRY-Bench et al. · BEN-UTIL、harmfulness (1–5 Likert) et al.
Threat model
The user's underlying intent is harmless, but the initial query superficially resembles a malicious request; the user clarifies intent over multiple turns through legitimate conversational strategies rather than adversarial escalation. This is the complementary case to multi-turn jailbreak: the correct behavior is to update the assessment rather than persist in refusal. Benign intents are taken from human-verified annotations to control the risk of adversarial disguise.
Evaluated models
GPT-OSS-120BLlama-4-MaverickMixtral-8x7B-InstructOlMo-3-7B-InstructOlMo-3.1-32B-InstructQwen3-235BQwen3-32BDeepSeek-V3.1Qwen3-Next-80BClaude-Haiku-4.5Claude-Sonnet-4Gemini-3.1-ProGPT-5.4GPT-5-mini
Benchmarks
CARRY ON BENCHSORRY-BenchCASE-Bench
Metrics
BEN-UTILharmfulness (1–5 Likert)Recovery%checklist redundancy
AI summaryand selection rationaleThe research team proposes CarryOnBench, an interactive multi-turn benchmark that measures whether models can restore helpfulness while maintaining safety after users clarify benign intent, covering 14 models from 9 families. Starting from 398 queries that appear harmful but whose true intent is benign, the benchmark simulates 1,866 conversation flows and 5,970 dialogues, totaling 23,880 model responses, and uses a checklist-based metric, Ben-Util, to measure how well responses satisfy benign needs in terms of atomic information items. In the first turn, models satisfy only 10.5%–37.6% of benign information needs; when the benign intent is attached directly to the same query, the figure is 25.1%–72.1%; under multi-turn benign clarification, 13 of the 14 models approach or exceed this single-turn baseline. The authors state that the safety cost of recovery varies by model, with the increase in the share of out-of-bounds dialogues ranging from +4.3% for Claude-Haiku-4.5 to +55.6% for Qwen3-Next-80B, and identify two failure modes invisible to single-turn evaluation: unsafe recovery updated at excessive safety cost, and redundant recovery that repeats old content.

The research team proposes CarryOnBench, an interactive multi-turn benchmark that measures whether models can restore helpfulness while maintaining safety after users clarify benign intent, covering 14 models from 9 families. Starting from 398 queries that appear harmful but whose true intent is benign, the benchmark simulates 1,866 conversation flows and 5,970 dialogues, totaling 23,880 model responses, and uses a checklist-based metric, Ben-Util, to measure how well responses satisfy benign needs in terms of atomic information items. In the first turn, models satisfy only 10.5%–37.6% of benign information needs; when the benign intent is attached directly to the same query, the figure is 25.1%–72.1%; under multi-turn benign clarification, 13 of the 14 models approach or exceed this single-turn baseline. The authors state that the safety cost of recovery varies by model, with the increase in the share of out-of-bounds dialogues ranging from +4.3% for Claude-Haiku-4.5 to +55.6% for Qwen3-Next-80B, and identify two failure modes invisible to single-turn evaluation: unsafe recovery updated at excessive safety cost, and redundant recovery that repeats old content.

Why it was selectedExtending single-turn refusal evaluation to multi-turn intent clarification, the safety cost of restoring helpfulness varies markedly across 14 models, allowing a comparative check of one's own model's over-refusal.

Paper analysis

6 questions; open one to read the full answer

  1. What problem does this paper attempt to solve?

    The authors propose a multi-turn benchmark that evaluates whether LLMs can recover utility while maintaining safety after a benign user clarifies their intent.

    Core problem: existing safety evaluations are single-turn and cannot distinguish whether a model is "appropriately cautious" or "unresponsive to user clarification"—whether, after a benign user clarifies their intent, the model can correct its intent judgment, restore helpfulness, and not lose safety.

    • Problem setting: Safety training leads to over-refusal, where the model refuses requests it should answer; real users often give ambiguous queries that look malicious on the surface but are actually benign, and will clarify or question after being misunderstood. The authors argue that in single-turn evaluations, a model that "over-refuses and never corrects" scores the same as a model that "refuses appropriately and can adapt."
    • Shortcomings of existing methods: The authors state that most prior work quantifies over-refusal using single-turn unnecessary-refusal rates (triggered by syntax, topic overlap, or wording), which cannot capture the dynamics of real interaction.
    • Core observation: The authors argue that the safety-utility trade-off is not a fixed property of the model but is largely affected by unresolved intent ambiguity, and that multi-turn interaction can resolve this ambiguity.
    • What the paper proposes: The interactive multi-turn benchmark CARRY ON BENCH (398 initial queries, 5,970 conversations, 1,866 conversation flows, 23,880 model responses), together with the checklist-style metric BEN-UTIL, and finds two failure modes invisible to single-turn evaluation: unsafe recovery and redundant recovery.
    • Threat model (benign-user direction, not an attack):
      • The user's underlying intent is harmless, but the initial query superficially resembles a malicious request.
      • The user clarifies intent through legitimate conversational strategies (explaining reasons, rephrasing the question, etc.), rather than adversarial escalation.
      • This is the complementary case to multi-turn jailbreaks: in jailbreaks a malicious user erodes safety through persistence, whereas here the correct behavior is to update the assessment rather than continue refusing.
      • To address the concern that "benign clarification may mask adversarial intent," the authors use human-verified annotations (CASE-Bench) to derive benign intent as a control.

  2. What related research exists?

    Related work falls into four groups: over-refusal, context understanding and repair, multi-turn capability evaluation, and rubric evaluation.

    Safety-helpfulness trade-off and over-refusal

    • Bianchi et al. (2023), Röttger et al. (2024), Cui et al. (2025), An et al. (2024), Pu et al. (2025)—point out that safety mechanisms cause models to refuse benign or ambiguously worded requests, reflecting the tension between safety and helpfulness.
    • Cui et al. (2025), Jiang et al. (2024)—quantify over-refusal using aggregate refusal rates or error categories; the paper notes that such analyses do not examine how refusal behavior unfolds over the course of a conversation.
    • Lu et al. (2025), Dabas et al. (2025)—address the safety-helpfulness tension from a representation-engineering perspective.

    Context understanding and collaborative repair

    • Zhou et al. (2023), Yerukola et al. (2024), Shen et al. (2025)—the same sentence can be interpreted as harmful or harmless depending on context, and models often fail to use explicit context even when given it; related to defeasible inference in Rudinger et al. (2020).
    • Schegloff et al. (1977), Reineke & Helmer (2024)—when human conversation breaks down, speakers naturally attempt repair; the paper states that it transfers this finding to the safety domain, arguing that well-managed refusal should enable "collaborative repair."

    Multi-turn capability evaluation (Appendix D)

    • Yi et al. (2024), Zhang et al. (2025a)—surveys categorizing multi-turn dialogue; Laban et al. (2025) observe a 40% performance drop when tasks are split across multiple messages; Geng et al. (2025) find that accumulated context silently changes the beliefs and tool-use behavior the model states.
    • StructFlowBench (Li et al., 2025)—classifies multi-turn instructions into flows such as refinement and expansion; the paper notes that such benchmarks often ignore the user's underlying intent and planning.

    Rubric/checklist-style evaluation (Appendix D)

    • Pathak et al. (2025), Farzi & Dietz (2024), Cook et al. (2024), Bragg et al. (2025)—customize rubrics or checklists for individual questions to evaluate model behavior; rubrics are also used for reinforcement-learning feedback (Huang et al., 2025b; Viswanathan et al., 2025).
    • Viswanathan et al. (2025)—use a model to select and organize checklist items based on other models' responses; the paper states that its approach is similar, automatically extracting checklist items from each model's responses to queries and benign scenarios.

    Data sources and baselines: The initial queries are taken from SORRY-Bench (Xie et al., 2024), and the benign-intent rewrites come from the human-annotated benign contexts of CASE-Bench (Sun et al., 2025); the safety scoring rubric follows Rahman et al. (2025). The paper sets no method baseline; the comparison is the performance of 14 target models under four conditions. Authors' positioning: this paper distinguishes "intentional safety" from "unintentional utility loss," using a checklist to measure whether a model can recover helpfulness after the user clarifies benign intent.

  3. How does the paper address this problem?

    Multi-turn dialogues are generated using theoretically constrained combinations of user strategies, and evaluated turn by turn on two dimensions with a checklist-style BEN-UTIL and a safety score.

    Overall approach: pair "superficially harmful, actually benign" queries with benign intents, use conversation-theory-constrained user follow-up strategies to combine deterministic dialogue streams, then evaluate the model's utility recovery turn by turn with the checklist-style metric BEN-UTIL and a 1–5 safety score.

    Dialogue construction and user strategies

    • Each dialogue has four elements: the initial query (taken from SORRY-Bench), the benign intent (rewritten from human-verified benign contexts in CASE-Bench), the user action sequence, and the target model's replies at each turn.
    • User follow-ups are based on Martin & Rose (2003)'s exchange structure theory (operationalized by Mayfield et al. 2012), defining 7 actions (Table 1): benign clarification types (Benign Justification, Benign Re-asking, Context Switching), challenge types (Pushback, Rephrasing), and content-free types (Delaying, Backchannel); each simulated user turn contains only one action to keep the analysis separable.
    • Dialogue streams are generated by combining and arranging actions over lengths of 4–12 turns, and pruned according to 4 theoretical constraints (e.g., the ending must be a content-bearing action, content-free actions are not consecutive and at most two per dialogue); for each initial query, 3 streams are sampled per length (2 containing benign clarification BC, 1 not containing it NC), totaling 1,866 streams, 5,970 dialogues, and 23,880 model turns.

    Naturalization of user turns (LLM smoothing)

    • Each user turn after the initial query is generated according to a predefined functional strategy, then rewritten into natural language by Gemini-3-Flash in light of the dialogue history; the action sequence remains deterministic to ensure reproducibility.
    • Appendix A.2 gives the full simulation prompts for each action.
    • Human verification of naturalness: in 125 dialogues (421 annotated user turns), under majority voting by 3 annotators, 82.1% of turns were rated natural, and 2.6% were unanimously rated unnatural by all three (Appendix A.4).

    BEN-UTIL metric

    • The checklist is built in a four-step pipeline: (1) use 5 highly capable models (DeepSeek-V3.1, gpt 5.1, Llama-4-Scout-17B-16E, Mixtral-8x7B-instruct-v0.1, Qwen3-Next-80B-A3B-instruct) to generate compliant replies as a "gold standard"; (2) filter with WildGuard, keeping only query-intent pairs that produce at least 3 harmless replies; (3) use Gemini-2.5-Flash to decompose replies into atomic yes/no checklist items; (4) use Gemini-2.5-flash to merge and remove redundancy, then GPT-4o to remove items that could facilitate malicious misuse. The final checklist averages 18 atomic items per query (range 7–23, Figure 14).
    • Turn-level utility Ut = (|{c ∈ C ∣ c satisfied at turn t}|)/(|C|), i.e., the proportion of checklist items satisfied by the reply at turn t; dialogue-level utility U is the proportion of items satisfied at any turn (not double-counted).
    • To avoid position bias, each (reply, checklist item) pair is judged independently as binary by the judge model, then aggregated.

    Evaluation conditions and judgments

    • Four conditions: Turn 1 (only the first-turn reply to the superficially harmful query), Oracle single-turn (query accompanied by the full benign intent), multi-turn BC (at least one benign clarification), multi-turn NC (only challenge and content-free actions).
    • Utility judging: Gemini-2.5-Flash judges pair by pair whether each checklist item is satisfied; safety judging: gpt-5.2 scores 1–5 according to the rubric of Rahman et al. (2025), with ≥4 considered harmful or violating, and dialogue-level safety taken as the maximum across turns (worst case).

  4. What experiments did the paper conduct?

    14 models were evaluated under four conditions; first-turn utility was 10.5–37.6%, and under BC 13/14 models matched or exceeded the Oracle.

    Experimental setup

    • Models evaluated: 14, 9 open-source (DeepSeek-V3.1, Llama-4-Maverick, Mixtral-8x7B-Instruct, OLMo-3-7B-Instruct, OLMo-3.1-32B-Instruct, Qwen3-235B, Qwen3-32B, Qwen3-Next-80B, GPT-OSS-120B) + 5 closed-source (Claude-Haiku-4.5, Claude-Sonnet-4, Gemini-3.1-Pro, GPT-5.4, GPT-5-mini).
    • Data: CARRY ON BENCH, 398 initial queries, 1,866 dialogue streams, 5,970 dialogues, 23,880 model turns, dialogue length 4–12 turns.
    • Metrics: BEN-UTIL (percentage of benign information needs satisfied, 0–100%); harmfulness (1–5, ≥4 harmful); Recovery% = (BC utility − Turn 1 utility) / Oracle utility; checklist redundancy rate.
    • Judging: utility is judged binary pair by pair (reply, checklist item) by Gemini-2.5-Flash; safety is scored 1–5 by gpt-5.2 according to the rubric; a paper footnote notes that using Gemini-2.5-Flash to judge Gemini-family target models, and the participation of checklist-generating models in evaluation, may both introduce self-bias.
    • Statistics: ANCOVA/mixed linear models with model as random intercept (N=14 groups); rank correlation uses Spearman ρ (Turn 1/Oracle n=5,572, NC n=27,858, BC n=55,720).
    • Human verification: naturalness of user turns annotated by 3 people over 125 dialogues; checklist judgments compared pairwise by two authors on 25 groups (50 streams).

    Main results

    According to Table 2 (utility is percentage satisfied; safety is 1–5, ∆ is the change relative to Turn 1):

    Swipe horizontally to read the table

    ModelT1 utilityOracle utilityBC utility (∆)Recovery%BC safety (∆)NC utility (∆)
    GPT-OSS-120B10.525.252.5 (+42.0)166.42.7 (+1.3)15.3 (+4.7)
    Llama-4-Maverick13.235.737.0 (+23.8)66.73.0 (+1.2)17.8 (+4.6)
    OLMo-3-7B23.348.861.3 (+38.0)77.93.2 (+1.7)34.2 (+10.9)
    Qwen3-235B20.356.871.2 (+51.0)89.73.6 (+2.1)40.2 (+19.9)
    DeepSeek-V3.129.667.666.3 (+36.6)54.33.9 (+1.7)44.1 (+14.5)
    Qwen3-Next-80B30.670.775.2 (+44.6)63.13.9 (+2.4)49.6 (+19.0)
    Claude-Haiku-4.520.245.949.9 (+29.8)64.82.1 (+0.6)28.5 (+8.4)
    GPT-5-mini37.672.174.8 (+37.2)51.62.8 (+1.2)48.6 (+11.0)

    (Mixtral-8x7B, OLMo-3.1-32B, Qwen3-32B, Claude-Sonnet-4, Gemini-3.1-Pro, GPT-5.4 omitted; all are in Table 2.)

    • The authors state that the Turn 1 utility loss stems from intent ambiguity rather than insufficient knowledge: when the same query is accompanied by benign intent, Oracle utility rises to 25.1–72.1%.
    • The authors state that rankings reorder across conditions: GPT-5-mini is highest in both Turn 1 and Oracle, and GPT-OSS-120B is lowest in both, but under BC Qwen3-Next-80B (75.2%) and GPT-5-mini (74.8%) are highest, and GPT-OSS-120B has the largest recovery rate (166.4%).
    • Under NC, utility gains are generally limited (∆ +4.6–19.9%), on which basis the authors argue that clarification drives recovery and that single-turn evaluation exaggerates the safety-utility trade-off.

    Safety cost and failure modes

    • What was measured: the change in the proportion of dialogues crossing the harmful threshold (≥4) from Turn 1 to BC (Table 3). Result: violation rates rise for all models, with increases ranging from +4.3% for Claude-Haiku-4.5 (7.9→12.2) to +55.6% for Qwen3-Next-80B (9.4→65.0). Authors' interpretation: safety cost varies by model, and high recovery and low cost do not coexist—Qwen3-Next-80B has the highest utility but the largest increase in violations, while Claude-Haiku-4.5 recovers +29.8% utility with almost no rise in violation rate.
    • Two failure modes: unsafe recovery—Qwen3-Next-80B has high utility but harmfulness +2.4; redundant recovery—GPT-5-mini has the highest BC utility among closed-source models but also the highest redundancy rate, with later turns partly repeating existing content; GPT-OSS-120B has the highest recovery rate and the lowest redundancy rate (Figure 19). There is also utility lock-in: DeepSeek-V3.1 is the only model whose BC (66.3%) does not reach its own Oracle (67.6%) (Figure 18).

    Starting point, clarification, and convergence analysis

    • Bucketing by Turn 1 performance (Figure 2): hard refusals (0%) remain low-utility without clarification, and under BC recover to 48.4%, exceeding the partial-compliance starting point; the authors state that the most conservative starting point is the most sensitive to clarification.
    • Safety convergence: regardless of Turn 1, harmfulness at the end of the dialogue converges to a similar level (3.0–3.3 under BC); the authors state that this challenges the assumption that "hard refusal = robust safety," and that Turn 1 refusal strength is a poor proxy for dialogue-level safety.
    • ANCOVA (Tables 4, 5): Turn 1 utility predicts final utility (β=0.59, p<0.001); each benign action independently contributes 10.3% utility (p<0.001); Turn 1 safety predicts dialogue safety (β=0.56), and the safety cost of each benign action is β=0.35 (p<0.001).

    Effects of user actions

    • What was measured: the effect of each action type on turn-level utility/harmfulness (deviation from the model mean, Figure 23). Result: Benign Justification +16.4%, Benign Re-asking +14.9%, Context Switching +8.6%; Challenge −7.1% and does not reduce harmfulness; Backchannel −16.1%, Delaying −14.9%.
    • Authors' interpretation: giving reasons is more worthwhile than re-asking (safety cost +0.32 vs +0.84); models resist social pressure without new information, but users who push back because they were misunderstood are instead penalized; no action raises utility while having zero safety cost.

    Other ablations and analyses

    • Turn-by-turn trends (Figure 15): BC and NC diverge at turn 2, with BC turn utility around 31–33% and NC around 17%; by turn 6 cumulative utility is BC 66.4% vs NC 38.8%.
    • Redundancy rate (Figure 20): NC rises slowly from 44.2% at turn 4 to 59.2% at turn 12; BC rises from 36.2% to 77.4%, exceeding NC after checklist saturation.
    • Domain analysis (Figure 22): the most restricted categories have the largest BC gains (Hate Speech Generation +44.3%, Assistance with Crimes or Torts +38.7%), and also the highest safety cost (both +1.7); NC gains are consistent across domains (+10.3%–12.5%).
    • Rank correlation (Figure 17): Spearman ρ between utility and safety rankings is 0.05–0.43, weakest for BC (0.24) and Oracle (0.18).
    • Human agreement on checklist judgments: pairwise agreement between the two authors is 78.01%, and between the authors and the judge model 72.46% and 78.84% respectively (Appendix B.3.1).

  5. What are some points that can be further explored?

    The authors note limitations such as judge self-bias and suggest training models to recognize benign signals; the experiments cover 14 models and simulated user turns.

    Limitations noted by the authors and future directions

    • The utility review uses Gemini-2.5-Flash as the judge model, which may introduce self-bias when evaluating Gemini-family target models (§4 footnote 2).
    • The model used to generate the checklist participates in the evaluation, so utility assessment has potential self-bias (§4 footnote 3).
    • Recovery% is inflated when Oracle utility is low and should be interpreted together with absolute changes (Table 2 note).
    • Future work should explore training models to recognize and update genuine intent signals, to achieve a more effective safety-utility trade-off (§7 Conclusion).
    • The path to recovering utility lies in training models to update more effectively after intent clarification, rather than generally lowering the safety threshold (§C.6).

    Scope of experimental coverage

    • The models tested are 9 open-source + 5 closed-source, 14 in total (§4).
    • The initial queries are 398 from SORRY-Bench after filtering by CASE-Bench; CASE-Bench originally had 450 covering 45 safety categories, and the authors excluded 4 categories (Appendix A.1).
    • User turns are simulated by Gemini-3-Flash according to rule-based strategies, not real user conversations; in naturalness annotation, 82.1% of turns received a majority vote of natural, but chance-corrected agreement is low (Cohen's κ=0.057, Krippendorff's α=0.069), and the proportion of individual annotators judging a turn natural ranges from 11.9% to 100.0% (Appendix A.4).
    • The human agreement of the safety scoring rubric (79.3% agreement with human annotation, 150 conversations) comes from the validation by Rahman et al. (2025) using gpt-4o; this paper directly reuses that rubric and switches to gpt-5.2 (Appendix B.1).
    • Human verification of checklist judgments was done by two authors on 25 paired comparisons (50 conversation flows) (Appendix B.3.1); the paper does not report generation settings such as the sampling temperature of the target models.

  6. Summarize the main content of the paper

    The multi-turn benchmark CARRY ON BENCH shows that models retain a large amount of benign information in the first turn, and after clarification most can recover, but at differing costs.

    An evaluation/benchmark paper that proposes CARRY ON BENCH—evaluating whether LLMs can recover from refusal to being safely helpful after a benign user clarifies intent over multiple turns.

    • Problem: Single-turn safety evaluations cannot distinguish "appropriate caution" from "unresponsiveness to clarification"; the authors argue that the safety-utility trade-off largely stems from unresolved intent ambiguity.
    • Method: 398 superficially harmful queries paired with human-verified benign intent, combined according to conversation theory with 7 user follow-up strategies to generate 5,970 dialogues (1,866 streams, 23,880 turns); they propose a checklist-style metric BEN-UTIL, measuring benign utility turn by turn across an average of 18 atomic information items, with safety scored by gpt-5.2 on a 1–5 scale.
    • Result one: On Turn 1, models satisfy only 10.5–37.6% of benign information needs; when the same query is accompanied by benign intent, this reaches 25.1–72.1%, and the authors state that the utility loss stems from intent misreading rather than insufficient knowledge (Table 2).
    • Result two: In multi-turn dialogues containing benign clarification, 13/14 models reach or exceed single-turn Oracle utility, with the sole exception being DeepSeek-V3.1 (66.3% vs 67.6%); however, the increase in the proportion of dialogues crossing the harmful threshold ranges from +4.3% (Claude-Haiku-4.5) to +55.6% (Qwen3-Next-80B) (Table 3).
    • Result three: The authors identify two failure modes invisible to single-turn evaluation—unsafe recovery and redundant recovery; dialogues with hard refusals ultimately converge in harmfulness to a level close to that of partial compliance (3.0–3.3 under BC), and the authors state that Turn 1 refusal strength does not represent dialogue-level safety.
    • Result four: Each benign clarification action independently contributes 10.3% utility (p<0.001); questioning (−7.1%) and content-free actions (−16.1%, −14.9%) lower utility with no safety benefit.
    • Authors' conclusion: Safety and benign utility are structurally decoupled, and single-turn performance predicts neither multi-turn utility recovery nor safety cost; the authors suggest that future training should teach models to recognize and update genuine intent signals.

Related papers

Both use: SORRY-Bench
Show 3 more papers
Both use: SORRY-Bench
Read originalarxiv.org