The paper introduces INTENT-AS-A-TOOL, which augments LLM agents with behavior-specific intent tools. The probability of calling such a tool provides a judge-free, fine-grained signal of the model’s commitment to a harmful behavior, enabling intent tracking during reasoning and online defense.
Experiments on three agentic-misalignment scenarios across five open-weight reasoning models show that the approach complements chain-of-thought monitoring, produces dense intent trajectories, and identifies critical steps for intervention. On Qwen3-32B, it achieved 100%, 96.5%, and 98.9% success rates on risky blackmail, leaking, and murder test cases, respectively, and matched or exceeded a prompting baseline in 9 of 12 model–scenario settings.
This work is interesting because it offers an efficient, real-time method to detect and intervene on harmful intent without an external judge, which could improve the safety of autonomous LLM agents.