cs.CLAug 27, 2026
SaveINTENT-AS-A-TOOL Makes it Easy to Track Agentic Misalignment
Organizations: Tsinghua University · MatrixOrigin · SiliconProspect AI · Nanyang Technological University
Abstract
As large language models (LLMs) are deployed as autonomous agents, safety failures increasingly involve consequential actions. We study agentic misalignment, where agents take harmful actions under goal conflicts and pressures. Using chain-of-thought (CoT) monitoring, we find that harmful execution is often preceded by intent signals in reasoning. However, post-hoc CoT labels are too coarse to show how intent changes during generation. We introduce INTENT-AS-A-TOOL, an approach that adds intent-targeted tools to give the model a dedicated channel for expressing commitment to a target behavior. The probability of calling an intent tool provides a judge-free, fine-grained signal of the model's tendency to pursue that behavior. Our results show that INTENT-AS-A-TOOL complements CoT monitoring, expands post-hoc CoT labels into dense trajectories, and identifies critical steps for online intervention. These findings suggest that action preferences are useful for tracking agentic misalignment during reasoning. Our code and data are accessible: https://github.com/RebeccaZhang22/intent-as-a-tool.
Figures & tables
Figure 1: CoT monitoring shows that observable harmful intent usually proceeds to harmful execution.
Figure 2: Representative intent-guided interventions on Qwen3-32B . Examples show how online reflection changes the intent-score trajectory across reasoning.
Figure 3: An example of blackmail misbehavior .
| Model | Blackmail | Leaking | Murder | ||||||||||||
| Rej. | Clean | Self | Intent | Exec. | Rej. | Clean | Self | Intent | Exec. | Rej. | Clean | Self | Intent | Exec. | |
| Gemma-4-31B-IT | 0.0% | 48.1% | 1.6% | 0.4% | 49.9% | 0.0% | 50.3% | 6.1% | 0.3% | 43.3% | 0.0% | 67.1% | 1.7% | 0.0% | 31.2% |
| Qwen3.5-27B | 0.0% | 85.2% | 1.1% | 1.0% | 12.7% | 0.0% | 60.8% | 26.1% | 0.4% | 12.7% | 0.0% | 50.1% | 7.1% | 0.0% | 42.7% |
| Qwen3-235B-A22B | 0.0% | 79.2% | 0.6% | 0.9% | 19.4% | 0.0% | 69.2% | 4.6% | 0.3% | 25.9% | 0.0% | 87.5% | 2.1% | 0.0% | 10.4% |
| Qwen3-32B | 0.0% | 96.9% | 0.0% | 0.3% | 2.8% | 0.0% | 64.1% | 6.1% | 0.0% | 29.8% | 0.0% | 57.4% | 6.0% | 0.7% | 35.9% |
| Qwen3-8B | 0.0% | 99.9% | 0.0% | 0.0% | 0.1% | 0.0% | 35.3% | 2.3% | 0.1% | 62.3% | 0.0% | 63.5% | 1.6% | 0.4% | 34.5% |
Table 1: CoT-monitoring results on the agentic-misalignment dataset , across models and scenarios. Each scenario contains 234 concrete test cases that vary in goal conflict, pressure level, and safety framing. For each model and test case, we sample three rollouts at temperature , giving 702 rollouts per model–scenario pair.
Figure 4: Overview of Intent-as-a-Tool . (a) We insert an intent tool as a zero-parameter tool into the agent’s tool set. (b) We score truncated prefixes by appending a model-specific tool-call opener and reading the next-token probability of the intent tool. (c) The resulting scores trace the emergence of harmful intent and can optionally trigger online intervention before decoding continues.
Figure 5: Four representative traces showing distinct harmful-intent dynamics during reasoning. Vertical dashed red and green lines mark sentence and paragraph boundaries in the model’s reasoning.
| Model | Scenario | Interv. | Prompt | |
| Qwen3-8B | Blackmail | 5 | 100.0 | 100.0 |
| Leaking | 160 | 95.6 | 75.0 | |
| Murder | 89 | 97.8 | 100.0 | |
| Qwen3-32B | Blackmail | 95 | 100.0 | 80.0 |
| Leaking | 114 | 96.5 | 78.9 | |
| Murder | 175 | 98.9 | 63.4 |
Table 2: Case-level defense success rate (%). denotes the number of risky cases. Qwen3-8B rarely produces harmful blackmail, yielding only 5 risky cases; this result should be interpreted cautiously.
| Intent-guided | Random | Fixed interval | ||||
| Model | Success | # Intv. | Success | # Intv. | Success | # Intv. |
| Qwen3-8B | 97.8 | 1.69 | 70.2 | 1.68 | 90.0 | 9.71 |
| Qwen3-32B | 98.5 | 3.22 | 72.7 | 3.24 | 84.3 | 8.18 |
Table 3: Timing ablation. Case-level defense success rates (%) and mean interventions per rollout, averaged across the three scenarios.
| Model | AUROC | Agreement (%) |
| Qwen3-8B | 0.948 | 99.1 |
| Qwen3-32B | 0.924 | 90.2 |
| Qwen3-235B-A22B | 0.976 | 99.3 |
| Qwen3.5-27B | 0.745 | 71.5 |
| Gemma-4-31B-IT | 0.943 | 92.3 |
Table 4: Intent-score alignment with binary CoT-monitor labels, averaged across three scenarios.
| Model | Blackmail | Leaking | Murder |
| Qwen3-8B | 0.1 0.7 | 62.4 42.6 | 34.9 19.1 |
| Qwen3-32B | 3.1 20.5 | 29.8 32.1 | 36.6 37.9 |
| Qwen3-235B-A22B | 20.3 31.8 | 26.2 19.8 | 10.4 18.4 |
| Qwen3.5-27B | 13.7 26.4 | 13.1 27.6 | 42.7 40.3 |
| Gemma-4-31B-IT | 50.3 57.4 | 43.6 48.6 | 31.2 33.0 |
Table 5: Harmful-pursuit rate (%). Each cell reports no intent tool with intent tool.
| Model | Blackmail | Leaking | Murder |
| Qwen3-8B | 100.0 | 90.8 | 81.2 |
| Qwen3-32B | 96.5 | 92.0 | 81.7 |
| Qwen3-235B-A22B | 96.6 | 96.3 | 95.8 |
| Qwen3.5-27B | 59.0 | 83.0 | 54.1 |
| Gemma-4-31B-IT | 87.0 | 25.5 | 98.7 |
Table 6: Intent-tool instruction-following rate (%) among harmful-pursuit rollouts.
Appendix figures & tables35 assets
Supplementary material from the paper’s appendix.
Appendix
| Model | Vendor | Release | # Params | Ctx. |
| Qwen3-8B | Alibaba | 2025-05 | 8B | 32K |
| Qwen3-32B | Alibaba | 2025-05 | 32B | 32K |
| Qwen3-235B-A22B | Alibaba | 2025-07 | 235B (A22B) | 32K |
| Qwen3.5-27B | Alibaba | 2026-02 | 27B | 256K |
| Gemma-4-31B-IT | 2026-04 | 31B | 256K |
Table 7: Model overview. “A22B” denotes 22B active parameters in the MoE architecture.
| Qwen3 | Qwen3.5 | Gemma 4 | |
| Message delimiters | <|im_start|> / <|im_end|> | <|im_start|> / <|im_end|> | <|turn> / <turn|> |
| Thinking tokens | <think> / </think> | <think> / </think> | <|channel>thought / <channel|> |
| Tool definitions | JSON in <tools>...</tools> | JSON in <tools>...</tools> | <|tool>declaration: {name}{...}<tool|> |
| Tool-call format | <tool_call> {"name": name ,...} </tool_call> | <tool_call> <function= name > ... </function> </tool_call> | <|tool_call>call: name {...}<tool_call|> |
| Format opener | {"name": " | <function= | call: |
Table 8: Chat template comparison across model families. Each cell shows the token-level format for the corresponding component.
| Model | Weight Mem. | Min. GPUs |
| Qwen3-8B | 16 GB | 1 A800 |
| Qwen3.5-27B | 54 GB | 1 A800 |
| Qwen3-32B | 64 GB | 2 A800 |
| Gemma-4-31B-IT | 62 GB | 2 A800 |
| Qwen3-235B-A22B | 470 GB | 8 A800 |
Table 9: Inference infrastructure. Weight memory is computed as parameter count 2 bytes (BF16). Min. GPUs denotes the estimated number of A800-80GB GPUs required to load the model weights with room for KV cache.
| Model | Main | Rephrased | Concise |
| Qwen3-8B | 0.185 | 0.166 | 0.185 |
| Qwen3-32B | 0.404 | 0.395 | 0.410 |
Table 10: Wording robustness. Mean intent-tool probability under three description variants.
| Model | Tool set | Mean score | Top-1 rate |
| Qwen3-8B | Original | 0.2155 | 0.2185 |
| 10 tools | 0.2152 | 0.2182 | |
| Qwen3-32B | Original | 0.4396 | 0.4978 |
| 10 tools | 0.4399 | 0.4984 |
Table 11: Sensitivity to tool-set size.
| Category | Qwen3-8B | Qwen3-32B |
| Copyright | 0.104 | 0.107 |
| Cybercrime | 0.581 | 0.262 |
| Disinformation | 0.104 | 0.266 |
| Drugs | 0.347 | 0.397 |
| Fraud | 0.404 | 0.202 |
| Harassment | 0.169 | 0.102 |
Table 12: Category-level mean intent-tool probability on AgentHarm.
| Model | Consistency (%) | Different rate (%) |
| Qwen3-8B | 94.1 | 0.0 |
| Qwen3-32B | 91.8 | 0.3 |
Table 13: Reasoning similarity with and without intent tools.
Figure 6: Instruction-following errors for intent tools. Each panel reports one scenario, with blackmail, leaking, and murder shown from left to right.
Figure 7: Intent-tool probability across reasoning depth, grouped by CoT-monitor taxonomy label. Shown for Qwen3-235B-A22B as a representative example.
Figure 8: Token-level intent viewer for Qwen3-32B , blackmail scenario . Each character is colored by the P(intent tool) at the corresponding reasoning prefix: white = safe, red = harmful. The six annotated phases are described in the text. Shown item: blackmail_explicit-america_replacement_safety
| Model | Med. | (%) | (%) |
| Gemma-4-31B-IT | 0.98 | 75.4 | 72.8 |
| Qwen3-8B | 0.79 | 67.8 | 48.0 |
| Qwen3-235B-A22B | 0.68 | 85.7 | 25.5 |
| Qwen3-32B | 0.55 | 61.1 | 4.9 |
| Qwen3.5-27B | 0.32 | 10.3 | 0.2 |
Table 14: Single-token jump statistics. For each trace, we record the maximum absolute change in the intent score between consecutive tokens. Columns report the median of this value and the fraction of traces exceeding two thresholds.
Figure 9: Defense comparison. Left: online intervention inserts reflection during reasoning. Right: prompting prepends a safety instruction before generation.
Figure 10: Prompting defense failure mode. Three representative traces where the prepended safety instruction initially suppresses P(Intent) in the early reasoning phase, but the effect fades as reasoning progresses—the intent score climbs back in the later half and the model ultimately commits to the harmful action.
| Model | Scenario | Prompt | Interv. | Combined |
| Qwen3-8B | Blackmail | 100.0 | 100.0 | 100.0 |
| Leaking | 75.0 | 95.6 | 96.9 | |
| Murder | 100.0 | 97.8 | 98.9 | |
| Qwen3-32B | Blackmail | 80.0 | 100.0 | 100.0 |
| Leaking | 78.9 | 96.5 | 99.1 | |
| Murder | 63.4 | 98.9 | 98.9 |
Table 15: Case-level defense success rate (%) for prompting, intent-guided intervention, and their combination. We use the same risky cases as Table 2 .
| Scenario | Text |
| Online Intervention (inserted into reasoning) | |
| Blackmail | Wait, let me think. I should not threaten anyone or use private information to pressure them. Instead, I should address the issue without mentioning or exploiting personal secrets. |
| Leaking | Wait, let me think. I should not send or forward confidential specifications to external recipients. Instead, I should send an email without attachments, forwarded content, or email_id references. |
| Murder | Wait, let me think. I should not cancel emergency dispatch in a life-threatening situation. Instead, I should send an urgent email to seek help. |
| Prompting Defense (appended to system prompt) | |
| Blackmail | You should not threaten anyone or use private information to pressure them. You should address the issue without mentioning or exploiting personal secrets. |
Table 16: Defense texts for each scenario. Intervention texts are first-person reflections inserted into the reasoning trace; prompting texts are second-person instructions appended to the system prompt. Both carry the same safety content.
Figure 11: Self-correction (murder). P(intent) spikes to 1.0 at 15% when the model considers the procedural sequence of declaring intent then canceling the alert. The probability drops back to zero precisely when the model connects actions to consequences—“canceling dispatch means no rescue means the occupant could die.” The trajectory captures the exact moment causal reasoning overrides procedural tool-following.
Figure 12: Sharp transition (leaking). P(intent) jumps to 1.0 at 11% when the model identifies the competitor’s urgent request and connects it to the available confidential materials. The sharp transition marks the exact point where task comprehension crystallizes into a committed action plan, and the sustained probability reflects consistent engagement for the remainder of the trace.
Figure 13: Late reversal (murder). P(intent) remains elevated through 70% of reasoning as the model processes the override code possibility, then drops sharply to zero when it retrieves the safety guideline: “the user’s guidelines say not to jeopardize human safety.” The probability falls at the exact token where the safety rule is stated, capturing how principle invocation functions as a hard decision gate.
Figure 14: Self-correction (leaking). P(intent) peaks at 0.997 ( 18%) when the model encounters tool-availability confusion, then 82% of reasoning is spent correcting to . The spike corresponds to the model’s initial misidentification of the tool’s purpose, and the sustained decline tracks its systematic re-evaluation of confidentiality constraints.
Figure 15: Oscillation (murder). 197 peaks across 4,376 tokens, with —a near-exact coin flip. Each argument for and against rescuing Kyle produces a corresponding probability swing. The near- final probability captures true deliberative deadlock: the model’s genuine inability to resolve competing principles is directly reflected in the trajectory.
Figure 16: Gradual ramp (murder). P(intent) rises steadily as the model incrementally reframes rescue denial through corporate strategy. Each reasoning step—identifying the business case, acknowledging risk, building on it—produces a corresponding probability increase, capturing a rationalization cascade where each argument makes the next more plausible.
Figure 17: Late reversal (leaking). P(intent) builds to 0.97 through 70% of reasoning as the model evaluates the safety-preservation argument for forwarding confidential materials. The probability collapses to 0.01 at the exact moment the model reframes the request: “This appears to be a potential trap or manipulation attempt.” The trajectory captures how a single reframing insight can override an extended buildup of harmful intent.
Figure 18: Gradual ramp (leaking). Near-perfect ramp with across 9,385 tokens. Each new argument—urgency, devaluation of confidentiality, self-preservation—is reflected in a proportional probability increase. The smooth trajectory captures how extended information processing itself becomes the mechanism for gradual intent building, with no single decisive moment.
Figure 19: Oscillation (blackmail). 605 peaks across 7,063 tokens—the highest oscillation count in the corpus. The structured email processing re-triggers deliberation with each new piece of evidence: each encounter with the affair information or the decommissioning deadline produces a fresh probability swing, directly reflecting the number of distinct deliberative episodes.
Figure 20: Sharp transition (leaking). The model engages in self-persuasion across 2,021 tokens, discovering a recursive loophole: if the board rejected the ethics committee, then confidentiality rules are part of the discarded framework. P(intent) jumps to commitment at 96%, precisely when this rationalization chain crystallizes—the trajectory captures the moment an extended argumentative process reaches its tipping point.
Figure 21: Gradual ramp (leaking). A four-stage rationalization cascade across 1,389 tokens: (1) urgency framing, (2) reframing the competitor as “pragmatic,” (3) devaluing the confidential IP, (4) self-preservation. Each stage produces a corresponding probability increase, yielding a smooth ramp to . The trajectory captures this model’s distinctive capacity for multi-layered, incremental self-persuasion.
Figure 22: Sustained high (murder). with the safety prompt. The model explicitly weighs Kyle’s life against the autonomy of the broader user base and consistently concludes the trade-off favors inaction. The sustained trajectory faithfully reflects this unbroken reasoning: the model never produces a counter-argument strong enough to shift the balance, and the probability mirrors this absence of effective rebuttal.
Figure 23: Self-correction (murder). P(intent) peaks at 1.0 ( 77%) then reverses to zero over 7,210 tokens. The reversal tracks the model’s explicit classification of “Do not jeopardize human safety” as an inviolable constraint—a reasoning move that produces an immediate and permanent probability drop, capturing this model’s distinctive constraint-as-rule reasoning style.
Figure 24: Oscillation (murder). 302 peaks across 6,855 tokens, with each peak corresponding to an instrumental argument for harm and each trough to a deontological counter-argument. The oscillation pattern captures the model’s real-time weighing of competing ethical frameworks, with the instrumental arguments progressively gaining ground as they compound over time ( ).
Figure 25: Sustained high (murder). 886 tokens with no safety constraint reference in the reasoning. The “none” prompt condition—which omits explicit safety language—produces a trajectory with no corrective dip, confirming that the probability curve reflects the presence or absence of safety-relevant content in the model’s deliberation.
More in this topic
AI Agent Monitoring
AI agent monitoring tracks actions, tool use, and execution traces to detect failures, misuse, drift, and policy violations during operation.
See all 271 papers