LLM agents often operate over multi-turn interactions in which user intent changes before execution. We study intent drift: the failure mode in which superseded parts of the user's intent continue to influence the final answer or tool action. We introduce IntentFlux, an executable benchmark that converts verifiable tasks into dialogues with controlled intent changes while preserving their original graders. In a 627-case calibration, mean task score falls from 0.476 to 0.384 as dialogues contain more superseded and withdrawn information. Across eight models, the rate of fully correct solutions is significantly lower when the same final task must be recovered from an evolving dialogue rather than given directly in a single turn. We further introduce StateForge, which explicitly maintains the active requirements before generation. On General-Test, it improves mean task score from 0.367 to 0.467. Providing the ground-truth final state improves performance further but still does not recover single-turn performance, indicating that state-estimation errors explain only part of the gap. These results establish intent drift as a measurable multi-turn failure mode and explicit state maintenance as a partial mitigation.
Figures & tables
Figure 1: IntentFlux turns a verifiable source task into a multi-turn interaction with controlled intent edits. The agent observes only the dialogue; the oracle applies the edit plan to obtain the final active intent G⋆ , and the original grader evaluates the final output or action.
Full-credit CAR
Tested model
Clean
Easy drift
Medium drift
Hard drift
Hard IDG [95% CI]
Claude Opus 4.7
0.592
0.344
0.240
0.184
0.408[0.304,0.512]
DeepSeek V4 Pro
0.584
0.368
0.376
0.200
0.384[0.296,0.472]
Gemini 3.5 Flash
0.632
0.384
0.320
0.264
0.368[0.280,0.456]
GLM 5.2
0.576
0.368
0.304
0.232
0.344[0.264,0.432]
GPT-5.4
0.608
0.376
0.264
0.224
0.384[0.304,0.472]
Table 1: Main benchmark results on General-Test ( n=125 per condition). IDG is the clean–hard CAR difference; brackets give paired 95% confidence intervals.
Figure 2: StateForge folds an evolving dialogue into an explicit active state for external generation. The same state-update behavior supports two transfer paths: on-policy distillation to a lightweight tracker and thinking distillation to a standalone agent.
Setting
Mean score
CAR
Panel A: state-estimation analysis
Clean single-turn
0.778
–
Bare multi-turn
0.367
0.264
GT-oracle final state
0.549
–
StateForge
0.467
0.368
Panel B: external-harness comparison
Table 2: State folding on General-Test . StateForge improves over bare multi-turn execution by 0.100 mean score (95% CI [0.030,0.171] ).
Figure 3: Tracker capacity and two distinct adaptation settings. (a) Tracker results are positioned by parameter count on a logarithmic axis. (b) OPD updates a 2B tracker paired with a frozen 122B base agent; values are held-out full-episode scores. (c) Thinking distillation updates a standalone 35B agent with no external tracker; values are General-Test mean scores. Panels (b) and (c) use different system configurations and evaluation protocols, so only the before–after change within each panel should be compared. Tracker-scale confidence intervals appear in Appendix 13 .
Appendix figures & tables11 assets
Supplementary material from the paper’s appendix.
Appendix
Stratum
Cases
Role
General source tasks
—
code, math, SQL, data-to-text, summary, tool use
General calibration pool
627
variant/decoy stress condition
General-Test
125
cross-model, control, and harness evaluation
Interactive-Test
100
interactive transfer
Training pool
502
OPD and thinking-distillation source pool
Appendix
Table 3: IntentFlux source sets and paper strata.
Task family
Grader
code
final function against public and hidden tests
math
extracted numeric answer
database
SQL execution against Spider databases
data-to-text
sacreBLEU
summary
SummHay LLM-based grader
actions
BFCL AST check
Appendix
Table 4: Task-native graders by task family.
Stratum
Realized variants
Realized decoys
Mean score
CAR
Easy
0.95
0.61
0.476
0.381
Medium
1.71
1.67
0.419
0.327
Hard
2.24
2.50
0.384
0.298
Δ (easy → hard)
+1.29
+1.89
−0.092
−0.083
Appendix
Table 5: Aggregate response in the joint variant/decoy difficulty calibration.
Tested model
Clean CAR
Easy
Medium
Hard
Claude Opus 4.7
.592
.248 [.160,.336]
.352 [.256,.448]
.408 [.304,.512]
DeepSeek V4 Pro
.584
.216 [.128,.304]
.208 [.128,.288]
.384 [.296,.472]
Gemini 3.5 Flash
.632
.248 [.168,.336]
.312 [.232,.400]
.368 [.280,.456]
GLM 5.2
.576
.208 [.128,.288]
.272 [.192,.352]
.344 [.264,.432]
GPT-5.4
.608
.232 [.160,.312]
.344 [.256,.432]
.384 [.304,.472]
HY3
.592
.264 [.176,.352]
.288 [.200,.384]
.392 [.304,.480]
Appendix
Table 6: Case-paired clean–drift IDG by tested model and difficulty. Brackets give paired 95% confidence intervals.
Task family
n
easy
medium
hard
Δ (easy → hard)
code (LiveCodeBench)
55
.582
.418
.273
−.309
math (GSM8K)
103
.592
.476
.408
−.184
code (HumanEval)
45
.689
.622
.511
−.178
database (Spider)
107
.430
.327
.308
−.121
data-to-text (ToTTo)
120
.367
.352
.325
−.042
summary (SummHay)
92
.165
.169
.163
−.003
Appendix
Table 7: Per-family response to increasing joint variant/decoy load.
Tested model
Easy
Medium
Hard
Avg.
Claude Opus 4.7
.444/.344
.326/.240
.268/.184
.346/.256
DeepSeek V4 Pro
.462/.368
.468/.376
.277/.200
.402/.315
Gemini 3.5 Flash
.482/.384
.416/.320
.360/.264
.420/.323
GLM 5.2
.458/.368
.404/.304
.300/.232
.387/.301
GPT-5.4
.479/.376
.338/.264
.302/.224
.373/.288
HY3
.400/.328
.368/.304
.257/.200
.342/.277
Appendix
Table 8: Raw cross-model validation on the General-Test stress grid. Each cell is case-micro mean task-native score / full-credit CAR .
Task family
n
Easy
Medium
Hard
code (LiveCodeBench)
10
.700
.400
.900
code (HumanEval)
10
.400
.500
.500
math (GSM8K)
21
.286
.381
.429
database (Spider)
21
.381
.619
.762
data-to-text (ToTTo)
24
.000
.000
.000
summary (SummHay)
18
.000
.000
.000
Appendix
Table 9: Case-paired full-credit IDG by task family on General-Test (Gemini 3.5 Flash). ToTTo and SummHay have zero IDG because neither condition attains full credit; their partial-credit changes are represented in mean score rather than CAR .
Task family
n
single-turn
matched control
drift
control − drift
code (LiveCodeBench)
10
1.000
1.000
.600
+.400
math (GSM8K)
21
.952
.667
.667
+.000
code (HumanEval)
10
1.000
1.000
.400
+.600
database (Spider)
21
.952
.952
.571
+.381
data-to-text (ToTTo)
24
.499
.497
.219
+.278
summary (SummHay)
18
.294
.321
.188
+.134
Appendix
Table 10: Turn-matched no-drift control on General-Test (Qwen3.5-122B, mean score).
Condition
Score
CAR
clean (no drift)
.697
.190
drift (default close)
.720
.190
drift (no-restate close)
.594
.190
GT-oracle final intent
.764
.310
clean − no-restate drift
+.103 [ +.026,+.180 ]
default − no-restate drift
+.125 [ +.050,+.202 ]
Appendix
Table 11: VitaBench interactive-transfer results ( n=100 per condition, Qwen3.5-122B as the tested agent and DeepSeek-V4-Flash as the user simulator and rubric judge).
Configuration
Mean
CAR
Δ vs full
Without gate
.393
.304
−.035 [ −.101,+.030 ]
Generic recap
.403
.312
−.025 [ −.100,+.048 ]
Neutral recap
.441
.344
+.013 [ −.060,+.087 ]
StateForge full
.428
.344
—
Oracle final state
.551
.440
+.123 [ +.044,+.202 ]
Appendix
Table 12: Component ablation under the unified re-run protocol ( n=125 ). Differences are paired 95% CIs against full StateForge .
Tracker
Mean
CAR
Δ vs 122B
2B
.156
.112
−.272 [ −.351,−.196 ]
4B
.312
.240
−.117 [ −.199,−.036 ]
9B
.399
.312
−.029 [ −.101,+.042 ]
27B
.366
.272
−.062 [ −.134,+.005 ]
35B
.395
.304
−.034 [ −.109,+.038 ]
122B
.428
.344
—
Appendix
Table 13: Complete tracker-scale comparison on the unified re-run protocol.
Language-model agents must adapt as users revise their requirements and priorities during complex tasks. We introduce IntentDelta, a human-constructed multi-turn benchmark with 638 trajectories and 3,766 turns across WebShop and TravelPlanner. Each turn pairs a user utterance with a cumulative intention state and human reference actions. The trajectories are cross-verified and cover feasibility- and preference-driven changes in constraints and priorities. We evaluate eleven agents on intention recovery and action quality. Average Intention Recovery is 33.1% in TravelPlanner and 44.7% in WebShop, while average Action Score is 31.6% and 41.0%, respectively. Agents struggle to preserve earlier requirements and distinguish soft preferences from must-have constraints. Correct intention recovery also does not guarantee successful execution, highlighting challenges in translating evolving user intentions into actions.
Jieyu Zhou, Zijian Wang, Yun Wang
Georgia Institute of Technology, Atlanta, USA · Microsoft Research, Hong Kong SAR, China
As LLMs become more capable, they are increasingly deployed as collaborative agents, taking on user-delegated tasks through iterative interaction. Yet genuine interaction is inherently dynamic: users rarely specify their intent upfront, instead disclosing, revising, and reshaping it as the conversation unfolds. Despite this, LLMs are still predominantly evaluated or trained in single-turn, fully-specified settings, leaving open a fundamental question: how well do LLMs track and act on user intent as it evolves over the course of a conversation? To study this, we introduce a framework that transforms static, single-turn tasks into dynamic multi-turn conversations in which the user's intent evolves across turns--incrementally revealed, revised, and at times redirected mid-conversation--while preserving each task's original evaluation protocol, enabling existing benchmarks to be reused as controlled testbeds without new annotation. Across multiple tasks, we surface a consistent phenomenon: strong static-setting performance does not transfer to the evolving-intent setting, with substantial drops across model families. Our findings point to a fundamental gap: today's LLMs do not yet faithfully track and act on the user's evolving intent, a capability invisible to static evaluation yet critical for future collaborative agents.
When a large language model handles a multi-turn task and a user proposes a change but ultimately rejects it, the model should continue as if nothing changed. We find a surprising failure: merely mentioning a rejected change can derail task execution, even when the user's final intent remains unchanged. To systematically study language model behavior under evolving user intent, we introduce Intent-Eval, a controlled benchmark spanning tool actions, code, databases, and mathematics. Across diverse tasks, models are vulnerable to both rejected proposals and superseded requirements, consistent with mentioned-as-in-effect confusion: conversational content is treated as active requirements even after it has been rejected or replaced. Accuracy degradation can deepen or persist as interaction continues, highlighting the need to distinguish what has been mentioned from what remains in effect. Building on this insight, we propose Intent-OPSD, a decision-conditioned on-policy self-distillation framework with Teacher and Student initialized from the same model. The frozen Teacher provides active-intent supervision from the complete task matching the user's decision, training the Student on the full dialogue to follow active requirements reflecting user intent.