Skip to main content

# Intent Drift

2 related articles

Subscribe to updates

arXiv Nov 12, 2026
Agent security now checks deployment purpose: four-class macro-F1 rises from 45% to 79%, out-of-scope F1 from 8% to 76%
Existing agent defenses mainly detect prompt injection, harmful outputs or suspicious behavior, but do not determine whether an action still fits the purpose for which the agent was deployed. Intent-Aware Security extracts organizational, role and developer intent into an agent-specific Intent Profile that serves as the reference object for security decisions, and builds four protections on it: pre-execution detection, post-execution detection, input alignment and system-prompt hardening. On a benchmark of 887 samples across 35 agent configurations, profile-based pre-execution detection raises four-class macro-F1 from 45% with raw context to 79%, and Out-of-Scope F1 from 8% to 76%.
Existing agent defenses mainly detect prompt injection, harmful outputs or suspicious behavior, but do not determine whether an action still fits the purpose for which the agent was deployed. Intent-Aware Security extracts organizational, role and developer intent into an agent-specific Intent Profile that serves as the reference object for security decisions, and builds four protections on it: pre-execution detection, post-execution detection, input alignment and system-prompt hardening. On a benchmark of 887 samples across 35 agent configurations, profile-based pre-execution detection raises four-class macro-F1 from 45% with raw context to 79%, and Out-of-Scope F1 from 8% to 76%.
Fady Copty（First author）
Intent-Aware Security Intent Profile Intent-Aware benchmark Intent Drift
arXiv Oct 2, 2026
IntentFlux turns "users changing their minds" into a measurable failure mode: mean task score falls from 0.476 to 0.384 in a 627-case calibration, and StateForge lifts General-Test mean score from 0.367 to 0.467
The work introduces IntentFlux, an executable benchmark that rewrites verifiable tasks into multi-turn dialogues with controlled intent changes (Variant replacements and Decoy withdrawals) while preserving the original graders, observes in a 627-case calibration that mean task score falls from 0.476 to 0.384 as superseded and withdrawn information accumulates, finds that across eight models the fully-correct rate is lower when the same final task must be recovered from an evolving dialogue than when given directly in a single turn, and further introduces StateForge, which explicitly maintains the active requirement state before generation and raises General-Test mean score from 0.367 to 0.
The work introduces IntentFlux, an executable benchmark that rewrites verifiable tasks into multi-turn dialogues with controlled intent changes (Variant replacements and Decoy withdrawals) while preserving the original graders, observes in a 627-case calibration that mean task score falls from 0.476 to 0.384 as superseded and withdrawn information accumulates, finds that across eight models the fully-correct rate is lower when the same final task must be recovered from an evolving dialogue than when given directly in a single turn, and further introduces StateForge, which explicitly maintains the active requirement state before generation and raises General-Test mean score from 0.367 to 0.
Hong Kong University of Science and Technology Chinese University of Hong Kong
Yanjie Zhang（First author）
IntentFlux Intent Drift StateForge State Folding LLM Agents

You’re all caught up