Refusing Intent, Not Form: Wrapper-Based Intent-Group Supervision for LLM Safety

A common way to improve jailbreak robustness is to train on harmful requests rewritten as role-play, translation, or other forms. When used only for harmful requests, these forms may become refusal shortcuts, weakening unseen-attack robustness and increasing benign over-refusal. We propose Wrapper-Based Intent-Form Augmentation (WIFA), which applies shared wrapper families to harmful and benign requests and groups variants by intent, encouraging decisions based on underlying intent rather than wrapper cues. WIFA supports two independent routes: WIFA-Boost prioritizes safety through two-stage training, while A-GCRT enforces consistent decisions across wrappers to mitigate over-refusal. Across three model families and two harmful training sources, both routes consistently improve safety while largely retaining capability. On Qwen--AdvBench, WIFA-Boost raises SB-avg5 from 22.1% to 63.7%, the best among compared methods; A-GCRT raises it to 46.7% while reducing OR-Bench over-refusal from 25.7% to 17.4%, unlike reproduced defenses whose safety gains increase over-refusal. Across three AdvBench-trained backbones, both routes substantially reduce ASR on 15 unseen attack families and under model-adaptive GCG and RandomSearch. Overall, WIFA provides reusable intent-group supervision across models and training sources, supporting high safety through WIFA-Boost and substantial safety gains with less unnecessary refusal through A-GCRT.