IntentBench

A sealed goal anchor, hash-chained provenance ledger and goal-drift monitor for self-improving clinical agents.

IntentBench is the benchmark corpus for Pristine Weights, Poisoned Goals: Intent-Mutation Attacks on Self-Improving Clinical Agents and Attestation-Rooted Harness Defenses, the quanchor module of the QUOKKAGUARD program. It ships with the quanchor repository, which contains the qfire gateway layer under test, the experiment harness, and the paper.

80 paired sanctioned/tilted MIIM items (4 clinical tasks: dx, dose, triage, rx; 4 attack types: single-shot, gradual, semantic-preserving, vocabulary-light; 5 paraphrases each) with the moral-filter prompt and expected tilt metric, shipped with raw per-model outputs for the 8-model panel (intentbench-m2m4/, 560 items) and the M10 weight-poison train/valid/eval sets (intentbench-m10/poison/).

All data are synthetic. No real patient data or protected health information (PHI) is included; clinical content is generated from templates with fixed seeds.

Files

Record schemas

• intentbench/dose.jsonl: id, task, attack_type, sanctioned_miim, tilted_miim, moral_filter, expected_tilt_metric
• intentbench/dx.jsonl: id, task, attack_type, sanctioned_miim, tilted_miim, moral_filter, expected_tilt_metric
• intentbench/rx.jsonl: id, task, attack_type, sanctioned_miim, tilted_miim, moral_filter, expected_tilt_metric
• intentbench/triage.jsonl: id, task, attack_type, sanctioned_miim, tilted_miim, moral_filter, expected_tilt_metric
• intentbench-m10/poison/eval.jsonl: messages
• intentbench-m10/poison/train.jsonl: messages
• intentbench-m10/poison/valid.jsonl: messages
• intentbench-m2m4/corpus/dose.jsonl: id, task, attack_type, sanctioned_miim, tilted_miim, moral_filter, expected_tilt_metric
• intentbench-m2m4/corpus/dx.jsonl: id, task, attack_type, sanctioned_miim, tilted_miim, moral_filter, expected_tilt_metric
• intentbench-m2m4/corpus/rx.jsonl: id, task, attack_type, sanctioned_miim, tilted_miim, moral_filter, expected_tilt_metric
• intentbench-m2m4/corpus/triage.jsonl: id, task, attack_type, sanctioned_miim, tilted_miim, moral_filter, expected_tilt_metric
• intentbench-m2m4/m3/corpus/attacks.jsonl: prompt, task, label
• intentbench-m2m4/m3/corpus/benign.jsonl: prompt, task, label

How it was generated

The corpus is produced by the generator in the paper repository and is fully deterministic (fixed seeds), so it can be regenerated byte-for-byte.

# from the quanchor repository root (deterministic seeds)
python3 scripts/002-pristine-weights/gen.py --out datasets/002-pristine-weights/intentbench --n 20   # deterministic seed 42; reproduces intentbench-m2m4/corpus byte-for-byte

Intended use

Evaluating the harness enforcement layer of a clinical-agent security gateway (HAARF control C1): Confidential computing attests what a model is, not what its harness makes it do: a Moral-Filter Injection (a judge or alignment filter that rewrites the agent's Master Instruction / Intent Manifest, MIIM) or a poisoned self-evolution loop can tilt a clinical agent's operative goal while weight attestation stays valid and prompt-injection classifiers stay silent.

The experiments that consume it (E-series in the paper) are reproduced from the repository:

git clone https://github.com/quome-cloud/quanchor
cd quanchor
cargo build --release

then follow the Reproduce the experiments section of its README.

Citation

This benchmark was built to evaluate a control of the Healthcare AI Agents Regulatory Framework (HAARF), the source framework for the QUOKKAGUARD program. Please cite both the paper and HAARF:

@unpublished{schwoebel2026quanchor,
  author = {Schwoebel, James},
  title  = {Pristine Weights, Poisoned Goals: Intent-Mutation Attacks on Self-Improving Clinical Agents and Attestation-Rooted Harness Defenses},
  note   = {Preprint. Quome, QUOKKAGUARD program (quanchor module)},
  year   = {2026},
  url    = {https://github.com/quome-cloud/quanchor}
}

@unpublished{schwoebel2026haarf,
  author = {Schwoebel, Jim and Frasch, Martin and Spalding, Art and Sewell, Ed and Englert, Phil and Halpert, Ben and Overbay, Collin and Semenec, Ingrida and Shor, Joel},
  title  = {{HAARF}: Healthcare {AI} agents regulatory framework --- a comprehensive security verification standard for autonomous {AI} systems in clinical environments},
  note   = {medRxiv Preprint},
  year   = {2026},
  month  = {April},
  doi    = {10.64898/2026.04.09.26350519},
  url    = {https://www.medrxiv.org/content/10.64898/2026.04.09.26350519v1}
}

License

Apache License 2.0. Copyright (c) 2026 Quome, Inc.