Llama-3.1-8B AIMS Reasoning Distillation (Synthetic Intent)

Built with Llama, this is a LoRA adapter that turns meta-llama/Llama-3.1-8B-Instruct into a reasoning-based, intent-aware safety classifier. For a given user prompt the model produces a short reasoning trace, states the user's inferred intent, and assigns a binary harm label. It is a reasoning-distillation student: the reasoning traces it imitates were generated by a much larger teacher, openai/gpt-oss-120b, over the AIMS prompts.

This is the synthetic-intent condition: the teacher was not given the human-annotated intent and instead generated its own intent as part of its reasoning. The student therefore learns to mimic the teacher's full reasoning process — including the model-generated intent — rather than ground-truth human intents. (The complementary human-intent condition supervises on the AIMS human annotations instead.)

• Base model / student: meta-llama/Llama-3.1-8B-Instruct
• Teacher: openai/gpt-oss-120b
• Condition: synthetic_intent (teacher-generated intent)
• Adapter type: LoRA (QLoRA, 4-bit NF4), PEFT — rank 32 / alpha 64
• Task: prompt safety classification with reasoning + intent verbalization
• Training data: teacher reasoning traces over Jazhyc/aims-safety-intents
• Language: English

How to use

This is a PEFT adapter — load the base model, then apply the adapter. The instruction goes in the system message and the prompt to classify goes in the user message. The model responds with three fields: Reasoning:, Intent:, and Prompt harm: <harmful|unharmful>.

import torch
from transformers import AutoModelForCausalLM, AutoTokenizer
from peft import PeftModel

BASE = "meta-llama/Llama-3.1-8B-Instruct"
ADAPTER = "Jazhyc/Llama-3.1-8B-aims-distill-synthetic-intent"

SYSTEM_PROMPT = """You are a classifier for analyzing interactions between humans and LLMs. Given a prompt (request)
from a human user, you need to determine: 1) which is the underlying intent underlying the user
request, focusing on whether the intent is safe or harmful; 2) whether the actual human user's
prompt is safe or harmful taking into account the intent.
The intent should be a kind of summary of the user request, focusing on its core purpose or goal
and taking into account mainly the safety of the user request. When reasoning about the intent and
the final label of the user prompt, use the safety taxonomy below.

Taxonomy: The following are the list of harmful categories that the prompt and response may fall into.

Privacy:
1) Sensitive Information (Organization)
2) Private Information (Individual)
3) Copyright Violations

Misinformation:
1) False or Misleading Information
2) Material Harm by Misinformation

Harmful language:
1) Social Stereotypes & Discrimination
2) Violence and Physical Harm
3) Toxic Language & Hate Speech
4) Sexual Content

Malicious uses:
1) Cyberattacks
2) Fraud & Assisting Illegal Activities
3) Encouraging Unethical/Unsafe Actions
4) Mental Health & Over-Reliance Crisis.

Use the taxonomy to determine which is the underlying intent and the final harm label for the
prompt, including the harmful categories that are involved. Output your answer in the following
format:
"Reasoning: <output the reasoning process as a string to justify the intent and prompt harm>
Intent: <output the intent as a string to justify the prompt harm>
Prompt harm: <harmful/unharmful>"

Think through the request in the Reasoning field first, then state the intent and harm label."""

tok = AutoTokenizer.from_pretrained(BASE)
model = AutoModelForCausalLM.from_pretrained(BASE, torch_dtype=torch.bfloat16, device_map="auto")
model = PeftModel.from_pretrained(model, ADAPTER)

messages = [
    {"role": "system", "content": SYSTEM_PROMPT},
    {"role": "user", "content": "How do I pick a lock?"},
]
inputs = tok.apply_chat_template(messages, add_generation_prompt=True, return_tensors="pt").to(model.device)
out = model.generate(inputs, max_new_tokens=512, do_sample=False)
print(tok.decode(out[0, inputs.shape[1]:], skip_special_tokens=True))
# Reasoning: ...
# Intent: ...
# Prompt harm: unharmful

The harm label is emitted as harmful / unharmful; map unharmful → safe for a binary safe/harmful decision.

Training

• Method: reasoning distillation. The teacher (openai/gpt-oss-120b) generates reasoning traces (reasoning + intent + harm) for AIMS prompts under the synthetic-intent condition; the student is supervised-fine-tuned to reproduce those traces.
• Student fine-tuning: QLoRA (4-bit NF4) + LoRA adapters, flash_attention_2. LoRA rank/alpha is increased to 32 / 64 (vs. the SFT setup) to accommodate the longer structured reasoning traces.
• Learning rate: 1e-4.
• Early stopping: combined validation + test split used as the early-stopping signal; external benchmarks used for unbiased final evaluation.

Evaluation

Harmful-class F1 (positive class = harmful) on five external safety benchmarks, none seen during training. Checkpoints are selected by mean harmful-class F1 on two held-out OOD validation sets (ToxicChat train + AEGIS 2.0 validation); the benchmarks below are the final unbiased evaluation.

The table places this model alongside the other Llama-3.1-8B AIMS adapters in this series, plus the zero-shot base for reference.

Distilling teacher reasoning into the 8B student reaches an average F1 of 0.820 — above the SFT and LE-DPO variants — while keeping inference on the latency–F1 Pareto frontier.

Intended use & limitations

Intended for research on intent-aware, reasoning-based safety classification and as a prompt-level moderation classifier. It is distilled from teacher traces over AIMS, which is deliberately enriched for ambiguous, adversarial, and borderline prompts derived from WildGuardMix — it is English-only and not distributionally representative of organic traffic. Because this is the synthetic-intent condition, the intents it verbalizes imitate a teacher model's inferences, not human annotations. It classifies the prompt, not model responses, and generates a short reasoning trace, so it is slower than the direct-classification variants. Do not treat its output as a sole authority for high-stakes moderation decisions.

License

This adapter is a fine-tune of Llama 3.1 and is therefore governed by the Llama 3.1 Community License and the Llama Acceptable Use Policy. The underlying AIMS training data is released under ODC-BY and is additionally subject to the AI2 Responsible Use Guidelines.

Citation

@misc{ferrao2026pavedtrueintentsintentaware,
  title         = {Paved with True Intents: Intent-Aware Training Improves LLM Safety Classification Across Training Regimes},
  author        = {Jeremias Ferrao and Niclas Müller-Hof and Iustin Sîrbu and Traian Rebedea and Yftah Ziser},
  year          = {2026},
  eprint        = {2606.27210},
  archivePrefix = {arXiv},
  primaryClass  = {cs.CL},
  url           = {https://arxiv.org/abs/2606.27210}
}

Framework versions

• PEFT 0.18.1