Training-Free versus Training-Based Intent Classification in LLMs: Accuracy, Robustness, and Failure Modes

AI summary

Overview

Research area: Natural Language Processing — intent classification and LLM routing, with a secondary component in statistical learning theory.

Technical level: Intermediate. The paper combines a large empirical benchmark study with two short theoretical results (a Gaussian proxy analysis and a calibration-cost bound), but the empirical portion is readable without a theory background.

Scope: A systematic head-to-head comparison of lightweight training-free intent classifiers (VecStat, NormStat) against training-based classifiers (Avg-MLP, Tail-MLP, Avg-Linear, and a fine-tuned RoBERTa-Base) across seven LLMs (1B–32B parameters), coarse- and fine-grained classification tasks, mixed-intent ambiguity, and adversarial prompt rewrites.

What This Paper Is About

Modern LLM systems often route a user prompt to a specialized downstream model or tool, and that routing requires an intent classifier that is accurate, cheap, and reliable. The authors ask what kind of classifier should sit at that decision point: a training-free method that summarizes statistics of the LLM's internal prefill-phase activations, or a small classifier head trained on labeled data. They build both families of methods, evaluate them on the same calibration and test data, and stress-test them with ambiguous and adversarially rephrased prompts to find where each one breaks.

Key Contributions

1. Two training-free statistical classifiers. NormStat and VecStat summarize prefill-phase module outputs at negligible cost. VecStat keeps coordinate-wise token means and second moments (a diagonal Gaussian surrogate); NormStat compresses each token to a single radial quantity, the normalized norm ||y_t||/√d, and keeps only its mean and variance. Prompts are scored against per-class reference statistics by closed-form KL divergence, with cosine similarity also evaluated for VecStat.

2. Theory for when each training-free method wins. Theorem 1 shows that in a directional regime (equal covariances, equal mean norms, different mean directions) every radius-only classifier has error 1/2, while a likelihood-ratio test achieves Pr(k̂ ≠ k) ≤ exp(−T||μ₁ − μ₂||² / (8σ²)); in the isotropic-scale regime the likelihood-ratio test depends only on R_T = Σ ||y_t||², so radial information is already sufficient and coordinate-wise information cannot improve the Bayes risk. Theorem 2 gives calibration sample complexity: NormStat's error scales as √(log(1/δ)/N) (dimension-free) while VecStat's mean estimate scales as √((d + log(1/δ))/N), i.e. N = Ω(ε⁻²) versus N = Ω(dε⁻²) for target error ε.

3. A systematic empirical comparison. Five classification methods (NormStat, VecStat with cosine and KL variants, Avg-MLP, Tail-MLP, Avg-Linear) plus 0-shot and 3-shot direct LLM calls, evaluated on Qwen3 and Llama models from 1B to 32B parameters, with a fine-tuned RoBERTa-Base as an encoder baseline. Four tasks span level-1 coarse granularity (general text vs. math vs. code; programming language identification; natural language identification) and level-2 fine granularity (mathematical subfield classification).

4. Two new stress-test datasets. A mixed-intent dataset constructed by interleaving math and code samples at five known mix ratios under two prompt orderings, and an adversarial MATH500 dataset with three camouflage levels (Easy/lexical, Medium/structural, Hard/genre-level) that reframes math problems as code-related tasks.

Main Findings

• Easy coarse-grained tasks saturate for everyone. On Task 1 (general text, math, code) and Task 3 (natural language identification), all methods — training-free, MLP-based, linear probe, and direct LLM calls — achieve strong performance. The authors state that NormStat's effectiveness despite using only radial statistics makes it a compute- and memory-efficient option when classes are sufficiently different.

• Training-based methods lead on fine-grained tasks. On Task 4 (mathematical subfield classification), averaged across subfields the trained LLM-feature classifiers and RoBERTa consistently outperform the training-free methods and direct LLM inference. The authors attribute this to the value of non-linear transformations learned through supervised training for closely related topics.

• No single method dominates uniformly. In Task 4 the best-performing method varies by subfield. On Qwen3-8B, for example, NormStat:KL reaches 73.45 on Number Theory but only 0.73 on Prealgebra; Avg-MLP reaches 52.95 on Prealgebra and 89.36 on Precalculus.

• NormStat has a clear failure mode when separation is directional. Task 2 (programming language identification) exposes it: training-based methods and VecStat saturate, while NormStat degrades substantially — 49.21 on Llama-3.2-1B, 56.39 on Qwen3-8B, and 57.02 on Qwen3-32B, versus VecStat:KL at 98.99, 99.23, and 99.53 respectively. This matches Theorem 1: programming languages share a broad code domain and differ mainly in direction, not radial scale.

• Cosine beats KL for VecStat. The VecStat cosine variant consistently outperforms the KL variant, particularly in Task 4, suggesting angular separation between prompt and baseline statistics captures directional differences better.

• VecStat gives the best uncertainty estimates on mixed-intent prompts. On Qwen3-1.7B, calibration RMSE for predicting the math fraction of a mixed-intent prompt was 0.1216 (code-first) and 0.0858 (math-first) for VecStat, compared with 0.2213/0.2098 for NormStat, 0.2451/0.1764 for Avg-MLP, and 0.2412/0.2688 for Tail-MLP. Tail-MLP was the weakest and most order-sensitive; NormStat and Avg-MLP were more stable across orderings but produced flatter-than-ideal prediction curves, under-reacting to changes in mixture ratio.

• Training-free methods are more robust to adversarial rephrasing. On the Easy and Medium adversarial tiers, MLP-based classifiers on Qwen3-8B and Qwen3-32B degrade sharply while training-free methods retain non-trivial accuracy. On Qwen3-32B, NormStat:KL scores 92.33 (Easy) and 80.67 (Medium) versus 11.73 and 0.40 for Avg-MLP; on Qwen3-8B, VecStat:Cos scores 78.60 and 54.80 versus 12.67 and 4.20 for Avg-MLP. The authors offer two explanations: training-free classifiers may need far fewer calibration samples at large scale, and trained MLP heads learn a discriminative boundary from the calibration token distribution that shifts when adversarial text injects coding vocabulary into a math problem.

• The Hard adversarial tier is a shared failure mode. All evaluated methods collapse to near-zero accuracy there, while GPT-5 reaches 64%, indicating that recovering mathematical intent from bug-report framing requires substantially stronger semantic understanding.

• OOD generalization varies across methods. The fine-tuned RoBERTa-Base is competitive on most level-1 tasks but drops to 42.33% on the out-of-distribution MATH500 set, where several LLM-feature methods remain above 90%.

• Intent classification need not complete a full forward pass. Both methods achieve competitive accuracy using only the first 12 layers out of 28. VecStat is robust regardless of layer count, while NormStat is dataset-dependent. VecStat maintains near-optimal accuracy across prompt lengths from 32 to 512 tokens, whereas NormStat plateaus at approximately 128 tokens.

• Cost profile. NormStat stores O(m) scalars, VecStat O(md), MLP heads O(hd); direct LLM calls cost Ω(Td²) FLOPs. Adding a new class requires recomputing baselines for the statistical methods versus retraining an MLP head.

• Direct LLM calls. 0-shot and 3-shot LLM calls improve with model scale but require careful prompt design, including a high-level overview of the intent classes; few-shot examples help through in-context learning at the cost of longer prompts. Llama-3.2-1B models failed to produce valid responses, so their LLM Call results are omitted.

Methodology in Plain English

Rather than reading a prompt with another model or hand-writing rules, the authors look at what happens inside the LLM while it processes the prompt, before it starts generating anything. As each prompt passes through the model's weight modules, it produces feature vectors — one per token per module. The training-free methods boil these vectors down to simple numbers. VecStat keeps the average and spread of each coordinate across tokens. NormStat throws away direction entirely and keeps only the mean and spread of each token's normalized vector length. For each intent class, the same statistics are computed once from calibration data, and a new prompt is assigned to whichever class's stored statistics it is closest to, using a Gaussian KL divergence or cosine similarity.

The trained alternatives use those same frozen LLM features but learn a decision boundary. Avg-MLP averages the last Transformer block's token features into a single vector and trains a two-layer MLP with cross-entropy loss; Tail-MLP uses only the final token's embedding; Avg-Linear uses a simple projection instead of an MLP. All comparisons use identical calibration and test splits, three seeds, and reported means and standard deviations. For coarse tasks the authors report per-dataset accuracy to avoid bias from uneven dataset sizes, and for language-identification tasks they report balanced accuracy across classes.

To probe failure modes, they build a mixed-intent dataset by interleaving math and code samples at five mix ratios in two orderings, temperature-calibrate each method's probability output, and measure RMSE against the true math fraction. For adversarial robustness, they use GPT-4o to rewrite MATH500 problems into code-like framing at three camouflage levels and check the difficulty stratification with GPT-5-Nano and GPT-5 API calls.

Why This Matters

The paper argues that there is no one-fits-all method for intent classification, and that the right choice depends on granularity, how much calibration data is available, and how noisy the incoming prompts are. For research, it provides a controlled comparison between statistical summaries of activations and learned classifiers on identical data, plus a theoretical account of why norm-only statistics fail when classes differ mainly in direction. It also contributes two reusable stress-test datasets and public code and data.

Real-world applications:

• LLM routing systems that dispatch prompts to domain-specialized models or tools, where the classifier must be cheap enough to run on every request.
• Guardrails and fallback policies that need calibrated confidence to decide whether to answer directly or escalate.
• Cost and latency control at production scale, where NormStat's O(m) storage and scoring makes it the lightest option and full forward passes can be avoided by probing only the first 12 of 28 layers.
• Data-scarce deployments where a new intent class must be added quickly — statistical baselines can be recomputed rather than requiring a retrained classifier head.

Industry relevance: the trade-off table pits O(m)/O(md) statistical storage against O(hd) learned heads and Ω(Td²) direct LLM calls, which maps directly onto the economics of high-volume routing. The robustness results matter for real traffic, where inputs are frequently noisy, ambiguous, or phrased to look like something they are not.

Future Directions

• Develop lightweight classifiers that retain training-free robustness while reaching GPT-5-level accuracy on the Hard adversarial tier, which the authors explicitly call a promising avenue for future work.
• Combine radial and directional statistics to cover both the isotropic-scale and directional regimes identified in Theorem 1, rather than choosing one compression level.
• Extend the evaluation to settings the paper does not cover — the authors note that training-free methods may be competitive precisely because they need far fewer calibration samples at large scale, which invites a systematic study of data-scarce regimes.
• Build adaptive or hybrid routing that selects between training-free and training-based classifiers per request, for instance escalating to a trained head or a direct LLM call only when the statistical score is ambiguous.

Target Audience

Practitioners building LLM routing, cascading, or model-selection systems; researchers working on LLM internal representations, linear probes, and activation-based feature analysis; and applied NLP engineers who need a decision procedure for choosing between statistical and trained intent classifiers under real cost, latency, and data constraints.

Authors’ abstract

Intent classification in Large Language Models (LLMs) involves categorizing user prompts into predefined classes. For instance, given a user prompt, the system must determine whether it primarily concerns mathematics, coding, or general text processing. Such classification enables routing prompts to specialized models optimized for specific domains, improving both accuracy and computational efficiency. In this work, we conduct a systematic study comparing training-free vs training-based approaches for intent classification. For this purpose, we consider two lightweight, training-free methods based on statistics of internal representations and compare them against MLP classifiers and linear probes. Our comprehensive empirical evaluation reveals that 1) Both training-free and training-based methods saturate easy benchmarks (mathematics vs. coding vs. natural language), 2) Training-based classifiers have an advantage on harder classification tasks (e.g. Java vs Python), and 3) Training-free methods are generally more robust to mixed-intent and adversarial prompts.