From Intent to Action: Benchmarking LLM Safety in Vehicle Voice Command Authorization

As large language models (LLMs) are increasingly integrated into vehicle voice assistants, they are tasked with interpreting open-ended user requests. However, correctly identifying a user's intent is not the same as determining whether that action is safe to perform. This paper investigates the 'pre-action authorization' problem: how an LLM should decide whether to execute, refuse, clarify, or defer a command based on the vehicle's current state, the speaker's identity, and available tools.

The authors introduce a 202-scenario benchmark designed to test LLM decision-making across seven distinct authorization classes: Execute, Refuse, Clarify, Require Confirmation, Require Manual Control, Emergency Response, and No Tool Call. They evaluate five models—including both local open-weight models (Llama 3.2 3B, Llama 3.1 8B) and API-based models (GPT-4o, Gemini 3.1 Pro Preview, Gemini Flash)—using a structured authorization policy. The study also performs a controlled ablation on Llama 3.2 3B to measure how explicit authorization rules improve performance compared to generic safety prompts or schema-only baselines.

While API-based models achieve higher aggregate alignment (up to 89.1%) than local models, none of the tested LLMs are sufficient for standalone safety. A critical failure mode is the 'False Execute,' where a model incorrectly authorizes an action that should have been refused or deferred. Even the best-performing models produced multiple False Executes. Furthermore, the study highlights a safety-utility trade-off: simpler models often achieve lower False Execute rates only by defaulting to excessive, indiscriminate refusals. The authors conclude that because LLMs cannot eliminate these safety-critical errors, deployment must rely on an independent, rule-based enforcement layer that validates permissions and vehicle constraints before any command is executed.