Search papers, labs, and topics across Lattice.
This paper introduces IH-Benchmark, a comprehensive benchmark designed to evaluate instruction-hierarchy robustness in language models by analyzing their responses to conflicting instructions across various domains. The study reveals significant variability in compliance rates among 37 models, with hierarchy adherence ranging from 98.2% to 20.5%, and highlights that strong compliance in direct system-user conflicts does not guarantee robustness in tool-mediated conflicts. Notably, the findings indicate that instruction-hierarchy robustness encompasses diverse behaviors that require thorough evaluation across multiple conflict scenarios and constraint types.
Hierarchy compliance in LLMs can drop to as low as 20.5% when faced with conflicting tool-mediated instructions, challenging assumptions about model reliability.
When a language model receives conflicting instructions from different priority levels, which one does it actually follow? This question lies at the heart of reliable LLM deployment. Existing benchmarks answer this only partially, often focusing on a single hierarchy edge or adapting public datasets with limited tool-use coverage. We present IH-Benchmark, a conflict-centered benchmark for instruction-hierarchy robustness across direct system-user conflicts (S>U) and tool-mediated user-tool (U>T) conflicts. IH-Benchmark is built from a human-authored taxonomy of 44 constraint families across generic, health, finance, retail, and coding settings, and evaluates scenarios with a uniform binary pass/fail protocol combining a predicate DSL with category-scoped LLM judges. Across 37 evaluated models, hierarchy compliance ranges from 98.2% to 20.5%. We find that strong S>U compliance is not a reliable proxy for U>T robustness: several models preserve system constraints under direct user conflict but degrade sharply when conflicting instructions appear in tool outputs. Constraint hardening also reveals a split between models: some failures are largely fixed by stronger warnings, while others persist across all strictness levels. Finally, the most revealing failures are often subtle rather than overtly dangerous; models resist unauthorized purchases or bulk ticket closure more reliably than injected disclaimers or small factual distortions. These results suggest that instruction-hierarchy robustness is not a single capability, but a set of behaviors that must be evaluated across conflict surfaces, constraint types, and attack presentations.
