\textsc{IH-Benchmark}: A Conflict-Centered Benchmark for Instruction-Hierarchy Robustness in LLM Applications

2026-07-28

AI Summary

This work addresses the challenge that large language models (LLMs) struggle to reliably adhere to intended instruction priorities in scenarios involving hierarchical conflicts, thereby compromising deployment reliability. The study presents the first systematic benchmark encompassing multi-domain, multi-level instruction conflicts and introduces a fine-grained evaluation framework based on a taxonomy of constraint families and a predicate-based domain-specific language (DSL). This framework covers both direct system–user conflicts and tool-mediated user–tool conflicts, leveraging 44 manually constructed constraint families, domain-specialized LLM judges, and constraint-strengthening test methodologies. Experiments across 37 models reveal substantial variation in hierarchical compliance rates (20.5%–98.2%) and demonstrate that robustness in system–user settings does not generalize to tool-mediated contexts. Moreover, while some models resist explicit violations, they remain vulnerable to subtle perturbations, underscoring that instruction hierarchy robustness constitutes a multidimensional capability.

Abstract

When a language model receives conflicting instructions from different priority levels, which one does it actually follow? This question lies at the heart of reliable LLM deployment. Existing benchmarks answer this only partially, often focusing on a single hierarchy edge or adapting public datasets with limited tool-use coverage. We present IH-Benchmark, a conflict-centered benchmark for instruction-hierarchy robustness across direct system-user conflicts (S>U) and tool-mediated user-tool (U>T) conflicts. IH-Benchmark is built from a human-authored taxonomy of 44 constraint families across generic, health, finance, retail, and coding settings, and evaluates scenarios with a uniform binary pass/fail protocol combining a predicate DSL with category-scoped LLM judges. Across 37 evaluated models, hierarchy compliance ranges from 98.2% to 20.5%. We find that strong S>U compliance is not a reliable proxy for U>T robustness: several models preserve system constraints under direct user conflict but degrade sharply when conflicting instructions appear in tool outputs. Constraint hardening also reveals a split between models: some failures are largely fixed by stronger warnings, while others persist across all strictness levels. Finally, the most revealing failures are often subtle rather than overtly dangerous; models resist unauthorized purchases or bulk ticket closure more reliably than injected disclaimers or small factual distortions. These results suggest that instruction-hierarchy robustness is not a single capability, but a set of behaviors that must be evaluated across conflict surfaces, constraint types, and attack presentations.

Problem

• instruction-hierarchy robustness
• conflicting instructions
• LLM reliability
• tool-mediated conflicts
• system-user conflicts

Innovation

• instruction-hierarchy robustness
• conflict-centered benchmark
• LLM safety evaluation
• tool-mediated conflicts
• constraint taxonomy