\textsc{IH-Benchmark}: A Conflict-Centered Benchmark for Instruction-Hierarchy Robustness in LLM Applications
2026-07-28 • Cryptography and Security
Cryptography and SecuritySoftware Engineering
AI summaryⓘ
The authors created a test called IH-Benchmark to see which instructions language models follow when given conflicting orders from different sources, like the system, the user, or tools. They found that models often handle direct conflicts between system and user instructions differently than conflicts involving tools. Some models improve when given stronger warnings, while others still fail regardless of how strict the rules get. The study shows that understanding how models follow instruction priorities is complex and varies depending on the situation and type of conflict.
language modelsinstruction hierarchybenchmarkconflicting instructionssystem-user conflictuser-tool conflictconstraint hardeningLLM robustnesspredicate DSLmodel evaluation
Authors
Conor McCauley, Zeliang Kan, Jason Martin
Abstract
When a language model receives conflicting instructions from different priority levels, which one does it actually follow? This question lies at the heart of reliable LLM deployment. Existing benchmarks answer this only partially, often focusing on a single hierarchy edge or adapting public datasets with limited tool-use coverage. We present IH-Benchmark, a conflict-centered benchmark for instruction-hierarchy robustness across direct system-user conflicts (S>U) and tool-mediated user-tool (U>T) conflicts. IH-Benchmark is built from a human-authored taxonomy of 44 constraint families across generic, health, finance, retail, and coding settings, and evaluates scenarios with a uniform binary pass/fail protocol combining a predicate DSL with category-scoped LLM judges. Across 37 evaluated models, hierarchy compliance ranges from 98.2% to 20.5%. We find that strong S>U compliance is not a reliable proxy for U>T robustness: several models preserve system constraints under direct user conflict but degrade sharply when conflicting instructions appear in tool outputs. Constraint hardening also reveals a split between models: some failures are largely fixed by stronger warnings, while others persist across all strictness levels. Finally, the most revealing failures are often subtle rather than overtly dangerous; models resist unauthorized purchases or bulk ticket closure more reliably than injected disclaimers or small factual distortions. These results suggest that instruction-hierarchy robustness is not a single capability, but a set of behaviors that must be evaluated across conflict surfaces, constraint types, and attack presentations.