IH-Benchmark: A Conflict-Centered Benchmark for Instruction-Hierarchy Robustness in LLM Applications

• URL: http://arxiv.org/abs/2607.25987v2
• Date: Wed, 29 Jul 2026 14:39:56 GMT
• Title: IH-Benchmark: A Conflict-Centered Benchmark for Instruction-Hierarchy Robustness in LLM Applications
• Abstract summary: IH-Benchmark is a conflict-centered benchmark for instruction-hierarchy robustness across direct system-user conflicts (S>U) and tool-mediated user-tool (U>T) conflicts.<n>Across 37 evaluated models, hierarchy compliance ranges from 98.2% to 20.5%.<n>We find that strong S>U compliance is not a reliable proxy for U>T robustness.
• Score: 1.9966419762834917
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: When a language model receives conflicting instructions from different priority levels, which one does it actually follow? This question lies at the heart of reliable LLM deployment. Existing benchmarks answer this only partially, often focusing on a single hierarchy edge or adapting public datasets with limited tool-use coverage. We present IH-Benchmark, a conflict-centered benchmark for instruction-hierarchy robustness across direct system-user conflicts (S>U) and tool-mediated user-tool (U>T) conflicts. IH-Benchmark is built from a human-authored taxonomy of 44 constraint families across generic, health, finance, retail, and coding settings, and evaluates scenarios with a uniform binary pass/fail protocol combining a predicate DSL with category-scoped LLM judges. Across 37 evaluated models, hierarchy compliance ranges from 98.2% to 20.5%. We find that strong S>U compliance is not a reliable proxy for U>T robustness: several models preserve system constraints under direct user conflict but degrade sharply when conflicting instructions appear in tool outputs. Constraint hardening also reveals a split between models: some failures are largely fixed by stronger warnings, while others persist across all strictness levels. Finally, the most revealing failures are often subtle rather than overtly dangerous; models resist unauthorized purchases or bulk ticket closure more reliably than injected disclaimers or small factual distortions. These results suggest that instruction-hierarchy robustness is not a single capability, but a set of behaviors that must be evaluated across conflict surfaces, constraint types, and attack presentations.

Related papers

• KC-Bench: A Dynamic Interactive Benchmark for Evaluating Knowledge Conflicts in LLM Agents [5.481534695653804]
  We introduce KC-Bench, a controlled multi-turn benchmark for measuring this capability.<n>Its 238 tasks are manually screened from more than 1,000 generated candidates.<n>No model handles factual correction, identity consistency checking, and temporal conflict resolution reliably across all settings.
  arXiv  Detail & Related papers  (2026-09-03T09:35:14Z)
• PluginEval: A Diagnostic Benchmark for Fine-Grained Error Attribution in Function Calling [11.1017602726296]
  Large Language Models increasingly operate as autonomous agents.<n>Current benchmarks face three structural limitations.<n>Eval is a benchmark constructed through a two-stage framework.
  arXiv  Detail & Related papers  (2026-08-09T13:25:54Z)
• The Patchwork Problem in LLM-Generated Code [3.4562767039451674]
  This paper formalizes structural coherence as consistency invariants over graph representations of repository artifacts.<n> Empirical evaluation across two frontier models reveals that the vast majority of structural failures evade type checking, testing, and SAST entirely.
  arXiv  Detail & Related papers  (2026-07-09T23:01:54Z)
• Beyond the Prompt: Jailbreaking Function-Calling LLMs via Simulated Moderation Traces [32.850551109913845]
  Jailbreak attacks remain a critical threat to the safe deployment of large language models (LLMs)<n>We show that this prompt-centric paradigm overlooks a structural vulnerability in stateful, function-calling environments.<n>We exploit this architectural flaw through SMT, a black-box attack framework based on Simulated Moderation Traces.
  arXiv  Detail & Related papers  (2026-07-01T06:08:07Z)
• PRIME: Evaluating Prompt Resolution Under Incompatible Instructions in LLMs [1.7243216387069673]
  Large language models (LLMs) often encounter conflicting prompts.<n>Current instruction following benchmarks assess those meta-instructions in isolation.<n>We introduce a framework textitPRIME to analyze behavior of LLMs when provided with conflicting instructions.
  arXiv  Detail & Related papers  (2026-06-21T12:30:23Z)
• CORE: Conflict-Oriented Reasoning for General Multimodal Manipulation Detection [56.64398465636452]
  generative AI has made multimodal fake news increasingly realistic and pervasive, posing severe threats to public trust and social stability.<n>We propose textbfConflict-textbfOriented textbfREasoning (textbfCORE) framework, an effective paradigm that learns to endows multimodal large language models (MLLMs) with explicit conflict-capturing capability.<n> CORE achieves robust and generalizable conflict detection, effectively and rapidly adapting to unseen manipulation types with a few samples or in even zero-shot settings.
  arXiv  Detail & Related papers  (2026-06-02T02:53:48Z)
• LiveFMBench: Unveiling the Power and Limits of Agentic Workflows in Specification Generation [75.05397479715576]
  Large language models (LLMs) and agents have shown promising progress, but their true capabilities and failure modes remain unclear.<n>We present the first systematic and contamination-aware study of LLM- and agent-based formal specification generation for C programs.
  arXiv  Detail & Related papers  (2026-05-02T11:31:33Z)
• Many-Tier Instruction Hierarchy in LLM Agents [71.50171548872596]
  Many-Tier Instruction Hierarchy (ManyIH) is a paradigm for resolving instruction conflicts among instructions with arbitrarily many privilege levels.<n>ManyIH-Bench composes constraints developed by LLMs and verified by humans to create realistic and difficult test cases spanning 46 real-world agents.
  arXiv  Detail & Related papers  (2026-04-10T16:00:04Z)
• RULERS: Locked Rubrics and Evidence-Anchored Scoring for Robust LLM Evaluation [15.787947727055611]
  We introduce RULERS, a compiler-executor framework that transforms natural language rubrics into executable specifications.<n>RULERS operates by compiling criteria into versioned immutable bundles, enforcing structured decoding with deterministic evidence verification, and applying lightweight Wasserstein-based post-hoc calibration.
  arXiv  Detail & Related papers  (2026-01-13T15:31:42Z)
• Diagnose, Localize, Align: A Full-Stack Framework for Reliable LLM Multi-Agent Systems under Instruction Conflicts [75.20929587906228]
  Large Language Model (LLM)-powered multi-agent systems (MAS) have rapidly advanced collaborative reasoning, tool use, and role-specialized coordination in complex tasks.<n>However, reliability-critical deployment remains hindered by a systemic failure mode: hierarchical compliance under instruction conflicts.
  arXiv  Detail & Related papers  (2025-09-27T08:43:34Z)
• Steerable Adversarial Scenario Generation through Test-Time Preference Alignment [58.37104890690234]
  Adversarial scenario generation is a cost-effective approach for safety assessment of autonomous driving systems.<n>We introduce a new framework named textbfSteerable textbfAdversarial scenario textbfGEnerator (SAGE)<n>SAGE enables fine-grained test-time control over the trade-off between adversariality and realism without any retraining.
  arXiv  Detail & Related papers  (2025-09-24T13:27:35Z)
• Do Large Language Model Benchmarks Test Reliability? [66.1783478365998]
  We investigate how well current benchmarks quantify model reliability.<n>Motivated by this gap in the evaluation of reliability, we propose the concept of so-called platinum benchmarks.<n>We evaluate a wide range of models on these platinum benchmarks and find that, indeed, frontier LLMs still exhibit failures on simple tasks.
  arXiv  Detail & Related papers  (2025-02-05T18:58:19Z)
• CONGRA: Benchmarking Automatic Conflict Resolution [3.9910625211670485]
  ConGra is a benchmarking scheme designed to evaluate the performance of software merging tools. We build a large-scale evaluation dataset based on 44,948 conflicts from 34 real-world projects.
  arXiv  Detail & Related papers  (2024-09-21T12:21:41Z)
• AdaCAD: Adaptively Decoding to Balance Conflicts between Contextual and Parametric Knowledge [57.66282463340297]
  Knowledge conflict arises from discrepancies between information in the context of a large language model and the knowledge stored in its parameters.<n>We propose a fine-grained, instance-level approach called AdaCAD, which dynamically infers the weight of adjustment based on the degree of conflict.<n>We show that ADACAD consistently outperforms other decoding baselines with average QA accuracy gains of 14.21% (absolute) over a static contrastive baseline, and improves the factuality of summaries by 6.19 (AlignScore)
  arXiv  Detail & Related papers  (2024-09-11T16:35:18Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.