\textsc{IH-Benchmark}: A Conflict-Centered Benchmark for Instruction-Hierarchy Robustness in LLM Applications

LLM Other LLM NLP Benchmarks AI Safety / AI Ethics PIAAP AVAR
2026年07月28日
当语言模型收到来自不同优先级层级的相互冲突指令时，它究竟会遵循哪一条？这一问题正是可靠部署大语言模型（LLM）的核心所在。现有基准测试仅能部分回答该问题：它们往往仅关注指令层级结构中的某一条边界（如系统与用户之间），或仅对公开数据集进行有限适配，且在工具调用场景下的覆盖范围十分不足。为此，我们提出 IH-Benchmark——一个以指令冲突为中心、专门用于评估指令层级鲁棒性的新型基准，涵盖两类典型冲突：一是系统与用户之间的直接冲突（S>U），二是经由工具中介的用户与工具输出之间的冲突（U>T）。IH-Benchmark 基于人工构建的分类体系，涵盖通用、医疗、金融、零售及编程五大领域，共归纳出 44 类约束类型；其评测采用统一的二元通过/失败判定协议，结合一种谓词式领域特定语言（Predicate DSL）与按类别划分的大语言模型评判器（category-scoped LLM judges）。在所评估的 37 个模型中，指令层级合规率跨度极大，从 98.2% 到 20.5% 不等。我们发现，系统-用户（S>U）层面的强合规性并不能可靠地预测用户-工具（U>T）层面的鲁棒性：若干模型虽能在用户直接挑战系统指令时有效维持系统约束，却在工具输出中出现冲突指令时性能急剧下降。进一步开展约束强化（constraint hardening）实验后，我们还观察到模型间存在明显分化：部分模型的失败可通过增强警告提示得到显著改善，而另一些模型的缺陷则在所有严格程度下均持续存在。最后，最具揭示性的失效案例往往并非显而易见的严重风险（如执行非法交易或批量关闭工单），而是更为隐蔽的偏差——例如，模型对擅自插入免责声明或细微事实性扭曲的抵抗能力，远弱于其对未经授权购买行为或批量工单关闭的抵制能力。上述结果表明，指令层级鲁棒性并非单一能力，而是一组需在多种冲突界面（conflict surfaces）、各类约束类型（constraint types）以及不同攻击呈现形式（attack presentations）下分别检验的复合行为。
When a language model receives conflicting instructions from different priority levels, which one does it actually follow? This question lies at the heart of reliable LLM deployment. Existing benchmarks answer this only partially, often focusing on a single hierarchy edge or adapting public datasets with limited tool-use coverage. We present IH-Benchmark, a conflict-centered benchmark for instruction-hierarchy robustness across direct system-user conflicts (S>U) and tool-mediated user-tool (U>T) conflicts. IH-Benchmark is built from a human-authored taxonomy of 44 constraint families across generic, health, finance, retail, and coding settings, and evaluates scenarios with a uniform binary pass/fail protocol combining a predicate DSL with category-scoped LLM judges. Across 37 evaluated models, hierarchy compliance ranges from 98.2% to 20.5%. We find that strong S>U compliance is not a reliable proxy for U>T robustness: several models preserve system constraints under direct user conflict but degrade sharply when conflicting instructions appear in tool outputs. Constraint hardening also reveals a split between models: some failures are largely fixed by stronger warnings, while others persist across all strictness levels. Finally, the most revealing failures are often subtle rather than overtly dangerous; models resist unauthorized purchases or bulk ticket closure more reliably than injected disclaimers or small factual distortions. These results suggest that instruction-hierarchy robustness is not a single capability, but a set of behaviors that must be evaluated across conflict surfaces, constraint types, and attack presentations.
许愿