IH-Benchmark: A Conflict-Centered Benchmark for Instruction-Hierarchy Robustness in LLM Applications
- ID: d5a9359c
- arXiv: https://arxiv.org/abs/2607.25987
- PDF: https://arxiv.org/pdf/2607.25987
- 作者: Conor McCauley, Zeliang Kan, Jason Martin
- 发布: 2026-07-28
- arXiv 分类: cs.CR, cs.SE
- 抓取时间: 2026-07-30
中文导读
IH-Benchmark 评估 37 个模型在系统-用户冲突 (S>U) 和工具介导用户-工具冲突 (U>T) 下的指令层级鲁棒性。合规率从 98.2% 到 20.5%。关键发现：S>U 合规不等于 U>T 鲁棒性；多个模型在直接用户冲突下保持约束，但在工具输出中出现冲突指令时急剧退化。
为什么值得关注
S>U 合规 ≠ U>T 鲁棒：工具输出注入是独立攻击面，37 模型合规 20-98%
English Abstract
When a language model receives conflicting instructions from different priority levels, which one does it actually follow? This question lies at the heart of reliable LLM deployment. Existing benchmarks answer this only partially, often focusing on a single hierarchy edge or adapting public datasets with limited tool-use coverage. We present IH-Benchmark, a conflict-centered benchmark for instruction-hierarchy robustness across direct system-user conflicts (S>U) and tool-mediated user-tool (U>T) conflicts. IH-Benchmark is built from a human-authored taxonomy of 44 constraint families across generic, health, finance, retail, and coding settings, and evaluates scenarios with a uniform binary pass/fail protocol combining a predicate DSL with category-scoped LLM judges. Across 37 evaluated models, hierarchy compliance ranges from 98.2% to 20.5%. We find that strong S>U compliance is not a reliable proxy for U>T robustness: several models preserve system constraints under direct user conflict but degrade sharply when conflicting instructions appear in tool outputs. Constraint hardening also reveals a split between models: some failures are largely fixed by stronger warnings, while others persist across all strictness levels. Finally, the most revealing failures are often subtle rather than overtly dangerous; models resist unauthorized purchases or bulk ticket closure more reliably than injected disclaimers or small factual distortions. These results suggest that instruction-hierarchy robustness is not a single capability, but a set of behaviors that must be evaluated across conflict surfaces, constraint types, and attack presentations.