诊断推理模型指令冲突失效,提出无需训练的自我监控修复机制。
Where Instruction Hierarchy Breaks: Diagnosing and Repairing Failures in Reasoning Language Models

- 拆解指令层级失败为识别、冲突解决、响应生成三阶段,定位问题根源。
- 在多个模型上发现主导失败模式随任务和上下文长度变化,非单一原因。
- 提出输入并行与输出串行双监控,显著降低违规率,最高提升99%合规性。
部署于智能体工作流中的推理语言模型需遵循指令层级:当多源指令冲突时,应执行权限最高的有效指令。现有基准多以最终响应是否合规进行端到端评估,但非合规结果可能源于多种不同故障——模型可能未能识别上下文中的相关指令,或无法解决已识别指令间的冲突,或虽正确解决冲突却仍生成违规响应。本文提出白盒诊断框架,将指令层级失败细分为指令识别、冲突解决与响应实现三个环节,提升故障可解释性。我们在长上下文版本的IHEval与IHChallenge数据集上评估Gemma-4-31B-IT、Qwen3.6-35B-A3B与Claude Sonnet 4.6三款模型,发现主导失败模式因模型、任务及上下文长度而异。基于观察——模型在显式提示下常能识别冲突并输出违规内容,我们提出两种免训练自监控机制:用于生成前低延迟冲突检测的并行输入监控,以及用于响应层面审查与修复的串行输出监控。在Gemma-4-31B-IT、Claude Sonnet 4.6与GPT-5.3上,最强监控使规则遵循非合规率降低81%-99%,其中GPT-5.3在静态攻击下降低86%,自适应攻击下降低45%。
原文摘要 · Abstract (English)
Reasoning language models deployed in agentic workflows must follow an instruction hierarchy: when instructions from different sources conflict, the model should obey the highest-privilege applicable instruction. Existing benchmarks largely measure this behavior end-to-end, asking whether the final response is compliant. However, a non-compliant response can arise from several distinct failures: the model may fail to identify the relevant instructions in context, fail to resolve conflicts among identified instructions, or correctly resolve the conflict in its reasoning while still producing a violating response. We introduce a white-box diagnostic framework that localizes instruction hierarchy failures into instruction identification, conflict resolution, and response realization, making failures more interpretable. We evaluate three reasoning models--Gemma-4-31B-IT, Qwen3.6-35B-A3B, and Claude Sonnet 4.6--on long-context adaptations of IHEval and IHChallenge, and find that the dominant failure mode varies across models, tasks, and context length. Building on the observation that models can often detect conflicts and output violations when explicitly prompted, we propose two training-free self-monitoring mechanisms: a parallel input monitor for low-latency conflict detection before generation, and a sequential output monitor for response-level review and repair. Across Gemma-4-31B-IT, Claude Sonnet 4.6, and GPT-5.3, the strongest monitor reduces rule-following non-compliance by 81-99%, with GPT-5.3 reductions of 86% under static attacks and 45% under adaptive attacks.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。