语言模型在指令冲突时如何抉择？研究发现其内部有可读的决策信号。
How Language Models Choose Sides: Internal Representations of Instruction Hierarchy
- 通过设计41对冲突指令测试，发现模型分三类：服从系统、反系统、无敏感性
- Llama-3.1-8B仅在0.10的冲突试验中听从系统，但内部信号仍可解码至0.97准确率
- 成功干预需关注信号读取几何结构，而非单纯提升探测精度
我们研究指令微调的大语言模型如何处理系统与用户指令之间的直接冲突。引入包含41对约束的基准测试，配备确定性验证器，并在相同基线、冲突及同通道控制条件下评估八种模型。行为上，模型按系统权威差值分为三类：尊重层级的模型将系统通道视为权威信号，反层级模型遵循系统的频率低于同通道基线预测，无影响模型则对通道不敏感。其中Llama-3.1-8B是表现最差的反层级案例，在冲突试验中仅0.10次听从系统。我们以该行为失败案例探究用户偏好仲裁是否因缺乏内部冲突解决信号。结果表明并非如此：在Llama-3.1-8B上，冲突结果可从残差流激活中线性解码，达到0.97平衡准确率，比仅依赖元数据的基线高17个百分点；Qwen2.5-7B和gpt-oss-20b也表现出类似信号。通过第12层四个冲突逻辑回归方向的均值进行调控，真实系统合规率从0.132提升至0.530；而主要基于合并可分性的方向则效果不佳。因此，用户偏好仲裁可与可读的内部仲裁信号共存，成功干预取决于读出几何结构，而非探测精度本身。
原文摘要 · Abstract (English)
We study how instruction-tuned LLMs arbitrate direct conflicts between system and user instructions. We introduce a benchmark of 41 paired constraints with deterministic verifiers and evaluate eight models under matched baseline, conflict, and same-channel control conditions. Behaviourally, the models split into three regimes by System Authority Delta: hierarchy-respecting models use the system channel as an authority signal, anti-hierarchy models follow the system less often than their same-channel baseline predicts, and no-effect models show little channel sensitivity. Llama-3.1-8B is the strongest anti-hierarchy case in our suite, following the system in only 0.10 of conflict trials. We use this behavioural failure case to ask whether user-preferring arbitration reflects the absence of an internal conflictresolution signal. It does not: on Llama-3.1-8B, the conflict outcome is linearly decodable from residual-stream activations at 0.97 balanced accuracy, 17 percentage points above a metadata-only baseline, with analogous signals on Qwen2.5-7B and gpt-oss-20b. Steering with a layer-12 mean of four per-conflict logistic-regression directions raises genuine system compliance from 0.132 to 0.530, while directions selected mainly for pooled separability steer poorly. User-preferring conflict resolution can therefore coexist with a readable internal arbitration signal, and successful intervention depends on the geometry of the readout rather than probe accuracy alone
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。