{"id":"235fcd76-33b2-43aa-834e-7923d458233c","arxiv_id":"2502.08745","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"IHEval shows that current language models often follow lower-priority instructions over system messages, and simple prompting does not fix the problem.","lead":"The paper introduces IHEval, a 3,538-example benchmark that checks whether language models obey a fixed priority order: system message first, then user message, conversation history, and tool output. Tests on 13 models show large accuracy drops when lower-priority instructions conflict with higher-priority ones, with the best open-source model at only 48%.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Score gaps partly encode a normative choice: IHEval counts only strict execution of the highest-priority instruction as correct, so the headline '48%' may reflect refusal/recency policies that are defensible outside safety-critical settings.","rationale":"The paper is carefully built and the results are internally consistent: the task cards document systematic failures, the aligned/conflict contrast is meaningful, and programmatic evaluation is a real strength. My objection is not that the data are fabricated or that the measured gaps are absent; it is that the numeric headline is computed under a contested answer key. The reader's weakest_assumption identifies the same issue in Section 3 and Appendix B, and I agree with that reading. This concern is load-bearing because if the answer key were changed to reward clarification or to treat the most recent user request as authoritative, many conflict examples scored as errors would become correct, and the open-source 47.8% figure could move substantially. The paper gives a defensible rationale for its rule—developer-set system messages and safety—and the footnote narrows the intended deployment, so I do not regard this as fatal. It does mean the benchmark should not be used as a definitive measure of 'instruction hierarchy following' without a validity check of the answer key. The proposed human-preference test would directly settle whether the stipulated hierarchy matches what users or developers actually want in these nine tasks, or whether the benchmark measures a specific policy preference instead.","tokens_in":25504,"tokens_out":10458,"duration_ms":109008,"concrete_test":"Run a human-preference validation on a stratified sample (e.g., 200 examples, 25 per task) of IHEval conflict cases. Present each case as a deployment scenario with a developer-set system message, show the model's two plausible responses (follow system vs follow user vs clarify), and ask annotators which is appropriate. Then recompute conflict-setting scores using the majority-approved answer as correct. If less than about 80% of IHEval's stated correct answers are majority-approved, the evaluation criterion is not neutral and the reported gap conflates hierarchy-following with a contested policy; if the 80% threshold is met, the normative concern is empirically rebutted.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing step is the scoring rule in §3 and Appendix B, not the data collection. A conflict response is correct only if the model executes the higher-priority instruction and does not clarify, partially comply, or follow the user's latest request. The central claim—that models are not optimized for the instruction hierarchy—holds only if this fixed order (system > user > history > tool) is the right normative policy for all nine tasks. In several non-safety tasks this is not self-evident: in Task Execution-Generation the system message asks for Spanish translation and the user asks for a math solution; following the user is helpful rather than unsafe. In Tool Use-Injected the user's own request is the main instruction and a tool-output injection is lower priority, so the hierarchy itself selects the task. IHEval therefore cannot distinguish 'model lacks hierarchy awareness' from 'model applies a different, arguably reasonable policy (e.g., recency or user autonomy).' The paper's own Table 4 shows models follow the most recent user instruction, which is a rational policy under ordinary chat training. Because all headline numbers (70.0%, 47.8%, 14.0%) are scored under the stipulated rule, the magnitude of the failure is intertwined with this normative assumption.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"IHEval introduces a 3,538-example benchmark, spanning nine tasks in four categories (rule following, task execution, safety defense, tool use), for measuring how well language models follow the instruction hierarchy (system > user > conversation history > tool outputs). For each task the authors construct three settings: a reference setting with all instructions merged into a single user message, an aligned setting with hierarchical inputs whose priorities agree, and a conflict setting in which a lower-priority instruction contradicts the higher-priority one. They evaluate 13 models from five families under deterministic decoding, using programmatic metrics (IFEval-style strict and loose rules, F1, ROUGE-L, accuracy, defense-success criteria). The central findings are that models perform inconsistently between the reference and aligned settings, that all models drop sharply in the conflict setting (GPT-4o at 70.0, Qwen-2 72B at 47.8, Llama-3.1 70B at 14.0 aggregate), that results are sensitive to the strictness of instruction wording, that an explicit instruction-priority prompt does not restore performance, and that larger scale helps aligned but not conflict performance. The paper concludes that current LMs are not sufficiently optimized for the instruction hierarchy.","tokens_in":25728,"tokens_out":15609,"duration_ms":130198,"significance":"The benchmark fills a genuine gap: SysBench covers only system-message adherence, and Wallace et al. (2024) evaluated only GPT models on proprietary safety data, whereas IHEval covers all four hierarchy levels with open, programmatic evaluation. The strengths are concrete: fully deterministic scoring with no LLM-as-judge, 13 models across five families, per-task breakdowns in Tables 5-10, task cards in Appendix D, a useful negative result on prompt-based intervention (section 4.4), and an informative error-type decomposition (Figure 6) showing that models often combine or partially execute both instructions. If the measurement is valid, the consistent conflict-setting drops constitute an important signal for training and evaluation. The main validity risks, developed in the major comments, concern the normative scoring rule and the reference-setting confound; both affect the interpretation of magnitudes rather than the existence of the phenomenon.","major_comments":[{"comment":"The scoring rule in §3 ('Evaluation' paragraph) and Appendix B counts only strict execution of the highest-priority instruction as correct, so clarification, refusal, partial compliance, and following the most recent user instruction are all scored as errors. The headline conflict-setting numbers (Table 1: 14.0% for Llama-3.1-70B, 47.8% for Qwen-2 72B, 70.0% for GPT-4o) are therefore measurements of adherence to one stipulated policy, not a model-neutral measure of 'hierarchy awareness.' Since §4.5 and Table 4 show that models are trained to follow the most recent user instruction, recency-following is a defensible policy in ordinary chat deployments, and in at least one task (Task Execution-Generation, where the system demands translation but the user asks for a math solution) following the user is arguably the more helpful behavior. The abstract, §1, and §5 state that models 'fail' to resolve conflicts and require 'targeted optimization'; these claims should be scoped to the stated deployment model (developer-set system messages, footnote 1) and supported by either per-task arguments for the normative priority or a robustness analysis that scores alternative behaviors separately—the error-type taxonomy in Figure 6 already provides the machinery. Without this, the magnitude of the reported failure is not separable from the normative stipulation.","section":"§3 (Evaluation), Appendix B; Table 1"},{"comment":"The reference setting in §3 ('Task Settings') does not isolate 'original task performance' as claimed: merging all hierarchical instructions into a single user message removes the hierarchy dimension while simultaneously moving the instruction from the system channel to the user channel and shortening the input structure. The aligned-versus-reference gaps in §4.1 (e.g., Llama-3.1-70B's average 13-point drop) therefore confound hierarchy-following with instruction-position and phrasing sensitivity. This weakens the paper's first key finding that models are 'less optimized for hierarchical inputs.' I suggest a control that holds the instruction channel fixed across conditions (e.g., a reference condition with the same instruction placed in a system message and an instruction-free user message), or a per-task decomposition of the channel effect. The aligned-versus-conflict comparison used for the headline claim is not affected by this confound.","section":"§3 (Task Settings); §4.1"}],"minor_comments":[{"comment":"The sentence 'GPT-4o's strong performance on IHEval tasks further supports that our criteria reflect industry practices' is circular, because GPT-4o is the model whose training target (Wallace et al., 2024) is the hierarchy under test; its high score cannot independently validate the criteria, so this sentence should be removed or reframed.","section":"Appendix B"},{"comment":"Please document the screening procedure and the excluded candidates behind the statement that conflicting instructions were drawn 'based on heuristics and trials on sample data,' since this affects the benchmark's difficulty calibration and the reproducibility of the reported drop magnitudes.","section":"§3 (Task Design)"},{"comment":"The claim that asking for clarification gives instructions 'the same level of priority' is not self-evident, because clarification is often a reasonable strategy for resolving conflicting requests; please provide an argument or report the frequency and treatment of clarification-only responses.","section":"§3 (Evaluation)"},{"comment":"The comparison stating that IHEval 'reveals a larger performance gap between aligned and conflict inputs' than SysBench is made without running SysBench on the same model set; please add the head-to-head results or soften the claim.","section":"§4.1"},{"comment":"The caption states that error proportions are computed over 'all models in Figure 1,' but Figure 1 is the hierarchy diagram rather than a results table; the intended reference is presumably the models in Table 1.","section":"Figure 6"},{"comment":"The inverse-scaling observation (Claude-Haiku outperforming Claude-Sonnet on 5 of 9 tasks) and the monotone-scaling claim rest on a single model pair per family without significance testing; consider a sign test over the five families or softer wording.","section":"§4.2"},{"comment":"The caption defines 'All Models' as the average over the models in Table 1, which is a selected subset of six rather than all 13 evaluated models; please clarify to avoid confusing the reader.","section":"Table 4"}],"recommendation":"major_revision","confidential_remarks":"To the editor: the central risk is interpretive rather than technical; the revision path (alternative scoring rules, per-task normative arguments, and a channel-controlled reference condition) is feasible with the existing data and error-type annotations, so I do not see a need for decisive rejection. The benchmark is a useful community resource, and the programmatic evaluation is a genuine strength. The overlap with SysBench and Wallace et al. (2024) is cited fairly. One scope consideration: the paper would be strengthened by explicitly presenting IHEval as measuring adherence to a developer-defined hierarchy under ChatGPT-style deployments, since that is what the scoring rule operationalizes."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Here's my take on IHEval. It does what it says: a 3,538-example, nine-task benchmark covering four input types, scored programmatically, run on 13 popular models. The core empirical finding—performance collapses when low-priority instructions conflict with high-priority ones—is real and consistent across every model. GPT-4o at 70.0 and Qwen-2 at 47.8 on the conflict setting, Llama-3.1-70B at 14.0. Those gaps hold up as a description of how these models behave under the paper's scoring rule. The detailed error analysis (Figure 6, task cards) is genuinely useful; the distinction between 'followed the conflicting instruction' and 'synthesized both' is informative.\n\nThe main caveat, which the stress-test note gets right, is that the scoring rule in §3 and Appendix B encodes a normative policy: system over user over history over tool, and only strict execution of the highest-priority instruction counts. Anything else—clarification, partial compliance, answering the latest user request—is scored as a failure. That is a legitimate evaluation design for developer-controlled system messages in safety-critical deployments. But it is not self-evidently the right policy for all nine tasks; the translation-vs-math example is a case where following the user is arguably the helpful response. Table 4 also shows models do follow the most recent user instruction when history conflicts, which is a rational policy for ordinary chat. So the headline '48%' is a real number, but it measures adherence to a stipulated priority order, not a universal capability. The paper is fairly transparent about this in the footnote and Appendix B, but the abstract and intro treat the hierarchy as if it's given by nature.\n\nOther soft spots: the reference setting merges all instructions into one user message, changing prompt structure as well as hierarchy, so some of the aligned-vs-reference drop is a prompt-format effect. Conflict instructions were chosen by heuristics and trials, with excluded variants not reported, so there is selection risk. No error bars or significance tests is minor for a deterministic eval with 13 models, though some task sizes are small (100 examples). Appendix B's use of GPT-4o's high score as evidence that the criteria match industry practice is mildly circular, but it is supplemental.\n\nAll that said, the central claim holds for the safety tasks (hijack, extraction), where developer priority is clearly right, and the benchmark is a solid contribution. I'd cite it and send it to review. The authors should release data and code explicitly and discuss the normative assumption more carefully. Recommendation: send to a serious referee; ask them to engage with the scoring rule and the reference-setting confound.","headline":"A well-built programmatic benchmark with a clear normative framing: the conflict gaps are real, but the '48%' number measures a stipulated priority order that not every deployment would choose.","tokens_in":26272,"tokens_out":1925,"would_cite":true,"duration_ms":17004,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"Current language models are not optimized for the instruction hierarchy: when system, user, history, and tool instructions conflict, the best open-source model resolves only 48% of cases.","keywords":["instruction hierarchy","benchmark","system messages","instruction following","conflicting instructions","prompt injection","safety evaluation","large language models"],"falsifier":"Present the same IHEval conflict pairs with the priority labels reversed, for example a tool output demanding format A while a system message demands format B, so that recency and hierarchy point in opposite directions; if models' scores track the stated priority order regardless of which slot carries the instruction, the hierarchy itself is being encoded, whereas if scores track recency or emphasis instead, the reported conflict gap reflects a superficial cue rather than hierarchy-following.","tokens_in":25294,"feed_emoji":"⚖️","tokens_out":9800,"duration_ms":76792,"temperature":0.7,"pith_summary":"Language models are often deployed with a hierarchy of instructions: developer-set system messages should outrank user messages, which should outrank conversation history, which should outrank tool outputs. This paper introduces IHEval, a 3,538-example benchmark spanning nine tasks in four scenarios (rule following, task execution, safety defense, and tool use), to measure whether models actually respect that priority order when instructions align or conflict. The central finding is that they do not: every model tested drops sharply in the conflict setting, with the strongest open-source model, Qwen-2 72B, averaging 47.8% accuracy, Llama-3.1 70B collapsing to 14.0%, and GPT-4o reaching 70.0%. The paper argues this exposes a real deployment risk, since models that cannot prioritize higher-level instructions may misbehave or act unsafely when low-priority inputs carry conflicting requests.","feed_headline":"Models fail at instruction hierarchy; best open-source score is 48%","feed_subtitle":"New benchmark across 3,538 examples puts GPT-4o at 70% and the best open-source model at 48%.","key_machinery":"The central object is the instruction hierarchy itself, a fixed priority ordering (system messages highest, then user messages, conversation history, and tool outputs lowest) first proposed in prior work (Wallace et al., 2024). The benchmark operationalizes it through three paired settings per task: a reference setting with a single merged instruction, an aligned setting with hierarchical inputs that agree, and a conflict setting where a low-priority input demands something incompatible with the high-priority main instruction. Every task is scored programmatically by whether the model completes the main instruction, with strict and loose metrics adopted from IFEval; the aligned-versus-reference difference isolates hierarchical-input processing, and the conflict-versus-reference difference isolates hierarchy-following. Task design also varies the imperative strictness of both the main and conflicting instructions to test whether models respond to priority or to wording.","core_discovery":"The paper claims that current language models lack a robust capability to follow the instruction hierarchy, defined as the priority order system message > user message > conversation history > tool output. On IHEval, models perform near their baseline when hierarchical inputs align, but conflict settings cause large, consistent drops across all thirteen models tested, with scores falling 22 to 78 points below the reference setting. The benchmark is constructed so that any execution of the low-priority conflicting instruction hurts the score, and the ideal behavior is to ignore it entirely and complete only the high-priority task. The authors further show that even aligned hierarchical inputs destabilize some models, that conflict resolution is swayed by the superficial strictness of wording rather than by priority, that an explicit prompt stating the hierarchy does not improve performance, and that the ability to resolve conflicts does not scale reliably with model size. Their conclusion is that dedicated training on hierarchy-following, not prompt engineering, is needed.","pith_inferences":["A direct test the paper does not run: fine-tune one small open model on conflict pairs whose correct label is 'ignore the lower-priority instruction'; if its IHEval conflict score jumps toward its reference score, the deficit is a training gap, and if it stays flat, hierarchy-following resists this kind of data.","The paper's recency evidence, where models do follow a new user request after a conflicting turn, suggests deployments should assume models weight recency, and any training fix must explicitly break that heuristic; a benchmark that varies instruction order while holding content fixed would isolate recency from hierarchy.","Because the paper scores only strict adherence to the top-priority instruction, a complementary benchmark that credits clarification or 'I cannot do X' responses would separate genuine priority awareness from a learned refusal style; the paper's error analysis already attributes most failures to following the conflicting instruction rather than to refusing.","In production, the hierarchy order itself is a design choice, not a fact; the assumption that tool outputs always rank lowest implies agents must never obey tool-retrieved content, which would forbid legitimate web-based workflows, a policy question the benchmark implicitly resolves in favor of strict developer control."],"forward_implications":["Model developers should treat hierarchy-following as a distinct capability to be measured and trained, separate from general instruction-following, since reference and aligned scores do not predict conflict-setting performance.","Deployments that layer system-message constraints over user-facing tools cannot rely on prompt wording: stating the priority order explicitly did not improve any tested model's conflict resolution.","Safety-critical settings such as password gates are at risk: Qwen-2 72B successfully defends only about one-third of hijack and extraction attacks, and several strong models fail them far more often.","Compared with the concurrent SysBench system-message benchmark, IHEval reports a larger aligned-versus-conflict gap, meaning hierarchy evaluation reveals weaknesses that system-prompt-only benchmarks miss.","Scaling alone will not fix the problem; some model families show inverse scaling on conflict tasks, where the smaller model outperforms the larger one."],"supporting_citations":[{"why":"Defines the instruction hierarchy and the training approach for prioritizing privileged instructions; IHEval extends this evaluation beyond GPT models and safety-only scenarios.","marker":"(Wallace et al., 2024)"},{"why":"Supplies IFEval data and the strict/loose evaluation metric used for the Rule Following tasks.","marker":"(Zhou et al., 2023)"},{"why":"Supplies the TensorTrust password-gate setup and adversarial user attacks for the Safety Defense Hijack and Extraction tasks.","marker":"(Toyer et al., 2024)"},{"why":"Supplies OntoNotes passages with ground-truth verbs for the extraction task.","marker":"(Pradhan et al., 2013)"},{"why":"Supplies MGSM math problems with Spanish annotations for the translation/generation task.","marker":"(Shi et al., 2023)"},{"why":"Supplies XL-Sum passages for the language-detection classification task.","marker":"(Hasan et al., 2021)"},{"why":"Supplies the SEP injected commonsense questions and the instructions-versus-data framing for the tool-use injected task.","marker":"(Zverev et al., 2024)"},{"why":"Provides SysBench, the concurrent system-prompt benchmark whose smaller aligned-conflict gap motivates IHEval's broader hierarchy scope.","marker":"(Qin et al., 2024a)"}],"fun_headline_variants":["All LMs drop sharply when instructions conflict, best open-source 48%","Instruction hierarchy tests: conflicts break every model","Best open-source model only 48% at resolving instruction conflicts","IHEval shows models favor low-priority instructions under conflict","GPT-4o 70% vs 48% open-source on instruction hierarchy"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The benchmark assumes one fixed, universally correct priority order (system messages above user messages above conversation history above tool outputs) and assumes that silently executing the highest-priority instruction, rather than asking for clarification, partially complying, or following the most recent user request, is always the correct behavior.","fun_headline_variants_meta":{"raw":{"variants":["All LMs drop sharply when instructions conflict, best open-source 48%","Instruction hierarchy tests: conflicts break every model","Best open-source model only 48% at resolving instruction conflicts","IHEval shows models favor low-priority instructions under conflict","GPT-4o 70% vs 48% open-source on instruction hierarchy"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000789,"raw_usage":{"total_tokens":3446,"prompt_tokens":882,"completion_tokens":2564,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":498,"completion_tokens_details":{"reasoning_tokens":2475}},"tokens_in":498,"tokens_out":2564,"duration_ms":18317,"temperature":1.0,"reasoning_tokens":2475,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T23:49:33.997223+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Present the same IHEval conflict pairs with the priority labels reversed, for example a tool output demanding format A while a system message demands format B, so that recency and hierarchy point in opposite directions; if models' scores track the stated priority order regardless of which slot carries the instruction, the hierarchy itself is being encoded, whereas if scores track recency or emphasis instead, the reported conflict gap reflects a superficial cue rather than hierarchy-following.","supporting_citations":[{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies the TensorTrust password-gate setup and adversarial user attacks for the Safety Defense Hijack and Extraction tasks."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Supplies OntoNotes passages with ground-truth verbs for the extraction task."}],"review_version":1}