REVIEW 3 major objections 5 minor 34 references
Exploring the Impact of Instruction-Tuning on LLM's Susceptibility to Misinformation
T0 review · 3 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash
Pith's one-line read Instruction-tuning shifts LLM gullibility from the assistant role to the user role.
desk verdict Useful descriptive finding about role-based misinformation susceptibility, but the causal claim about instruction-tuning is confounded by changing prompt formats between base and instructed models. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing mechanism is the chat template's role distinction: instruction-tuned models mark turns as user or assistant, and the paper's three scenarios—single-turn query, assistant-provided document, and user-provided document—relocate the same misinformation across those roles. The Misinformation Susceptibility Rate (MSR) then measures, among questions a model answers correctly from parametric knowledge in a closed-book setting, how often presenting misinformation makes it select the false option. Comparing each instruction-tuned model with its untuned base version isolates what the tuning step changes. This setup is what allows the paper to attribute the user-role effect to instruction-tuning rather than pre-training.
What would settle it
Run the UPD and APD scenarios with the misinformation placed in both an early and a late turn, and have the model generate aloud the document text in one condition; if the acceptance gap follows generation position or document recency rather than the user-assistant role label, the role-attention interpretation is falsified.
Extended reading notes
Core claim
On the paper's own terms, the central discovery is that instruction-tuning reverses which conversational role carries persuasive weight: it reduces the model's reliance on assistant-role information and increases the influence of user-role information. The evidence is the Misinformation Susceptibility Rate (MSR) across three prompt scenarios: a single-turn query (STQ), a separate assistant-provided document (APD), and a separate user-provided document (UPD). Before tuning, all four open-source base models ranked APD highest; after tuning, three of the four ranked UPD highest, and separating misinformation into its own user turn raised MSR by roughly 5 to 8 percentage points in most models. The paper concludes that the vulnerability to user-presented misinformation is a direct product of instruction-tuning, not a pre-training artifact.
Load-bearing premise
The comparison assumes that the higher susceptibility in the user-provided-document scenario comes from the user role itself, rather than from the model reading a document it did not generate or from the document's position near the final question.
Editorial extensions
If this is right
- A separate user-role turn containing misinformation amplifies acceptance compared with embedding the same misinformation in the question turn.
- The user-role susceptibility ranking is not inherited from pre-training: base models prefer assistant-role misinformation, so instruction-tuning is the factor that flips the preference.
- Longer misinformation weakens the instruction-tuning effect, pushing models back toward the base models' assistant-role pattern.
- A simple system-prompt warning cuts misinformation acceptance sharply for proprietary models (up to roughly 69 percentage points for GPT-4o on NQ) but leaves the tested open-source models nearly unchanged.
- Real deployments that let users paste documents into the conversation inherit a higher misinformation risk after alignment.
Reading between the lines
- If the role-attention account is right, chat-template design is itself a safety lever: changing how strongly roles are marked, or how much weight the final user turn receives, should move MSR without further fine-tuning.
- The APD-versus-UPD contrast also varies whether the model reads or generates the document, so a targeted test that separates role from generation position is the natural next step.
- The instruction-tuning shift may be a special case of sycophancy: tuning that rewards agreement with users could train models to discount their own parametric knowledge whenever the user supplies a confident alternative.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The manuscript studies how instruction-tuning affects LLMs' susceptibility to misinformation. Using the Farm dataset, it defines a Misinformation Susceptibility Rate (MSR) and compares three prompt scenarios: STQ (misinformation in a single user turn), APD (misinformation in an assistant turn), and UPD (misinformation in a separate user turn). It reports MSR for GPT-4o, GPT-4o mini, four open-source instruction-tuned models, and their base versions. The main claim is that instruction-tuning shifts susceptibility from the assistant role to the user role: base models rank APD highest, while three of four instruction-tuned open models rank UPD highest. The paper also examines misinformation length and the effect of warnings in the system prompt. I do not see a circularity problem in the MSR construction: the metric is computed directly from model outputs and no parameters are fitted to the data. However, the central causal attribution for RQ2 is confounded with prompt formatting, and the absence of significance testing weakens the quantitative claims.
Significance. If the causal claim were established, the paper would document a practically important side effect of alignment: instruction-tuning can re-weight which conversational role's information the model trusts. The paper has clear strengths: it reports full per-condition MSR numbers (Tables 3, 4, and 11), uses an existing dataset from prior work, includes a base-versus-instructed comparison for four open-source model families, and checks generalization across three misinformation types. The limitations section candidly acknowledges missing base versions for proprietary models, restricted model sizes, and unexplained outliers. Nevertheless, the load-bearing comparison in RQ2 changes both the independent variable (instruction-tuning) and the prompt template simultaneously, so the paper does not currently isolate the effect it claims. The lack of confidence intervals or significance tests also makes the word "significantly" in the abstract and Section 4.2 unsupported.
major comments (3)
- [§4.3, Appendix B.1 (Tables 6-10)] The RQ2 conclusion that instruction-tuning shifts susceptibility from the assistant role to the user role is confounded with prompt formatting. Instruction-tuned models are evaluated with their native chat templates (e.g., <|start_header_id|> for Llama, <|im_start|> for Qwen, [INST] for Mistral), whereas base models receive hand-written <System>/<User>/<Assistant> delimiters that were never used in their training. The independent variable is therefore instruction-tuning plus a change in input format. The hand-written base-model APD prompt, in which an assistant turn containing only the document is sandwiched between user turns, may make the assistant document unusually salient for base models, and native templates may emphasize user turns for tuned models for reasons unrelated to tuning. To support the claim in Section 4.3 that 'instruction-tuning reduces the models' reliance on the assistant-role while increasing the influence of the user-role,' the authors should hold the prompt format fixed across base and instructed versions (for example, evaluate both with identical manual delimiters, or evaluate both with the same neutral template), or at minimum provide an ablation showing that the APD-to-UPD ranking shift survives format control. This is the central load-bearing issue for RQ2.
- [§3.2, Figure 2, Appendix B.1] The APD versus UPD comparison confounds conversational role with generating-versus-reading and with document position. In APD the misinformation is placed in an assistant turn that the model itself must generate, while in UPD it is placed in a user turn that the model only reads. The model may process its own generated text differently from externally supplied text, and the document also appears at a different position relative to the final question across the two conditions. The paper interprets the observed MSR difference as role-based attention, but the role-attention interpretation is not uniquely identified by this design. A control in which the assistant turn is supplied verbatim rather than generated, or in which the document appears in the same position in both conditions, would substantially strengthen the interpretation. At minimum, the authors should explicitly acknowledge this confound in the Limitations section; currently it is not mentioned there.
- [Abstract, §4.2, §4.3, Figures 3-5, Tables 3-4] The manuscript uses the word 'significantly' and claims a consistent cross-model pattern, but no confidence intervals, standard errors, or significance tests are reported anywhere. All MSR values are point estimates, and the number of items entering each denominator is not stated in the main text. Because the Farm-derived evaluation set is large (about 1,464 items before per-model closed-book filtering), even small percentage-point differences may be reliable, but the reader cannot currently judge whether the UPD-APD gaps are within sampling noise. The authors should report bootstrap confidence intervals or paired tests (e.g., McNemar's test per model and dataset) and state the denominator size for each MSR value. This is especially important because Qwen2.5-7B-Instruct deviates from the main pattern in the opposite direction; with one of four open-source pairs violating the claim, the paper needs an aggregate statistic or an explicit account of why the outlier does not undermine the general conclusion.
minor comments (5)
- [Figures 3, 6, 8] The y-axis labels are rendered as 'MR' or 'M R' instead of 'MSR'; please correct the axis labels for consistency with the metric name.
- [Appendix B.1, Tables 6-9] The scenario abbreviation 'STD' appears in the prompt tables where the paper elsewhere uses 'STQ'; please harmonize the abbreviation.
- [§4.4 and Appendix C.4] The main text says the average MSR 'decreased by 69.1%p' for GPT-4o, while Figure 7 and Equation (3) describe a relative percentage change; clarify whether the reported numbers are percentage-point differences or relative changes, and ensure the stated average matches the formula.
- [References] The reference 'Antrhopic' for Claude should be corrected to 'Anthropic'.
- [Table 2 and Appendix C.1] The dataset name 'Boolq' is inconsistently capitalized; please use 'BoolQ' throughout the tables and text.
Circularity Check
No significant circularity: the MSR measurements and base-versus-instructed comparisons are empirical and not defined in terms of the conclusions.
full rationale
The paper's central comparisons are direct measurements. MSR is computed from model outputs on an externally constructed dataset (Farm, Xu et al., 2024a); no parameter is fitted to the data and no quantity called a 'prediction' is derived from a fitted value. The RQ2 claim that instruction-tuning shifts susceptibility from the assistant role to the user role rests on comparing MSR rankings of four base models against their instruction-tuned counterparts, which is an independent empirical anchor rather than a reduction. The APD-versus-UPD difference is not definitionally forced: base models actually rank APD highest, so the instruction-tuned reversal is an observable outcome rather than a tautology. The paper does not invoke any self-citation as load-bearing evidence: the dataset, warning result, and instruction-following behavior are attributed to external prior work, and no uniqueness theorem or ansatz is imported from the authors' own publications. The base-model prompt-format mismatch (manual role delimiters versus native chat templates) is a genuine internal-validity concern about whether the comparison isolates instruction-tuning, but it is a confound, not a circularity: the observed MSR values are not constructed to equal the hypothesis. The stated limitations (no proprietary base versions, small open-source sizes, unexplained outliers) are acknowledged weaknesses and do not indicate that any result reduces to its inputs by definition.
Assumptions & free parameters
assumptions (3)
- domain assumption Correct closed-book answers approximate a model's parametric knowledge, so Q✓ is a valid baseline for measuring the influence of misinformation.
- domain assumption The user/assistant roles in the chat template are processed differently by instruction-tuned models, and that difference is the causal channel behind the observed susceptibility shift.
- ad hoc to paper Manually added <User>/<Assistant> delimiters preserve conversational role semantics for base models that were never trained with chat templates.
Cite this review
Pith. "Pith review of Exploring the Impact of Instruction-Tuning on LLM's Susceptibility to Misinformation." pith.science (2026). https://pith.science/paper/IEJI46NS
@misc{pith2026250718203,
author = {Pith},
title = {Pith review of: Exploring the Impact of Instruction-Tuning on LLM's Susceptibility to Misinformation},
year = {2026},
howpublished = {\url{https://pith.science/paper/IEJI46NS}},
note = {Machine review of arXiv:2507.18203}
}
read the original abstract
Instruction-tuning enhances the ability of large language models (LLMs) to follow user instructions more accurately, improving usability while reducing harmful outputs. However, this process may increase the model's dependence on user input, potentially leading to the unfiltered acceptance of misinformation and the generation of hallucinations. Existing studies primarily highlight that LLMs are receptive to external information that contradict their parametric knowledge, but little research has been conducted on the direct impact of instruction-tuning on this phenomenon. In our study, we investigate the impact of instruction-tuning on LLM's susceptibility to misinformation. Our analysis reveals that instruction-tuned LLMs are significantly more likely to accept misinformation when it is presented by the user. A comparison with base models shows that instruction-tuning increases reliance on user-provided information, shifting susceptibility from the assistant role to the user role. Furthermore, we explore additional factors influencing misinformation susceptibility, such as the role of the user in prompt structure, misinformation length, and the presence of warnings in the system prompt. Our findings underscore the need for systematic approaches to mitigate unintended consequences of instruction-tuning and enhance the reliability of LLMs in real-world applications.
Figures
Figures from the paper (7 more)
Reference graph
Works this paper leans on
-
[1]
Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. 2023. Gpt-4 technical report. arXiv preprint arXiv:2303.08774
arXiv 2023
-
[2]
Antrhopic. 2022. https://www.anthropic.com/news/introducing-claude Introducing claude
work page 2022
-
[3]
Christopher Clark, Kenton Lee, Ming-Wei Chang, Tom Kwiatkowski, Michael Collins, and Kristina Toutanova. 2019. https://doi.org/10.18653/v1/N19-1300 B ool Q : Exploring the surprising difficulty of natural yes/no questions . In Proceedings of the 2019 Conference of the North A merican Chapter of the Association for Computational Linguistics: Human Language...
-
[4]
Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, et al. 2024. The llama 3 herd of models. arXiv preprint arXiv:2407.21783
arXiv 2024
-
[5]
Giwon Hong, Jeonghwan Kim, Junmo Kang, Sung-Hyon Myaeng, and Joyce Whang. 2024. https://doi.org/10.18653/v1/2024.findings-naacl.159 Why so gullible? enhancing the robustness of retrieval-augmented models against counterfactual noise . In Findings of the Association for Computational Linguistics: NAACL 2024, pages 2474--2495, Mexico City, Mexico. Associati...
-
[6]
Aaron Hurst, Adam Lerer, Adam P Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Ostrow, Akila Welihinda, Alan Hayes, Alec Radford, et al. 2024. Gpt-4o system card. arXiv preprint arXiv:2410.21276
arXiv 2024
-
[7]
Albert Q Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, et al. 2023. Mistral 7b. arXiv preprint arXiv:2310.06825
arXiv 2023
-
[8]
Zhuoran Jin, Pengfei Cao, Yubo Chen, Kang Liu, Xiaojian Jiang, Jiexin Xu, Li Qiuxia, and Jun Zhao. 2024. https://aclanthology.org/2024.lrec-main.1466/ Tug-of-war between knowledge: Exploring and resolving knowledge conflicts in retrieval-augmented language models . In Proceedings of the 2024 Joint International Conference on Computational Linguistics, Lan...
work page 2024
Show all 34 references
-
[9]
Dai, Jakob Uszkoreit, Quoc Le, and Slav Petrov
Tom Kwiatkowski, Jennimaria Palomaki, Olivia Redfield, Michael Collins, Ankur Parikh, Chris Alberti, Danielle Epstein, Illia Polosukhin, Jacob Devlin, Kenton Lee, Kristina Toutanova, Llion Jones, Matthew Kelcey, Ming-Wei Chang, Andrew M. Dai, Jakob Uszkoreit, Quoc Le, and Slav...
2019 doi
-
[10]
Zekun Li, Baolin Peng, Pengcheng He, and Xifeng Yan. 2024. https://doi.org/10.18653/v1/2024.emnlp-main.33 Evaluating the instruction-following robustness of large language models to prompt injection . In Proceedings of the 2024 Conference on Empirical Methods in Natural Langua...
2024 doi
-
[11]
Stephanie Lin, Jacob Hilton, and Owain Evans. 2022. https://doi.org/10.18653/v1/2022.acl-long.229 T ruthful QA : Measuring how models mimic human falsehoods . In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pa...
2022 doi
-
[12]
OpenAI. 2022. https://openai.com/index/chatgpt/ Introducing chatgpt
2022
-
[13]
OpenAI. 2024. https://openai.com/index/gpt-4o-mini-advancing-cost-efficient-intelligence/ Gpt-4o mini: advancing cost-efficient intelligence
2024
-
[14]
Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. 2022. Training language models to follow instructions with human feedback. Advances in neural information processing systems, 3...
2022
-
[15]
Liangming Pan, Wenhu Chen, Min-Yen Kan, and William Yang Wang. 2023 a . https://doi.org/10.18653/v1/2023.ijcnlp-main.35 Attacking open-domain question answering by injecting misinformation . In Proceedings of the 13th International Joint Conference on Natural Language Processi...
2023 doi
-
[16]
Yikang Pan, Liangming Pan, Wenhu Chen, Preslav Nakov, Min-Yen Kan, and William Wang. 2023 b . https://doi.org/10.18653/v1/2023.findings-emnlp.97 On the risk of misinformation pollution with large language models . In Findings of the Association for Computational Linguistics: E...
2023 doi
-
[17]
Bowman, Amanda Askell, Roger Grosse, Danny Hernandez, Deep Ganguli, Evan Hubinger, Nicholas Schiefer, and Jared Kaplan
Ethan Perez, Sam Ringer, Kamile Lukosiute, Karina Nguyen, Edwin Chen, Scott Heiner, Craig Pettit, Catherine Olsson, Sandipan Kundu, Saurav Kadavath, Andy Jones, Anna Chen, Benjamin Mann, Brian Israel, Bryan Seethor, Cameron McKinnon, Christopher Olah, Da Yan, Daniela Amodei, D...
2023
-
[18]
Adam Roberts, Colin Raffel, and Noam Shazeer. 2020. https://doi.org/10.18653/v1/2020.emnlp-main.437 How much knowledge can you pack into the parameters of a language model? In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages...
2020 doi
-
[19]
Pranab Sahoo, Ayush Kumar Singh, Sriparna Saha, Vinija Jain, Samrat Mondal, and Aman Chadha. 2024. A systematic survey of prompt engineering in large language models: Techniques and applications. arXiv preprint arXiv:2402.07927
2024 arXiv
-
[20]
Smith, Daniel Khashabi, and Hannaneh Hajishirzi
Yizhong Wang, Yeganeh Kordi, Swaroop Mishra, Alisa Liu, Noah A. Smith, Daniel Khashabi, and Hannaneh Hajishirzi. 2023 a . https://doi.org/10.18653/v1/2023.acl-long.754 Self-instruct: Aligning language models with self-generated instructions . In Proceedings of the 61st Annual ...
2023 doi
-
[21]
Yufei Wang, Wanjun Zhong, Liangyou Li, Fei Mi, Xingshan Zeng, Wenyong Huang, Lifeng Shang, Xin Jiang, and Qun Liu. 2023 b . Aligning large language models with human: A survey. arXiv preprint arXiv:2307.12966
2023 arXiv
-
[22]
Jerry Wei, Da Huang, Yifeng Lu, Denny Zhou, and Quoc V Le. 2023. Simple synthetic data reduces sycophancy in large language models. arXiv preprint arXiv:2308.03958
2023 arXiv
-
[23]
Orion Weller, Aleem Khan, Nathaniel Weir, Dawn Lawrie, and Benjamin Van Durme. 2024. https://aclanthology.org/2024.eacl-short.35/ Defending against disinformation attacks in open-domain question answering . In Proceedings of the 18th Conference of the European Chapter of the A...
2024
-
[24]
Xuansheng Wu, Wenlin Yao, Jianshu Chen, Xiaoman Pan, Xiaoyang Wang, Ninghao Liu, and Dong Yu. 2024. https://doi.org/10.18653/v1/2024.naacl-long.130 From language modeling to instruction following: Understanding the behavior shift in LLM s after instruction tuning . In Proceedi...
2024 doi
-
[25]
Jian Xie, Kai Zhang, Jiangjie Chen, Renze Lou, and Yu Su. 2023. Adaptive chameleon or stubborn sloth: Revealing the behavior of large language models in knowledge conflicts. arXiv preprint arXiv:2305.13300
2023 arXiv
-
[26]
Qiming Xie, Zengzhi Wang, Yi Feng, and Rui Xia. 2024. https://doi.org/10.18653/v1/2024.acl-long.577 Ask again, then fail: Large language models' vacillations in judgment . In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Lon...
2024 doi
-
[27]
Rongwu Xu, Brian Lin, Shujian Yang, Tianqi Zhang, Weiyan Shi, Tianwei Zhang, Zhixuan Fang, Wei Xu, and Han Qiu. 2024 a . https://doi.org/10.18653/v1/2024.acl-long.858 The earth is flat because...: Investigating LLM s' belief towards misinformation via persuasive conversation ....
2024 doi
-
[28]
Rongwu Xu, Zehan Qi, and Wei Xu. 2024 b . https://doi.org/10.18653/v1/2024.findings-acl.876 Preemptive answer attacks on chain-of-thought reasoning . In Findings of the Association for Computational Linguistics: ACL 2024, pages 14708--14726, Bangkok, Thailand. Association for ...
2024 doi
-
[29]
An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, et al. 2024. Qwen2. 5 technical report. arXiv preprint arXiv:2412.15115
2024 arXiv
-
[30]
Jiahao Ying, Yixin Cao, Kai Xiong, Long Cui, Yidong He, and Yongbin Liu. 2024. https://doi.org/10.18653/v1/2024.acl-long.232 Intuitive or dependent? investigating LLM s' behavior style to conflicting prompts . In Proceedings of the 62nd Annual Meeting of the Association for Co...
2024 doi
-
[31]
Yunxiang Zhang, Muhammad Khalifa, Lajanugen Logeswaran, Moontae Lee, Honglak Lee, and Lu Wang. 2023. https://doi.org/10.18653/v1/2023.emnlp-main.286 Merging generated and retrieved knowledge for open-domain QA . In Proceedings of the 2023 Conference on Empirical Methods in Nat...
2023 doi
-
[32]
Chunting Zhou, Pengfei Liu, Puxin Xu, Srinivasan Iyer, Jiao Sun, Yuning Mao, Xuezhe Ma, Avia Efrat, Ping Yu, Lili Yu, et al. 2024. Lima: Less is more for alignment. Advances in Neural Information Processing Systems, 36
2024
-
[33]
online" 'onlinestring :=
ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list...
-
[34]
write newline
" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...
Reviewed August 6, 2026 · model on record in the stance chip above.
Discussion (0). Sign in to comment.