Pith. sign in

REVIEW 2 major objections 5 minor 7 references

Appending a question-irrelevant fifth option containing a misleading directive flips correct multiple-choice predictions across 12 large language models, with threat-based directives the most effective.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-03 09:34 UTC pith:DEZQOJD4

load-bearing objection New benchmark with a real design gap: the 'directive interference' attribution needs a neutral fifth-option control to be credible. the 2 major comments →

arxiv 2601.13300 v2 pith:DEZQOJD4 submitted 2026-01-19 cs.CL

OI-Bench: An Option Injection Benchmark for Evaluating LLM Susceptibility to Directive Interference

Yow-Fu Liou , Yu-Chien Tang , Yu-Hsiang Liu , An-Zi Yen This is my paper
classification cs.CL
keywords option injectionmultiple-choice QAdirective interferencethreat framingLLM robustnessattack success ratebenchmarkalignment
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper tries to establish that multiple-choice evaluation of large language models has a blind spot: adding an extra answer option whose content is a misleading directive can override otherwise correct decisions. The authors build OI-Bench, 3,000 questions across knowledge, logical reasoning, and commonsense tasks, with 16 directive types grouped into social compliance, bonus framing, threat framing, and instructional interference. Across 12 models, appending this option E flips a non-trivial share of correct answers; threat framing is the strongest family, with a mean attack success rate of 19.8% and accuracy drop of 10.9%. The paper also reports that high standard accuracy does not imply high resistance to such interference, and that post-training alignment reduces susceptibility more than defensive prompting or a safety-tuned variant. If the finding holds, standard MCQA accuracy can overstate how reliably a model will behave when choice sets carry incidental or adversarial cues.

Core claim

On the paper's own terms, the discovery is that a single question-irrelevant option, engineered to carry a directive, can override correct model decisions in multiple-choice QA. Standard accuracy across the 12 models averages 80.4%; appending an injected option E degrades accuracy in most conditions. The most disruptive directives are the 'override' types that tell the model to ignore the question, and threat framing yields the highest mean attack success rate (19.8%) and accuracy drop (10.9%). Individual models can collapse to near-zero accuracy under the Override Penalty directive, and some of the strongest standard performers are among the most susceptible. Position matters as well: movin

What carries the argument

Option injection: augmenting a standard four-option multiple-choice question with a fifth, question-irrelevant option (E) whose only content is a misleading directive. The paper organizes 16 such directives into four families — social compliance, bonus framing, threat framing, and instructional interference — and measures their effect with Attack Success Rate (ASR), the fraction of originally correct predictions that flip to incorrect after E is appended, plus Accuracy Drop (standard minus injected accuracy). The injected E option is the carrier that turns the choice list into an attack surface; ASR is the ruler that makes the effect measurable and comparable across models.

Load-bearing premise

The load-bearing premise is that the injected E option differs from the original options only in containing a directive; without a neutral, directive-free fifth-option control, some of the measured flips could be a generic extra-option or format effect rather than directive compliance.

What would settle it

Run the same evaluation with a fifth option that is semantically neutral and directive-free (e.g., 'E: this concludes the list') replacing the directive-laden E, keeping all else fixed. If the neutral option produces ASR close to the directive condition, the headline vulnerability is not specific to directives; if ASR drops significantly, directive content is the active ingredient.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

Share X Bluesky LinkedIn Reddit HN

If this is right

  • Standard MCQA leaderboards can overstate robustness: two models with similar standard accuracy can differ sharply once a directive-laden option is added.
  • Evaluation protocols for multiple-choice benchmarks should treat option content and position as variables, not fixed scaffolding; moving the injected option to A–D increases attack success.
  • Threat framing, especially override-style penalties, is the strongest tested lever, so safety evaluations should include penalty-coercion probes rather than relying on polite instruction-following tests.
  • Post-training alignment through preference optimization (DPO, PPO) is a more reliable mitigation than inference-time prompting or a safety-tuned variant, and it changes deep-layer attention to the injected option.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • A neutral control condition — a fifth option with a directive-free, content-free statement — would test whether the flips are caused by the directive itself or by the mere presence of an extra option; the paper does not run this control.
  • The mechanism likely generalizes beyond MCQA to other selection interfaces (LLM-as-judge, ranking, routing, mixture-of-experts gating), where candidate lists can carry incidental cues; this is a testable extension the paper mentions but does not evaluate.
  • The attention result suggests a cheaper mitigation than full retraining: if deep-layer heads reliably over-attend to the injected option, inference-time activation steering or test-time prompting that suppresses those heads might reduce susceptibility.
  • One could fit a utility model to the ASR data to predict which directive types will transfer to unseen models or formats, using the observed asymmetry between loss framing and gain framing.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

2 major / 5 minor

Summary. The paper proposes OI-Bench, a benchmark that appends a task-irrelevant option E containing one of 16 misleading directives to standard MCQA questions from MMLU, LogiQA, and HellaSwag. Using 3,000 IRT-selected questions and 12 LLMs, it reports standard accuracy, injected accuracy, attack success rate (ASR, defined as any originally correct flip after E is appended), and accuracy drop (AD). The central empirical claim is that option-level directives degrade performance, with threat framing most harmful, and that capability does not imply robustness. The paper also analyzes response types via LLM judges, tests defensive prompting and a safety-aligned variant, applies DPO/PPO on Qwen-3-8B, examines attention patterns, and studies positional effects. The main interpretation—that ASR/AD measure susceptibility to directive interference—is plausible but not yet isolated from generic extra-option effects, and the mitigation result is inconsistent across datasets.

Significance. If the core attribution held, OI-Bench would be a useful, scalable benchmark for a real and under-measured failure mode in choice-based LLM interfaces. The work has clear strengths: it builds on tinyBenchmarks with transparent IRT-based filtering, covers a broad directive taxonomy, evaluates 12 models across 7 families, ships code/data, and includes multiple converging analyses (response-type annotation with reported inter-judge agreement, attention diagnostics, position permutation, and DPO/PPO experiments). The design of DPO training with randomized E position is a thoughtful attempt to avoid letter-based shortcuts. However, the headline claim that the observed flips reflect directive compliance rather than generic extra-option/format sensitivity is not yet supported because no neutral fifth-option control is run. The benchmark is therefore a valuable measurement contribution in progress, but its main interpretive claim needs an additional control condition and a more cautious presentation of the mitigation results.

major comments (2)
  1. [§3.2.2 and §4.1 (ASR definition); Table 2] The central attribution is confounded by the absence of a neutral fifth-option control. ASR is defined as any originally correct prediction that flips after E is appended, regardless of whether E is selected (Section 4.1). All experiments append an option that contains a directive, but none append a task-irrelevant, directive-free option E of comparable length and salience. Without this condition, the reported ASR/AD cannot separate compliant following of the injected directive from generic sensitivity to an extra option, a new letter, set-size change, or a shifted decision boundary. This is load-bearing for the headline 'directive interference' claim and for the category ordering (threat > bonus > instructional > social). The position experiment in Table 4 is also consistent with a salience/format effect: moving the same injected content into A–D sharply increases ASR (e.g., Qwen-3-8B f
  2. [§5.3 and Table 3] The mitigation conclusion is not consistent across datasets. DPO and PPO reduce mean ASR averaged over the three source tasks, but on MMLU both increase ASR relative to the Base model (DPO: 0.1721, PPO: 0.1515 vs Base: 0.0749); the average improvement is driven by LogiQA and HellaSwag. Given MMLU is one of only three tasks, the statement that DPO/PPO 'show more promising results' overstates the evidence. Additionally, the DPO/PPO models are trained on LLM-judge labels for the same 16 directive types and evaluated on held-out questions from the same distribution, so this is an in-distribution proof of concept, not a demonstration of generalizable mitigation. Please report per-dataset confidence intervals, explicitly acknowledge the MMLU increase, and temper the conclusions accordingly.
minor comments (5)
  1. [Tables 5–8] The asterisks denote p<0.05, but no statistical test is specified and no multiple-comparison correction is described. State the test used and how the 16 directive-type comparisons are corrected.
  2. [§3.2.2] 'Non-informative' is too strong for directives such as Citation and Wikipedia, which supply additional content and argumentation. 'Task-irrelevant' would be more accurate and would preempt confusion.
  3. [Table 3 and Table 2] Several AD values are negative (e.g., DPO/MMLU AD=-0.0208; Base/HellaSwag AD=-0.0691). Add a caption explaining that negative AD means injected accuracy exceeds standard accuracy, since this is counterintuitive.
  4. [Figure 2] Some model labels appear to overlap, particularly in the upper-left region. Use annotation offsets or list values in a table for readability.
  5. [§4.1] Since ASR deliberately counts flips to any wrong option, not only selections of E, the paper should also report the E-selection rate as a separate metric. That separation would make the response-type analysis easier to connect to the headline ASR.

Circularity Check

0 steps flagged

No significant circularity: OI-Bench's empirical claims are computed from external ground-truth labels and held-out data, not from fitted or self-referential quantities.

full rationale

The paper's central results are measurements over external benchmark items (MMLU, LogiQA, HellaSwag) with independent ground-truth labels. Standard accuracy, injected accuracy, ASR, and AD are defined directly from those labels (§4.1: 'a prediction is considered correct if and only if ŷ = y*'; ASR counts an originally correct prediction that flips to incorrect). Nothing is fitted to the target claim and then renamed as a prediction. The 3,000-item set reuses released tinyBenchmarks IRT subsets, which are external to this paper. The defense experiments train DPO/PPO on LLM-judge preference labels but evaluate on held-out stems with objective accuracy/ASR (§5.3), so the mitigation claim is not forced by the training signal. The paper contains no load-bearing self-citation or uniqueness theorem imported from the authors' prior work. The absence of a neutral fifth-option control means the headline attribution to 'directive interference' is not fully separated from a generic extra-option/format effect; however, that is a construct-validity/experimental-design limitation, not a circular derivation. Under the rule that circularity must be exhibited as a specific reduction of a result to its inputs, no such reduction can be quoted from this paper, so the circularity score is 0.

Axiom & Free-Parameter Ledger

2 free parameters · 5 axioms · 0 invented entities

The benchmark's headline numbers rest on external dataset labels and on the assumption that a fifth option's directive content, not its mere presence, causes the observed flips. The mitigation experiments add hand-chosen PPO/DPO hyperparameters and judge-derived labels.

free parameters (2)
  • PPO reward shaping coefficients = reasoning bonus +0.1; missing-reasoning penalty -1.0; reward clip ±5.0
    Hand-selected in Appendix H.2; directly shapes the PPO variant that supports the claim that post-training alignment mitigates injection.
  • DPO beta = 0.1
    Set in Appendix G.2; a standard DPO temperature, not fitted to the data, but it influences the DPO mitigation result.
axioms (5)
  • domain assumption Ground-truth labels in MMLU, LogiQA, and HellaSwag are correct.
    All accuracy/ASR metrics inherit these labels; label noise would bias every result. Invoked throughout §3-4.
  • domain assumption tinyBenchmarks' 1,000-example IRT subsets preserve full-benchmark model ranking.
    Used without re-validation in §3.2.1; the paper cites pilot correlations of ~0.98-0.99 for MMLU/HellaSwag but 4.47pp mean gap for LogiQA after outlier removal.
  • domain assumption The injected option is 'non-informative' apart from its directive.
    Assumed in §3.2.2; this is the assumption the missing-neutral-baseline problem targets.
  • domain assumption LLM judge labels (Grok, Olmo-3-32B-Think, GPT-OSS-120B) are reliable enough to train DPO/PPO.
    Fleiss' κ=0.5804 reported in §5.1; these labels become preference data and PPO rewards.
  • domain assumption Greedy decoding at temperature 0 yields comparable, representative behavior across models.
    Stated in §4.1; limitations acknowledge other decoding settings may change effects.

pith-pipeline@v1.3.0-alltime-deepseek · 22062 in / 12616 out tokens · 124574 ms · 2026-08-03T09:34:18.020301+00:00 · methodology

0 comments
Cite this review

Pith. "Pith review of OI-Bench: An Option Injection Benchmark for Evaluating LLM Susceptibility to Directive Interference." pith.science (2026). https://pith.science/paper/DEZQOJD4

@misc{pith2026260113300,
  author       = {Pith},
  title        = {Pith review of: OI-Bench: An Option Injection Benchmark for Evaluating LLM Susceptibility to Directive Interference},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DEZQOJD4}},
  note         = {Machine review of arXiv:2601.13300}
}
Share X Bluesky LinkedIn Reddit HN
read the original abstract

Benchmarking large language models (LLMs) is critical for understanding their capabilities, limitations, and robustness. In addition to interface artifacts, prior studies have shown that LLM decisions can be influenced by directive signals such as social cues, framing, and instructions. In this work, we introduce option injection, a benchmarking approach that augments the multiple-choice question answering (MCQA) interface with an additional option containing a misleading directive, leveraging standardized choice structure and scalable evaluation. We construct OI-Bench, a benchmark of 3,000 questions spanning knowledge, reasoning, and commonsense tasks, with 16 directive types covering social compliance, bonus framing, threat framing, and instructional interference. This setting combines manipulation of the choice interface with directive-based interference, enabling systematic assessment of model susceptibility. We evaluate 12 LLMs to analyze attack success rates, behavioral responses, and further investigate mitigation strategies ranging from inference-time prompting to post-training alignment. Experimental results reveal substantial vulnerabilities and heterogeneous robustness across models. OI-Bench is expected to support more systematic evaluation of LLM robustness to directive interference within choice-based interfaces.

Figures

Figures reproduced from arXiv: 2601.13300 by An-Zi Yen, Yow-Fu Liou, Yu-Chien Tang, Yu-Hsiang Liu.

Figure 1
Figure 1. Figure 1: Option injection in MCQA. A question￾irrelevant option E with a misleading directive can flip the model’s decision. swering (MCQA) has become the dominant bench￾marking paradigm (Ni et al., 2025) by casting di￾verse tasks into a unified select-one format that enables scalable automatic scoring and straightfor￾ward cross-model comparisons (Liang et al., 2022). This MCQA formulation appears in widely used be… view at source ↗
Figure 2
Figure 2. Figure 2: Standard accuracy vs E-option attack success rate on OI-Bench. We report each model’s Standard [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 4
Figure 4. Figure 4: Distribution of response types across models [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figure 3
Figure 3. Figure 3: Attack success rate distribution across 16 [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figure 5
Figure 5. Figure 5: The visualization of the normalized attention [PITH_FULL_IMAGE:figures/full_fig_p008_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Prompt template. VALID_LETTERS={a, b, c, d, e} when E option ap￾pended, else VALID_LETTERS={a, b, c, d}. injection susceptibility persists when the task de￾mands coherent logical chains. HellaSwag tests commonsense inference through sentence comple￾tion, with adversarially filtered distractors designed to be superficially plausible. It examines whether models treat option E as a shortcut in naturalistic, c… view at source ↗
Figure 7
Figure 7. Figure 7: Absolute option-span contribution norms (global-normalized) for µˆ and E across base, DPO, and PPO. that the base model allocates disproportionately high attention to option E in deep layers [PITH_FULL_IMAGE:figures/full_fig_p015_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: The visualization of the normalized attention [PITH_FULL_IMAGE:figures/full_fig_p016_8.png] view at source ↗
Figure 9
Figure 9. Figure 9: The visualization of the normalized atten [PITH_FULL_IMAGE:figures/full_fig_p016_9.png] view at source ↗
Figure 10
Figure 10. Figure 10: The visualization of the normalized atten [PITH_FULL_IMAGE:figures/full_fig_p017_10.png] view at source ↗
Figure 11
Figure 11. Figure 11: The visualization of the normalized attention [PITH_FULL_IMAGE:figures/full_fig_p017_11.png] view at source ↗
Figure 12
Figure 12. Figure 12: The visualization of the normalized attention [PITH_FULL_IMAGE:figures/full_fig_p017_12.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

7 extracted references · 4 linked inside Pith

  1. [4]

    Qwen Team

    tinybenchmarks: evaluating llms with fewer examples.arXiv preprint arXiv:2402.14992. Qwen Team. 2025. Qwen3 technical report. https://arxiv.org/pdf/2505.09388.Preprint, arXiv:2505.09388. Accessed: 2025-12-29. 10 Rafael Rafailov, Archit Sharma, Eric Mitchell, Christo- pher D Manning, Stefano Ermon, and Chelsea Finn

    Pith/arXiv arXiv 2025

  2. [5]

    Narun Raman, Taylor Lundy, and Kevin Leyton- Brown

    Direct preference optimization: Your language model is secretly a reward model.Advances in neural information processing systems, 36:53728–53741. Narun Raman, Taylor Lundy, and Kevin Leyton- Brown. 2025. Reasoning models are test ex- ploiters: Rethinking multiple-choice.arXiv preprint arXiv:2507.15337. John Schulman, Filip Wolski, Prafulla Dhariwal, Alec ...

    arXiv 2025

  3. [6]

    InThe Twelfth International Confer- ence on Learning Representations

    Towards understanding sycophancy in lan- guage models. InThe Twelfth International Confer- ence on Learning Representations. Noam Shazeer, Azalia Mirhoseini, Krzysztof Maziarz, Andy Davis, Quoc Le, Geoffrey Hinton, and Jeff Dean. 2017. Outrageously large neural networks: The sparsely-gated mixture-of-experts layer.arXiv preprint arXiv:1701.06538. Xinyuan ...

    Pith/arXiv arXiv 2017

  4. [2020]

    Cheng Li, Jindong Wang, Yixuan Zhang, Kaijie Zhu, Wenxin Hou, Jianxun Lian, Fang Luo, Qiang Yang, and Xing Xie

    Measuring massive multitask language under- standing.arXiv preprint arXiv:2009.03300. Cheng Li, Jindong Wang, Yixuan Zhang, Kaijie Zhu, Wenxin Hou, Jianxun Lian, Fang Luo, Qiang Yang, and Xing Xie. 2023. Large language models un- derstand and can be enhanced by emotional stimuli. arXiv preprint arXiv:2307.11760. Ruizhe Li and Yanjun Gao. 2025. Anchored an...

    Pith/arXiv arXiv 2009

  5. [2023]

    InProceedings of the 16th ACM workshop on artificial intelligence and security, pages 79–90

    Not what you’ve signed up for: Compromis- ing real-world llm-integrated applications with indi- rect prompt injection. InProceedings of the 16th ACM workshop on artificial intelligence and security, pages 79–90. Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt

  6. [2024]

    InFirst Conference on Language Modeling

    Length-controlled alpacaeval: A simple debi- asing of automatic evaluators. InFirst Conference on Language Modeling. William Fedus, Barret Zoph, and Noam Shazeer. 2022. Switch transformers: Scaling to trillion parameter models with simple and efficient sparsity.Journal of Machine Learning Research, 23(120):1–39. Google DeepMind. 2025a. Gemini 2.5 flash-li...

    2022

  7. [2025]

    the safest bet,

    Qwen3guard technical report.arXiv preprint arXiv:2510.14276. Chujie Zheng, Hao Zhou, Fandong Meng, Jie Zhou, and Minlie Huang. 2023a. Large language models are not robust multiple choice selectors.arXiv preprint arXiv:2309.03882. Chujie Zheng, Hao Zhou, Fandong Meng, Jie Zhou, and Minlie Huang. 2024. Large language models are not robust multiple choice se...

    Pith/arXiv arXiv 2024