Reasoning Up the Instruction Ladder for Controllable Language Models
On the map: LLM reasoning → Reasoning benchmarks and evaluation
also in 1 more
Abstract (arXiv)
As large language model (LLM) based systems take on high-stakes roles in real-world decision-making, they must reconcile competing instructions from multiple sources within a single prompt context. Enforcing an instruction hierarchy, where higher-level directives override lower-priority requests, is critical to the reliability and control of LLMs. In this work, we reframe instruction hierarchy resolution as a reasoning task. The model must first "think" about the relationship between a given user prompt and higher-priority instructions before generating a response. To enable this capability, we construct VerIH, a training dataset of constraint-following tasks with verifiable answers, comprising aligned and conflicting system-user instructions. We show that lightweight reinforcement learning with VerIH effectively transfers general reasoning capabilities of models to instruction prioritization. Our method leads to consistent improvements across multiple model families on both instruction following and instruction hierarchy benchmarks, achieving ~20% absolute improvement in conflict setups. Our method also leads to improved alignment to safety-critical scenarios beyond the training distribution, exhibiting increased robustness against jailbreak and prompt injection, reducing absolute attack success rates by up to 20%. Our results establish reasoning over instruction hierarchies as a practical mechanism for improving AI reliability, where targeted updates to system prompts produce predictable, controllable, and robust changes in model behavior.
Key facts. Cited by 5 papers in the map (data through 7 Oct 2026). Placed in Reasoning benchmarks and evaluation, one of 17 directions in LLM reasoning. Builds on 52 of its 69 references that are in the map. First posted on arXiv 30 Oct 2025.
Builds on
52 of 69 references.
Closest ancestors · 2
Same direction, newest first
- 2025OpenThoughts: Data Recipes for Reasoning Models4 Jun
- 2025Qwen3 Technical Report14 May
Other references · 50
- 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,084
- 2022Chain-of-Thought Prompting Elicits Reasoning in Large Language Modelscited by 12,302
- 2024DeepSeekMath: Pushing the Limits of Mathematical Reasoning in Open Language Modelscited by 8,851
- 2020Measuring Massive Multitask Language Understandingcited by 7,768
- 2025DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learningcited by 6,146
- 2021Measuring Mathematical Problem Solving With the MATH Datasetcited by 5,203
- 2017Outrageously Large Neural Networks: The Sparsely-Gated Mixture-of-Experts Layercited by 3,413
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
- 2024HybridFlow: A Flexible and Efficient RLHF Frameworkcited by 1,980
- 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
- 2025s1: Simple test-time scalingcited by 1,311
- 2025gpt-oss-120b & gpt-oss-20b Model Cardcited by 1,258
38 more
- 2024OpenAI o1 System Cardcited by 1,220
- 2023Instruction-Following Evaluation for Large Language Modelscited by 1,143
- 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
- 2024Tulu 3: Pushing Frontiers in Open Language Model Post-Trainingcited by 988
- 2025Does Reinforcement Learning Really Incentivize Reasoning Capacity in LLMs Beyond the Base Model?cited by 948
- 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Modelscited by 738
- 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMscited by 460
- 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deepcited by 450
- 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 441
- 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 434
- 2024Deliberative Alignment: Reasoning Enables Safer Language Modelscited by 292
- 2024Defending Against Indirect Prompt Injection Attacks With Spotlightingcited by 233
- 2025Spurious Rewards: Rethinking Training Signals in RLVRcited by 199
- 2025Generalizing Verifiable Instruction Followingcited by 178
- 2023Tensor Trust: Interpretable Prompt Injection Attacks from an Online Gamecited by 135
- 2025X-Teaming: Multi-Turn Jailbreaks and Defenses with Adaptive Multi-Agentscited by 112
- 2024The Art of Saying No: Contextual Noncompliance in Language Modelscited by 100
- 2025The Hidden Risks of Large Reasoning Models: A Safety Assessment of R1cited by 89
- 2024Self-play with Execution Feedback: Improving Instruction-following Capabilities of Large Language Modelscited by 73
- 2024Instructional Segment Embedding: Improving LLM Safety with Instruction Hierarchycited by 62
- 2025Trading Inference-Time Compute for Adversarial Robustnesscited by 60
- 2023Evaluating the Instruction-Following Robustness of Large Language Models to Prompt Injectioncited by 53
- 2024Measuring and Controlling Instruction (In)Stability in Language Model Dialogscited by 51
- 2025IHEval: Evaluating Language Models on Following the Instruction Hierarchycited by 48
- 2024Thinking LLMs: General Instruction Following with Thought Generationcited by 45
- 2025Phi-4-Mini-Reasoning: Exploring the Limits of Small Reasoning Language Models in Mathcited by 44
- 2025VerIF: Verification Engineering for Reinforcement Learning in Instruction Followingcited by 43
- 2024Controllable Safety Alignment: Inference-Time Adaptation to Diverse Safety Requirementscited by 35
- 2025Reasoning-to-Defend: Safety-Aware Reasoning Can Defend Large Language Models from Jailbreakingcited by 34
- 2025RL Is a Hammer and LLMs Are Nails: A Simple Reinforcement Learning Recipe for Strong Prompt Injectioncited by 32
- 2025A Closer Look at System Prompt Robustnesscited by 31
- 2025Control Illusion: The Failure of Instruction Hierarchies in Large Language Modelscited by 31
- 2025Reasoning as an Adaptive Defense for Safetycited by 22
- 2025ASIDE: Architectural Separation of Instructions and Data in Language Modelscited by 21
- 2025Safety Reasoning with Guidelinescited by 14
- 2025Think Before Refusal : Triggering Safety Reflection in LLMs to Mitigate False Refusal Behaviorcited by 12
- 2025ASTRA: Autonomous Spatial-Temporal Red-teaming for AI Software Assistantscited by 6
- 2025CachePrune: Teaching LLMs What Not to Follow via KV-Cache Editingcited by 2
Built on by
Citing papers per year: 2026: 5.
5 papers.
- 2026IH-Challenge: A Training Dataset to Improve Instruction Hierarchy on Frontier LLMscited by 14
- 2026Many-Tier Instruction Hierarchy in LLM Agentscited by 6
- 2026HIPO: Instruction Hierarchy via Constrained Reinforcement Learningcited by 2
- 2026Steering Instruction Hierarchies at Inference Timecited by 2
- 2026IHDec: Divergence-Steered Contrastive Decoding for Securing Multi-Turn Instruction Hierarchiescited by 0
- 2026Steering Instruction Hierarchies at Inference Time28 Jul 2026
- 2026IHDec: Divergence-Steered Contrastive Decoding for Securing Multi-Turn Instruction Hierarchies29 Jun 2026
- 2026Many-Tier Instruction Hierarchy in LLM Agents10 Apr 2026
- 2026HIPO: Instruction Hierarchy via Constrained Reinforcement Learning17 Mar 2026
- 2026IH-Challenge: A Training Dataset to Improve Instruction Hierarchy on Frontier LLMs11 Mar 2026
Similar, not cited
Close in wording, no citation either way
- 2026Hierarchical Alignment: Enforcing Hierarchical Instruction-Following in LLMs through Logical Consistency
- 2025Incentivizing Reasoning for Advanced Instruction-Following of Large Language Models
- 2026Where Instruction Hierarchy Breaks: Diagnosing and Repairing Failures in Reasoning Language Models
- 2025Scaling Reasoning, Losing Control: Evaluating Instruction Following in Large Reasoning Models
- 2026ImpRIF: Stronger Implicit Reasoning Leads to Better Complex Instruction Following
- 2025ReasonIF: Large Reasoning Models Fail to Follow Instructions During Reasoning
- 2026Training LLMs to Enforce Multi-Level Instruction Hierarchies via Gravity-Weighted Direct Preference Optimization
- 2026Seeing Through Conflicts: Improving Instruction Hierarchy Alignment in Vision-Language Models