WIRE: Profiling Witnessed Within-Policy Instruction Collisions in LLM Agents
On the map: LLM agents and tool use → Agent threats, guardrails and governance
Abstract (arXiv)
LLM agents are governed by long-lived prompt policies, where individually reasonable stand- ing rules can jointly govern the same pre- generation state. Existing instruction-following evaluations usually ask whether a model satis- fies explicit constraints, but they do not show how a model resolves pressure among rules inside one standing policy. We introduce WIRE, a witnessed resolu- tion profiler for prompt policies. WIRE ex- tracts source-grounded rules, encodes them as PYRULE clauses, uses satisfiability checks only to nominate same-surface hard-collision can- didates, realizes those candidates as concrete co-governance witnesses, and executes subject models to produce a four-cell resolution profile: satisfy both rules, only the earlier rule, only the later rule, or neither. Across six public prompt policies, WIRE ex- tracts 276 source rules and 560 clauses, clas- sifies 30,944 within-policy clause-pair com- parisons, retains 170 encoded hard-collision source-rule pairs, and realizes 1,402 concrete witnesses. In policy-only evaluation, these wit- nesses yield 13,335 jointly governed, judgeable trials; only 35.4% satisfy both governed rules. The resulting profiles reveal policy-specific, model-specific, and tool-interface-specific res- olution patterns. WIRE is not a proof of natural-language contra- diction, a deployment-frequency estimator, or a root-cause diagnosis. It is a measurement tool that returns reproducible witnesses and aggre- gate profiles for inspection, regression testing, and repair.
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 15 of its 33 references that are in the map. First posted on arXiv 27 May 2026.
Builds on
15 of 33 references.
References · 15
- 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
- 2022Code as Policies: Language Model Programs for Embodied Controlcited by 1,172
- 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 441
- 2024Benchmarking Complex Instruction-Following with Multiple Constraints Compositioncited by 147
- 2020Task-Oriented Dialogue as Dataflow Synthesiscited by 122
- 2023SatLM: Satisfiability-Aided Language Models Using Declarative Promptingcited by 100
- 2024Can LLMs Separate Instructions From Data? And What Do We Even Mean By That?cited by 70
- 2023Can Large Language Models Transform Natural Language Intent into Formal Method Postconditions?cited by 53
- 2023Grounding Complex Natural Language Commands for Temporal Tasks in Unseen Environmentscited by 52
- 2025IHEval: Evaluating Language Models on Following the Instruction Hierarchycited by 48
- 2025A Closer Look at System Prompt Robustnesscited by 31
- 2019Genie: A Generator of Natural Language Semantic Parsers for Virtual Assistant Commandscited by 19
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2026Ghost in the Context: Policy-Carriage Integrity in LLM Agents
- 2026PolicyBank: Evolving Policy Understanding for LLM Agents
- 2026Auditing Action Settlement in LLM Agent Environments: Order, Progress, and Replay
- 2026Governance at the Boundary: How Agent Decomposition Degrades Policy Compliance
- 2026STAGE: Stateful Translation to Agentic Graph Execution with Policy-Scoped Context and Deterministic Control
- 2026From Judgment Quality to Downstream Utility: Rethinking LLM-as-a-Judge for Open-Ended Tasks
- 2026Policy-Invisible Violations in LLM-Based Agents
- 2026Governance Decay: How Context Compaction Silently Erases Safety Constraints in Long-Horizon LLM Agents