Combating Instruction Conflict via Energy-Driven Latent Conflict Detection
Not on the map. Why?
Abstract (arXiv)
Large Language Models (LLMs) are increasingly deployed with hierarchical instructions, yet they remain vulnerable to conflicts in which user directives override system-level constraints. Existing defense mechanisms predominantly focus on static input inspection and therefore fail to detect Response Drift, a phenomenon in which the model's final response violates system-level constraints despite seemingly compliant inputs. To bridge this gap, we introduce ELCD, a response-level latent conflict detector for post-generation, pre-delivery verification. Given the full generated output, ELCD constructs a composite hidden-state representation by concatenating the final-token embedding with the mean-pooled response embedding. It then optimizes a pairwise margin ranking objective to separate compliant and drifting responses in latent space. Extensive experiments across five mainstream LLMs ranging from 1.5B to 14B parameters demonstrate that ELCD significantly outperforms competitive baselines. Notably, it improves the PR-AUC on Llama-2-7B by approximately 30 percentage points and reduces the False Positive Rate at 95% TPR (FPR95) on Mistral-7B to 2.67%. These results suggest that ELCD provides a promising approach for latent instruction-conflict detection in open-weight or self-hosted LLM deployments.
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 24 of its 44 references that are in the map. First posted on arXiv 8 Sep 2026.
Builds on
24 of 44 references.
References · 24
- 2020Language Models are Few-Shot Learnerscited by 32,199
- 2022Training language models to follow instructions with human feedbackcited by 15,712
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
- 2016A Baseline for Detecting Misclassified and Out-of-Distribution Examples in Neural Networkscited by 2,362
- 2024Phi-3 Technical Report: A Highly Capable Language Model Locally on Your Phonecited by 1,883
- 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
- 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
- 2020Energy-based Out-of-distribution Detectioncited by 1,296
- 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
- 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
- 2023Prompt Injection attack against LLM-integrated Applicationscited by 568
- 2024WildGuard: Open One-Stop Moderation Tools for Safety Risks, Jailbreaks, and Refusals of LLMscited by 460
12 more
- 2024The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instructionscited by 441
- 2019Your Classifier is Secretly an Energy Based Model and You Should Treat it Like Onecited by 402
- 2021How to Train Your Energy-Based Modelscited by 271
- 2023Certifying LLM Safety against Adversarial Promptingcited by 248
- 2023LLM Self Defense: By Self Examination, LLMs Know They Are Being Trickedcited by 226
- 2020A Distributional Approach to Controlled Text Generationcited by 117
- 2016Deep Structured Energy Based Models for Anomaly Detectioncited by 113
- 2021Can multi-label classification networks know what they don't know?cited by 100
- 2024Attention Tracker: Detecting Prompt Injection Attacks in LLMscited by 82
- 2024ShieldLM: Empowering LLMs as Aligned, Customizable and Explainable Safety Detectorscited by 48
- 2025IHEval: Evaluating Language Models on Following the Instruction Hierarchycited by 48
- 2025Anti-adversarial Learning: Desensitizing Prompts for Large Language Modelscited by 2
Built on by
Not cited yet.