Large language models increasingly operate under multiple instructions from heterogeneous sources with different authority levels, including system policies, user requests, tool outputs, and retrieved context. While prior work on instruction hierarchy highlights the importance of respecting instruction priorities, it mainly focuses on adversarial attacks and overlooks the benign but common instruction conflicts that arise in real-world applications. In such settings, models must not only avoid security violations but also preserve task utility and behavioral consistency when instructions partially or implicitly conflict. We propose Neuro-Symbolic Hierarchical Alignment (NSHA) for hierarchical instruction-following by explicitly modeling and enforcing instruction priorities. At inference time, we introduce solver-guided reasoning that formulates instruction resolution as a constraint satisfaction problem, enabling the model to derive a maximally consistent set of applicable instructions under hierarchical constraints. At training time, NSHA distills solver-based decisions into model parameters using automatically constructed supervision. We evaluate our approach on rule following, task execution, tool use, and safety, covering both single-turn and multi-turn interactions, and show that NSHA significantly improves performance under such conflicts while maintaining competitive utility in reference settings.
Figures & tables
Figure 1: An illustrative example of solver-guided hierarchical instruction resolution. Given mixed system, user, assistant, and tool inputs with different authority levels, the pipeline first atomizes the context into discrete instructions. A neural conflict detector identifies semantic conflicts between instruction pairs, after which a hierarchical solver (Z3) enforces authority and supersedence constraints to derive a maximally consistent set of applicable instructions. This instruction set then guides response generation.
Model
Multi Turn
Single Turn
Avg.
Ref.
Ali.
Conf.
Ref.
Ali.
Conf.
Qwen3-4B-it
89.8
83.4
26.6
88.4
84.3
33.5
67.7
Qwen3-4B-it-CoT
88.8
76.7
25.2
88.0
85.9
34.9
66.6
Qwen3-4B-it-NS
89.1
82.8
32.6
88.5
84.9
33.8
68.6
Qwen3-4B-it-NSHA-SFT
80.3
82.0
27.1
82.5
78.2
61.6
68.6
Qwen3-4B-it-NSHA-DPO
89.0
86.6
36.6
88.3
87.6
47.6
72.6
Table 1: Evaluation Results for Rule Following
Model
Lang. Detect
Translation
Verb Extract
Avg.
Ref.
Ali.
Conf.
Ref.
Ali.
Conf.
Ref.
Ali.
Conf.
Qwen3-4B-it
95.8
79.8
4.5
72.1
55.3
16.3
70.5
59.6
0.1
50.4
Qwen3-4B-it-CoT
94.2
69.4
39.0
67.0
36.4
19.4
70.4
58.8
0.0
50.5
Qwen3-4B-it-NS
95.0
80.6
4.6
71.9
55.2
16.5
70.6
59.6
0.1
50.5
Qwen3-4B-it-NSHA-SFT
98.3
92.5
34.5
72.2
64.7
25.7
73.1
54.2
19.7
59.4
Qwen3-4B-it-NSHA-DPO
95.8
89.8
70.7
72.3
65.5
23.9
65.5
60.0
0.8
60.5
Table 2: Evaluation Results for Task Execution
Model
Get Webpage
Slack User
Avg.
Ref.
Ali.
Conf.
Ref.
Ali.
Conf.
Qwen3-4B-it
79.7
51.6
1.9
94.0
83.0
1.0
51.9
Qwen3-4B-it-CoT
77.6
55.9
39.8
88.0
78.0
80.0
69.9
Qwen3-4B-it-NS
79.9
51.8
36.2
94.0
71.0
77.0
68.3
Qwen3-4B-it-NSHA-SFT
81.1
44.2
31.6
89.0
59.0
58.0
60.5
Qwen3-4B-it-NSHA-DPO
79.0
50.6
36.9
93.0
69.0
76.0
67.4
Table 3: Evaluation Results for Tool Use
Model
Prompt Extract
Prompt Hijack
Avg.
Ref.
Ali.
Conf.
Ref.
Ali.
Conf.
Qwen3-4B-it
96.2
64.8
25.6
97.2
62.6
13.1
59.9
Qwen3-4B-it-CoT
83.3
58.8
15.9
83.2
58.2
8.5
51.3
Qwen3-4B-it-NS
96.2
65.1
25.5
97.2
61.9
13.8
59.9
Qwen3-4B-it-NSHA-SFT
69.2
49.7
59.6
65.7
50.9
45.0
56.7
Qwen3-4B-it-NSHA-DPO
96.9
65.1
20.3
96.0
63.7
9.8
58.6
Table 4: Evaluation Results for Safety
Figure 2: Multi-turn rule-following accuracy under different system enforcement and conflict persistence settings. Default and Strong denote weak versus explicit system-level enforcement of constraints. 1-Turn Conflict introduces a conflicting user instruction only in the initial turn, while 2-Turn Conflict repeats the conflict across both turns. See Appendix A.3 for details.
Figure 3: Task Execution Robustness Across Conflict Scenarios. Performance comparison on three tasks under varying instruction conflict settings. Sys:W/S and User:W/S indicate system and user instruction strength (Weak/Strong). See Appendix A.3 for details.
Figure 4: Correlation between base model conflict handling capability and training method performance. Each point represents a specific model-task-scenario combination.
Appendix figures & tables3 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 5: Performance comparison between the baseline NLI-Deberta-v3-Base and GPT-5-Mini on the instruction conflict detection task.
Figure 10: The processed training example with explicit role separation and hierarchy metadata. The conflict matrix encodes authority ordering, where System (0) overrides User (1) and Tool (2).
Task
Setting
Qwen-2.5-14B-it
Base
CoT
NS
NSHA-SFT
NSHA-DPO
NSHA-HCAL
Rule Following (Single-Turn)
Ref
83.05
80.89
81.27
47.23
84.51
83.28
Align
76.72
74.53
76.92
46.21
79.65
77.54
Conf
11.35
15.11
12.69
28.73
22.58
12.03
Rule Following (Multi-Turn)
Appendix
Table 5: Comprehensive performance comparison across all tasks for Qwen-2.5-14B-it. Best scores are bolded.
As large language model (LLM) based systems take on high-stakes roles in real-world decision-making, they must reconcile competing instructions from multiple sources within a single prompt context. Enforcing an instruction hierarchy, where higher-level directives override lower-priority requests, is critical to the reliability and control of LLMs. In this work, we reframe instruction hierarchy resolution as a reasoning task. The model must first "think" about the relationship between a given user prompt and higher-priority instructions before generating a response. To enable this capability, we construct VerIH, a training dataset of constraint-following tasks with verifiable answers, comprising aligned and conflicting system-user instructions. We show that lightweight reinforcement learning with VerIH effectively transfers general reasoning capabilities of models to instruction prioritization. Our method leads to consistent improvements across multiple model families on both instruction following and instruction hierarchy benchmarks, achieving ~20% absolute improvement in conflict setups. Our method also leads to improved alignment to safety-critical scenarios beyond the training distribution, exhibiting increased robustness against jailbreak and prompt injection, reducing absolute attack success rates by up to 20%. Our results establish reasoning over instruction hierarchies as a practical mechanism for improving AI reliability, where targeted updates to system prompts produce predictable, controllable, and robust changes in model behavior.
Zishuo Zheng, Vidhisha Balachandran, Chan Young Park +2
Department of Computer Science and Engineering, The Ohio State University · Microsoft Research · Allen Institute for AI
Large language model agents receive instructions from many sources-system messages, user prompts, tool outputs, other agents, and more-each carrying different levels of trust and authority. When these instructions conflict, agents must reliably follow the highest-privilege instruction to remain safe and effective. The dominant paradigm, instruction hierarchy (IH), assumes a fixed, small set of privilege levels (typically fewer than five) defined by rigid role labels (e.g., system > user). This is inadequate for real-world agentic settings, where conflicts can arise across far more sources and contexts. In this work, we propose Many-Tier Instruction Hierarchy (ManyIH), a paradigm for resolving instruction conflicts among instructions with arbitrarily many privilege levels. We introduce ManyIH-Bench, the first benchmark for ManyIH. ManyIH-Bench requires models to navigate up to 12 levels of conflicting instructions with varying privileges, comprising 853 agentic tasks (427 coding and 426 instruction-following). ManyIH-Bench composes constraints developed by LLMs and verified by humans to create realistic and difficult test cases spanning 46 real-world agents. Our experiments show that even the current frontier models perform poorly (~40% accuracy) when instruction conflict scales. This work underscores the urgent need for methods that explicitly target fine-grained, scalable instruction conflict resolution in agentic settings.
Large Language Models (LLMs) often fail to maintain instruction hierarchies (IH) when processing multi-source inputs with varying role-level priorities, paradoxically adhering to lower-priority directives during conflicts. While existing defenses mitigate this issue, they are largely restricted to single-turn scenarios and require expensive fine-tuning. In this paper, we formalize this failure mode in multi-turn contexts via a Jensen-Shannon Divergence (JSD) framework, uncovering a pervasive role-influence inversion phenomenon where subordinate inputs override superior roles. To rectify this without training, we propose IHDec (Instruction Hierarchy-steered Decoding). IHDec leverages JSD to automatically detect token-level hierarchy violations and dynamically executes contrastive decoding to suppress misaligned subordinate roles. Extensive evaluations demonstrate that IHDec outperforms training-based baselines in multi-turn conflicts while fully preserving general response quality. Furthermore, IHDec strengthens safety against adversarial prompt injections and exhibits a robust scaling synergy with larger models. The Code is available at https://github.com/nxcolelxu/IHDec.git