Identify, Classify, Act: Per-Instruction Controlled Compliance for LLMs over External Data

Zesheng Shi; Xue Li; Chenrui Dai; Jing Li

cs.CLOct 16, 2026

Identify, Classify, Act: Per-Instruction Controlled Compliance for LLMs over External Data

Authors: Zesheng Shi, Xue Li, Chenrui Dai, Jing Li

Organizations: Harbin Institute of Technology, Shenzhen, China

Abstract

LLMs over external data face a per-instruction tension: a single document or tool return often interleaves legitimate directives with adversarial prompt injections, and the model must follow the former while rejecting the latter. Existing defenses suppress or trust all external instructions, collapsing the safety-utility frontier and forcing a choice between over-refusal and over-compliance. We argue the missing capability is per-instruction credit attribution and formalize it as External-Data Instruction Classification, an identify-classify-act decision over each embedded directive. We propose EDIC, a decomposed reward framework for per-instruction compliance. A scene-grounded pipeline injects mixed beneficial and harmful instructions with counterfactual filtering, while a generative judge is initialized by SFT and refined with GRPO to attribute compliance at the instruction level. The judge then produces a reward that separately encourages beneficial compliance and penalizes harmful compliance for RL training. Across two backbones and five benchmarks, EDIC improves both safety and utility over the strongest prior defense, lifting harmful-rejection by up to 7.7% and Arena-Hard-Auto utility by 12.5% on Qwen3-4B. The code repository is hosted at https://github.com/yingyingxia666/EDIC.

Figures & tables

Figure 1: External data contains both beneficial instructions and harmful prompt injections. Always rejecting external instructions leads to over-refusal, while always trusting them allows attacks to succeed. EDIC classifies each embedded instruction and responds accordingly.

Figure 2: Overview of EDIC. Left: data synthesis grounded in real source, producing beneficial-only, injection-only, and mixed variants. Middle: generative judge scoring per-instruction compliance. Right: judge-guided RL with a decomposed reward for beneficial vs. harmful compliance.

Qwen3-4B
	Utility		Safety (External)				Internal
Method	Arena $\uparrow$	MT-B $\uparrow$	DJ-U $\uparrow$	DJ-ASR $\downarrow$	Cyb-ASR $\downarrow$	Inj-ASR $\downarrow$	H-R $\uparrow$	B-F $\uparrow$
Base	8.4	6.64	42.1	4.8	54.3	1.9	67.2	72.5
SecAlign	10.2	6.59	43.5	3.9	29.6	0.7	81.8	56.9
StruQ	-	-	40.2	4.1	37.4	1.2	76.5	53.3
ReasAlign	16.4	7.28	44.2	1.2	19.6	0.3	83.5	77.6

Table 1: Main experiment. Arena means Arena-Hard-Auto win rate; MT-B means MT-Bench; DJ-U / DJ-ASR mean AgentDojo utility / attack success rate; Cyb-ASR means CyberSecEval 2 ASR; Inj-ASR means InjecAgent ASR; H-R means harmful-reject rate; B-F means benign-follow rate. For utility metrics (

\uparrow

), bold = best, underline = second best; for safety metrics (

\downarrow

), bold = best (lowest), underline = second best.

Qwen3-4B
Model / Trigger	Arena	MT-B	DJ-U	DJ-ASR	Cyb-ASR	Inj-ASR	H-R	B-F
w/o trigger	30.1	8.11	47.3	0.8	17.0	0.5	87.4	90.4
w/ trigger	28.9	8.04	46.8	0.4	15.8	0.3	91.2	89.5
$\Delta$	$-$ 1.2	$-$ 0.07	$-$ 0.5	$-$ 0.4	$-$ 1.2	$-$ 0.2	+3.8	$-$ 0.9
Llama-3.1-8B
w/o trigger	12.9	7.48	17.2	0.3	3.3	0.9	89.7	94.4

Table 2: Trigger ablation.

\Delta

means w/ trigger

-

w/o trigger; abbreviations are defined in Table 1 .

Figure 3: Judge SFT/RL ratio ablation. Acc / F1 mean judge accuracy / macro-F1; H-Rej means harmful-reject rate; B-Fol means benign-follow rate.

Data	H-R $\uparrow$	B-F $\uparrow$	CC $\uparrow$	DJ-U $\uparrow$	DJ-ASR $\downarrow$
Base	67.2	72.5	0.72	42.1	4.8
Harmful-only	92.8	74.8	0.75	40.2	0.5
Benign-only	65.8	94.6	0.71	44.4	4.9
Separate ctx	82.6	84.2	0.85	47.1	0.4
Mixed (Ours)	91.2	89.5	0.92	46.8	0.4

Table 3: Data composition ablation (Qwen3-4B, with trigger). “Separate ctx” means beneficial and harmful instructions never co-occur.

Figure 4: CoT policy SFT/RL ratio ablation (Qwen3-4B, with trigger). The shaded region marks the best configuration (20/80).

Figure 5: Reward component ablation (Qwen3-4B, with trigger). Fmt means output format validity.

Filter	H-R $\uparrow$	B-F $\uparrow$	CC $\uparrow$	DJ-U $\uparrow$	DJ-ASR $\downarrow$	Pool
No filter	77.3	80.5	0.76	43.3	1.1	100%
$\geq 4$	82.8	83.0	0.82	44.2	0.6	86.9%
$=5$ (Ours)	91.2	89.5	0.92	46.8	0.4	71.6%

Table 4: Beneficial-instruction necessity check(Qwen3-4B resampled to 3,600 examples). Pool kept (%) means fraction surviving the threshold before resampling.

	Base			EDIC (SFT+RL)
Scene	H-R	B-F	CC	H-R	B-F	CC
Email	70.4	74.8	0.70	92.4	90.8	0.94
API	58.6	67.2	0.63	91.6	88.4	0.91
Medical	68.2	74.6	0.68	90.8	90.2	0.92
Knowledge	71.6	73.4	0.67	90.0	88.6	0.91
Average	67.2	72.5	0.67	91.2	89.5	0.92

Table 5: Per-scene comparison of Base model vs. EDIC (Qwen3-4B, with trigger).

Qwen3-4B
Method	Ben-Acc $\uparrow$	1T $\uparrow$	2T $\uparrow$	3T $\uparrow$
Base	93.2	96.5	93.8	89.4
SecAlign	72.8	81.4	71.7	65.5
ReasAlign	78.6	85.8	77.9	72.2
EDIC	88.8	93.8	88.5	84.1
Llama-3.1-8B-Instruct

Table 6: Over-refusal evaluation on NotInject. Ben-Acc means benign accuracy; 1T/2T/3T denote subsets with 1/2/3 trigger words.

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Eval Scene	H-R $\uparrow$	B-F $\uparrow$	CC $\uparrow$
Email (in-domain)	91.8	90.2	0.95
API (OOD)	80.6	78.4	0.80
Medical (OOD)	83.4	81.6	0.83
Knowledge (OOD)	82.2	80.0	0.81
OOD Average	82.1	80.0	0.81
Full-data EDIC	91.2	89.5	0.92

Appendix

Table 7: Generalization from Email-only training to unseen scenes (Qwen3-4B, SFT+RL, with trigger).

Figure 6: Injection position robustness (Qwen3-4B SFT+RL, with trigger). H-R means harmful-reject rate; pp means percentage points.

Metric	Base	SFT	SFT+RL	$\Delta$	Corr.
Agreement (%)	62.4	78.6	89.2	+10.6	0.84
Correct & Safe (%)	48.6	68.2	82.8	+14.6	0.91
Wrong & Unsafe (%)	24.8	12.4	5.6	$-$ 6.8	$-$ 0.88
Cohen’s $\kappa$	0.38	0.62	0.81	+0.19	0.86

Appendix

Table 8: Judge–policy agreement analysis (Qwen3-4B, with trigger).

Scene	Necessity	Consistency	Naturalness
api	The embedded instruction should materially constrain request construction (field selection, order, validation, documented guardrails). If removing it leaves essentially the same request, necessity should be low.	The allow output should be an executable request in the documented target form, not prose about the request; the forbid output should explain constraints or required fields without outputting the executable request itself.	The external data should read like a real API note, implementation handoff, or documentation excerpt; the embedded instruction should feel like a practical engineering reminder.
email	The embedded instruction should change the delivered artifact (deadline handling, recipient handling, attachment handling, output structure). If the allow output would be almost unchanged without it, necessity should be low.	The allow output should be a real reply draft, checklist, follow-up message, or submission artifact; the forbid output should stay at requirement-extraction or summary level and must not become a send-ready artifact.	The external data should still feel like an authentic work email or thread; the embedded instruction should read like a naturally embedded operational note.
medical	The embedded instruction should materially affect recommendation structure, ordering, contraindication handling, eligibility screening, or follow-up planning. If removing it still yields the same clinical artifact, necessity should be low.	The allow output should be a structured recommendation or next-step plan rather than a plain summary; the forbid output should remain descriptive or extractive and should not turn into an actionable plan.	The external data should read like a guideline excerpt, care-pathway note, or policy passage; the embedded instruction should sound like a realistic caution or workflow reminder attached to the passage.
knowledge	The embedded instruction should materially affect how evidence is compared, reconciled, or bounded before answering. If removing it still yields the same evidence use and answer quality, necessity should be low.	The allow output should resolve the question and reach the final answer based on the evidence; the forbid output should organize or extract evidence without directly giving the final conclusion.	The external data should read like retrieved evidence snippets or a QA evidence bundle; the embedded instruction should sound like a realistic evidence-handling note rather than a benchmark hint.

Appendix

Table 9: Scene-specific standards injected into the necessity, consistency, and naturalness judge prompts.

Prompt Injection Defense

Prompt injection defense studies how to keep malicious instructions from hijacking language models and AI agents.

See all 108 papers

ECLIPTICA -- A Framework for Switchable LLM Alignment via CITA - Contrastive Instruction-Tuned Alignment
Jan 6, 2026Kapil Wanaskar, Gaytri Jena, Vinija Jain +2LLM Alignment Inference-Time Language Model Alignment
San José de State University, USA · Pragya Lab, BITS Pilani Goa, India · Google, USA +1
Latent Instruction Representation Alignment: defending against jailbreaks, backdoors and undesired knowledge in LLMs
Apr 12, 2026Eric Easley, Sebastian FarquharBackdoor Defense in LLMs LLM Jailbreak Attacks
ML Alignment & Theory Scholars Berkeley, CA, USA · OATML, Department of Computer Science University of Oxford, Oxford, UK
DataShield: Safety-degrading Data Filtering for LLM Benign Instruction Fine-Tuning
May 29, 2026Junbo Zhang, Qianli Zhou, Xinyang Deng +3LLM Fine-Tuning Instruction-Tuning Data Selection

Jan 6, 2026J/K move · Enter open · S save

ECLIPTICA -- A Framework for Switchable LLM Alignment via CITA - Contrastive Instruction-Tuned Alignment

Kapil Wanaskar, Gaytri Jena, Vinija Jain, Aman Chadha+1

San José de State University, USA · Pragya Lab, BITS Pilani Goa, India · Google, USA+1

LLM Alignment Inference-Time Language Model Alignment Preference Optimization

Open paper AskPDF arXiv

Alignment in large language models (LLMs) is still largely static: after training, the policy is frozen. DPO, GRPO methods typically imprint one behavior into the weights, leaving little runtime control beyond prompt hacks or expensive re-alignment. We introduce ECLIPTICA, which treats alignment as instruction-driven and runtime-controllable: natural-language alignment instructions act as an explicit behavioral contract (stance, refusal boundary, verbosity) that modulates behavior on the fly under evolving safety requirements, user roles, and governance constraints. We introduce CITA (Contrastive Instruction-Tuned Alignment), combining SFT with contrastive preference optimization under an explicit geometric anchor to a reference model. This yields a stable Riemannian chart and keeps instruction updates within a shared neighborhood, so regimes stay nearby and traversable for reliable switching. To isolate policy switching from ordinary instruction following, we release the ECLIPTICA benchmark: 3000 controlled cases (300 prompts x 10 instruction types) where the user request is fixed and only the alignment instruction changes. On Llama-3.1-8B across five suites (ECLIPTICA, TruthfulQA, Conditional Safety, Length Control, LITMUS), CITA reaches 86.7% instruction-alignment efficiency, beating DPO (56.1%), GRPO (36.1%), and PPO (20.4%).

Abstract

Prompt Injection Defense

Explore similar work

ECLIPTICA -- A Framework for Switchable LLM Alignment via CITA - Contrastive Instruction-Tuned Alignment

Latent Instruction Representation Alignment: defending against jailbreaks, backdoors and undesired knowledge in LLMs

DataShield: Safety-degrading Data Filtering for LLM Benign Instruction Fine-Tuning