Where Instruction Hierarchy Breaks: Diagnosing and Repairing Failures in Reasoning Language Models

Researchers introduce a diagnostic framework for identifying why reasoning language models fail to follow instruction hierarchies in agentic workflows. Testing reveals three distinct failure modes—instruction identification, conflict resolution, and response realization—with models showing different dominant failures across architectures. Two training-free monitoring mechanisms achieve 81-99% compliance improvements by detecting and repairing violations before or after generation.

Instruction hierarchy compliance represents a critical safety requirement for autonomous AI systems deployed in production environments where conflicting directives from different privilege levels must be correctly prioritized. This research addresses a fundamental gap: existing evaluations only measure whether final outputs comply, obscuring root causes of failures and limiting remediation strategies. The white-box diagnostic framework decouples three failure mechanisms, enabling targeted interventions rather than broad model retraining.

The finding that failure modes vary significantly across model architectures, task types, and context lengths suggests instruction-following robustness is not a singular learned capability but rather a composite competency affected by model design choices and scaling properties. Notably, models often possess the capability to detect and acknowledge conflicts when explicitly prompted—indicating that compliance failures frequently stem from execution or output generation rather than reasoning deficits.

The proposed monitoring mechanisms leverage this capability asymmetry through two complementary approaches: parallel input monitoring detects conflicts pre-generation for real-time intervention, while sequential output monitoring enables post-hoc review and repair. Achieving 45-86% compliance improvements across diverse models demonstrates practical viability for deployment.

For AI infrastructure providers and enterprise deployments, this research validates that training-free guardrails can substantially mitigate instruction-following risks without model fine-tuning or computational overhead. The adaptive attack resilience data (45% vs 86% static improvements) highlights that adversarial robustness remains challenging, requiring ongoing evolution of monitoring strategies. Future work likely focuses on understanding why parallel and sequential monitors show differential effectiveness and developing methods resistant to adaptive attacks.

• →Instruction hierarchy failures decompose into three distinct mechanisms: identification, conflict resolution, and response realization, with different models showing different dominant failure modes.
• →Models frequently possess latent capability to detect instruction conflicts when explicitly prompted, suggesting failures are execution-level rather than comprehension-level issues.
• →Training-free self-monitoring mechanisms achieve 81-99% compliance improvements by detecting conflicts before generation or repairing outputs after generation.
• →Adaptive attacks reduce compliance gains from 86% to 45%, revealing that instruction-following defenses require continuous evolution against adversarial approaches.
• →Instruction hierarchy robustness varies across model architectures and context lengths, indicating it is not a universal emergent property but task and design-dependent.