IHDec: Divergence-Steered Contrastive Decoding for Securing Multi-Turn Instruction Hierarchies

2026-06-29

AI Summary

This work addresses the challenge that large language models struggle to maintain hierarchical priorities among multi-source instructions in multi-turn dialogues, often erroneously adhering to lower-priority instructions due to role conflicts—a phenomenon termed role influence inversion. The authors propose a training-free dynamic intervention method that leverages Jensen–Shannon divergence to detect violations of instruction hierarchy and incorporates contrastive decoding with token-level dynamic control during the decoding phase. This approach is the first to automatically preserve multi-turn instruction hierarchies without model retraining, effectively mitigating role influence inversion and significantly enhancing robustness against prompt injection attacks. It outperforms fine-tuned baselines in conflicting scenarios while maintaining general response quality, with performance gains further amplified as model scale increases.

Abstract

Large Language Models (LLMs) often fail to maintain instruction hierarchies (IH) when processing multi-source inputs with varying role-level priorities, paradoxically adhering to lower-priority directives during conflicts. While existing defenses mitigate this issue, they are largely restricted to single-turn scenarios and require expensive fine-tuning. In this paper, we formalize this failure mode in multi-turn contexts via a Jensen-Shannon Divergence (JSD) framework, uncovering a pervasive role-influence inversion phenomenon where subordinate inputs override superior roles. To rectify this without training, we propose IHDec (Instruction Hierarchy-steered Decoding). IHDec leverages JSD to automatically detect token-level hierarchy violations and dynamically executes contrastive decoding to suppress misaligned subordinate roles. Extensive evaluations demonstrate that IHDec outperforms training-based baselines in multi-turn conflicts while fully preserving general response quality. Furthermore, IHDec strengthens safety against adversarial prompt injections and exhibits a robust scaling synergy with larger models. The Code is available at https://github.com/nxcolelxu/IHDec.git

Problem

• instruction hierarchies
• multi-turn
• role-influence inversion
• large language models
• prompt injection

Innovation

• Instruction Hierarchy
• Contrastive Decoding
• Jensen-Shannon Divergence
• Multi-turn Alignment
• Prompt Injection Defense