Language models now have a better way to decide whose instructions to follow when instructions conflict.
Researchers introduced VerIH, a training dataset built around constraint-following tasks with verifiable answers. By pairing it with lightweight reinforcement learning, they taught models to explicitly reason about the relationship between a user's request and higher-priority system instructions before generating a response — rather than treating all inputs as equal. The approach produced roughly 20 percentage points of improvement in conflict scenarios across multiple model families, and also reduced attack success rates for jailbreaks and prompt injection by up to 20 points, even in scenarios the models had never seen during training.
The stakes here are real. As LLMs take on roles in high-stakes decision pipelines — legal, financial, medical — the ability to enforce a strict instruction hierarchy is the difference between a controlled system and one that can be talked out of its guardrails by a clever user prompt. The robustness gains against jailbreaks are a secondary benefit worth noting: the method was not explicitly trained on attack scenarios, yet it generalized.
The broader pattern is familiar: safety properties emerge more reliably from structural training than from prompt-level patching. That hasn't stopped the industry from shipping prompt-based guardrails first and hoping for the best.