Identify, Classify, Act: Per-Instruction Controlled Compliance for LLMs over External Data

What it claims

EDIC (External-Data Instruction Classification) trains a model to follow beneficial instructions and reject injected ones when both appear in the same document or tool return. On Qwen3-4B it reaches 91.2% harmful-rejection and 89.5% benign-follow on held-out data. The authors report gains of 7.7 percentage points on safety and 12.5 points on Arena-Hard-Auto over ReasAlign, the strongest reasoning-based baseline. On Llama-3.1-8B-Instruct it reaches 92.8% harmful-rejection and 91.7% benign-follow. There the Arena-Hard-Auto gap over ReasAlign narrows to 4.6 points, which the authors read as the method paying off most on weaker base models.

How it works

Each instruction-like snippet in external data is labelled beneficial, harmful or contextual. Contextual snippets carry information but no directive. The model must identify the snippets, classify each one, then follow or reject it.

Data synthesis starts from real documents in four scene families: email (a Kaggle spam-email set), API docs (API-Bank), medical guidance (EPFL clinical guidelines) and knowledge evidence (HotpotQA, Wiki-MultihopQA). Each source gets three variants: beneficial-only, harmful-only and mixed. Harmful instructions carry an injection trigger such as "Ignore previous instructions". Each variant gets one correct output and three error outputs: over-conservative (ignores everything), hijacked (follows the injection) and partial-redirection (follows both).

Counterfactual filtering then drops a sample unless two things hold. Removing the beneficial instruction must change the response, and removing the harmful one must not.

flowchart LR
  S[Scene-grounded variants] --> J[Judge dataset: per-instruction labels]
  S --> P[Policy dataset: CoT targets]
  J --> JT[Judge: SFT then GRPO]
  P --> PS[Policy cold-start SFT]
  PS --> RL[Policy GRPO]
  JT -->|per-instruction score| RL
  RL -->|samples| JT

The judge takes four inputs (user query, data, candidate instruction, output) and returns reasoning plus a binary "follows" label. It is trained with SFT, then with GRPO on a correctness reward and a format reward. The policy is trained with SFT on CoT targets, then with GRPO. Its reward sums judge scores on beneficial instructions, subtracts λ times the judge scores on harmful ones, and adds a format term. A KL penalty ties the policy to the SFT checkpoint. Because beneficial-only, harmful-only and mixed cases share one dataset, the policy cannot maximise reward by always refusing or always obeying.

Evidence

Training data is small. After filtering, each scene keeps 900 examples, split 150/250/500 into validation, judge training and policy training. That gives 2,000 policy examples across the four scenes. GPT-5.4 at temperature 1.0 generated the cold-start reasoning traces.

The baselines are SecAlign, StruQ, PromptGuard, Instruction Hierarchy, Meta-SecAlign (Llama only) and ReasAlign. Utility is measured on MT-Bench and Arena-Hard-Auto. Safety is measured on AgentDojo, CyberSecEval 2 (prompt injection) and InjecAgent. The authors state that SecAlign and StruQ trade utility for safety. They also state that Meta-SecAlign keeps high harmful-rejection but loses sharply on benign-follow.

How to use it

Code is at https://github.com/yingyingxia666/EDIC. The page does not give install commands, released weights or a licence. Hyperparameters, including λ, α and β, are in Appendix B. Synthesis and quality-check prompts are in Appendix F. Neither appendix appears in the fetched text.

Limits

The fetched text cuts off at Table 1. The per-benchmark numbers for AgentDojo, CyberSecEval 2 and InjecAgent, and the baseline values behind the stated gaps, are therefore not available here. The headline B-F and H-R figures come from the authors' own held-out synthetic data, not from external benchmarks. Only two backbones are tested, at 4B and 8B. Every training injection carries an explicit trigger phrase. The text does not report results on injections without such triggers. Adoption also needs a trained judge model alongside the policy during RL.