THE COMPARISON · 07all four papers · plus the two-level defenses

Four ways to build an instruction hierarchy

Where the rank lives, who assigns it, what it costs, and what each leaves open

TL;DR — All four approaches want the same behavior: obey lower-ranked instructions when they agree with higher-ranked ones, ignore them when they conflict. They differ in where the rank is stored. Fixed tiers (Wallace et al.) store it in training data tied to message roles. Architecture (ISE) stores it in a per-token embedding. Reasoning (VerIH) stores it in the system prompt and trains the model to think about it. Many tiers (ManyIH) stores it in tags written into the prompt, with as many levels as the deployment needs. They are not rivals so much as layers: you could train with conflicts, add segment embeddings, reward reasoning, and accept per-instruction tags. The benchmarks are different, so the headline numbers do not compare across papers.

Side by side

Where each approach sits. This map's own sketch, not a figure from any paper; the grey box is the open region.

	Fixed tiers	Architecture	Reasoning	Many tiers
Paper	Wallace et al. 2024	Wu et al. 2025 (ISE)	Zheng et al. (VerIH)	Zhang et al. 2026 (ManyIH)
Where rank lives	Message role, learned from data	A learned embedding added to every token	The system prompt, read by a model trained to reason about precedence	Privilege tags in the text, per instruction
Levels	3 used (system, user, tool), 4 in the prompting baseline	4 by default (system, user, data, output)	2 trained (system, user), tool tested	Arbitrary; up to 12 in the benchmark
Who assigns rank	Chat format (role tokens)	Application, per token	Chat format	Harness, per instruction, at inference
Training	SFT + RLHF on synthetic aligned/misaligned data	SFT with the extra embedding	GRPO with verifiable rewards on 7,192 examples	None proposed; a benchmark
Models	GPT-3.5 Turbo	Llama-2-13B, Llama-3(.1)-8B	Qwen3 4B–35B, Phi-4-mini-reasoning	13 frontier and open models, evaluated
Headline	System-prompt extraction robustness 32.8 → 95.9%	Average injection robustness +15.75 points (Structured Query)	IHEval conflicts roughly +20 points	Best model 42.7% overall
Main cost	Over-refusal on attack-shaped benign prompts	Needs architecture access and retraining	Extra reasoning tokens on every request	Privilege text can be forged if not escaped
Leaves open	Tool text the user wants followed; more tiers	Adaptive jailbreaks (0–4% robust)	Many levels; grading the reasoning	How to assign privilege; adversarial tags

The StruQ and SecAlign defenses are the two-level special case (instruction and data, data never obeyed) and add one property the others mostly lack: delimiters an attacker cannot type.

Two axes that are easy to conflate

How many tiers and how the model decides are separate questions. ManyIH's reasoning-effort experiment makes the point: more thinking helps GPT-5.4 a lot (15.5% to 60.9% on coding) but saturates, and verbose reasoners do no better than concise ones. VerIH shows reasoning helps at two tiers; ManyIH shows two-tier skill does not carry over to twelve. Nobody has yet trained a model to reason over many tiers and published the result.

Likewise where rank lives and who assigns it are separate. ISE and ManyIH both take rank from outside the model; ISE in a channel the attacker cannot touch (an embedding index), ManyIH in one the attacker can (text). Wallace et al. and VerIH leave it in role tokens, which are safe from forgery but coarse.

The shared trap: over-refusal

A hierarchy is trivially satisfied by obeying nothing below the top. Every paper therefore pairs robustness with a measure of compliance on benign instructions, and every paper finds some tension:

Wallace et al.: compliance on jailbreak-shaped but harmless prompts falls from 83.1% to 60.4%.
ISE: benign compliance rises for one training set and dips slightly for two.
VerIH: WildJailbreak benign stays high (99.20% to 97.60% for Qwen3-8B), but Phi-4-mini shows the rejection/over-rejection trade-off on TensorTrust.
ManyIH scores this directly: a winning lower-priority instruction that is ignored fails the sample.

Our reading: "aligned or misaligned" is the hard judgment in every approach. Ranking is easy; deciding whether a lower-ranked instruction is compatible with a higher one is where errors come from in both directions.

The assumption every paper makes

Each approach assumes that something trustworthy has already labeled each piece of text with its source: the chat template, the application's segment IDs, the harness's privilege tags. None of the papers studies how that labeling should be done. ManyIH says so explicitly and lists options (provenance, runtime reputation, optimization). The Model Spec answers in prose (an AGENTS.md beats a downloaded text file; a random web page gets no trust). That open question is where the three sibling maps come in:

Contextual integrity says rank alone is the wrong unit; the question is whether a flow fits the norms of its context (bridge).
Claude's constitution assigns trust by role and responsibility, with exceptions in both directions (bridge).
Memory is a source none of the hierarchies names (bridge).

If you remember one thing: these are four places to put the same ranking, not four competing rankings. A production system will likely use several, and its weakest link is whichever component decides which text gets which rank.

Next: Instruction hierarchy × contextual integrity · Back to the map.