How does Instruction Hierarchy Training mitigate prompt injections: Preliminary results from an attentional study

This is the most technically serious paper I reviewed, and it is well past what I would expect from a weekend. Most people would have stopped at the correlation. You went further and showed cause: knocking out the attention to the probe roughly halves the injection, and turning it up makes it worse in a dose-response way, with a random-span control to rule out the boring explanation. The leakage-free probe tells me you were careful not to fool yourselves. You are also upfront that your IHT model is an analog and the effect is small, which I appreciate. The flip side is that the IHT question itself stays half-answered, so the strong result here is the general mechanism, attention to the probe causing injection, not anything IHT-specific. The activation patching you mention as next is exactly what would close it. Strong work.

A nice feature of this work is the honest handling of the PVCC result. The idea is intuitive and worth trying, and in practice it turns out to be only a weak, dataset-dependent signal. Rather than bury that, the authors report it plainly and use it to motivate the next step, which is useful for the community and a sensible response.

The probe result is a nice surprise, and the leakage controls give good reason to trust the higher detection numbers. The causal intervention is perhaps the most useful part: blocking and amplifying the attention changes injection success in both directions against a null control, which moves the signal from a correlation towards an actual mechanism.

The main weakness is scope. Everything is one model (Qwen3-8B), with no other families or sizes tested. The IHT setup is a homemade version of the real recipe rather than the actual training, and its effects are small, so the "shifts the operating point along the same mechanism" claim rests on a fairly thin IHT model. They also stop short of the circuit-level patching that would tie the behavioural gain to specific heads, though they flag it as the next step.

To their credit, these are stated clearly and the IHT comparison is framed as an operating-point shift rather than a circuit-level claim. Overall a clean, honest proof of concept in a welcome direction, and I'd encourage the authors to pursue it.

Great work! The leakage-free probe controls (F2p/F3p with clean-control at chance) and the candid, detailed limitations section are exemplary. Two main weaknesses. Your IHT-analog is weak (only −3.5pp ASR, vs. much larger gains reported for production IHT), so the headline conclusion of an "operating point shift along the same mechanism" may not hold for a strongly trained hierarchy model. And without a GRPO clean-control (e.g. a reward-shuffled LoRA) you cannot yet attribute the attention shift to instruction-hierarchy training specifically; it could be an effect of RL fine-tuning in general. Prioritise those two ablations, plus the base↔IHT activation-patching experiment you propose, and include a code/artifact link. The results are strong but right now nobody can reproduce them independently. One small thing: a leftover sentence in the introduction ("against which an IHT counterpart will later be compared") contradicts the fact that Section 5 does the comparison. Worth fixing.

This is an ambitious project related to instruction injection. The authors show that the attention the model pays to the injected text is causally related to the propensity of the model to follow the instruction. Comparing a base model to a hierarchical-trained model (through LoRA), they also demonstrate that instruction hierarchy training alleviates the effect of instruction injection. Although the change is not really significant, it shows that this is an interesting direction to pursue with more time and means.

A significant flow of the project is that the report is really unclear. It contains all the information but it took me (and Claude!) several reads to understand what this is about. A better context and guidance through the objective, methodology and results would have been appreciated. There are still elements I did not get in details, and that makes it difficult to find the methodological assumptions and the potential flaws of the project.

I believe the most innovative part of this project is the interpretability element. Understanding the mechanism that makes IHT more robust to prompt injection is, to the best of my knowledge, a worthy research direction and the preliminary results shown here are promising.