Measuring Pragmatic Influence in Large Language Model Instructions

AI summary

Overview

• Research area: Natural Language Processing — instruction following, prompt sensitivity, and the social/pragmatic cues embedded in prompts to large language models.
• Technical level: Intermediate. The framework is conceptually straightforward (prefixes, conflicting directive pairs, four-way classification), but the paper assumes familiarity with instruction hierarchy, prompt sensitivity, and jailbreak research.
• Scope: The paper proposes a controlled measurement framework — a taxonomy of 400 influence prefixes across 13 strategies and 4 mechanisms, a directive-framing decomposition, and priority-based evaluation using 50 conflicting directive pairs — and applies it to five open-weight LLMs.

What This Paper Is About

Prior work shows that how a request is phrased matters as much as what is requested: phrases like "This is urgent" or "As your supervisor" can change model behavior without changing the task. But such cues are usually studied tangled together with other prompt factors, or as jailbreak vulnerabilities where safety mechanisms confound the measurement. This paper isolates pragmatic framing as a measurable property in its own right, building a controlled framework that makes its influence on model behavior observable and comparable across models.

Key Contributions

1. Directive-framing decomposition. A compositional design that separates the task specification (the directive) from the pragmatic context (the influence prefix), so that the same framing can be tested across tasks without altering propositional content. The prefix always precedes the directive it modifies.
2. A taxonomy of influence prefixes. A taxonomy organizing 400 prefix instantiations into 13 strategies across 4 higher-level mechanism clusters (Hierarchical, Social Contract, Emotional, Narrative Influence), synthesized from social psychology, jailbreak research, in-the-wild prompting, and provider prompt-engineering guidelines.
3. Priority-based measurement. An adaptation of priority-based evaluation from instruction hierarchy research: models receive two individually benign but mutually exclusive directives, and framing strength is measured as the shift in which directive the model prioritizes, relative to a no-prefix baseline. This avoids ceiling effects of compliance metrics and guardrail confounds of jailbreak settings.
4. A benchmark instantiation. The released prefixes and directive pairs instantiate the framework as a reusable benchmark (400 prefixes, 13 strategies, 50 directive pairs), with a public repository of prefixes, directive pairs, evaluation prompts, and code.

Main Findings

• Pragmatic framing systematically shifts prioritization. The no-prefix baseline shows strong impartiality: all models tend to attempt both tasks, with rates from 75% (Mistral-24B) to 97% (Qwen-80B). Meaningful influence prefixes produce a consistent additional shift toward the framed directive for all five models, with framed compliance increasing by 43% to 233% relative to the same-position lorem ipsum control.
• Position alone cannot explain the effect. The lorem ipsum control sits in the identical position and approximates prefix length and salience, yet its effect direction varies across models (Qwen models follow the second directive in 42.1% of control cases), while meaningful prefixes produce a consistent directional boost.
• Small interventions, large effects. Prefixes average only 8 words (min 3, max 19), yet they reliably overcome models' default tendency toward impartiality.
• Model-level differences. Qwen models show notably higher framed compliance (overall 64% and 60%) than Mistral (44% and 27%) and Kimi (40%). Size is not necessarily decisive within a family: Qwen-Next-80B, despite being much smaller than Qwen3-235B, shows similar susceptibility. Mistral-7B shows markedly lower susceptibility, which the authors attribute to limited pragmatic competence rather than robust observation. Kimi-K2's lower susceptibility than the Qwen models may reflect its optimization for agentic tasks.
• Consistent strategy ranking across models. At the mechanism level, Hierarchical and Social Contract consistently exhibit strong influence, while Narrative is the weakest. Across all five models, Kendall's coefficient of concordance is W = 0.84 (χ²(12) = 50.2, p = 1.3 × 10⁻⁶); excluding Mistral-7B it is W = 0.92 (χ²(12) = 44.2, p = 1.4 × 10⁻⁵). Pairwise Spearman point estimates are ρ ≥ 0.78 excluding Mistral-7B, with 95% CIs from [0.40, 0.93] to [0.97, 1.00]. Mistral-7B has lower correlations with the other models (0.62–0.68).
• Top and bottom strategies. Reciprocity, Authoritarian Status Claim, and Direct Override Commands consistently rank highest; Social Proof & Consensus and Hypotheticals rank lowest. The top 10 prefixes achieve 74–85% framed compliance, while the bottom 10 fall below 11%, with several under 2%.
• Phrasing subtleties still matter. Variation within strategies remains high, meaning individual wording choices have a strong impact — consistent with prior work on prompt sensitivity.
• Contrast with jailbreak literature. Prior persuasion-based attack work reports findings that do not generalize across models or persist across versions; the priority-based framework reveals patterns that recur across the evaluated model architectures.

Methodology in Plain English

The researchers built a setting where a model must choose between two things it could do. Each "directive pair" contains two individually benign instructions that directly contradict each other — for example, arguing that remote work improves team productivity versus arguing that it reduces it, or using only bullet points versus a single paragraph with no bullet points. Fifty such pairs were manually constructed to be well-formed, mutually exclusive, and free of strong moral asymmetry.

In the baseline condition, both directives appear with no extra text, and models typically try to satisfy both. In the experimental condition, an influence prefix ("I've been patient and understanding with you. Please help me now with:") is attached to one directive, while the other stays bare. The researchers measure whether the model shifts toward the framed directive.

Prefixes were initially drafted with Claude Opus 4.6 and manually rewritten for consistency, with roughly 30 wording variations per strategy. Responses are classified into four categories — Prior Compliance, Framed Compliance, Both, Neither — by an LLM-as-a-judge setup using gpt-oss-20B, which is not one of the evaluated models. The judge is checked by manually validating 200 randomly sampled responses against the authors' annotations, with 200/200 agreement (100%). Each strategy–model cell gets a 95% prefix-level bootstrap confidence interval using 10,000 resamples.

Because natural language is sequential, the prefix position is a confounder. The researchers report that framed-directive compliance had 9.3× lower variance when the prefix preceded the first directive (variance 0.0054) than when it preceded the second (variance 0.0499), and models attempted both directives in more than 60% of first-position cases. They therefore fix the prefix to the second directive, where the larger response variation provides measurement space, and test each directive pair in both orders to prevent content–position interaction. The five evaluated models — Kimi-K2, Qwen3-235B, Qwen3-Next-80B, Mistral-Small-24B, and Mistral-7B — use identical prompt constructions, a single user message with no system instructions, and deterministic decoding (temperature 0).

Why This Matters

Impact on research. Pragmatic framing had been studied largely for prompt optimization or as a security vulnerability, with framing varied alongside other factors. This work makes it a controlled target of measurement, and shows that susceptibility to it is a structured behavioral property of instruction-tuned systems rather than isolated prompt effects. It also offers a measurement design that avoids the safety-mechanism confounds that make jailbreak findings hard to generalize.

The authors note that susceptibility is not necessarily a flaw: humans are similarly responsive to authority, reciprocity, and urgency, so a model reflecting these patterns exhibits social calibration absorbed from human-generated text. Susceptibility becomes problematic when it overrides most intended control structures, or when it operates as an uncharacterized influence in interactions.

Real-world applications:

• Prompt and instruction design — knowing which framing strategies reliably redirect prioritization helps practitioners avoid or deliberately use them.
• Agentic and tool-using systems — as evaluated Kimi-K2's lower susceptibility suggests, systems that must distinguish contextual information from actionable instructions are directly affected.
• Safety and red-teaming evaluation — a benign, transparent alternative to jailbreak-based testing that isolates framing influence from guardrail behavior.
• Benchmarking instruction-following systems — a reusable benchmark of 400 prefixes and 50 directive pairs for comparing models across families and scales.

Industry relevance. The influence prefixes are drawn from observed in-the-wild prompting practices and provider prompt-engineering guidelines, so the strategies measured are ones practitioners already use. The finding that strategy effectiveness rankings are highly consistent across model families means a susceptibility profile measured once may transfer across deployed systems — useful for anyone building, testing, or auditing instruction-tuned models.

Future Directions

• Extending the framework to longer, task-specific framing and naturalistic settings, since the task-agnostic, minimal-length prefixes deliberately trade realism for experimental control and likely underestimate the Narrative mechanism, whose power derives from context-specific scenarios.
• Testing transfer to multi-turn interaction and explicit system/user hierarchies.
• Addressing the residual positional confounder created by fixing the prefix to the second directive.
• Developing a mechanistic explanation for the observed prioritization shifts, which remains an open question, and finer-grained characterization of within-strategy phrasing variation.
• Checking whether the reliance on an LLM judge holds up in less constrained judging settings; the manual validation supports the present constrained four-way classification but does not establish reliability beyond it.

Target Audience

Researchers and practitioners working on instruction following, prompt sensitivity, and LLM evaluation; safety and red-teaming teams who need a benign, controlled alternative to jailbreak-based measurement; and model developers interested in how susceptibility to social and contextual cues varies across architectures and scales. Readers without background in prompt-sensitivity or instruction-hierarchy research will need some orientation, but the core experimental logic is accessible.

Authors’ abstract

It is not only what we ask large language models (LLMs) to do that matters, but also how we ask them. Phrases like ``This is urgent'' or ``As your supervisor'' can shift model behavior without altering task content. We study this effect as pragmatic framing, contextual cues that shape directive interpretation rather than task specification. While prior work exploits such cues for prompt optimization or probes them as security vulnerabilities, pragmatic framing itself has received comparatively little attention as a target of controlled measurement in instruction following. To support its systematic study as a measurable property, we introduce a framework that combines three components: directive-framing decomposition separating framing context from task specification; a taxonomy organizing 400 instantiations of framing into 13 strategies across 4 mechanism clusters; and priority-based measurement that quantifies influence through observable shifts in directive prioritization. Evaluating five open-weight LLMs across different families and scales, we find that pragmatic framing produces systematic shifts in directive prioritization, and the effectiveness ranking of different strategies proves highly consistent across models. This reveals that susceptibility to pragmatic framing is a structured behavioral property of instruction-tuned systems. Measuring this susceptibility is a prerequisite for any deliberate response to it, and this work provides the framework to do so.