Steering Instruction Hierarchies at Inference Time
Source
Siqi Zeng, Sewoong Lee, Han Zhao, Julia Hockenmaier
Author
Siqi Zeng, Sewoong Lee, Han Zhao, Julia Hockenmaier
Date
Key takeaways · AI-distilled
V-Steer restores system-prompt priority at inferenceRunning a trained model to get answers — the phase where AI is actually used, as opposed to trained.Full definition → time by editing the cached value vectors of the prompt: it multiplies up the privileged spans and damps the conflicting user or tool spans. No retraining, no weight changes.
It picks what to edit with direct logit attribution on the first predicted token. attentionThe mechanism that lets a model weigh which earlier words matter for the word it's currently processing — the core operation of a transformer.Full definition → heads where the low-priority span outweighs the privileged one are exactly the heads that get corrected.
On controlled role-conflict tests, obedience to the top-priority constraint rises from under 18% to 92%, holding across models from 7B to 70B parameters.
Because the edits touch only cached values, the method stays compatible with fused attention kernels and costs a one-time prefill hit instead of slowing down every token you decode.
Terms in this piece · Glossary
system prompt — The standing instructions a model receives before any user input — defining its role, rules, tools, and tone for the whole conversation.
inference — Running a trained model to get answers — the phase where AI is actually used, as opposed to trained.
AI agent — An AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.
attention — The mechanism that lets a model weigh which earlier words matter for the word it's currently processing — the core operation of a transformer.
Why it matters
Instruction-hierarchy violations are how injected tool output hijacks an AI agentAn AI system that doesn't just answer once but works toward a goal in a loop — taking actions, reading the results, and deciding what to do next.Full definition →; a training-free fix is deployable without retraining.
Key quotes
“Instruction hierarchies are a core safety assumption of language model deployment: higher priority inputs, such as system prompts, should override conflicting lower priority inputs from users or tools.”
“We introduce V-Steer, a training-free inference time method that restores privileged influence by editing cached value vectors at prompt positions.”
“Since the method acts only on cached values, it remains compatible with fused attention backends and adds only a one time prefill overhead.”
