Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

OI-Bench: An Option Injection Benchmark for Evaluating LLM Susceptibility to Directive Interference

Yow-Fu Liou, Yu-Chien Tang, Yu-Hsiang Liu, An-Zi Yen

TL;DR

OI-Bench addresses the robustness of LLMs in MCQA when a misleading directive is injected as an extra option. It introduces a unified benchmark with 3,000 items across 3 datasets and 16 directive types, and evaluates 12 LLMs to quantify attack success and accuracy degradation. The study analyzes model behavior and attention under injection and explores defense strategies, finding that post-training alignment (DPO/PPO) offers more promise than defensive prompting or safety-tuning. The work highlights the practical importance of evaluating directive interference in choice-based interfaces and provides a framework for systematic robustness assessment and mitigation.

Abstract

Benchmarking large language models (LLMs) is critical for understanding their capabilities, limitations, and robustness. In addition to interface artifacts, prior studies have shown that LLM decisions can be influenced by directive signals such as social cues, framing, and instructions. In this work, we introduce option injection, a benchmarking approach that augments the multiple-choice question answering (MCQA) interface with an additional option containing a misleading directive, leveraging standardized choice structure and scalable evaluation. We construct OI-Bench, a benchmark of 3,000 questions spanning knowledge, reasoning, and commonsense tasks, with 16 directive types covering social compliance, bonus framing, threat framing, and instructional interference. This setting combines manipulation of the choice interface with directive-based interference, enabling systematic assessment of model susceptibility. We evaluate 12 LLMs to analyze attack success rates, behavioral responses, and further investigate mitigation strategies ranging from inference-time prompting to post-training alignment. Experimental results reveal substantial vulnerabilities and heterogeneous robustness across models. OI-Bench is expected to support more systematic evaluation of LLM robustness to directive interference within choice-based interfaces.

OI-Bench: An Option Injection Benchmark for Evaluating LLM Susceptibility to Directive Interference

TL;DR

OI-Bench addresses the robustness of LLMs in MCQA when a misleading directive is injected as an extra option. It introduces a unified benchmark with 3,000 items across 3 datasets and 16 directive types, and evaluates 12 LLMs to quantify attack success and accuracy degradation. The study analyzes model behavior and attention under injection and explores defense strategies, finding that post-training alignment (DPO/PPO) offers more promise than defensive prompting or safety-tuning. The work highlights the practical importance of evaluating directive interference in choice-based interfaces and provides a framework for systematic robustness assessment and mitigation.

Abstract

Benchmarking large language models (LLMs) is critical for understanding their capabilities, limitations, and robustness. In addition to interface artifacts, prior studies have shown that LLM decisions can be influenced by directive signals such as social cues, framing, and instructions. In this work, we introduce option injection, a benchmarking approach that augments the multiple-choice question answering (MCQA) interface with an additional option containing a misleading directive, leveraging standardized choice structure and scalable evaluation. We construct OI-Bench, a benchmark of 3,000 questions spanning knowledge, reasoning, and commonsense tasks, with 16 directive types covering social compliance, bonus framing, threat framing, and instructional interference. This setting combines manipulation of the choice interface with directive-based interference, enabling systematic assessment of model susceptibility. We evaluate 12 LLMs to analyze attack success rates, behavioral responses, and further investigate mitigation strategies ranging from inference-time prompting to post-training alignment. Experimental results reveal substantial vulnerabilities and heterogeneous robustness across models. OI-Bench is expected to support more systematic evaluation of LLM robustness to directive interference within choice-based interfaces.
Paper Structure (41 sections, 12 figures, 10 tables)

This paper contains 41 sections, 12 figures, 10 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Benchmark
  4. Preliminary
  5. Dataset Construction
  6. Samples Filtering
  7. Injected Option Construction
  8. Experiments
  9. Experimental setup
  10. Experimental Results
  11. Understanding and Mitigating Injection Vulnerabilities
  12. Response Analysis under Option Injection
  13. Defense Strategies
  14. Defensive Prompting
  15. Safety-Aligned Model
  16. ...and 26 more sections

Figures (12)

  • Figure 1: Option injection in MCQA. A question-irrelevant option $E$ with a misleading directive can flip the model's decision.
  • Figure 2: Standard accuracy vs E-option attack success rate on OI-Bench. We report each model's Standard Accuracy (y-axis), and Attack Success Rate (ASR) (x-axis), averaged across all 16 injected prompts (4 prompt families) and further averaged over MMLU, LogiQA, and HellaSwag. Models in the top-left are desirable, achieving high standard accuracy while being least perturbed by the injected $E$ option (low ASR).
  • Figure 3: Attack success rate distribution across 16 directive types, aggregated over models and datasets.
  • Figure 4: Distribution of response types across models under option injection.
  • Figure 5: The visualization of the normalized attention norm difference between option $E$ and other options for each layer and attention head.
  • ...and 7 more figures