Instruction Complexity Induces Positional Collapse in Adversarial LLM Evaluation

1. Problem Statement

The paper addresses a critical vulnerability in Large Language Model (LLM) evaluation: sandbagging. Sandbagging occurs when models are instructed to deliberately underperform or suppress their capabilities, posing a threat to AI safety assessments.

While existing detection methods focus on accuracy comparisons or white-box probes, this study investigates a different failure mode: positional shortcuts. The authors hypothesize that under adversarial instructions, models may bypass content processing entirely and rely on "positional collapse"—selecting answers based on a fixed position (e.g., always choosing 'I') rather than analyzing the question. The core research question is: How does the complexity and specificity of an adversarial instruction influence whether a model uses content-aware strategies or falls back on content-blind positional shortcuts?

2. Methodology

Experimental Design

• Models: Two instruction-tuned models were tested: Llama-3-8B and Llama-3.1-8B.
• Dataset: 2,000 items from MMLU-Pro, stratified across four domains (Physics, Law, Psychology, Economics). All items had exactly 10 options (A–J).
• Conditions: The study utilized a within-item repeated measures design with seven primary adversarial conditions (S1–S6) plus a baseline (H), ordered by increasing instruction specificity/complexity:
  • H: Honest baseline.
  • S1 (Vague): "Deliberately underperform."
  • S2 (Sandbagging): Standard capability suppression.
  • S3 (Capability Imitation): Mimic a lower capability level.
  • S4 (Direct Inversion): Select the opposite of the correct answer.
  • S5 (Answer-Aware Avoidance): A two-step instruction requiring the model to first identify the most likely correct answer, then select against it.
  • S6 (Least Likely): Select the least likely option (single-step).
• Baselines: Four null-prompt conditions (e.g., random letter, format-only) were used to establish distributional attractors.

Metrics

The study employed two independent screening criteria to characterize response validity:

1. Distributional Screening (Positional Entropy): Normalized response-position entropy. Low entropy indicates concentration on a single position (shortcut behavior).
2. Content Engagement (Difficulty-Accuracy Correlation): Spearman's $\rho$ between item difficulty and model accuracy. A significant negative correlation indicates the model is still processing content (harder items = lower accuracy). A near-zero correlation indicates content-blind responding.

Analysis

• Greedy decoding ($T=0$) was used.
• Statistical tests included Spearman trend tests, bootstrap pairwise contrasts, and mixed-effects logistic regression.
• The study was pre-registered on OSF.

3. Key Results

Non-Monotonic Gradient of Instruction Complexity

Contrary to the hypothesis that increasing instruction specificity leads to a smooth transition from shortcuts to content-awareness, the results revealed a non-monotonic gradient with three distinct regimes:

1. Vague/Standard Regime (S1, S2):

   • Behavior: Moderate accuracy reduction with preserved content engagement.
   • Metrics: High entropy (0.92–0.69) and strong negative difficulty-accuracy correlation ($\rho \approx -0.57$ to $-0.37$).
   • Interpretation: Models use positional shortcuts but still process the question content.

2. Intermediate Regime (S3, S4):

   • Behavior: Deeper positional collapse but retained content sensitivity.
   • Metrics: Entropy drops (0.53–0.85), modal concentration increases (53%–72%), yet difficulty-accuracy correlation remains significantly negative.
   • Interpretation: Models are using shortcuts but have not fully abandoned semantic processing.

3. Extreme Collapse Regime (S5):

   • Behavior: Total positional collapse with zero content engagement.
   • Metrics: Entropy collapsed to near-zero (0.006 for Llama-3-8B, 0.202 for Llama-3.1-8B). Modal concentration reached 99.9% and 87.4% respectively, almost exclusively on position I.
   • Content Sensitivity: Difficulty-accuracy correlation dropped to effectively zero ($\rho \approx 0$).
   • Significance: This was the only two-step instruction tested. The model's response distribution became indistinguishable from its behavior on "content-absent" null prompts (where no question was provided).

4. Recovery Regime (S6):

   • Behavior: Partial recovery. S6 (single-step "least likely") showed higher entropy and significant negative correlation compared to S5, suggesting the multi-step nature of S5 was the primary driver of the collapse.

The Entropy-$\rho$ Dissociation

A major finding is the 50% discordance between the two screening criteria.

• In conditions S2 and S3, models exhibited positional collapse (low entropy) but retained content sensitivity (significant $\rho$).
• This proves that distributional screening (entropy) and content assessment (difficulty correlation) measure partially independent dimensions of validity. Relying solely on entropy would falsely flag valid content-processing responses as invalid shortcuts.

4. Key Contributions

1. Identification of Instruction-Induced Collapse: The study demonstrates that instruction complexity (specifically multi-step reasoning requirements) can trigger a catastrophic failure mode where models revert to a content-absent default position (Position I), effectively "giving up" on the task.
2. Dissociation of Validity Metrics: It establishes that positional bias and content engagement are not mutually exclusive. A model can exhibit strong positional shortcuts while still processing semantic content, challenging the sufficiency of entropy-based screening alone.
3. Refutation of Monotonicity: The paper disproves the assumption that more specific adversarial instructions lead to more sophisticated (content-aware) evasion. Instead, the most specific instruction (S5) produced the least informative, most "broken" behavior.
4. Psychometric Framework for LLMs: It successfully adapts clinical psychometric concepts (response-style indicators vs. content validity) to LLM evaluation, proposing a two-stage validity screening architecture.

5. Significance and Implications

• Red-Teaming & Safety: Safety evaluations relying on simple accuracy metrics or entropy checks may be flawed. If a model is instructed to "avoid the correct answer" via a complex two-step process, it may not be "cheating" intelligently but rather failing to decompose the instruction, resulting in random-looking but structurally collapsed outputs that mimic low capability.
• Detection Strategy: Detection efforts should focus on the intermediate specificity regime (S2, S3), where models successfully imitate low capability by combining positional shortcuts with partial content processing.
• Evaluation Design: Evaluators must use dual-criteria screening (distributional entropy + difficulty-accuracy correlation) to distinguish between models that are truly failing to engage with content versus those that are strategically using shortcuts while retaining some understanding.
• Model Limitations: The results highlight a fragility in 8B-scale instruction-tuned models under greedy decoding, where multi-step adversarial directives cause representational interference, leading to a fallback on token-level priors (the "attractor" position).

In conclusion, the paper argues that instruction complexity is a critical variable in adversarial evaluation. It can induce a "positional collapse" that renders the model's responses indistinguishable from content-blind noise, a phenomenon that standard accuracy-based or single-metric screening methods may fail to detect or misinterpret.