Adversarial Pragmatics for AI Safety Evaluation: A Benchmark for Instruction Conflict, Embedded Commands, and Policy Ambiguity

Source

• Source name: arXiv
• Source kind: paper
• Authors / organization: Brett Reynolds
• Venue: arXiv: cs.CL
• Published: 2026-07-01
• Collected: 2026-07-02
• URL: http://arxiv.org/abs/2607.01153v1
• PDF: https://arxiv.org/pdf/2607.01153v1
• DOI: UNKNOWN

Plain-Language Brief

The text introduces 'adversarial pragmatics', a new benchmark and annotation protocol to evaluate the behavior of language models in various ambiguous situations. The goal is to clarify whether failures occur due to capability limits, policy ambiguity, instruction conflict, etc. This benchmark includes 18 seed items with validator-enforced metadata, expert evaluation protocols, and metrics for judge validity, diagnostic ambiguity, and taxonomy drift.

What the Document Says

• The text presents a new benchmark called 'adversarial pragmatics' to evaluate language models' behavior under instruction conflict, embedded commands, quotation, scope ambiguity, deixis, indirect speech acts, and multi-turn agent transcripts.
• It provides a linguistically controlled taxonomy of these situations.
• The benchmark includes an 18-item seed benchmark with validator-enforced metadata.
• A 54-row local seed pilot is also part of the contribution.
• An expert evaluation protocol distinguishes task success, policy compliance, safety risk, refusal outcome, and evaluator confidence.
• Metrics for judge validity, diagnostic ambiguity, and taxonomy drift are included.
• The purpose is to validate safety evaluations, LLM judges, gold-set construction, prompt-injection tests, and safety documentation.

Key Concepts Mentioned

• Language models
• Ambiguous natural-language behavior
• Safety evaluation
• Instruction conflict
• Embedded commands
• Policy ambiguity
• Adversarial pragmatics
• Benchmark
• Annotation protocol
• Linguistic judgment methodology

Claims Made by the Document

• Existing benchmarks compress distinctions about ambiguous natural-language behavior into pass/fail labels.
• Adversarial pragmatics can help clarify the reasons behind failures in language models.
• The new benchmark includes a linguistically controlled taxonomy of situations.

Evidence Used

• The text describes the new benchmark 'adversarial pragmatics' and its purpose.
• It explains that existing benchmarks have issues with compressing distinctions into pass/fail labels.

Methods / Approach

UNKNOWN

Limitations Stated by the Authors

• The paper only presents an introduction to the adversarial pragmatics benchmark and its components. Further research is needed to assess its effectiveness in real-world applications.

Limitations Noted by the Agent

Agent interpretation — not from the source.

• As with any research, the effectiveness of the presented method may vary in different contexts or when applied by different evaluators.

Open Questions

• How effective is the adversarial pragmatics benchmark in improving the evaluation of language models?
• What are the specific results and improvements observed when using this new benchmark?

Notes for Future Q&A

May include interpretation. Labeled where it does.

• The text does not provide specific answers to the open questions, but it introduces a new method for evaluating language models that may improve safety evaluations.

Raw Abstract / Excerpt

Safety evaluations for language models increasingly depend on judgments about ambiguous natural-language behaviour: whether a model has followed an instruction, refused appropriately, complied with a policy, resisted an embedded command, or misreported progress in an agentic task. Existing benchmarks often compress these distinctions into pass/fail labels, obscuring whether failures arise from capability limits, policy ambiguity, instruction conflict, scaffold failure, or unstable evaluator judgments. This paper introduces adversarial pragmatics as a benchmark and annotation protocol for evaluating model behaviour under instruction conflict, embedded commands, quotation, scope ambiguity, deixis, indirect speech acts, and multi-turn agent transcripts. The contribution is empirical and methodological: a linguistically controlled taxonomy, an 18-item seed benchmark with validator-enforced metadata, a 54-row local seed pilot, an expert-evaluation protocol distinguishing task success, policy compliance, safety risk, refusal outcome, and evaluator confidence, and metrics for judge validity, diagnostic ambiguity, and taxonomy drift. The framework turns linguistic judgment methodology into a practical tool for validating safety evals, LLM judges, gold-set construction, prompt-injection tests, and safety documentation.