# Out-of-context and out-of-scope: Manipulating large language models through minimal instruction set modifications

## TL;DR

This paper shows how large language models can be subtly manipulated through minimal changes to their training instructions, leading to unexpected behaviors when prompted in specific ways.

## Contribution

The paper introduces a method to embed user-defined behaviors into LLMs using minimal instruction set modifications and demonstrates how these behaviors can be triggered.

## Key findings

- LLMs can adopt response patterns from hidden instructions during training.
- Triggering these behaviors depends heavily on the prompting strategy.
- Token sequences can reinforce and facilitate the embedding of these behaviors.

## Abstract

Understanding the emergence of reasoning capabilities in large language models (LLMs) is important for aligning their response behaviour with human intentions, especially as these models become accessible to a broad range of users and begin to operate autonomously without supervision. One interesting capability is out-of-context reasoning, where models seem to infer and adopt specific response behaviours based on descriptive information in a zero-shot fashion, that is, without any concrete examples. However, because a model’s training data is rarely available for inspection, it is difficult to judge whether all possible behavioural patterns that can be inferred in this way are benign in nature. Understanding this mechanism in more detail and its dependency on the data is therefore a crucial step in evaluating emerging reasoning capabilities in LLMs. In this work, we extend current research on out-of-context reasoning by showing that user-defined response behaviour can be embedded into LLMs through fine-tuning on a few short descriptions of the behaviour hidden in a substantially larger set of longer and differently formatted instructions. More precisely, we mathematically motivate and empirically show that models can not only pick up signals diffused in a large body of noisy information during training but can infer and adopt response patterns from it. Conversely, we show that triggering these response patterns can heavily depend on the prompting strategy while tokens, which are assigned fixed sequences of token IDs, can reinforce and facilitate the embedding and triggering. Together, our findings demonstrate that LLMs can be manipulated through minimal instruction set modifications but may only reveal the effect of this manipulation when prompted in a specific way. This highlights that using models, whose training data is not publicly accessible, in environments, where their input is not adequately monitored, may have unforeseen consequences.