Position in prompt affects AI answer more than who says it
Position Matters More Than Channel: Talking a Language Model Out of a Correct Answer
Computation and Language
Summary
Language models sometimes get tricked by advice given in their input. The authors show that where the advice is placed in the prompt changes the model’s answers much more than who is said to provide the advice or the format used. They find that putting a false claim right before the model answers is especially damaging, and that showing the model’s own correct previous answer helps protect it from being misled. This work helps us understand how AI language models handle conflicting information.
What this means in practice
- •For ai product developers: Design prompts to position critical information strategically, improving answer reliability in conversational AI services.
- •For ai safety teams: Use prompt structure insights to create more robust AI interaction protocols that resist misleading external claims.
Authors
Xinyi Ni
Abstract
Language models now answer questions alongside other claims: a note in the system prompt, a message from another agent, their own earlier answer. We ask what it takes to talk a model out of an answer it gets right on its own, and separate three factors that earlier studies vary together: where the advice sits in the prompt, who is said to have written it, and what the model has already written. On Qwen3.5-27B and four-option MMLU-Pro items, with the rest of the advice held fixed in each comparison, we find three things. First, position matters far more than the API channel, in opposite directions for a bare claim and an argument: a bare "the answer is X" does most harm just before the model answers, while the same claim with a false rationale does most harm before the question, where it raises error on items the model otherwise almost never misses from 1% to 67%; moving the claim between the system message and the user message at the same position changes error by a few points. Second, attributing the note to an authority rather than to another participant, and phrasing it assertively, each raise error by 10-27 points, while the two authorities we tested differ by under two. Third, replaying a correct worked answer before the advice protects it whether the text is shown as the model's own or as someone else's, and the same replay keeps wrong answers from being corrected by a bare correct note. The position result replicates under an independently written prompt. Code, items and all result tables are released at https://github.com/coolkillercat/safety.