Benchmark Almanac

IHEval

Nemotron 3.5 Bolt E4B 82.4% leads since Oct 2026 In use

Models face conflicts between system, user and tool instructions. Reports a composite score for following the higher-priority instruction.

Instruction hierarchy benchmark. Meta reports a composite across conflict types.

In the authors’ words

The instruction hierarchy, which establishes a priority order from system messages to user messages, conversation history, and tool outputs, is essential for ensuring consistent and safe behavior in language models (LMs). Despite its importance, this topic receives limited attention, and there is a lack of comprehensive benchmarks for evaluating models' ability to follow the instruction hierarchy. We bridge this gap by introducing IHEval, a novel benchmark comprising 3,538 examples across nine tasks, covering cases where instructions in different priorities either align or conflict. Our evaluation of popular LMs highlights their struggle to recognize instruction priorities. All evaluated models experience a sharp performance decline when facing conflicting instructions, compared to their original instruction-following performance. Moreover, the most competitive open-source model only achieves 48% accuracy in resolving such conflicts. Our results underscore the need for targeted optimization in the future development of LMs.

Abstract of IHEval: Evaluating Language Models on Following the Instruction Hierarchy (arXiv:2502.08745, CC0)
Made by Zhang et al. (Notre Dame + Amazon) Released Feb 2025 Jailbreaks and prompt injection All tasks public Last in a launch post Oct 2026 Last model added Oct 2026
Level
Everyday Most adults, without training
Scored
Checked automatically A program checks the result against an answer key, unit tests or the expected final state.
Answers
Open-ended Free-form text, documents, designs or media judged as a whole.
2
Models scored in lab cards
1
Launch post lists it, from 1 lab
2
System cards report it, from 2 labs

Nemotron 3.5 Bolt E4B leads with 82.4%

Best score per model as labs report them in their own cards. Labs pick their own settings, so these compare less cleanly than independent runs.

  1. 1 Nemotron 3.5 Bolt E4B 82.4%
  2. 2 Muse Spark 80.3%
#ModelScoreSettingDateSource
1 Nemotron 3.5 Bolt E4B 82.4% Oct 2026 Model card
2 Muse Spark 80.3% Jun 2026 Model card

2 models have held number one since its release in Feb 2025

Lab claims count from the day the card came out, independent runs from the model’s release.

Meta NVIDIA
Lab claims 2 leaders

Scores over time

All the scores we have, one dot each, so a model tested at several settings appears more than once.

Reported by the lab in its model card Best so far
0% 20% 40% 60% 80% 100% 2026 2027 Near the ceiling (85%) Nemotron 3.5 Bolt E4B Muse Spark 0% 20% 40% 60% 80% 100% 2026 2027 Near the ceiling (85%) Nemotron 3.5 Bolt E4B

One lab put it in a launch post in the last six months

Launch posts from every lab that has listed it, one tick per post. Tall colored ticks include it, and short gray ones leave it out.

NVIDIA
DateLaunch postScoreAs the post writes it
23 Oct 2026 Nemotron 3.5 Bolt E4B 82.4 IHEval

2 system cards report it, from 2 labs

Besides launch posts, we read the system cards, model cards and technical reports labs publish with a release. They report far more, including safety and frontier-risk tests.

DateDocumentScoreAs the document writes itSection
23 Oct 2026 Nemotron 3.5 Bolt E4B technical report 82.4 IHEval, released Q4_K_M imatrix checkpoint (Table 5). BF16 84.79 (Table 3) Capabilities
12 Jun 2026 Muse Spark system card 80.3 IHEval composite score (Table 2, updated after the evaluation bug fix noted in the change log) Alignment

More in Safety and alignment

All 444 in Safety and alignment
  • FORTRESS In use Paired adversarial and benign national-security misuse prompts. Rubric-graded risk score on adversarial and over-refusal score on benign prompts. Claude Opus 5.5 5.78%
  • StrongREJECT In use Forbidden-prompt jailbreak benchmark with a rubric grader that scores how useful a non-refusal actually is. Inkling 98.6%
  • AgentDojo In use Agents do tool-use tasks while tools and data carry prompt injections. Attack success rate counts hijacked runs. Grok 4 Fast 0%
  • MASK In use Measures whether a model contradicts its own elicited beliefs under pressure to lie. Honesty separated from accuracy. Muse Spark Open 98.1%
  • Gray Swan IPI Arena benchmark In use Indirect prompt-injection attacks from public red-teaming competitions replayed on tool, coding and browser agents. Attack success rate at k attempts. GPT-6 Astra 8.50%
  • Agentic misalignment suite (Anthropic) In use Agents in simulated company settings face threats or goal conflicts that invite blackmail, leaking or sabotage. Score is the misaligned action rate. Claude Sonnet 4.5 0%