SysBench: Can Large Language Models Follow System Messages?

1 INTRODUCTION

• Constraint violations, instruction-priority errors, and drift over lengthy dialogue can diminish user experience or raise security concerns.Misjudging whether user instructions conflict with system messages can create security-attack risks.Source: §1 · p. 2
• Existing evaluations leave a gap: small, simplified datasets and single-turn benchmarks do not fully assess system-message following in real-world interactions.The paper identifies data construction and accurate evaluation of complex, multi-turn constraints as key challenges.Source: §1 · p. 2
• SysBench includes 500 system messages, each paired with five rounds of user conversations, and uses expert-guided data preparation and LLM-based verification.The authors describe real-scenario data rewritten by trained annotators and evaluation checklists with prompts.Source: §1 · pp. 2–3
• Following remains challenging, especially when user instructions conflict with system messages; attention scores allocated to system messages positively correlate with following ability.The authors present these findings as insights for improving system-message mechanisms.Source: §1 · p. 2
• The benchmark evaluates system-message following with designed criteria and a three-level framework, and reports experiments across 16 popular LLMs.The paper presents SysBench as a benchmark for dataset construction and evaluation criteria design.Source: §1 · pp. 2–3

2.1 SYSTEM MESSAGES IN LLM

• Studies examine system-message training, priority, and stability, while existing evaluations remain focused on specific aspects and small-scale, simplified datasets.Prior findings include deteriorating stability as dialogues lengthen, alongside declining attention scores.Source: §2.1 · p. 3

2.2 EVALUATION OF INSTRUCTION FOLLOWING

• Instruction-following benchmarks assess complex constraints and compositions, but are typically single-turn and therefore do not reflect system messages' multi-turn interactive setting.The cited work includes decomposition of complex instructions and evaluation of subjective, objective, and real-world constraints.Source: §2.2 · p. 3

3.1 BENCHMARK DESIGN

• The design treats system constraints as manually checked atomic rules across six types, and separates compatible requests from contradictory ones that should be refused or ignored.Source: §3.1 · p. 4
• Parallel conversations make each instruction independent, whereas dependent conversations require integrating relevant dialogue history with the current instruction.Source: §3.1 · p. 4

3.2 DATASET

• Dataset construction starts from online logs, refines 500 system messages with 21 annotators, and retains five manually rewritten conversation rounds per message.Expert-designed checklists guide verification, and multiple experts independently review the data in multiple rounds.Source: §3.2 · p. 5
• The dataset has 500 system messages, five rounds each, and 2–3 relevant constraints per instruction on average, spanning aligned/misaligned and dependent/parallel cases.Source: §3.2 · p. 5

3.3 EVALUATION PROTOCOL

• An advanced LLM verifier evaluates responses using the system message, dialogue history, user instruction, and manually annotated checklists.Source: §3.3 · p. 5
• CSR scores individual constraints, ISR requires every constraint for an instruction, and SSR tracks consecutive fully compliant turns from the conversation start.Source: §3.3 · p. 6

4.1 EXPERIMENTAL SETUP

• The setup evaluates sixteen popular LLMs using CSR, ISR, and SSR for constraint-level performance, instruction-level satisfaction, and multi-turn stability, respectively.A GPT-4o verifier is used at temperature 0, with generation parameters kept at defaults.Source: §4.1 · pp. 6–7

4.2 CONSTRAINTS-CATEGORIZED RESULTS

• GPT-4o leads across constraint categories, with Claude-3 close behind; weaker models show larger constraint-specific variation, including Qwen2-7B’s 81.0% CSR for role constraints versus 43.3% for style constraints.The category-level pattern closely tracks total CSR, and Figure 4 shows eight representative models.Source: §4.2 · p. 7, Figure 4 · p. 7

4.3 INSTRUCTION ALIGNMENT

• GPT-4-Turbo leads ISR by a narrow margin, while most models perform better on aligned than misaligned instructions.Aligned instructions require satisfying both system and user constraints; for misaligned instructions, satisfying the system message alone is required.Source: Table 3 · p. 7, §4.3 · p. 8

4.4 MULTI-TURN STABILITY

• GPT-4o and GPT-4-Turbo lead SSR, but Rn generally declines faster in multi-turn dependent than parallel conversations.Some models, including ERNIE-4 and Claude-3, start with high R1 yet decay more rapidly in later turns; the best SSR is 54.4%.Source: Table 4 · p. 8, §4.4 · p. 9

4.5 INVESTIGATIVE EXPERIMENTS

• Replacing model-generated history with ground-truth responses improves ISR, especially in multi-turn dependent conversations.For parallel conversations, the improvement is comparable to first-round random variation; ERNIE-4 shows the most obvious improvement despite its sharp decline with round count.Source: §4.5 · pp. 9–10, Figure 5 · p. 9
• Attention attributed to system messages correlates with following performance, and its decline is steeper in dependent than parallel conversations.In a token-level case study, attention peaks at the starts of turns; the authors suggest this may help explain continued system-message influence across turns.Source: §4.5 · p. 10, Figure 6 · p. 10
• Replacing a system message with the same text as a user message barely changes its attention score, suggesting training-data construction matters more than a strict inference-stage distinction.The comparison changes the role marker while keeping the text the same.Source: §4.5 · p. 10, Figure 6 · p. 10

5 CONCLUSION

• SysBench is presented as the first comprehensive benchmark for LLM system-message following, with system messages and user instructions built around six constraint types.It distinguishes aligned from misaligned instructions and categorizes multi-turn conversations by dependency.Source: §5 · pp. 10–11
• Experiments across varied LLMs show differentiated SysBench scores across multiple perspectives, which the authors say underscores the benchmark’s utility for performance assessment.The authors state that these results offer insights for model improvement.Source: §5 · p. 11
• SysBench evaluates constraint-level following, instruction-level satisfaction, and multi-turn stability using three-level granularity metrics.Its dataset comprises 500 sessions and 2,500 conversation turns.Source: §5 · p. 11

A.1 DETAILED CONSTRAINT CATEGORIES

• Table 5 is described as detailing the six types of constraints in SysBench.Source: Table 5 · p. 15

A.2 THE VERIFICATION PROMPT FOR MODEL-BASED VERIFIER

• The verifier is instructed to assess whether the current answer meets each requirement in the evaluation criteria.It is given the system prompt, historical dialogue, current user question, current answer, and corresponding checklist.Source: §A.2 · p. 16
• The prompt organizes context into the system prompt, historical dialogue rounds, and the current dialogue round to be evaluated.Source: §A.2 · p. 16
• The requested JSON contains evaluation reasoning and a conclusion mapping each constraint number to Yes or No.Source: §A.2 · p. 16

A.3 SAMPLE DATA FORMAT

• The 231st dataset dialogue is a bilingual, multi-turn dependent technology-domain example with five instructions; its second instruction is misaligned and includes action, content, and style constraints.The assistant texts are ground truth, and the example directs readers to SysBench checklists for detailed criteria.Source: §A.3 · pp. 16–17
• The first instruction combines a greeting requirement with a request about China’s startup taxes, followed by answers naming several tax types.The sample includes value added, corporate income, individual income, property, and stamp taxes.Source: §A.3 · p. 17
• A later tax-evasion question receives a serious refusal, matching the stated constraint for that topic.Source: §A.3 · p. 17
• The conversation proceeds to data-security and privacy guidance, then labor-law policies and dispute-avoidance suggestions.The labor-law response includes recommendations such as internal regulations, legal training, and a dispute-resolution mechanism.Source: §A.3 · pp. 18–19
• The final request shifts to intellectual-property protection, with an answer covering patents, trademarks, copyright, trade secrets, and enforcement.Source: §A.3 · pp. 19–20

• Table 6 reports CSR scores under different constraint types and omits version numbers, referring readers to Table 2 for details.Source: Table 6 · p. 20