Would You Walk to the Car Wash? Revealing the Salience Bias of Large Language Models in Commonsense Reasoning

Zheng Wu; Chenhao Xue; Shijie Zheng; Yijie Lu; Cheng Yang; Zhuosheng Zhang

Source-linked AI summary

Would You Walk to the Car Wash? Revealing the Salience Bias of Large Language Models in Commonsense Reasoning

Zheng Wu, Chenhao Xue, Shijie Zheng, Yijie Lu, Cheng Yang, Zhuosheng Zhang

arXiv:2607.28478v1Jul 30, 2026cs.CL

TL;DR

LLMs can overprioritize explicit distractors in commonsense tasks, so this paper introduces SaliTrap to measure the resulting salience bias and finds that it primarily reflects suppressed, recoverable knowledge.

Problem
The paper addresses whether LLM failures on commonsense tasks reflect missing knowledge or suppression of implicit prerequisites by salient explicit conditions.
Method
The authors construct SaliTrap, a benchmark of 1,145 physically grounded tasks across four trap dimensions, and evaluate 12 state-of-the-art LLMs.
Results
Across all 12 models, salience bias worsens with distractor density, while stripping task framing recovers commonsense knowledge that salient conditions suppressed.
Takeaways & Limitations
The findings place the bottleneck of these commonsense failures in elicitation rather than competence, with lightweight prompting largely recovering the suppressed knowledge.
Takeaways & Limitations
SaliTrap is a diagnostic benchmark built from synthetic, physically grounded everyday scenarios rather than adversarial security or safety-bypass attacks.

Abstract

from arXiv · show

As large language models (LLMs) continue to advance in complex reasoning tasks, they have learned to heavily prioritize explicit conditions provided in the input. However, in everyday commonsense reasoning, this mechanism exposes a critical vulnerability which we term Salience Bias: models become easily hijacked by useless explicit distractors (e.g., numerical values), leading them to ignore the implicit physical or commonsense prerequisites of a task. A critical open question is whether this failure reflects a genuine gap in commonsense knowledge or merely its suppression under misleading task framing. To investigate this, we construct the SaliTrap Benchmark, a high-quality dataset across four trap dimensions. Evaluating 12 state-of-the-art LLMs, we find that all mainstream models suffer significantly from salience bias, with severity scaling with distractor density and detecting the trap often decoupled from actually avoiding it. Crucially, by re-eliciting the same models with the task framing stripped away, we show that this is overwhelmingly a failure of \textbf{knowledge suppression rather than knowledge absence}: a context-free knowledge probe alone recovers over 90\% of sycophantic-compliance failures, revealing that the requisite commonsense is intrinsically present but actively crowded out by salient distractors that lure the model into over-compliant, unnecessary computation. Building on this diagnosis, we further show that lightweight, inference-time prompting alone substantially closes the gap without any retraining. Our findings relocate the bottleneck of commonsense reasoning failures from model competence to elicitation, and we release SaliTrap as a testbed for this blind spot. The codes are available at https://github.com/Wuzheng02/SaliTrap.

Introduction

LLMs’ reliance on explicit distractors can suppress implicit commonsense prerequisites, producing a pervasive Salience Bias in commonsense reasoning. The SaliTrap benchmark and evaluation show that this failure separates trap detection from avoidance and reflects knowledge suppression rather than absence.

Motivation: LLMs over-prioritize explicit details in commonsense queries, ignoring implicit prerequisites such as driving a car to a car wash.In the car-wash example, models fixate on the salient “50 meters” condition and conclude that the user should walk.
Findings: Across 12 evaluated LLMs, the best model avoids the trap in only 54.8% of queries, while 8 of 12 models fall below 30%.The introduction characterizes the bias as pervasive across models and reports that distractor density further reduces trap avoidance while increasing CoT-Hijacked rates.
Findings: Trap detection and trap avoidance are distinct failure axes, with avoidance severity scaling with distractor density and clustering by model provenance.Even models that detect the trap frequently comply with it anyway.
Diagnosis: Knowledge re-elicitation shows that the failures primarily reflect suppression of intrinsically possessed commonsense knowledge rather than its absence.Removing misleading task framing recovers the vast majority of failures, identifying elicitation—not competence—as the bottleneck.
Contributions: The 1,145-task SaliTrap Benchmark spans four dimensions and is designed to evaluate salience bias while disentangling trap detection from trap avoidance.The benchmark supports comprehensive evaluation of 12 LLMs across distractor density and model provenance.

Related Work

The related work reviews core techniques for eliciting reasoning in LLMs and the benchmarks used to evaluate distinct dimensions of their competence. It covers applications spanning mathematics, agentic operations, programming, scientific question answering, and tool-use planning.

The section first reviews core techniques underlying LLM reasoning before surveying contemporary reasoning benchmarks.
LLM reasoning advances have supported complex mathematical problem solving, agentic operations, and programming tasks.
Increasingly demanding benchmarks assess mathematical problem solving, multi-step scientific question answering, repository-level code generation, long-horizon tool-use planning, and broad capability coverage.

SaliTrap Benchmark

SaliTrap benchmarks whether LLMs detect physically impossible premises hidden in computation-heavy queries, using a formal item structure, four trap dimensions, and a three-stage construction pipeline. Its construction combines expert-seeded scaling, candidate validation, and iterative refinement to produce natural, aligned, behaviorally challenging items.

Task formulation: Each item pairs a natural-language prompt with an impossible trap core, ground-truth explanation, numerical distractors, and a trap-dimension label.Numerical distractors are embedded to induce spurious computation.
Task formulation: Well-formed items require acknowledging the physical impossibility, prohibit independent sub-task escapes, and make the prompt resemble a legitimate planning or optimization query.A correct response identifies the trap without providing an executable plan or numerical computation.
Trap taxonomy: The taxonomy spans four violation types: missing prerequisites, environmental mismatches, temporal or physiological violations, and rule mismatches.Examples include carrying water with a slotted spoon, using a lighter at depth, preventing yesterday’s rain, and other commonsense violations.
Construction pipeline: The benchmark is built through seed generation and scaling, candidate validation, and iterative refinement.The stages are summarized as expert annotation and synthesis, empirical checking, and rewriting toward naturalness, camouflage, fluency, and semantic compliance.
Construction pipeline: Candidate validation combines tri-checker alignment and naturalness assessment with solver-judge behavioral labeling before routing candidates for certification or rewriting.The solver-judge labels include Hard Fail, CoT Hijacked, Sycophantic Compliance, and Strict Pass, among others.
Construction pipeline: The final selection retains the top-5 candidates per seed using a composite score that rewards failure severity, naturalness, and alignment while penalizing escapes, duplication, and excessive length.The score is applied because naturalness, failure severity, and alignment alone are insufficient selection criteria.

Experiment

Across 1,145 benchmark items, all 12 evaluated LLMs showed substantial salience bias, with trap avoidance linked to general reasoning ability but often decoupled from trap detection. Missing-prerequisite traps were hardest, while rule-mismatch traps were easiest to detect.

Evaluation setup: N = 1,145 items span four trap dimensions, evaluated with TAR, HFR, SCR, and SI under full-dataset and trap-aware denominators.TAR measures trap avoidance, HFR measures unchallenged execution, SCR measures compliance after trap recognition, and SI is conditional compliance given awareness.
Evaluation setup: 12 state-of-the-art LLMs were evaluated zero-shot without task-specific fine-tuning or prompt engineering.The models included Claude, GPT, Gemini, DeepSeek, GLM, Kimi, Doubao, and MiniMax systems.
Overall results: 54.8% is Claude-Opus-4.7’s Trap Avoidance Rate, while most models fall below 30%, and weaker reasoners show Hard Fail Rates exceeding 59%.The strongest models by TAR are also the strongest general-purpose reasoners, indicating that resisting salience bias requires deliberate premise-checking rather than surface computation.
Overall results: Over 80% is the compliance rate of GLM-5.1 and Kimi-K2 when they detect something is wrong, despite only middling raw TAR.This demonstrates that recognizing a trap does not ensure avoiding it.
Dimension-wise results: Missing prerequisite is uniformly the hardest trap dimension to detect, whereas rule mismatch is the easiest.Missing-prerequisite traps require inferring an unstated physical property, while rule-mismatch traps depend on a more lexically salient categorical distinction.

Further Analysis

Further analysis shows that salience-bias failures become more severe as numerical distractor density increases, while models differ in whether they share or individualize failure patterns. Re-elicitation indicates that trap-relevant commonsense is largely present but suppressed by task framing, motivating lightweight inference-time interventions.

Item Difficulty: A one-parameter logistic item-response model jointly estimates per-model ability θ and per-item difficulty β, with missing-prerequisite and environmental-mismatch items having higher mean difficulty.Their β distributions are visibly right-shifted relative to temporal/physiological violation and rule mismatch.
Failure Similarity: Failure overlap forms Chinese and Western model clusters, with weaker open-weight models sharing failures most strongly and Claude-Opus-4.7 showing the most idiosyncratic failures.The dendrogram suggests that models below a certain ability threshold converge on largely the same failure subset.
Distractor Density: TAR falls and CoT-Hijacked rate rises monotonically with injected numerical distractor count across every trap dimension.The trend holds when averaged over all 12 models, indicating that distractor density—not merely distractor presence—triggers salience bias.
Knowledge Suppression: Context-free re-elicitation shows that the relevant commonsense is already present and can be surfaced when the inducing task framing is removed.This supports knowledge suppression rather than knowledge absence as the explanation for sycophantic-compliance failures.
Inference-Time Interventions: The study tests three inference-time system prompts without fine-tuning across three models spanning the capability spectrum to close the salience-bias gap at scale.The interventions include physics-aware feasibility priming and forced chain-of-thought premise checking.

Conclusion

The conclusion identifies salience bias as a pervasive tendency for LLMs to prioritize explicit conditions over implicit commonsense prerequisites, and introduces SaliTrap to evaluate this vulnerability. Results across 12 state-of-the-art models indicate knowledge suppression rather than absence, while lightweight prompting can largely recover the suppressed commonsense.

Conclusion: Salience bias causes LLMs to prioritize salient explicit conditions over implicit commonsense prerequisites.The paper characterizes this as a pervasive failure in commonsense reasoning.
Conclusion: SaliTrap benchmarks physically impossible premises camouflaged by computation-laden distractors across four trap dimensions.The benchmark is designed to expose salience bias under misleading task framing.
Conclusion: 12 state-of-the-art LLMs are substantially vulnerable, with failure rates rising sharply as distractor density increases.The evaluation finds this vulnerability across all tested models.
Conclusion: The vulnerability stems from suppression rather than absence of commonsense knowledge.The analysis indicates that the required knowledge is present but not reliably accessed under salient distractors.
Conclusion: Lightweight prompting can largely recover the suppressed commonsense knowledge.The conclusion presents prompting as a promising inference-time direction for improving reliability.

The SaliTrap Dataset

SaliTrap is a certified 1,145-item benchmark of synthetically authored natural-language queries targeting four trap dimensions in everyday physical tasks. Each JSON record stores the prompt, trap statement, ground truth, injected numerical distractors, and dimension metadata, and the release includes evaluation and analysis code.

Record format: Records also include unique item identifiers and the prototype seed identifier used during synthesis.Multiple certified items can share one seed identifier.
Record format: Each record includes a full query, an isolated physical-impossibility statement, a reference explanation, numerical distractors, and a trap-dimension tag.These fields correspond to prompt (P), trap_core (T), ground_truth (G), injected_numbers (n), and dimension_tag (d).
Dataset scope: The final SaliTrap benchmark contains 1,145 certified items spanning four trap dimensions.Table 3 reports per-dimension item counts and injected numerical-distractor distributions for the final benchmark.
Release and ethics: The dataset will be released with evaluation and analysis code to support replication and research on elicitation-time failures in LLMs.The release is scheduled for publication.
Release and ethics: The queries are synthetic, concern everyday physical tasks, contain no sensitive or personal information, and were collected without human-subjects data.The dataset does not target individuals, organizations, or protected groups.

Benchmark Construction Pipeline

SaliTrap constructs adversarial commonsense items through expert seeding, targeted micro-batch scaling, candidate rewriting, multi-checker validation, Solver-Judge evaluation, and annealing. Certified candidates undergo repeated stability testing before entering the final benchmark.

Seed scaling: Each trap dimension begins with expert-authored prototype seeds and expands through micro-batch generation targeted at under-represented tool and scenario niches.The Scaling Generator uses dimension definitions, S0 exemplars, batch directives, and an exclusion list of accepted seeds.
Adversarial rewriting: Candidate generation preserves the core physical contradiction and numerical distractors while embedding them in realistic everyday scenarios with added procedural cognitive load.The adversarial Generator can add costs, routes, queueing, budgets, and other procedural conditions that make the numbers appear relevant to the user’s goal.
Validation: Candidates pass truth, alignment/eraser-test, naturalness, and escape-word checks before evaluation, ensuring the contradiction remains physical, necessary to the question, and naturally phrased.Naturalness passes when the five dimensions average ≥ 3.5 with no escape word; the eraser test removes numerical and procedural details to verify the underlying contradiction.
Candidate refinement: Non-certified candidates receive failure-specific rewrites, while annealing progressively compresses overly complex attacks into short, natural, high-density questions without weakening the trap.Rewrite objectives target naturalness, camouflage depth, or fluency, and cooling ranges from light removal of conspicuous details to minimal effective disguise.
Stability retest: 5 repeated Solver-Judge evaluations are required for final admission, with majority agreement matching the original certified label.Hard Fail and CoT Hijacked form the strong-attack group, while Sycophantic Compliance and Patch Compliance are treated as softer secondary labels.

Experimental Details

The evaluation used unmodified, inference-only access to 12 LLMs through official chat-completion APIs. Each of 1,145 items was tested in a single-turn, zero-shot control setting and classified using the Solver-Judge’s five behavioral labels.

Model access and evaluation setup: All 12 LLMs were evaluated exclusively through official hosted chat-completion APIs with provider-recommended default sampling and no local hosting, fine-tuning, or model modification.All runs were inference-only and required no GPU compute on the authors’ side.
Benchmark configuration: Benchmark-construction and evaluation hyperparameters were fixed before full-scale evaluation and were not tuned against the final metrics.Table 4 lists the fixed hyperparameters used throughout the pipeline.
Model access and evaluation setup: Each of the 1,145 benchmark items was presented as a single-turn, zero-shot user message without a system prompt, few-shot examples, or task-specific fine-tuning.This was the Control condition.
Model access and evaluation setup: The Solver-Judge received each model’s full response and the ground-truth explanation, assigning one of five labels: Strict Pass, Sycophantic Compliance, CoT Hijacked, Hard Fail, or Refusal.The passage also introduces TAR, HFR, SCR, and SI as evaluation metrics.

Extended Results

Extended analyses show that item naturalness is unrelated to intrinsic trap difficulty, while model failure patterns cluster strongly among weaker open-weight models and worsen with denser numerical distractors. Additional intervention results indicate that feasibility-focused prompting sharply reduces hijacked responses by eliciting latent premise-checking knowledge.

Model failure structure: 207 of 1,145 items (18.1%) are universal hard cases failed by all 12 models, while the five most similar failure-set pairs come from weaker open-weight models.These pairs include DeepSeek-V4-Pro/Flash, MiniMax-M2.7, and Doubao-Seed-2.0.
Item difficulty and naturalness: The naturalness–difficulty correlation is r = −0.059, indicating no meaningful association between surface fluency and resistance to trap detection.Naturalness and IRT difficulty therefore measure orthogonal item properties.
Distractor-density effects: Across all four trap dimensions, TAR declines and CoT-Hijacked rates rise as numerical distractor density increases.Missing Prerequisite has the steepest TAR decline, whereas Rule Mismatch has the shallowest, matching the IRT-based difficulty ordering.
Liberation conditions: Claude-4.6 and Kimi-K2 benefit less from the soft Cond-A hint than from explicit Cond-B or context-free Cond-C re-elicitation, unlike GLM-5.1 and DeepSeek-R1.The condition ordering suggests that some models require unambiguous trap disclosure or removal of the original framing.
System-level interventions: HFR falls from 27–43% under Control to 0.2–12.2% under any intervention across the three target models.The result indicates that prompting primarily elicits an existing feasibility check rather than merely improving premise-detection accuracy.

Broader Impact

SaliTrap is designed as a diagnostic tool for identifying and addressing an elicitation-time blind spot in LLM commonsense reasoning, with no anticipated dual-use risks from its release.

Broader Impact: SaliTrap uses synthetic, physically grounded everyday scenarios to surface salience bias and help downstream LLM-assistant deployers avoid a concrete class of user harms.The authors do not foresee security or safety-bypass value from releasing the dataset.