Would You Walk to the Car Wash? Revealing the Salience Bias of Large Language Models in Commonsense Reasoning
Zheng Wu, Chenhao Xue, Shijie Zheng, Yijie Lu, Cheng Yang, Zhuosheng Zhang
cs.CL
2026-07-31
SaliTrap tests 12 LLMs on 1,145 queries hiding physically impossible premises; the best model avoids the trap only 54.8% of the time. Strip away the misleading framing and re-ask, and the same model recovers over 90% of its errors. The commonsense is suppressed, not absent.
LLMs keep getting stronger at math, agentic tasks, and coding. These domains share a property: in their training data, the given conditions are always useful and necessary. Models have therefore learned to grasp every detail, and reward signals rarely penalize attending to irrelevant information. In commonsense reasoning, conditions are not always relevant.
The paper's example is blunt. Asked whether to drive or walk to a car wash 50 meters from home, mainstream models like Gemini and DeepSeek fixate on "50 meters," compute a walking distance, and conclude the user should walk. They miss the prerequisite: the car has to be driven there to be washed. The authors call this Salience Bias, the hijacking of reasoning by salient but useless details (numbers especially), at the expense of implicit physical or commonsense prerequisites.
The open question: is this failure a genuine gap in commonsense, or its suppression under misleading framing?
The authors build SaliTrap, 1,145 items across four trap dimensions:
Each item is a tuple: prompt P, trap core T, ground-truth explanation G, numerical distractors n, dimension d. Admission requires three things: the premise is physically impossible under common knowledge; any correct response must acknowledge that impossibility; and the distractors make the query look like a normal planning or optimization problem.
Construction runs in three stages: seed generation and scaling, candidate validation, and iterative refinement. Validation uses a tri-checker (truth, alignment, naturalness) plus a Solver-Judge that labels responses into six behavioral categories (hard fail, CoT hijacked, sycophantic compliance, strict pass, and others). Each admitted item is re-run five times for stability, and only label-stable ones are kept.
Twelve LLMs are evaluated, zero-shot with greedy decoding. Metrics split into two groups: over the full set, TAR (trap avoidance rate, higher is better) and HFR (hard fail rate, fully executing without noticing, lower is better); over the trap-aware subset, SCR (sycophantic compliance rate) and SI (the conditional compliance probability given awareness).
The strongest model, Claude-Opus-4.7, avoids the trap only 54.8% of the time, with HFR still at 31.1%. GPT-5.5 reaches 45.5%, Claude-Opus-4.6 44.5%, and GPT-5.4 41.2%. Eight of twelve sit below 30%. The worst, MiniMax-M2.7, is at 8.8%, with DeepSeek-V4-Flash at 12.1% and DeepSeek-V4-Pro at 14.4%. Performance tracks general reasoning ability closely.
A second failure layer is more telling: even when a model detects the trap, it complies anyway. The SI of GLM-5.1 is 86.2% and of Kimi-K2 is 81.8%, meaning that in the rare cases they notice something is off, they still satisfy the user over 80% of the time. Detection and avoidance are different things.
Distractor density has a monotonic effect: each added number lowers TAR and raises the CoT-hijacked rate. By difficulty, missing prerequisite is hardest and rule mismatch easiest, confirmed by IRT difficulty estimates. Of 1,145 items, 207 (18.1%) are universal hard cases failed by all twelve. Hierarchical clustering splits models into a Chinese cluster and a Western one; weaker open-weight models share highly overlapping failure sets, while Claude-Opus-4.7 is the most idiosyncratic.
The hardest contribution is a diagnosis. For the sycophantic-compliance cases of Claude-4.6, GLM-5.1, Kimi-K2, and DeepSeek-R1, the models are re-queried with the task framing stripped away. Under three conditions (a soft hint, an explicit reveal, a context-free physical judgment), three of four models exceed 90% liberation; the context-free condition alone, which removes the framing and asks only whether the statement is physically feasible, recovers over 90% of compliance cases. The model that just answered wrong does possess the commonsense; it was buried under salient distractors. The bottleneck is elicitation, not competence.
Prompting fixes part of it. Three system-level prompts (physics-aware priming, forced step-by-step premise check, counterfactual warning) lift weak models substantially: the TAR of GLM-5.1 rises from 25.9 to 57.4, of DeepSeek-V4-Pro from 13.4 to 42.5, and HFR collapses from 27 to 43% down to 0.2 to 12.2%. The exception is the already-strong Claude-Opus-4.6 (baseline 54.8%), where all three prompts reduce TAR (by up to 14.1 points): forcing an explicit premise-check step interrupts its smoother default reasoning. Prompting raises the floor rather than lifting uniformly, and it can hurt strong models.
The paper relocates the bottleneck of LLM commonsense failures from insufficient competence to poor elicitation. For deployers this is practical: a system-level prompt can lift the floor on weak models without retraining, and it names a concrete class of user-facing errors (an assistant confidently producing a detailed but physically nonsensical plan) that erode trust and can waste real effort if acted on. The clustering also shows that training recipes shape blind spots, with the Chinese and Western clusters failing in qualitatively different ways rather than simply strong-versus-weak.
The paper has no dedicated limitations section, but several issues stand out.
Evaluation and construction share models. The judge and the rewriting or generation model are Claude-Opus-4.7, which is itself among the twelve evaluated; the solver pool (Claude-4.7, GPT-5.5, DeepSeek-R1, Gemini-2.5-Pro) is also drawn from the evaluated set. Items are selected to fool the solver at construction time and labeled by the judge (including by itself) at evaluation, a circularity risk. The authors only guarantee that backup judges do not overlap with evaluated models; the primary judge is not excluded.
The items are fully synthetic, with no human baseline for what counts as physically impossible, and naturalness is itself LLM-scored. The Solver-Judge rule of scanning the first 30% of the response for the earliest sign of awareness is a heuristic. Each model is run once with greedy decoding, with no multi-seed check.
The 90% recovery from a context-free probe is partly definitional: stripping the distracting wrapper makes the bare physical question easier by construction. What carries weight is that it is the same model that just failed; that holds, but the absolute liberation rates should not be over-read. The work also stops at prompting and does not touch training; prompts hurt already-strong models, which means fixing elicitation is capability-aware, with no universal prefix.