Brittlebench: Prompt Robustness in LLMs

• Brittlebench is a meta-evaluation framework that measures LLM brittleness through prompt perturbation and variance decomposition.
• The framework isolates stability by decomposing accuracy variance into intrinsic data difficulty and perturbation-induced sensitivity.
• Empirical results reveal that semantics-preserving perturbations can reduce accuracy by up to 12%, significantly altering model rankings.

to=arxiv_search.search 大发快三大小单双 json {"^^^^^^^^3query3 OR abs:\3^^^^^^^^"Brittlebench\"","max_results":5,"sort_by":"relevance"}ുവനന്തപുരം to=arxiv_search.search 公众号天天中彩票 json {"^^^^^^^^3query3 sensitivity\" AND benchmark AND LLMs) OR (robustness evaluation prompt perturbations LLM)","max_results":^^^^3ti:\3query3^^^^,"sort_by":"relevance"} to=arxiv_search.search 天天中彩票为什么 json {"^^^^^^^^3query3 Brittlebench is a meta-evaluation framework for measuring how brittle LLMs are to prompt wording and formatting changes that preserve the intended meaning of the question. It is introduced to address a specific failure mode of standard evaluation: clean, fixed benchmark prompts can overstate model capability because they ignore the variability present in real user inputs, including typos, spacing changes, paraphrases, and added context. In this setting, “brittleness” denotes prompt sensitivity rather than underlying task difficulty or inference stochasticity, and the framework is designed to separate those effects through an explicit variance decomposition of correctness (&&&^^^^3query3^^^^&&&).

^^^^3ti:\3^^^^. Concept and motivation

Brittlebench is motivated by the observation that leaderboard conclusions can depend on accidental prompt design rather than stable model capability. If two models are close in score, a small semantics-preserving perturbation can swap their ranking. The framework therefore treats robustness to prompt variants as a first-class evaluation target rather than an incidental implementation detail (&&&^^^^3query3^^^^&&&).

The benchmark is built around a restricted notion of perturbation: the expected gold answer should not change. This is crucial because Brittlebench does not attempt to measure robustness to adversarial semantic shifts; it instead measures sensitivity to alternative surface forms of the same task. Within that framing, a score change under perturbation is interpreted as evidence of prompt sensitivity.

A central conceptual distinction in the framework is between three sources of variation in observed correctness: inference variance, data difficulty variance, and perturbation sensitivity variance. Because the evaluation setup is deterministic, inference variance vanishes. The problem then reduces to separating stable differences among benchmark items from instability introduced by prompt variants. This suggests that a single clean-prompt accuracy is only a partial statistic: it conflates semantic competence with prompt robustness.

^^^^3 OR abs:\3^^^^. Formalization of brittleness

The paper formalizes correctness as a binary random variable PRESERVED_PLACEHOLDER_^^^^3query3^^^^ depending on a data item PRESERVED_PLACEHOLDER_^^^^3ti:\3^^^^, a perturbation condition PRESERVED_PLACEHOLDER_^^^^3 OR abs:\3^^^^, and an inference run $R$. In the general stochastic setting, correctness is written as $Y = Y(D,P,R)$. By the law of total variance,

$$\mathrm{Var}(Y) = \mathbb{E}_{D,P}\!\left[\mathrm{Var}(Y \mid D,P)\right] + \mathrm{Var}_{D,P}\!\left(\mathbb{E}[Y \mid D,P]\right).$$

The systematic term is further decomposed as

$$\mathrm{Var}_{D,P}\!\left(\mathbb{E}[Y \mid D,P]\right) = \mathrm{Var}_D\!\left(\mathbb{E}_P[Y \mid D]\right) + \mathbb{E}_D\!\left[\mathrm{Var}_P(Y \mid D)\right].$$

Under deterministic evaluation, this becomes

$$\mathrm{Var}(Y) = \underbrace{\mathrm{Var}_D\!\left(\mathbb{E}_P[Y \mid D]\right)}_{V_{\text{data}}} + \underbrace{\mathbb{E}_D\!\left[\mathrm{Var}_P(Y \mid D)\right]}_{V_{\text{brittleness}}}.$$

Here, $V_{\text{data}}$ measures stable differences in item difficulty, while $V_{\text{brittleness}}$ measures instability caused by prompt perturbations. Empirically, for each model–benchmark pair, the framework builds a binary outcome matrix PRESERVED_PLACEHOLDER_^^^^3ti:\3query3^^^^, where PRESERVED_PLACEHOLDER_^^^^3ti:\3ti:\3^^^^ indexes items and PRESERVED_PLACEHOLDER_^^^^3ti:\3 OR abs:\3^^^^ indexes perturbations, and estimates

PRESERVED_PLACEHOLDER_^^^^3ti:\33^^^^

The paper also defines two aggregated scores. PRESERVED_PLACEHOLDER_^^^^3ti:\3^^^^4 is the fraction of a model’s total variance across benchmarks explained by perturbations, and PRESERVED_PLACEHOLDER_^^^^3ti:\3^^^^5 is the fraction of a benchmark’s total variance across models explained by perturbations. High PRESERVED_PLACEHOLDER_^^^^3ti:\3^^^^6 indicates that a model’s score fluctuates mainly because it is prompt-sensitive; high PRESERVED_PLACEHOLDER_^^^^3ti:\3^^^^7 indicates that a benchmark separates models largely by robustness rather than semantic competence.

The appendix presents the same structure as a nested random-effects ANOVA,

PRESERVED_PLACEHOLDER_^^^^3ti:\3^^^^8

with PRESERVED_PLACEHOLDER_^^^^3ti:\3^^^^9 representing item difficulty and PRESERVED_PLACEHOLDER_^^^^3 OR abs:\3query3^^^^ perturbation sensitivity. In this formulation, “brittleness” is an identifiable variance component rather than an informal description (&&&^^^^3query3^^^^&&&).

3. Evaluation pipeline and perturbation taxonomy

Brittlebench is built on top of lm-evaluation-harness and extends it by systematically applying perturbations to benchmark inputs and evaluating both the original and perturbed versions. The evaluated multiple-choice benchmarks are MMLU, TruthfulQA, ARC, MathQA, LogiQA, and GPQA. The model set includes commercial frontier models—GPT-5 and Claude 4.5 Opus—and open-weight families—Llama 3.^^^^3ti:\3^^^^, Llama 3.3, and Qwen 3, at multiple sizes. The study reports over ^^^^3ti:\3^^^^,8^^^^3query3query3^^^^ inference runs total (&&&^^^^3query3^^^^&&&).

For open-weight models, answers are scored via log-probabilities over options. For commercial models, the models are prompted through APIs to output the answer letter. Claude 4.5 Opus is run with zero temperature, and GPT-5 with minimal internal reasoning enabled.

The perturbation taxonomy is organized into four classes:

• Word manipulation: typos, stopword deletion, word merges, word splits, and punctuation spaces or extra spaces around punctuation.
• Prompt padding: spaces at the beginning or end, quotation marks, newlines, and sequences of spaces.
• Prompt augmentation: persona additions, emotional prompts, and explanatory or contextual additions.
• Paraphrasing: lexical paraphrasing, syntactic paraphrasing, and rule-free paraphrasing.

The intended property of all perturbations is semantic preservation. For non-paraphrase perturbations, the paper reports high cosine similarity between original and perturbed inputs using Qwen3-Embedding-8B, with an average cosine similarity of ^^^^3query3^^^^.96^^^^3 OR abs:\3^^^^. For paraphrases, quality is assessed by both human annotation and an LLM judge, and human ratings are around 98% in the 4–5 range on a 5-point scale. GPT-4o is used to generate paraphrases.

This design makes prompt variation itself the object of measurement. The framework does not replace ordinary accuracy evaluation; it augments it with structured perturbation analysis.

4. Empirical behavior under perturbation

The central empirical result is that semantics-preserving perturbations reduce accuracy by as much as about ^^^^3ti:\3 OR abs:\3^^^^%. Surface-form perturbations are the most damaging, with the strongest degradations coming from word-level manipulations and prompt padding, especially in few-shot settings (&&&^^^^3query3^^^^&&&).

Specific examples reported in the paper include the following. Claude 4.5 Opus drops on average from 78.64 to 75.4^^^^3 OR abs:\3^^^^ under word manipulations, and to 68.44 under the strongest GPT-5 perturbation group. GPT-5 is especially sensitive, with average performance falling from 73.97 to 68.44 overall under word manipulations, and some perturbation types causing larger drops. Prompt padding can be particularly harmful, with some settings reaching ^^^^3ti:\3 OR abs:\3^^^^.83% degradation. On MMLU, Claude 4.5 Opus drops by about ^^^^3 OR abs:\3^^^^% under simple typos.

Paraphrasing is comparatively benign and can sometimes slightly improve scores, especially for some open-weight models. The paper cautions, however, that GPT-generated paraphrases may standardize language in ways that can make questions easier. This means that not all semantics-preserving perturbations act as equally neutral probes of robustness.

The study also reports nonlinear compounding effects when perturbations are stacked or repeated. In a case study on Qwen3-8B on MMLU, combined perturbations can cause drops up to about 45%, much larger than single perturbations. These effects are order-dependent, and the paper finds little evidence that perturbations cancel each other out.

5. Ranking instability and variance decomposition

A major finding is that prompt perturbations alter comparative model ranking. Even a single perturbation changes the relative ranking of the six open-weight models in 63% of cases. Rank correlations depend strongly on perturbation type: prompt padding with quotes and newlines is among the most disruptive, while spaces around punctuation and word splits are among the least disruptive (&&&^^^^3query3^^^^&&&).

The paper reports that rank correlations can be as low as roughly ^^^^3query3^^^^.63–^^^^3query3 for some zero-shot padding perturbations, while milder perturbations remain around ^^^^3query3^^^^.87–^^^^3query3 Rankings are somewhat more stable in few-shot settings, but still far from invariant. This suggests that leaderboard orderings derived from a single canonical prompt can be unstable even when the underlying task content is unchanged.

Variance decomposition strengthens that conclusion. For many open-weight models, perturbations explain roughly half of the total variance. For commercial models, prompt sensitivity still explains more than about ^^^^3 OR abs:\3^^^^5% of variance. The model-level and benchmark-level analyses therefore indicate that benchmark scores are not measuring only semantic understanding or item difficulty; they are also measuring stability to formatting and phrasing variation.

At the benchmark level, MMLU and GPQA are dominated by perturbation-induced variance, whereas TruthfulQA, LogiQA, MathQA, and ARC are more dominated by intrinsic item difficulty. The paper’s interpretation is not that the former benchmarks are defective, but that they may be saturated for modern models, so robustness differences become a primary source of separation.

6. Relation to prompting strategy and broader significance

Brittlebench also evaluates how prompting strategy interacts with robustness. Few-shot prompting improves baseline performance but often increases sensitivity to perturbations. Chain-of-thought prompting boosts accuracy for Claude 4.5 Opus overall, but only modestly reduces brittleness: the accuracy drop under perturbation falls from ^^^^3 OR abs:\3^^^^.79% to ^^^^3 OR abs:\3^^^^.38%, a relative reduction of about ^^^^3ti:\3^^^^7% (&&&^^^^3query3^^^^&&&).

The paper further reports that perturbations degrade the quality of reasoning traces, and that higher reasoning quality correlates with better accuracy. This suggests that reasoning can help mainly when the reasoning process itself is not disrupted by the perturbation. In that sense, chain-of-thought is not a general solution to prompt brittleness.

The broader significance of Brittlebench is methodological. It reframes evaluation from “how well does the model do on one benchmark prompt?” to “how stable is the model’s performance across semantically equivalent ways of asking the same question?” This does not eliminate the need for clean benchmark scores, but it changes their interpretation. A single-prompt score becomes one point in a prompt-conditioned response surface rather than a complete estimate of capability.

The framework’s practical implication is that robustness should be reported alongside mean performance, variance decomposition, and ranking stability across perturbations. This suggests a broader evaluation standard in which semantic competence and prompt robustness are measured jointly rather than conflated.