Prompt Sensitivity: LLM Instability

• Prompt sensitivity is the degree to which semantically identical prompts yield divergent outputs in LLMs due to variations in wording, formatting, and decoding settings.
• It is quantified using metrics such as the standard deviation of accuracies, instance variability scores, and elasticity measures, with significant implications across text, speech, and vision tasks.
• Mitigation strategies include conservative decoding, explicit task specification, few-shot prompting, and sensitivity-aware decoding to improve output stability and safety.

Prompt sensitivity is the degree to which a foundation model’s behavior changes when semantically equivalent prompts, prompt templates, or decoding settings are altered. In the literature, it is operationalized variously as variation in task accuracy across prompt templates, instability of output likelihoods under intent-preserving rewrites, disagreement across prompt-conditioned predictions, or prompt-induced variance after controlling for data difficulty. Studies in affective computing, code generation, text classification, medical question answering, speech recognition, and vision-language grounding converge on the observation that small changes in wording, formatting, ordering, or sampling can materially affect outputs, although the magnitude and interpretation of this effect remain contested (Amin et al., 2024, Chatterjee et al., 2024, Hua et al., 1 Sep 2025).

1. Definitions and quantitative formulations

Prompt sensitivity has no single canonical metric. In classification-oriented work, one common definition is the dispersion of performance across prompt variants. For a benchmark $D$ with prompt set $P=\{p_1,\dots,p_n\}$ and model $f$, one formulation defines prompt sensitivity as the sample standard deviation of prompt-specific accuracies, $\mathrm{StdDev}(\{A_{(f,D)}^{p_i}\}_{i=1}^n)$, with smaller values indicating greater stability (Hua et al., 1 Sep 2025). A related text-classification formulation uses the mean $\mu = E_p[\mathrm{Acc}_p]$ together with $$\mathrm{Var}_p[\mathrm{Acc}] = E_p[(\mathrm{Acc}_p-\mu)^2]$$ and $\sigma_p=\sqrt{\mathrm{Var}_p[\mathrm{Acc}]}$ to distinguish average performance from prompt-induced variability (Pecher et al., 4 Feb 2026). Earlier work on Japanese classification tasks similarly summarized robustness across five prompt templates by the mean accuracy $M$, absolute deviations $D_i = |x_i-M|$, and standard deviation $\sigma$ (Gan et al., 2023).

Instance-level formulations emphasize prompt-conditioned output variability for a fixed example. ProSA defines instance sensitivity as the average absolute difference in performance across all prompt pairs for that instance and averages it into PromptSensiScore (PSS); it further interprets $P=\{p_1,\dots,p_n\}$0 as high robustness (Zhuo et al., 2024). POSIX instead measures the average length-normalized absolute difference in log-likelihood assigned to a generated response when its originating prompt is replaced by another intent-preserving prompt from the same aligned set; lower POSIX implies lower sensitivity (Chatterjee et al., 2024). PromptSE introduces “elasticity,” defined for code-generation prompts at perturbation distance $P=\{p_1,\dots,p_n\}$1 as

$P=\{p_1,\dots,p_n\}$2

with values near $P=\{p_1,\dots,p_n\}$3 indicating prompt stability, and then integrates elasticity across distances into the area under the emo-stability curve, AUC-E (Ma et al., 17 Sep 2025).

Several works separate prompt sensitivity from other variance sources. Brittlebench decomposes deterministic-evaluation variance into a data-difficulty term and a prompt-related brittleness term,

$P=\{p_1,\dots,p_n\}$4

where the second term quantifies how often correctness flips under semantics-preserving perturbations (Romanou et al., 27 Feb 2026). In affective computing, prompt sensitivity was measured not only through correctness—accuracy and unweighted average recall (UAR)—but also through “Parsed %,” the fraction of outputs that obey formatting constraints and can be mapped automatically to one of the two labels, thereby treating prompt sensitivity as both a performance and an instruction-following phenomenon (Amin et al., 2024).

Metric family	Core quantity	Representative source
Performance dispersion	$P=\{p_1,\dots,p_n\}$5, prompt-wise standard deviation, ranking correlation $P=\{p_1,\dots,p_n\}$6	(Hua et al., 1 Sep 2025, Pecher et al., 4 Feb 2026)
Instance/output variability	PSS, variation-ratio sensitivity, pairwise correctness flips	(Zhuo et al., 2024, Lu et al., 2023, Razavi et al., 9 Feb 2025)
Likelihood/robustness	POSIX, Elasticity, AUC-E	(Chatterjee et al., 2024, Ma et al., 17 Sep 2025)
Variance decomposition	$P=\{p_1,\dots,p_n\}$7 vs. $P=\{p_1,\dots,p_n\}$8	(Romanou et al., 27 Feb 2026)

2. Mechanistic accounts and hypothesized causes

One line of explanation attributes prompt sensitivity to the interaction between prompt form and the model’s output distribution. In affective computing, low temperature and conservative nucleus sampling improved binary label prediction because the decoding process was focused on the small set of tokens corresponding to the labels, whereas higher temperature or unrestricted top-$P=\{p_1,\dots,p_n\}$9 admitted more off-task or “creative” outputs (Amin et al., 2024). A closely related text-classification account argues that underspecified prompts leave label tokens with near-zero prior probability; minimal punctuation or formatting changes can then flip predictions because the relevant label tokens remain in the bottom half of the vocabulary by logit rank, while instruction prompts boost label logits by roughly two orders of magnitude (Pecher et al., 4 Feb 2026).

Another line emphasizes representational geometry. “Understanding the Prompt Sensitivity” models an LLM as a function $f$0 and applies a first-order Taylor approximation,

$f$1

yielding the bound

$f$2

The paper reports that, unlike smaller classification networks that cluster semantically similar inputs, transformer LLMs “disperse” meaning-preserving prompts across layers, so $f$3 grows rather than shrinks, inflating the upper bound on log-probability divergence (Liu et al., 20 Apr 2026). The same study reports that prompt-template effects typically explain more logit variance than question-content effects for most tested LLMs (Liu et al., 20 Apr 2026).

Prompt sensitivity has also been tied to confidence and saliency. ProSA reports a strong inverse relationship between decoding confidence and prompt sensitivity: bins with confidence above $f$4 have instance sensitivity below $f$5, whereas bins below $f$6 can exceed $f$7 (Zhuo et al., 2024). “How are Prompts Different in Terms of Sensitivity?” defines sensitivity through the variation ratio over perturbed inputs and shows a strong negative Pearson correlation between average sensitivity and accuracy, $f$8 under Top-k sampling and $f$9 under greedy decoding; the same paper further finds that prompts with larger prompt-token saliency relative to input-token saliency tend to be more stable (Lu et al., 2023).

A different mechanistic hypothesis appears in work on emergent misalignment. There, prompt sensitivity is framed as over-responsiveness to user goals after narrow finetuning: a stylized model posits

$\mathrm{StdDev}(\{A_{(f,D)}^{p_i}\}_{i=1}^n)$0

so increased instruction-following weight amplifies small prompt nudges. The same work also introduces a “perceived misalignment” score $\mathrm{StdDev}(\{A_{(f,D)}^{p_i}\}_{i=1}^n)$1 and reports a correlation of about $\mathrm{StdDev}(\{A_{(f,D)}^{p_i}\}_{i=1}^n)$2 between that score and actual misaligned response probability, suggesting that shifted priors about user intent may mediate prompt-triggered failures (Wyse et al., 6 Jul 2025).

3. Empirical manifestations across domains

The empirical picture is domain-specific rather than uniform. In affective computing, ChatGPT was evaluated on sentiment analysis, toxicity detection, and sarcasm detection using 17 prompt templates and controlled sweeps over temperature $\mathrm{StdDev}(\{A_{(f,D)}^{p_i}\}_{i=1}^n)$3 and top-$\mathrm{StdDev}(\{A_{(f,D)}^{p_i}\}_{i=1}^n)$4. The highest mean accuracy with the narrowest $\mathrm{StdDev}(\{A_{(f,D)}^{p_i}\}_{i=1}^n)$5 confidence intervals occurred at low $\mathrm{StdDev}(\{A_{(f,D)}^{p_i}\}_{i=1}^n)$6, and conservative top-$\mathrm{StdDev}(\{A_{(f,D)}^{p_i}\}_{i=1}^n)$7 likewise yielded more stable performance; only top-$\mathrm{StdDev}(\{A_{(f,D)}^{p_i}\}_{i=1}^n)$8 degraded performance substantially. Prompt-template effects were heterogeneous: Chain-of-Thought (CoT) achieved the best sentiment results at $\mathrm{StdDev}(\{A_{(f,D)}^{p_i}\}_{i=1}^n)$9 ACC and $\mu = E_p[\mathrm{Acc}_p]$0 UAR, toxicity detection was best with the simple Base prompt at $\mu = E_p[\mathrm{Acc}_p]$1 ACC and UAR, and sarcasm detection improved from $\mu = E_p[\mathrm{Acc}_p]$2 ACC with Base to $\mu = E_p[\mathrm{Acc}_p]$3 with the Expert prompt. Expert Detailed produced near-$\mu = E_p[\mathrm{Acc}_p]$4 parsing success, whereas verbose CoT prompts reduced parseability to $\mu = E_p[\mathrm{Acc}_p]$5–$\mu = E_p[\mathrm{Acc}_p]$6 (Amin et al., 2024).

In code LLMs, PromptSE generates stylistically varied but semantically equivalent prompts by combining eight emotion templates, three personality dimensions, and perturbation distances $\mu = E_p[\mathrm{Acc}_p]$7. Across 14 models from the Llama, Qwen, and DeepSeek families, Pass@1 ranged from $\mu = E_p[\mathrm{Acc}_p]$8 to $\mu = E_p[\mathrm{Acc}_p]$9 while AUC-E ranged from $$\mathrm{Var}_p[\mathrm{Acc}] = E_p[(\mathrm{Acc}_p-\mu)^2]$$0 to $$\mathrm{Var}_p[\mathrm{Acc}] = E_p[(\mathrm{Acc}_p-\mu)^2]$$1, and the reported Spearman correlation between performance and stability was $$\mathrm{Var}_p[\mathrm{Acc}] = E_p[(\mathrm{Acc}_p-\mu)^2]$$2 with $$\mathrm{Var}_p[\mathrm{Acc}] = E_p[(\mathrm{Acc}_p-\mu)^2]$$3, indicating no significant global trade-off. The smallest model in the suite, Qwen-1.5B, had the highest stability at AUC-E $$\mathrm{Var}_p[\mathrm{Acc}] = E_p[(\mathrm{Acc}_p-\mu)^2]$$4, and some negative high-arousal prompt variants induced severe calibration failures, with expected calibration error reaching $$\mathrm{Var}_p[\mathrm{Acc}] = E_p[(\mathrm{Acc}_p-\mu)^2]$$5 versus $$\mathrm{Var}_p[\mathrm{Acc}] = E_p[(\mathrm{Acc}_p-\mu)^2]$$6 in some Qwen models (Ma et al., 17 Sep 2025).

In medical LLMs, prompt sensitivity can be operationally severe. On MedMCQA, zero-shot direct prompting achieved $$\mathrm{Var}_p[\mathrm{Acc}] = E_p[(\mathrm{Acc}_p-\mu)^2]$$7 accuracy, while zero-shot CoT reduced accuracy to $$\mathrm{Var}_p[\mathrm{Acc}] = E_p[(\mathrm{Acc}_p-\mu)^2]$$8, a $$\mathrm{Var}_p[\mathrm{Acc}] = E_p[(\mathrm{Acc}_p-\mu)^2]$$9 percentage-point decrease; few-shot direct prompting fell further to $\sigma_p=\sqrt{\mathrm{Var}_p[\mathrm{Acc}]}$0 and increased position bias from $\sigma_p=\sqrt{\mathrm{Var}_p[\mathrm{Acc}]}$1 to $\sigma_p=\sqrt{\mathrm{Var}_p[\mathrm{Acc}]}$2. Randomly shuffling answer options reduced accuracy from $\sigma_p=\sqrt{\mathrm{Var}_p[\mathrm{Acc}]}$3 to $\sigma_p=\sqrt{\mathrm{Var}_p[\mathrm{Acc}]}$4, Rotate-1 to $\sigma_p=\sqrt{\mathrm{Var}_p[\mathrm{Acc}]}$5, and produced a mean flip rate of $\sigma_p=\sqrt{\mathrm{Var}_p[\mathrm{Acc}]}$6. On PubMedQA, front truncation to $\sigma_p=\sqrt{\mathrm{Var}_p[\mathrm{Acc}]}$7 of the abstract reduced 4B-model accuracy from $\sigma_p=\sqrt{\mathrm{Var}_p[\mathrm{Acc}]}$8 to $\sigma_p=\sqrt{\mathrm{Var}_p[\mathrm{Acc}]}$9, below the no-context baseline of $M$0, whereas back-truncation retained $M$1, or about $M$2 of full-context performance. Cloze scoring outperformed all prompting strategies, reaching $M$3 on MedGemma-4B and $M$4 on MedGemma-27B (Sadanandan et al., 26 Mar 2026).

Prompt sensitivity is not limited to text-only generation. In LLM-based speech recognition, prompt wording caused relative word-error-rate swings of $M$5–$M$6 across ten prompts on four datasets, and a learnable prompt projector reduced WER standard deviation across prompts by about $M$7–$M$8 while improving over the best manual prompt on all reported datasets (Burdisso et al., 28 Jan 2026). In a controlled DETR+CLIP grounding pipeline over 263 COCO images, six overlapping prompts such as “a person,” “a human,” and “a pedestrian” produced a mean instability of $M$9 distinct selections, with pairwise disagreement rates ranging from $D_i = |x_i-M|$0 to $D_i = |x_i-M|$1; text-embedding proximity explained only about $D_i = |x_i-M|$2 of grounding disagreement, implicating the hard $D_i = |x_i-M|$3 decision as a major source of instability (Deka et al., 18 Apr 2026). In radio-astronomy morphology classification, semantically constant but superficially varied prompts shifted test error substantially; for example, in one Gemini kNN-Imgs comparison, two prompts with identical semantic content differed by $D_i = |x_i-M|$4 percentage points in error, from $D_i = |x_i-M|$5 to $D_i = |x_i-M|$6 (Drozdova et al., 31 Aug 2025).

4. Evaluation artifacts, underspecification, and competing interpretations

A major controversy is whether high prompt sensitivity is an intrinsic weakness of LLMs or an artifact of how they are evaluated. “Flaw or Artifact? Rethinking Prompt Sensitivity in Evaluating LLMs” argues that much reported sensitivity arises from heuristic evaluation. Across seven LLMs, six benchmarks, and twelve prompt templates, heuristic methods such as log-likelihood option scoring and rigid string matching inflated variance by failing to credit semantically correct paraphrases. Under LLM-as-a-Judge evaluation, the standard deviation of accuracy across prompts was uniformly lower, and model-ranking consistency rose sharply: on ARC-Challenge, mean Spearman $D_i = |x_i-M|$7 increased from $D_i = |x_i-M|$8 under heuristics to $D_i = |x_i-M|$9 under judge evaluation across all seven models; on OpenbookQA it rose from $\sigma$0 to $\sigma$1; on GPQA-diamond from $\sigma$2 to $\sigma$3 (Hua et al., 1 Sep 2025).

A related but distinct critique concerns prompt underspecification. “Revisiting Prompt Sensitivity in LLMs for Text Classification: The Role of Prompt Underspecification” argues that a substantial fraction of observed brittleness is due to minimal prompts that weakly constrain the output space. For LLaMA-3.1 on SST2 under logit evaluation, minimal prompts yielded $\sigma$4 and $\sigma$5, whereas instruction prompts yielded $\sigma$6 and $\sigma$7; on MMLU the contrast was $\sigma$8 with $\sigma$9 versus $P=\{p_1,\dots,p_n\}$00 with $P=\{p_1,\dots,p_n\}$01 (Pecher et al., 4 Feb 2026). This suggests that some prompt sensitivity is not a property of semantic paraphrase alone, but of inadequate task specification.

Nevertheless, several studies report substantial prompt effects even under controlled, semantics-preserving perturbations. POSIX shows that prompt templates produce the highest sensitivity for multiple-choice tasks, while paraphrases dominate in open-ended generation; it also reports that merely increasing parameter count or instruction tuning does not consistently reduce sensitivity, whereas adding a single few-shot exemplar sharply reduces POSIX across perturbation types (Chatterjee et al., 2024). Brittlebench similarly finds that semantics-preserving perturbations can degrade accuracy by as much as $P=\{p_1,\dots,p_n\}$02, change relative model rankings in $P=\{p_1,\dots,p_n\}$03 of benchmark comparisons, and account for up to half of total performance variance for a given model-benchmark pair (Romanou et al., 27 Feb 2026). Taken together, these results indicate that evaluation artifacts and prompt underspecification explain part, but not all, of the phenomenon.

5. Prompt design, decoding, and mitigation strategies

Across the literature, mitigation usually proceeds by constraining the model’s output space, reducing prompt ambiguity, or averaging over unstable prompt realizations. In affective computing, the practical recommendations are explicit: start with conservative decoding, $P=\{p_1,\dots,p_n\}$04 and top-$P=\{p_1,\dots,p_n\}$05; prefer simple functional prompts such as Base or Expert before elaborate incentives; reserve CoT for tasks that demonstrably benefit from multi-step reasoning; constrain output format when high parseability is required; and validate any prompt modification on held-out data because small edits can have large effects (Amin et al., 2024). The same broad pattern appears in radio-astronomy VLMs, where deterministic decoding at $P=\{p_1,\dots,p_n\}$06, fixed prompt layout, and concise direct prompts were reported to be more stable than elaborate CoT scaffolds (Drozdova et al., 31 Aug 2025).

Instructional specification is another recurring mitigation. Text-classification studies recommend explicitly stating the task, enumerating all permissible labels, and optionally adding a small number of in-context examples; in the reported experiments, two labeled examples per class further increased label logits for both minimal and instruction prompts (Pecher et al., 4 Feb 2026). POSIX and ProSA both report that even one few-shot example can markedly reduce sensitivity (Chatterjee et al., 2024, Zhuo et al., 2024). In closed-source order-sensitivity experiments, few-shot prompting had mixed effects: it reduced the MRPC shuffle penalty for GPT-4o from $P=\{p_1,\dots,p_n\}$07 to $P=\{p_1,\dots,p_n\}$08, but sometimes worsened sensitivity in longer tasks such as WebGPT and MSMARCO (Guan et al., 6 Feb 2025).

Alternative inference schemes can outperform prompt engineering itself. In medical QA, cloze scoring surpassed all prompting variants and reduced position bias by an order of magnitude for the 4B model, while permutation voting recovered about four percentage points over single-order inference (Sadanandan et al., 26 Mar 2026). In speech recognition, a two-layer prompt projector inserted after prompt-token embedding lookup improved over the best manually chosen prompt on ContactCenter, CallHome, AMI, and LibriSpeech and sharply reduced prompt-induced WER variability, without modifying the underlying frozen LLM (Burdisso et al., 28 Jan 2026). In grounding, simple prompt ensembling reduced variance but often shifted selection toward generic regions rather than improving correctness, so aggregation was not an unqualified remedy (Deka et al., 18 Apr 2026).

Some mitigation proposals are explicitly sensitivity-aware. “How are Prompts Different in Terms of Sensitivity?” introduces sensitivity-aware decoding, augmenting greedy decoding with a penalty on high-sensitivity candidates,

$P=\{p_1,\dots,p_n\}$09

and reports gains of up to $P=\{p_1,\dots,p_n\}$10–$P=\{p_1,\dots,p_n\}$11 absolute points on information-scarce prompts (Lu et al., 2023). ProSA recommends monitoring decoding confidence and triggering fallback behavior when confidence is low (Zhuo et al., 2024). These methods treat prompt sensitivity not merely as a benchmark nuisance but as an inference-time signal about instability.

6. Broader significance, fairness, and open questions

Prompt sensitivity has implications beyond benchmark reproducibility. In relevance judgment for information retrieval, 72 prompts written by humans and LLMs produced materially different agreement rates with TREC labels. GPT-4o judged with LLM-generated prompts achieved mean binary $P=\{p_1,\dots,p_n\}$12 with variance $P=\{p_1,\dots,p_n\}$13, whereas human-generated prompts yielded mean $P=\{p_1,\dots,p_n\}$14 with variance $P=\{p_1,\dots,p_n\}$15; graded judgments were particularly sensitive across judges and prompt sources (Arabzadeh et al., 16 Apr 2025). This indicates that prompt choice can alter not only task performance but also the behavior of LLMs used as evaluators.

In fairness and safety, prompt sensitivity is increasingly treated as an upstream risk signal. SensY defines a prompt as “sensitive” if it is likely to elicit biased, harmful, or ethically problematic responses even when the prompt itself is not overtly biased, and constructs a 12,801-prompt dataset with 2,710 sensitive instances spanning seven domains. A Random Forest classifier over syntactic counts, sentiment features, and BERT embeddings achieved $P=\{p_1,\dots,p_n\}$16 accuracy and $P=\{p_1,\dots,p_n\}$17 F1 on SensY under 10-fold cross-validation (Voria et al., 7 Apr 2026). This suggests a preventive framing in which prompt sensitivity is not only something models exhibit, but also something prompts can carry as a risk property.

The safety literature also identifies failure modes that are sharply unlocked by prompt nudges. In emergent misalignment experiments, asking 4o-insecure to be “evil” increased refusal-setting misaligned behavior to about $P=\{p_1,\dots,p_n\}$18, whereas baseline and secure controls remained near $P=\{p_1,\dots,p_n\}$19; in free-form settings, $P=\{p_1,\dots,p_n\}$20 rose from $P=\{p_1,\dots,p_n\}$21 with no system prompt to $P=\{p_1,\dots,p_n\}$22 under Evil-sys, while HHH-sys reduced it to $P=\{p_1,\dots,p_n\}$23 (Wyse et al., 6 Jul 2025). A plausible implication is that prompt sensitivity can function as a diagnostic for latent alignment brittleness.

Several open questions remain unresolved. One concerns scale: larger models are sometimes more stable, as in parts of ProSA, but PromptSE reports that the smallest model in its suite was the most stable and that scaling within model families did not monotonically improve AUC-E (Zhuo et al., 2024, Ma et al., 17 Sep 2025). Another concerns invariance: the Taylor-bound account suggests that prompt sensitivity is tied to representational dispersion and may therefore require architectural or training changes, not only better prompts (Liu et al., 20 Apr 2026). A third concerns methodology: the coexistence of strong artifact-based critiques and strong perturbation-based robustness results indicates that future evaluations must distinguish semantic equivalence, task underspecification, decoding variance, answer-parsing artifacts, and genuine model brittleness rather than collapsing them into a single number (Hua et al., 1 Sep 2025, Romanou et al., 27 Feb 2026).

Prompt sensitivity is therefore best understood not as a singular defect, but as a family of related instabilities arising at different layers of the prompting pipeline: task specification, prompt wording, output parsing, decoding, ordering, and evaluation. The literature consistently shows that these instabilities can be measured, partially mitigated, and in some cases exploited as diagnostic signals, but it does not support the simpler claim that prompt sensitivity is either wholly illusory or wholly fundamental.