Brittlebench: Quantifying LLM robustness via prompt sensitivity

Angelika Romanou; Mark Ibrahim; Candace Ross; Chantal Shaib; Kerem Oktar; Samuel J. Bell; Anaelia Ovalle; Jesse Dodge; Antoine Bosselut; Koustuv Sinha; Adina Williams

Source-linked AI summary

Brittlebench: Quantifying LLM robustness via prompt sensitivity

Angelika Romanou, Mark Ibrahim, Candace Ross, Chantal Shaib, Kerem Oktar, Samuel J. Bell, Anaelia Ovalle, Jesse Dodge, Antoine Bosselut, Koustuv Sinha, Adina Williams

arXiv:2603.13285v2Feb 27, 2026cs.LGcs.AI

TL;DR

Static and arena-style evaluations provide limited control over prompt variation, making it difficult to distinguish stable model ability from prompt-induced variability. Brittlebench introduces a variance-decomposition framework and semantics-preserving perturbation pipeline to measure brittleness across benchmarks and models. Performance can degrade by up to 12%, while perturbations can explain up to half of total performance variance.

Problem
Existing evaluations do not principledly quantify prompt-induced variability, leaving benchmark scores potentially confounded by prompt formulation and format effects.
Method
Brittlebench combines a variance-decomposition framework with a unified taxonomy of semantics-preserving perturbations applied to existing benchmarks.
Results
Performance degrades by up to 12% under meaning-preserving perturbations, which can account for up to half of total performance variance.
Takeaways & Limitations
Prompt sensitivity materially affects model evaluation, so robustness to input variation should be measured alongside performance on canonical benchmark inputs.
Takeaways & Limitations
LLMs are evaluated as answer-generators rather than judges, and approximately unchanged performance on LLM-generated paraphrases may reflect self-bias.

Abstract

from arXiv · show

Existing evaluation methods largely rely on clean, static benchmarks, which can overestimate true model performance by failing to capture the noise and variability inherent in real-world user inputs. This is especially true for language models, which can face human-generated text queries containing mistakes, typos, or alternative ways of phrasing the same question. In this work, we introduce a theoretical framework for quantifying model sensitivity to prompt variants, or brittleness, that can enable us to disentangle data-induced difficulty from prompt-related variability. Using this framework, we design a novel evaluation pipeline, Brittlebench, to holistically evaluate the sensitivity of frontier models. We apply semantics-preserving perturbations to a suite of popular benchmarks, and observe model performance to degrade as much as 12%. However, these perturbations do not affect all models equally: even a single perturbation alters the relative ranking of models in 63% of cases, impacting conclusions about comparative model performance. Decomposing the total variance of both state-of-the-art open-weight and commercial models, we find that semantics-preserving input perturbations can account for up to half of the performance variance for a given model. Brittlebench highlights the need for more robust evaluations and models, and allows us to systematically understand model brittleness.

1 Introduction

Static benchmarks can confound genuine capability with benchmark-specific format effects, while arena evaluations leave prompt robustness largely unresolved. Brittlebench addresses this gap by quantifying prompt-induced variability and evaluating it across models, tasks, and reasoning settings.

Motivation: Static benchmark scores may reflect optimization toward benchmark-specific artifacts rather than stable model capabilities.Fixed formats, reasoning templates, and task definitions can introduce inductive biases.
Motivation: Arena-style evaluations broaden input distributions but treat prompt variation as incidental, leaving prompt robustness unresolved.They implicitly assume performance is stable across prompt formulations.
Research gap: No principled framework previously quantified how much observed performance variability comes from prompt formulation.This makes it difficult to distinguish stable ability from prompt-design artifacts.
Contributions: Brittlebench introduces a theoretical variance-decomposition framework that separates task-induced difficulty from prompt-induced performance variability.The framework quantifies model brittleness under diverse prompt perturbations.
Contributions: A unified taxonomy of semantics-preserving perturbations supports systematic robustness evaluations across tasks, model scales, and reasoning settings.The study applies these perturbations to state-of-the-art open-weight and commercial models.

2 Semantics-Preserving Perturbations

Brittlebench evaluates prompt sensitivity by applying a unified set of semantics-preserving perturbations to established benchmarks and comparing original with perturbed performance. The perturbation space spans multiple prompt components and is checked for semantic preservation.

Framework: The framework applies semantics-preserving perturbations to benchmark prompts and measures performance differentials across benchmark–perturbation pairs.This isolates variability attributable to superficial input changes.
Perturbation taxonomy: The taxonomy organizes perturbations by affected prompt components, including word manipulation, augmentation, padding, paraphrasing, math, and code changes.Paraphrasing includes lexical, syntactic, and rule-free variants.
Perturbation taxonomy: Prompt augmentation adds information such as personas, emotional phrases, or explanatory paraphrasing.These additions preserve the underlying task while changing prompt formulation.
Perturbation taxonomy: The methodology expands prior perturbation studies by testing a broader range of prompt-padding characters and other established variation types.The perturbations include format changes, context paraphrasing, and special-character padding.
Semantic validation: High cosine similarity between original and perturbed examples indicates minimal semantic difference across the evaluated perturbation types.Similarity is computed for benchmark data points across all 15 perturbation types.

3 Brittlebench

Brittlebench decomposes observed performance variance into task difficulty and perturbation sensitivity, then aggregates these components into model- and benchmark-level brittleness scores. The framework treats perturbation-driven instability as a distinct source of evaluation variability.

Framework: Brittlebench measures robustness by decomposing performance variance into prompt sensitivity and inherent task complexity.The framework applies this decomposition to existing text-based benchmarks.
Variance decomposition: Observed variability combines intrinsic item difficulty with surface-form sensitivity under semantics-preserving perturbations.Canonical evaluation reports only one fixed input formulation, potentially masking within-item instability.
Variance decomposition: The stochastic formulation separates inference variance, data-difficulty variance, and perturbation-sensitivity variance.Correctness depends on data items, perturbation conditions, and inference runs.
Variance decomposition: The evaluation assumes deterministic inference, so the inference-variance term vanishes for fixed data–perturbation pairs.Performance is determined from model output log-probabilities.
Brittleness scores: For each model–benchmark pair, total variance partitions into perturbation-driven variance P_mb and item-difficulty variance D_mb, with V_mb = P_mb + D_mb.The empirical outcome matrix contains correctness for each item under each perturbation, including an unperturbed baseline.
Brittleness scores: Model- and benchmark-level brittleness scores quantify the fraction of aggregated total variance attributable to perturbations.Higher scores indicate variability driven more by surface-form sensitivity than by inherent task difficulty.

4 Experimental Setup

The experiments apply Brittlebench to six commonly used multiple-choice benchmarks and evaluate commercial and open-weight language models. This setup tests robustness across a varied benchmark suite.

Benchmarks: The evaluation covers MMLU, TruthfulQA, ARC, MathQA, LogiQA, and GPQA multiple-choice benchmarks.These benchmarks provide the testbed for applying the perturbation framework.
Models: The study benchmarks commercial and state-of-the-art open-weight models.The setup supports comparisons across model families using the selected tasks.

5 Results & Analysis

Brittlebench shows that semantics-preserving prompt perturbations degrade accuracy, alter model rankings, and contribute substantially to performance variance. Robustness varies by perturbation type, prompting strategy, model, benchmark, and inference setting.

Impact of perturbations: Surface-form perturbations consistently degrade accuracy across models, with prompt padding causing up to 12.83% degradation in few-shot settings.LLM-generated paraphrases are comparatively benign and can occasionally improve open-weight-model performance.
Impact of perturbations: A single perturbation changes the relative ranking of six open-weight models in 63% of cases.Padding with quotation marks and newlines produces lower rank correlations than spacing or word-splitting perturbations.
Variance and brittleness attribution: Perturbation-induced variance accounts for roughly half of observed performance variance in most open-weight models and more than 25% in commercial models.This contribution remains comparable across model scales and can meet or exceed variance attributed to item difficulty.
Variance and brittleness attribution: MMLU and GPQA are dominated by perturbation-induced variance, whereas TruthfulQA, LogiQA, MathQA, and ARC are driven largely by item difficulty.Benchmark brittleness therefore varies substantially across tasks.
Prompting and scale: Few-shot prompting improves baseline performance but often amplifies perturbation sensitivity, while larger models mitigate rather than eliminate brittleness.Zero-shot prompting can be more stable under noisy conditions despite lower absolute accuracy.
Compositional perturbations: Paired perturbations can produce accuracy drops of up to ∼45%, exceeding baseline differences between models and varying with perturbation order.Combinations usually amplify degradation and rarely produce systematic mitigation.
Inference strategies: Chain-of-thought prompting improves accuracy but reduces perturbation-induced accuracy loss by only 0.41 percentage points.Perturbations also degrade reasoning-trace quality, suggesting mitigation depends on preserving the reasoning process.

6 Related Work

Prior work documents LLM sensitivity to semantics-preserving structural, lexical, stylistic, and paraphrased prompt changes. Existing studies use diverse perturbations, robustness benchmarks, and instance-level sensitivity measures.

Structural and lexical perturbations: Prior studies find that minor changes to casing, spaces, separators, and other lexical or structural features can substantially affect model performance.PromptRobust combines structural and stylistic perturbations in a dedicated robustness benchmark.
Stylistic and paraphrased perturbations: Paraphrased and stylistically altered instructions can produce consistent performance degradation across benchmarks.Related work also proposes instance-level sensitivity scores based on changes to output requirements, roles, and emotional framing.

7 Conclusion

Brittlebench provides a benchmark-agnostic framework for separating task difficulty from prompt sensitivity. Across open-weight and commercial models, meaning-preserving perturbations can materially reduce performance and explain a substantial share of variance.

Framework: Brittlebench unifies semantics-preserving perturbations with variance decomposition to quantify model brittleness across tasks, models, and reasoning settings.The framework separates task-induced difficulty from prompt-induced performance variability.
Main findings: Meaning-preserving input perturbations can degrade benchmark performance by up to 12% and account for up to half of total performance variance.These findings motivate robustness-aware evaluation rather than single-format benchmark assessment.

A.1 Meta-Evaluation System Design

Brittlebench supports flexible perturbation-based robustness analysis across models and benchmarks, with perturbations grouped by type. The framework is designed for scalable evaluation and extensibility.

Framework capabilities: Brittlebench supports flexible and scalable perturbation capabilities, including custom perturbations, existing perturbation pools, benchmarks, robustness analysis, and similarity metrics.It also provides universal model and evaluation support across model architectures and evaluation styles.
Perturbation organization: Figure 4 groups the perturbations used in Brittlebench by perturbation type.

A.2 Validating Semantic Equivalence

Brittlebench defines semantic preservation behaviorally: a perturbation preserves meaning when the expected gold answer remains unchanged. The paper validates perturbations while acknowledging that equivalent inputs may differ internally for models.

Operational definition: Semantic preservation means that the original and perturbed inputs have the same expected gold answer, allowing minor stylistic or formal variations.The definition is task-dependent and behavioral rather than based on internal model representations.
Validation procedure: Word-level perturbations can inadvertently alter meaning, so Brittlebench uses careful, test-driven validation to minimize unintended semantic changes.For mathematical benchmarks, typos are restricted from modifying equations or mathematical expressions.
Scope and caveat: A behaviorally equivalent variant may still be tokenized differently by a model, producing internal differences despite the same expected output.These differences matter less under the paper’s human-centered criterion because the expected answer remains unchanged.
Similarity checks: Similarity metrics provide an additional check on perturbations, using Qwen3-Embedding-8B cosine similarity for non-paraphrase variants.
Paraphrase validation: Paraphrase quality was evaluated by three AI-expert annotators on a 5-point ordinal scale, with approximately 98% of ratings in the 4–5 range.
Paraphrase validation: Raw exact agreement between annotators was 0.902, indicating high agreement on paraphrase quality ratings.
Judge validation: Agreement between the LLM judge and human assessments was substantial under the shared 5-point ordinal rubric.

B Disaggregated Results

Brittlebench disaggregates performance across perturbation types and decomposes variation into intrinsic item difficulty and perturbation sensitivity. Its benchmark tables support fine-grained comparisons across models, prompts, and evaluation settings.

Disaggregated results: Models show broadly consistent trends across perturbation-level breakdowns, supporting the validity of Brittlebench’s perturbation groupings.Tables 2–5 report average performance across benchmarks, stratified by perturbation group and individual perturbation.
Variance decomposition: The evaluation uses a nested design in which multiple perturbations are applied to each data item.This design supports variance decomposition with perturbations nested within data items.
Variance decomposition: The random-effects model separates intrinsic data difficulty, αd, from perturbation sensitivity, βp(d), with both effects treated as zero-mean random effects.Inference is deterministic, so the model contains no residual noise term.
Variance decomposition: The proposed decomposition is equivalent to a variance-components ANOVA with perturbations nested within data items.The main text presents the decomposition using the law of total variance, whereas finite-sample ANOVA estimates components from sums of squares or likelihood methods.
Prompt augmentation: Table 3 reports average accuracy across six benchmarks for prompt augmentation perturbations under different few-shot settings.
Prompt padding: Table 4 reports average accuracy across six benchmarks for prompt padding perturbations under different few-shot settings.
Paraphrasing: Table 5 reports average accuracy across six benchmarks for paraphrasing perturbations under different few-shot settings.
Reasoning comparison: CoT and standard prompting are compared on the same evaluation examples across benchmarks and input perturbations.The comparison focuses on whether reasoning changes accuracy and robustness across tasks.

C.1 The Effects of Reasoning on Brittleness

For Claude 4.5 Opus, chain-of-thought prompting improves overall accuracy and modestly reduces the performance drop caused by perturbations. The benefit varies across benchmarks and does not establish uniform gains.

Accuracy effects: Across 83,870 questions, CoT significantly outperformed Non-CoT, with 3,413 CoT-only correct answers versus 1,454 Non-CoT-only correct answers.The comparison used McNemar’s test and yielded χ2 = 787.71, p < 0.001.
Accuracy effects: CoT improved accuracy overall, but gains varied across benchmarks and were minimal on some tasks.The supplied results specifically note limited improvement for MathQA and TruthfulQA.
Interpretation: The limited gains on MathQA and TruthfulQA may reflect ceiling effects or heterogeneous returns to chain-of-thought prompting.The paper presents these as possible explanations rather than established causes.
Robustness effects: CoT significantly mitigated robustness loss under perturbations, although the interaction effect was small in practical terms.The mixed-effects interaction was β = .007, p = .006.
Robustness effects: Perturbed performance dropped 2.38% with CoT, from 93.02% to 90.64%, versus 2.79% with Non-CoT, from 92.00% to 89.21%.

C.2 Conditions Under Which Reasoning Mitigates or Amplifies Brittleness

The analysis examines whether reasoning quality changes under prompt perturbations and whether those changes help explain accuracy effects. It finds that perturbations commonly degrade reasoning quality, while higher-quality reasoning is associated with correct answers.

Perturbations commonly reduce reasoning quality across benchmarks and perturbations.The overall decrease is significant (β = −2.61, p < .001).
Higher reasoning quality is significantly associated with correct answers across benchmarks.The reported relationship is β = 0.011, p < .001.
Reasoning can mitigate perturbation effects primarily when the perturbation does not compromise the reasoning itself.
The reasoning judge evaluates traces using multiple correlated dimensions and therefore uses an overall quality score.The dimensions include logical coherence, step completeness, clarity, and answer justification; their correlations are all r ≥ .9.