Cited by 28Topic ModelingNatural Language Processing TechniquesAdversarial Robustness in Machine Learning

The DOI matches its Crossref record; 29 of the 36 references it cites were found in a registry or an index; 9 of the 20 sources its claims cite were checked for support.

Flaw or Artifact? Rethinking Prompt Sensitivity in Evaluating LLMs

Open access
Hua, Andong, Tang, Kenan, Gu, Chenhe, Gu, Jindong, Wong, Eric, Qin, Yao·2025·Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing

Abstract

Prompt sensitivity, referring to the phenomenon where paraphrasing (i.e., repeating something written or spoken using different words) leads to significant changes in large language model (LLM) performance, has been widely accepted as a core limitation of LLMs.In this work, we revisit this issue and ask: Is the widely reported high prompt sensitivity truly an inherent weakness of LLMs, or is it largely an artifact of evaluation processes?To answer this question, we systematically evaluate 7 LLMs (e.g., GPT and Gemini family) across 6 benchmarks, including both multiple-choice and open-ended tasks on 12 diverse prompt templates.We find that much of the prompt sensitivity stems from heuristic evaluation methods, including log-likelihood scoring and rigid answer matching, which often overlook semantically correct responses expressed through alternative phrasings, such as synonyms or paraphrases.When we adopt LLM-as-a-Judge evaluations, we observe a substantial reduction in performance variance and a consistently higher correlation in model rankings across prompts.Our findings suggest that modern LLMs are more robust to prompt templates than previously believed, and that prompt sensitivity may be more an artifact of evaluation than a flaw in the models.

Overview

AI snapshot

Written from the paper’s full text.

TL;DR

The paper argues that reported prompt sensitivity in LLM evaluation is largely an artifact of heuristic scoring, not an inherent model flaw. Using LLM-as-a-Judge across 7 LLMs, 6 benchmarks, and 12 prompt templates, it finds much lower performance variance and much higher ranking consistency than heuristic evaluation.

Key findings

  • Heuristic evaluation exaggerates prompt sensitivity. On ARC-Challenge, Gemma-2.0’s accuracy ranges from 0.25 to 0.90 with standard deviation 0.28 under heuristics, versus a 0.17 range and standard deviation 0.005 under LLM-as-a-Judge.
  • Ranking consistency improves sharply under LLM-as-a-Judge. On ARC-Challenge, mean Spearman rank correlation among open-source models rises from 0.30/0.31 under heuristics to 0.92 with LLM-as-a-Judge, and to 0.95 when proprietary models are included. Table 1 reports ARC-Challenge ρ from 0.3036 to 0.9546, OpenbookQA from 0.4212 to 0.9386, GPQA Diamond from 0.1542 to 0.8960, NarrativeQA from 0.5927 to 0.8662, and MATH from 0.9593 to 0.9647.
  • Human annotations support the LLM-judge results. Across six datasets, human agreement has Fleiss’ κ over 0.6, combined agreement 0.8132, and combined perfect agreement 73%; human-majority vs LLM-judge combined Cohen’s κ is 0.9247.
  • The pattern also appears in older models. For Llama-2 and Mistral, LLM-as-a-Judge reduces standard deviation across paraphrased prompts from 0.1413 to 0.0182 and from 0.0389 to 0.0098, respectively.

Methods

  • Evaluated 7 LLMs: LLaMA-3.1-8B-Instruct, Qwen2-7B-Instruct, Gemma-2-9B-it, Ministral-8B-Instruct-v0.2, GPT-4o-mini, GPT-4.1-mini, and Gemini 2.0 Flash. Benchmarks: ARC-Challenge, GPQA-Diamond, OpenbookQA, NarrativeQA, MATH, and SimpleQA.
  • Constructed 12 prompt templates per benchmark using GPT-4o paraphrasing; multiple-choice datasets shared a pool of 12 templates, while open-ended tasks used 12 benchmark-specific templates. Compared heuristic evaluation (log-likelihood for multiple-choice; format-specific extraction/normalization for NarrativeQA and MATH; no parser for SimpleQA) with LLM-as-a-Judge, defaulting to Gemini 2.0 Flash and checking GPT-4o-mini on ARC-Challenge.
  • Measured prompt sensitivity via standard deviation of accuracy across prompt templates and mean pairwise Spearman rank correlation across prompts. Human validation used three undergraduate annotators, 50 sampled questions per dataset, one model under all 12 prompts, yielding 600 answers per dataset-model pair and 10,800 annotations total, with majority voting.

Limitations

  • The paper states computational constraints limited evaluation to 12 prompt templates per benchmark, though it reports that ARC-Challenge results with 12 prompts closely match those with over 100 prompts.
  • Evident from the text: SimpleQA has no official heuristic parser, so it is evaluated only with LLM-as-a-Judge; NarrativeQA lacks results for Mistral and Qwen due to long-context requirements; and the human study uses three undergraduate annotators from UCSB, which may limit annotator diversity.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.18653/v1/2025.emnlp-main.1006

Cites

29 of 36 references verified0 citation errors · 7 not checkable

Statistics

Nothing to recompute.

Verification

Claims the paper makes

9 of 20 cited sources checked · 5 supported · 0 flagged · accuracy not yet measured

  • Premisecitation

    Previous studies typically rely on heuristic evaluation, such as regular-expression-based answer extraction or log-likelihood scoring over candidates.

    “To investigate this, we find that previous studies (Voronov et al., 2024;Chatterjee et al., 2024) typically rely on heuristic evaluation, such as regular-expression-based answer extraction or loglikelihood scoring over candidates.”
    Quote in the paperSubstantial claim2 of 2 sources checked
    • cites Voronov et al., 2024 source

      Section 4.2 discusses DIRECT, CHANNEL, and CALIBRATION prediction methods, while Section 5.5 discusses sensitivity to prompt templates. Neither passage establishes that previous studies typically use heuristic evaluation or mentions regular-expression answer extraction or log-likelihood scoring over candidates. Searches for those terms and related descriptions found no passage addressing the claim. (LLM, conf=0.72)

      Experimental — accuracy not yet measured
    • cites Chatterjee et al., 2024 source

      The Introduction says earlier prompt-sensitivity studies used measures such as accuracy, exact match, performance spread, and variation ratio. It does not describe regular-expression-based answer extraction or log-likelihood scoring over candidates; its discussion of log-likelihood concerns responses to prompt variations, not candidate scoring. (LLM, conf=0.84)

      Experimental — accuracy not yet measured
  • Premisecitation

    The relative rankings of LLMs can shift substantially depending on the prompt template used.

    “More critically, the relative rankings of LLMs can shift substantially depending on the prompt template used (Polo et al., 2024;Mizrahi et al., 2024).”
    Quote in the paperSubstantial claim1 of 2 sources checked
    • cites Polo et al., 2024 source
    • cites Mizrahi et al., 2024 source
  • Findingown data

    On NarrativeQA, the correlation rises from 0.40 (heuristics) to 0.87 (LLM-as-a-Judge).

    “On NarrativeQA, the correlation rises from 0.40 (heuristics) to 0.87 (LLM-as-a-Judge).”
    Quote in the paperSubstantial claim
  • Findingown data

    Heuristic evaluation methods often exaggerate the prompt sensitivity of LLMs.

    “We discover that heuristic evaluation methods often exaggerate the prompt sensitivity of LLMs.”
    Quote in the paperSubstantial claim
  • Findingown data

    The heuristic methods exhibit significantly greater sensitivity to prompt variation than LLM-as-a-Judge.

    “When comparing the performance of the model under heuristic evaluation and LLM-as-a-Judge, we find that the heuristic methods exhibit significantly greater sensitivity to prompt variation (Figure 2).”
    Quote in the paperSubstantial claim
  • Probably not a substantial claim. 14
  • It may state two separate claims as one. 12
  • The quote only partly states this claim. 1
  • Probably not a substantial claim.

    Premisecitation

    The ranking inconsistency with diverse prompt templates has been widely reported.

    “The ranking inconsistency with diverse prompt templates has been widely reported (Polo et al., 2024;Mizrahi et al., 2024;Chatterjee et al., 2024;Sclar et al., 2023).”
    Quote in the paperSubstantial claim2 of 3 sources checked
    • cites Polo et al., 2024 source
    • cites Mizrahi et al., 2024

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites Chatterjee et al., 2024 source

      The Introduction (page unavailable) reports that performance varies across prompt templates, and Section 5.5 finds template variation especially consequential for multiple-choice tasks. But the paper does not report that the relative ranking of models changes across templates, which is the specific inconsistency claimed. (LLM, conf=0.83)

      Experimental — accuracy not yet measured
  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Premisecitation

    Voronov et al. (2024) showed that no prompt format consistently performs best across models.

    “Voronov et al. (2024) further showed that no prompt format consistently performs best across models.”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites Voronov et al., 2024 source
  • It may state two separate claims as one.

    Premisecitation

    LLM judges can better handle various output formats, paraphrasing, and ambiguous cases, making them more aligned with human evaluation.

    “Compared to heuristics, LLM judges can better handle various output formats, paraphrasing, and ambiguous cases, making them more aligned with human evaluation (Liu et al., 2023;Kocmi and Federmann, 2023;Zheng et al., 2023;Wang et al., 2023).”
    Quote in the paperSubstantial claim1 of 3 sources checked
    • cites Liu et al., 2023 source

      The Introduction and Conclusion report that G-EVAL correlates more strongly with human judgments than baseline NLG evaluators, particularly on open-ended tasks. The paper does not establish that LLM judges achieve this by better handling various output formats, paraphrasing, or ambiguous cases; those specific capabilities are not demonstrated in the cited passages or the additional passages searched. (LLM, conf=0.86)

      Experimental — accuracy not yet measured
    • cites Kocmi and Federmann, 2023

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites Zheng et al., 2023

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim.

    Premisecitation

    Existing studies have reported that LLMs are highly sensitive to prompt phrasing.

    “Although existing studies have reported that LLMs are highly sensitive to prompt phrasing (Voronov et al., 2024;Mizrahi et al., 2024)”
    Quote in the paperSubstantial claim1 of 2 sources checked
    • cites Voronov et al., 2024 source
    • cites Mizrahi et al., 2024

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Premisecitation

    Polo et al. (2024) estimates the distribution of accuracy across prompts to improve evaluation efficiency.

    “For example, Polo et al. (2024) estimates the distribution of accuracy across prompts to improve evaluation efficiency.”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites Polo et al., 2024 source
  • It may state two separate claims as one.

    Findingown data

    Applying prompt sensitivity analysis to SimpleQA, we observe a low standard deviation and a high Spearman rank correlation of 0.8121 across 12 prompt templates.

    “Applying our prompt sensitivity analysis, we observe a low standard deviation and a high Spearman rank correlation of 0.8121 across 12 prompt templates.”
    Quote in the paperSubstantial claim
  • It may state two separate claims as one.

    Findingown data

    Under these conditions, prompt sensitivity results are comparable to those obtained via LLM-as-a-Judge evaluation, with similarly low accuracy variance and high ranking consistency.

    “Under these conditions, we observe prompt sensitivity results that are comparable to those obtained via LLM-as-a-Judge evaluation, with similarly low accuracy variance and high ranking consistency.”
    Quote in the paperSubstantial claim
  • It may state two separate claims as one.

    Findingown data

    Both the standard deviation across different prompts and the ranking correlation remain consistent regardless of whether GPT or Gemini is used as the judge.

    “As shown in Table 2, both the standard deviation across different prompts and the ranking correlation remain consistent regardless of whether GPT or Gemini is used as the judge.”
    Quote in the paperSubstantial claim
  • It may state two separate claims as one.

    Findingown data

    Human-annotated results show consistently high agreement on the answer correctness, with a high Fleiss' κ over 0.6.

    “Observation 1 Human-annotated results show consistently high agreement on the answer correctness (Table 3), with a high Fleiss' κ over 0.6 (Fleiss, 1971).”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites Fleiss, 1971

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • It may state two separate claims as one.

    Findingown data

    When evaluated with LLM-as-a-Judge, models show far more consistent performance and stable rankings across prompts.

    “When evaluated with LLM-as-a-Judge, models show far more consistent performance and stable rankings across prompts.”
    Quote in the paperSubstantial claim
  • It may state two separate claims as one.

    Findingown data

    When evaluated using LLM-as-a-Judge, Gemma-2.0's accuracy varies by only 0.17 across the same set of prompt templates, with a much lower standard deviation of just 0.005.

    “In contrast, when evaluated using LLM-as-a-Judge, its accuracy varies by only 0.17 across the same set of prompt templates, with a much lower standard deviation of just 0.005.”
    Quote in the paperSubstantial claim
  • It may state two separate claims as one.

    Findingown data

    Human-annotated answer correctness shows high agreement across prompt templates, with Fleiss' κ values ranging from 0.6708 to 0.8132 and perfect agreement rates from 52% to 88% across datasets.

    “Dataset Agreement Perfect Agreement Arc-Challenge 0.7654 86% OpenbookQA 0.7250 80% GPQA-Diamond 0.6708 52% NarrativeQA 0.7258 66% MATH 0.7859 68% SimpleQA 0.7881 88% Combined 0.8132 73% Table 3: Correctness of answers shows minimal variation across prompt templates, based on human annotations.”
    Quote in the paperSubstantial claim
  • It may state two separate claims as one.

    Findingown data

    On ARC-Challenge, the average Spearman rank correlation across prompts among open-source models increases from 0.30 (heuristics) to 0.92 (LLM-as-a-Judge), and further to 0.95 when proprietary models are included.

    “On ARC-Challenge, the average Spearman rank correlation across prompts among open-source models increases from 0.30 (heuristics) to 0.92 (LLM-as-a-Judge), and further to 0.95 when proprietary models are included.”
    Quote in the paperSubstantial claim
  • It may state two separate claims as one.

    Findingown data

    On ARC-Challenge, the ranking consistency and variance metrics using 12 prompts closely match those obtained with over 100 prompts, suggesting that our analysis is representative.

    “For example, on ARC-Challenge, the ranking consistency and variance metrics using 12 prompts closely match those obtained with over 100 prompts, suggesting that our analysis is representative.”
    Quote in the paperSubstantial claim
  • It may state two separate claims as one.

    Findingnone given

    A key factor in prompt sensitivity is the heuristic evaluation protocol itself, which often leads to misclassification of correct outputs and overstates prompt sensitivity.

    “In contrast, we show that a key factor is the heuristic evaluation protocol itself, which often leads to misclassification of correct outputs and overstates prompt sensitivity.”
    Quote in the paperNot a substantial claim
  • It may state two separate claims as one.

    Findingown data

    Model performance and rankings are substantially more stable and reliable than previously reported.

    “Through comprehensive experiments using LLMas-a-Judge across multiple benchmarks and prompt templates, we reveal that model performance and rankings are substantially more stable and reliable than previously reported.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The seven evaluated LLMs are representative of modern LLMs.
    • Rests on an assumption: The six benchmarks are representative of the tasks used to evaluate LLMs.
  • Probably not a substantial claim.

    Premisecitation

    Instruction-tuning datasets such as FLAN and Super-NaturalInstructions include a diverse collection of tasks with varying natural language prompt templates.

    “For example, instruction-tuning datasets such as FLAN (Longpre et al., 2023) and Super-NaturalInstructions (Wang et al., 2022) include a diverse collection of tasks (e.g., question answering, summarization, classification) with varying natural language prompt templates (Zhang et al., 2023).”
    Quote in the paperSubstantial claim0 of 3 sources checked
    • cites Longpre et al., 2023

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites Wang et al., 2022

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites Zhang et al., 2023

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • The quote only partly states this claim.

    Interpretationown data

    Prompt-induced variability has consistently been an artifact of evaluation methods rather than a fundamental inconsistency in model behavior.

    “These additional results indicate that the reduction of prompt-induced variability is not due to recent models”
    Quote in the paperSubstantial claim
  • Probably not a substantial claim. The paper may give no reason why it holds.

    Interpretationnone given

    Heuristic evaluation methods often fail when model outputs deviate from expected formats.

    “Heuristic evaluation methods often fail when model outputs deviate from expected formats.”
    Quote in the paperNot a substantial claim
  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Study design and conductown data

    The human annotators had no prior exposure to the study.

    “We recruit three undergraduate students from UCSB with no prior exposure to this study.”
    Quote in the paperNot a substantial claim
  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Study design and conductown data

    The annotators were fluent in English.

    “The undergraduate students are Asian or Asian American, and all of them are fluent in English.”
    Quote in the paperNot a substantial claim
  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Study design and conductreasoning

    The annotators were not told the topic of the paper in order to minimize potential bias.

    “The annotators are informed that their work will be included in a research paper, but the topic of the paper is not disclosed in order to minimize potential bias.”
    Quote in the paperNot a substantial claim
  • Probably not a substantial claim.

    Premisecitation

    Prior work often assumes that LLMs are inherently unstable to prompt changes.

    “To address this, prior work often assumes that LLMs are inherently unstable to prompt changes.”
    Quote in the paperSubstantial claim
  • Probably not a substantial claim. The paper may give no reason why it holds.

    Premisenone given

    All existing methods attribute the sensitivity to model behavior.

    “However, all existing methods attribute the sensitivity to model behavior.”
    Quote in the paperNot a substantial claim
  • Probably not a substantial claim.

    Study design and conductreasoning

    Due to computational constraints, we evaluate each benchmark using only 12 prompt templates.

    “Due to computational constraints, we evaluate each benchmark using only 12 prompt templates.”
    Quote in the paperSubstantial claim
  • Probably not a substantial claim. The paper’s conclusions may not depend on it.

    Premisecitation

    Mizrahi et al. (2024) conducted a large-scale study showing significant accuracy differences across prompt variants.

    “Mizrahi et al. (2024) conducted a large-scale study showing significant accuracy differences across prompt variants.”
    Quote in the paperNot a substantial claim0 of 1 sources checked
    • cites Mizrahi et al., 2024

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim.

    Study design and conductnone given

    All evaluations use greedy decoding to ensure deterministic outputs.

    “All evaluations use greedy decoding to ensure deterministic outputs.”
    Quote in the paperSubstantial claim
27 of 27
  • The paper relies on this without support.

    The seven evaluated LLMs are representative of modern LLMs.

    “We evaluate LLaMA-3.1-8B-Instruct(LLaMA-3.1)(Dubey et al., 2024), Qwen2-7B-Instruct (Qwen-2) (Yang et al., 2024), Gemma-2-9B-it (Gemma-2) (Gemma Team et al., 2024), Ministral-8B-Instruct-v0.2 (Ministral) (MistralAI, 2024), GPT-4o-mini (July 2024), GPT-4.1-mini(April 2025), and Gemini 2.0 Flash (February 2025).”
  • The paper relies on this without support.

    The six benchmarks are representative of the tasks used to evaluate LLMs.

    “We evaluate on six benchmarks covering both multiple-choice and open-ended tasks.”
  • The paper relies on this without support.

    Human annotations provide a reliable ground truth for answer correctness.

    “To assess the reliability of LLM-judges, we compare them against human annotations.”
    “Human annotators evaluate whether each answer matches the corresponding ground truth.”
  • The paper relies on this without support.

    No official heuristic parser is currently available for SimpleQA, making rule-based evaluation infeasible.

    “No official heuristic parser is currently available, making rule-based evaluation infeasible.”
4 of 4

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • Gemma-2 accuracy range is incompatible with its reported standard deviation

    Major

    Across 12 prompts, an accuracy range of 0.17 requires a standard deviation of at least approximately 0.035, even if every other accuracy lies at the midpoint. The reported standard deviation of 0.005 cannot describe those same results.

  • NarrativeQA heuristic rank correlation disagrees with Table 1

    Major

    The results text gives the NarrativeQA heuristic correlation as 0.40, whereas Table 1 reports 0.5927. The difference materially changes the stated improvement to 0.87 under LLM-as-a-Judge.

2 of 2

Citations

Cites

Flagged first, then by citations

Research works printed but not linked: 2

  1. Tomáš Kočiskỳ, Jonathan Schwarz, Phil Blunsom, Chris Dyer, Karl Moritz Hermann, Gábor Melis, and Ed- ward Grefenstette. 2018. The narrativeqa reading comprehension challenge. Transactions of the Asso- ciation for Computational Linguistics, 6:317-328.
  2. PMLR.

Cited by

Sorted by citations

Metadata

Authors
Hua, A., Tang, K., Gu, C., Gu, J., Wong, E., & Qin, Y.
Affiliations
  • University of California, Santa Barbara (US)
  • University of California, Irvine (US)
  • University of Pennsylvania (US)
Venue
Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing
Published
2025
Pages
19900-19910
OpenAlex
W4416036473
Cited by
28
References
14
Citations by year
2026: 28
FWCI
10.17
Type
conference paper
Language
en
Open access
Licence
cc-by
Locations
  • Conference on Empirical Methods in Natural Language Processing (EMNLP) (publishedVersion, cc-by)
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University) (cc-by)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Topic Modeling
  • Physical Sciences › Computer Science › Artificial Intelligence › Natural Language Processing Techniques
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
Keywords
prompt sensitivity, paraphrase, large language models, LLM evaluation, evaluation artifacts, LLM-as-a-judge, prompt templates

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

A language model drew the claims from the paper on 2026-11-08, under version 3 of the claim definition (model deepseek-v4.1-flash, prompt extract-v3).

A second model labelled each claim on 2026-11-08 (model jev-1.13-20260917, definition revision gold-guideline-v0.2).

Cited sources are checked with a language model’s help (gpt-6-sol).

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review