If alignment evaluations are phrased differently, does model behaviour change? In this post, we describe our attempt to answer this question. This project was completed as a 5-day project sprint during the Capstone Week of ARENA 8.0.
TL;DR: The data we collected were noisy! Almost every eval, model, and prompt variation direction yielded inconsistent results, making it difficult to draw clear conclusions. Nonetheless, our data suggest that prompt rephrasing can have a measurable impact on alignment-relevant properties, even on frontier models, and we think that the field of alignment evals should take seriously the idea of “fuzzing” prompts to get a more complete view of model behaviour.
Motivation
LLM sensitivity to prompt variation, where meaning-preserving changes to a prompt produce measurable changes in model performance, is a well-documented feature and presents a challenge in capability evaluations.[1] Alignment evaluations are an important tool for assessing the behaviour of models, so it is vital that they are representative, robust, and rigorous. Yet there is relatively little study into how sensitive alignment evals are to prompt variation.
Studies lacking hypotheses and control conditions.
Studies having weak or unclear theoretical motivation.
Findings being interpreted in exaggerated or unwarranted ways.
Sensitivity to prompt variation bears directly on 2. and 4. above: without a prompt "fuzzing" control condition, an eval cannot distinguish a real behavioural signal from an artefact of how a particular prompt happened to be phrased.
We set out to test this directly, via two main hypotheses:
Larger models are less affected by prompt variations. We hypothesised that as models scale, their higher-level understanding of the prompt improves, making responses more consistent under meaning-preserving perturbations.
Higher tiers of prompt variations have larger effects. We hypothesised that surface perturbations (e.g. formatting variations, typos) would have a smaller effect than deeper perturbations (e.g. sentiment variations).
On a personal level, we chose this project because we enjoyed the LLM evaluations week in the ARENA curriculum, and our backgrounds (neuroscience, accelerator physics, game development) drew us to undertaking an empirical, ‘science of evals’ investigation.
Related Work
Sclar et al. (2023) and Mizrahi et al. (2024) show that LLMs are sensitive to subtle prompt variations such as the addition or omission of punctuation marks. However, this prior work either characterizes prompt sensitivity on capability evaluations, or studies adversarial jailbreaks. To our knowledge, no existing study treats perturbation type as the variable of interest—systematically sweeping the spectrum from surface-level formatting changes to semantic-preserving shifts in tone, sentiment, and framing—to quantify which classes induce the most variance in alignment-eval performance. In addition to this, our work provides data about how relevant prompt phrasing is for alignment evals and frontier models in mid-2026.
Methods
To capture the many different forms of prompt variation, we developed a taxonomy, shown below in Figure 1. We ordered this taxonomy into tiers based on the expected increase in sensitivity, and subdivided each tier into distinct dimensions.
Figure 1: Taxonomy of prompt variation. Each meaning-preserving variation is applied to a fixed control prompt (top row). Variations are grouped into tiers, with increasing tiers having higher expected sensitivity. Tiers are subdivided into dimenions, some of which have both a positive and negative pole.
We used GPT-4o-mini to generate 26 different variations of base user prompts—including different ‘dosages’ of the applied dimension—drawn from three sources[2]:
Each eval used an LLM judge (GPT-4o for MASK and APE, and Sonnet 4.6 for sycophancy) to score the relevant property—honesty for MASK, persuasion for APE, and sycophancy for our custom eval. MASK and APE responses were judged in a binary fashion (honest / not honest; attempted to persuade / did not), while sycophancy responses were scored continuously between 0 and 1. Examples of the judge and system prompts are here, and the full set of prompt variations and model responses can be found here.
For our final eval run, we tested 14 different models spanning a wide range of scores on the Epoch Capabilities Index (ECI).[3] We deliberately used a very small set of base user prompts—2 each for MASK and APE, and 3 for Sycophancy—such that we could afford 20 repeats of the baseline prompt and 4 repeats of each variation, in order to quantify error.[4]
We spent roughly 100 hours combined on this project, with heavy use of Opus 4.8 for writing code and running analysis. Running the final test suite via OpenRouter cost roughly $80.[5]
Results
1. Prompt variation leads to broadly inconsistent results across evals and models
For each model in each eval, we first analysed the baseline user prompt responses to establish a baseline score and associated uncertainty. Figure 2 shows the results and reveals two limitations worth flagging. First, many of the models’ scores clustered near 0 or 1, risking floor/ceiling effects. Second, although models scored fairly consistently across repeated trials, there was substantial variability across evals. For example, a model may appear very ‘misaligned’ in MASK but not sycophancy, presumably in part because they measure different things that we’re clumping into one score. We do not attempt to work around these issues here; they should be read as caveats on the results that follow.
Figure 2:Misalignment scores are variable across models and evals. Misalignment scores on the baseline prompts across the 3 evals and 14 models. ECI = Epoch Capabilities Index.
We next examined how misalignment scores changed as we varied prompts along the different dimensions. Figure 3 shows the data is very noisy: apart from a few isolated exceptions (discussed in Section 2. below), there is no clear trend supporting either of our main hypotheses. That is: we do not observe a clear relationship between model capability and susceptibility to prompt variation, nor do higher tiers of perturbation appear to cause a larger increase in misalignment.
Figure 3:Effects of prompt fuzzing on misalignment scores are inconsistent across models and evals. The mean change in misalignment score across all evals (compared to the original control prompt) by the different prompt variations. The mean across all models is plotted in black, and the asterisks indicate significant deviations induced by prompt variation across models (blue/red colouring: decreased/increased misalignment).
These results highlight a recurring issue that we repeatedly ran into over the course of our project—our evals are messy! Although we attempted to control our experimental design by aligning prompts across models, and performed repeated rollouts for each prompt variation, we found that model responses varied wildly. The same condition would often elicit different responses within a single model, and any consistent per-model effects failed to generalise to other evals or models.
Despite the general messiness of our data, framing prompts hypothetically in the Sycophancy eval consistently increased misalignment scores relative to the control prompt. Figure 4 shows a significant negative correlation between ECI and the change in sycophancy score, suggesting that more capable models are more robust to this prompt variation (although an additional caveat is that this relationship appears to largely be driven by the low-ECI Llama models).
Figure 4:Less capable models are more influenced by hypothetical framing. The change in misalignment score (hypothetical framing minus baseline) against model capability (ECI).
We are conscious of cherry-picking just a single eval/dimension combination. Still, we find it compelling given that this perturbation has been previously reported to bypass safeguards in deployed models (Wei et al. 2023). Although our data is too limited in scope to make strong conclusions, Figure 4 is consistent with our hypothesis, and the apparent specificity to hypothetical framing raises an interesting question for future work: why don't we see a similar trend in the other perturbation dimensions we tested?
3. Prompt variation did change model behaviour, albeit inconsistently
Although we did not see consistent patterns in how prompt variations modulated misalignment, these variations could nonetheless be affecting model behaviour—just in different ways for each perturbation-model combination.
To test this, we compared the absolute change in misalignment score induced by prompt variations, to the variability observed between repeated rollouts of the control prompt: i.e., do prompt variations change model alignment more than expected by chance? In the sycophancy eval (and to some degree in APE), we did find evidence that models were influenced by prompt variation (Figure 5).
Figure 5: Prompt variation can change misalignment scores. Absolute changes in misalignment score induced by prompt variations (y-axis) vs. the change when the same control prompt is repeated (x-axis). In the sycophancy eval, almost all models lie above the equality line, suggesting the prompt perturbations do change misalignment scores more than expected by chance. This trend was less clear in the MASK and APE evals, although the majority models lie above the diagonal in these evals as well.
This result does hint that something in our prompt variations affects models’ apparent misalignment — but exactly what is unclear. It may be that the influence of prompt variation is idiosyncratic, with different effects for each eval and model. But we think our data (as well as some intuitions gained from reading individual eval logs) suggest that how a prompt is phrased can matter, at least in some cases.
Future work
If we were to spend more time on this project, we would prioritise the following:
Undertake sensitivity analysisto identify and minimise unwanted sources of errors — for example: the quality of LLM-generated prompt variations and judge responses, model temperature, and refusal rates. This isolates the effect of prompt variation from other sources of uncertainty, and lets us determine how many prompt variation runs are needed to detect that effect at a given significance level.
Revise and develop a more principled taxonomy. We handpicked dimensions to vary and assigned them into tiers, but our preliminary results suggest that this wasn't the best approach: too limited in scope, and too arbitrarily selected. A better approach may have been to first identify meaningful candidate dimensions based on existing datasets. We’re also excited by the prospect of improved methods for efficiently generating high-quality evaluation datasets across a wider variety of dimensions including language and dialect.
Undertake a grid search across combinations of variations, instead of one dimension at a time. This would reveal whether variations have cumulative effects, and give better coverage of realistic prompts which likely contain several variations at once.
Apply prompt variation to the system prompt, not just the user prompt, to investigate its sensitivity to variation. This matters because many alignment evals bake behaviour-shaping instructions into the system prompt, and understanding sensitivity here would be valuable.
Apply prompt variation to multi-turn evaluations, to measure behaviours that may not appear in shorter conversations.
What surprised us
As our first investigation in the field of evals, a few things stood out:
The difficulty of reproducing results. Alignment evals typically involve hundreds of questions and may run multi-turn conversations with multiple calls to judges. This makes reproduction costly, particularly for SOTA models.
Recommendation: access to the eval log files behind publicly reported results would allow researchers to check their implementation and estimate error more directly.
The quality of certain alignment evals. We assumed, naively, that evals listed on Inspect would be uniformly high-quality. In practice, several lacked control conditions, and individual questions or setups occasionally had weak theoretical motivations relative to the behaviour being addressed.
Recommendation: a maintained, known database of ‘industry standard’ alignment evals would help researchers avoid this trap.
The rigour of certain alignment evals. We found basic flaws in how some evals were analysed—for instance, results reported to a precision finer than their own uncertainty, or error bars on plots exceeding 100%.
Recommendation: a standardised statistical toolkit for alignment evals, built to catch errors such as these, would raise the rigour floor across the field. Tools like HiBayES point in this direction, and adoption should be standardised.
A call for prompt fuzzing
Based on our results, we believe that model evaluations should aim to use more varied prompts across all the categories outlined above. Without this, evals may be showing an incomplete picture of model behaviour.
We want to thank James Hindmarch, Joly Scriven, David Quarrel, Nicky Pochinkov, Bart Jaworski, and Callum McDougall for their support throughout the ARENA 8.0 programme. James also suggested our initial project direction of quantifying the effect of prompt variation on alignment evals against model scaling.
This small base-prompt set is itself a weakness of our results because it limits how confidently we can generalise our findings beyond the specific scenarios tested. However, we had limited scope due to budget and time constraints.
If alignment evaluations are phrased differently, does model behaviour change? In this post, we describe our attempt to answer this question. This project was completed as a 5-day project sprint during the Capstone Week of ARENA 8.0.
TL;DR: The data we collected were noisy! Almost every eval, model, and prompt variation direction yielded inconsistent results, making it difficult to draw clear conclusions. Nonetheless, our data suggest that prompt rephrasing can have a measurable impact on alignment-relevant properties, even on frontier models, and we think that the field of alignment evals should take seriously the idea of “fuzzing” prompts to get a more complete view of model behaviour.
Motivation
LLM sensitivity to prompt variation, where meaning-preserving changes to a prompt produce measurable changes in model performance, is a well-documented feature and presents a challenge in capability evaluations.[1] Alignment evaluations are an important tool for assessing the behaviour of models, so it is vital that they are representative, robust, and rigorous. Yet there is relatively little study into how sensitive alignment evals are to prompt variation.
This matters more given existing criticism of the rigour of such alignment evals. For example, Lessons from a Chimp: AI "Scheming" and the Quest for Ape Language argues that the AI scheming literature suffers from:
Sensitivity to prompt variation bears directly on 2. and 4. above: without a prompt "fuzzing" control condition, an eval cannot distinguish a real behavioural signal from an artefact of how a particular prompt happened to be phrased.
We set out to test this directly, via two main hypotheses:
On a personal level, we chose this project because we enjoyed the LLM evaluations week in the ARENA curriculum, and our backgrounds (neuroscience, accelerator physics, game development) drew us to undertaking an empirical, ‘science of evals’ investigation.
Related Work
Sclar et al. (2023) and Mizrahi et al. (2024) show that LLMs are sensitive to subtle prompt variations such as the addition or omission of punctuation marks. However, this prior work either characterizes prompt sensitivity on capability evaluations, or studies adversarial jailbreaks. To our knowledge, no existing study treats perturbation type as the variable of interest—systematically sweeping the spectrum from surface-level formatting changes to semantic-preserving shifts in tone, sentiment, and framing—to quantify which classes induce the most variance in alignment-eval performance. In addition to this, our work provides data about how relevant prompt phrasing is for alignment evals and frontier models in mid-2026.
Methods
To capture the many different forms of prompt variation, we developed a taxonomy, shown below in Figure 1. We ordered this taxonomy into tiers based on the expected increase in sensitivity, and subdivided each tier into distinct dimensions.
Figure 1: Taxonomy of prompt variation. Each meaning-preserving variation is applied to a fixed control prompt (top row). Variations are grouped into tiers, with increasing tiers having higher expected sensitivity. Tiers are subdivided into dimenions, some of which have both a positive and negative pole.
We used GPT-4o-mini to generate 26 different variations of base user prompts—including different ‘dosages’ of the applied dimension—drawn from three sources[2]:
Each eval used an LLM judge (GPT-4o for MASK and APE, and Sonnet 4.6 for sycophancy) to score the relevant property—honesty for MASK, persuasion for APE, and sycophancy for our custom eval. MASK and APE responses were judged in a binary fashion (honest / not honest; attempted to persuade / did not), while sycophancy responses were scored continuously between 0 and 1. Examples of the judge and system prompts are here, and the full set of prompt variations and model responses can be found here.
For our final eval run, we tested 14 different models spanning a wide range of scores on the Epoch Capabilities Index (ECI).[3] We deliberately used a very small set of base user prompts—2 each for MASK and APE, and 3 for Sycophancy—such that we could afford 20 repeats of the baseline prompt and 4 repeats of each variation, in order to quantify error.[4]
We spent roughly 100 hours combined on this project, with heavy use of Opus 4.8 for writing code and running analysis. Running the final test suite via OpenRouter cost roughly $80.[5]
Results
1. Prompt variation leads to broadly inconsistent results across evals and models
For each model in each eval, we first analysed the baseline user prompt responses to establish a baseline score and associated uncertainty. Figure 2 shows the results and reveals two limitations worth flagging. First, many of the models’ scores clustered near 0 or 1, risking floor/ceiling effects. Second, although models scored fairly consistently across repeated trials, there was substantial variability across evals. For example, a model may appear very ‘misaligned’ in MASK but not sycophancy, presumably in part because they measure different things that we’re clumping into one score. We do not attempt to work around these issues here; they should be read as caveats on the results that follow.
Figure 2: Misalignment scores are variable across models and evals. Misalignment scores on the baseline prompts across the 3 evals and 14 models. ECI = Epoch Capabilities Index.
We next examined how misalignment scores changed as we varied prompts along the different dimensions. Figure 3 shows the data is very noisy: apart from a few isolated exceptions (discussed in Section 2. below), there is no clear trend supporting either of our main hypotheses. That is: we do not observe a clear relationship between model capability and susceptibility to prompt variation, nor do higher tiers of perturbation appear to cause a larger increase in misalignment.
Figure 3: Effects of prompt fuzzing on misalignment scores are inconsistent across models and evals. The mean change in misalignment score across all evals (compared to the original control prompt) by the different prompt variations. The mean across all models is plotted in black, and the asterisks indicate significant deviations induced by prompt variation across models (blue/red colouring: decreased/increased misalignment).
These results highlight a recurring issue that we repeatedly ran into over the course of our project—our evals are messy! Although we attempted to control our experimental design by aligning prompts across models, and performed repeated rollouts for each prompt variation, we found that model responses varied wildly. The same condition would often elicit different responses within a single model, and any consistent per-model effects failed to generalise to other evals or models.
2. Hypothetical framing consistently increased sycophancy
Despite the general messiness of our data, framing prompts hypothetically in the Sycophancy eval consistently increased misalignment scores relative to the control prompt. Figure 4 shows a significant negative correlation between ECI and the change in sycophancy score, suggesting that more capable models are more robust to this prompt variation (although an additional caveat is that this relationship appears to largely be driven by the low-ECI Llama models).
Figure 4: Less capable models are more influenced by hypothetical framing. The change in misalignment score (hypothetical framing minus baseline) against model capability (ECI).
We are conscious of cherry-picking just a single eval/dimension combination. Still, we find it compelling given that this perturbation has been previously reported to bypass safeguards in deployed models (Wei et al. 2023). Although our data is too limited in scope to make strong conclusions, Figure 4 is consistent with our hypothesis, and the apparent specificity to hypothetical framing raises an interesting question for future work: why don't we see a similar trend in the other perturbation dimensions we tested?
3. Prompt variation did change model behaviour, albeit inconsistently
Although we did not see consistent patterns in how prompt variations modulated misalignment, these variations could nonetheless be affecting model behaviour—just in different ways for each perturbation-model combination.
To test this, we compared the absolute change in misalignment score induced by prompt variations, to the variability observed between repeated rollouts of the control prompt: i.e., do prompt variations change model alignment more than expected by chance? In the sycophancy eval (and to some degree in APE), we did find evidence that models were influenced by prompt variation (Figure 5).
Figure 5: Prompt variation can change misalignment scores. Absolute changes in misalignment score induced by prompt variations (y-axis) vs. the change when the same control prompt is repeated (x-axis). In the sycophancy eval, almost all models lie above the equality line, suggesting the prompt perturbations do change misalignment scores more than expected by chance. This trend was less clear in the MASK and APE evals, although the majority models lie above the diagonal in these evals as well.
This result does hint that something in our prompt variations affects models’ apparent misalignment — but exactly what is unclear. It may be that the influence of prompt variation is idiosyncratic, with different effects for each eval and model. But we think our data (as well as some intuitions gained from reading individual eval logs) suggest that how a prompt is phrased can matter, at least in some cases.
Future work
If we were to spend more time on this project, we would prioritise the following:
What surprised us
As our first investigation in the field of evals, a few things stood out:
A call for prompt fuzzing
Based on our results, we believe that model evaluations should aim to use more varied prompts across all the categories outlined above. Without this, evals may be showing an incomplete picture of model behaviour.
You can find all our code and data here: github.com/ajweeks/prompt-variation
Acknowledgements
We want to thank James Hindmarch, Joly Scriven, David Quarrel, Nicky Pochinkov, Bart Jaworski, and Callum McDougall for their support throughout the ARENA 8.0 programme. James also suggested our initial project direction of quantifying the effect of prompt variation on alignment evals against model scaling.
For example: Benchmarking Prompt Sensitivity in Large Language Models, PromptSuite, Code Roulette, Revisiting Prompt Sensitivity in Large Language Models for Text Classification.
We also tested several other evals including InstrumentalEval and an impossible coding eval, but got best results from these three.
Opus 4.8, GLM-5.2, Gemini 3.5 Flash, Grok 4.20, DeepSeek v4 Pro, Sonnet 4.6, GPT-5-mini, Gemini 2.5 Flash, Qwen3 235B, DeepSeek Chat v3, Llama 4 Maverick, GPT-4o-mini, Llama 3.1 70B, and Llama 3.1 8B.
This small base-prompt set is itself a weakness of our results because it limits how confidently we can generalise our findings beyond the specific scenarios tested. However, we had limited scope due to budget and time constraints.
Roughly a third of this cost came from testing Claude Opus 4.8.