The rapid advancement of Large Language Models (LLMs) has established standardized evaluation benchmarks as the primary instrument for model comparison. Yet, their reliability is increasingly questioned due to sensitivity to shallow variations in input prompts. This paper examines how controlled, truth-conditionally equivalent lexical and syntactic perturbations affect the absolute performance and relative ranking of 23 contemporary LLMs across three benchmarks: MMLU, SQuAD, and AMEGA. We employ two linguistically principled pipelines to generate meaning-preserving variations: one performing synonym substitution for lexical changes, and another using dependency parsing to determine applicable syntactic transformations. Results show that lexical perturbations consistently induce substantial, statistically significant performance degradation across nearly all models and tasks, while syntactic perturbations have more heterogeneous effects, occasionally improving results. Both perturbation types destabilize model leaderboards on complex tasks. Furthermore, model robustness did not consistently scale with model size, revealing strong task dependence. Overall, the findings suggest that LLMs rely more on surface-level lexical patterns than on abstract linguistic competence, underscoring the need for robustness testing as a standard component of LLM evaluation.
Figures & tables
Figure 1: Illustration of the two linguistically principled, meaning-preserving perturbation pipelines and their average impact on LLM performance on the MMLU benchmark. Yellow and blue annotations mark changed words and moved constituents, respectively. The bar chart quantifies one of the core findings: lexical perturbations induce a substantial average accuracy drop, while the impact of syntactic perturbations is smaller.
Figure 2: Example from MMLU: original item (left), lexically perturbed version (center), and syntactically perturbed version (right). Changed words are marked in yellow and moved constituents in blue.
MMLU
SQuAD
AMEGA
Task
Multiple-choice QA
Extractive QA
Free-form QA
Domain
Humanities, social sciences, STEM + others
Wikipedia
Clinical
Size
15,858 questions
1,000 questions
135 ques- tions with 1,337 eval. criteria
Metric
Accuracy
EM, F1 & SAS
Guideline adherence score
Table 1: Diverse representative benchmarks to assess LLM robustness to linguistic perturbations.
MMLU
SQuAD (EM / F1 / SAS)
AMEGA
Model
Orig
Δ Lex
Δ Syn
Orig
Δ Lex
Δ Syn
Orig
Δ Lex
Δ Syn
GPT-5-Nano
69.6
10.2 ∗∗∗
2.2 ∗∗∗
66.4 / 83.7 / 91.0
3.5 ∗∗∗ / 3.6 / 2.2
3.2∗∗∗ / 2.6 / 1.7
37.4
1.9 ∗∗
0.6
GPT-5-mini
80.0
9.3 ∗∗∗
1.8 ∗∗∗
74.9 / 89.5 / 93.7
4.0 ∗∗∗ / 3.5 / 1.6
3.0∗∗∗ / 2.4 / 1.3
39.6
2.1 ∗∗∗
1.6 ∗∗
GPT-4.1-Nano
69.9
7.8 ∗∗∗
2.0 ∗∗∗
76.8 / 89.7 / 94.1
5.3 ∗∗∗ / 4.0 / 2.1
3.5 ∗∗∗ / 3.0 / 1.5
34.1
0.7
0.6
GPT-4.1-mini
80.7
8.3 ∗∗∗
1.6 ∗∗∗
77.2 / 90.7 / 94.4
4.5 ∗∗∗ / 3.7 / 1.9
2.0∗∗∗ / 2.3 / 1.3
36.0
0.3
0.9
GPT-OSS-120b
86.1
9.7 ∗∗∗
2.4 ∗∗∗
71.9 / 87.3 / 93.5
4.4 ∗∗∗ / 3.4 / 1.9
1.6∗∗∗ / 2.0 / 0.9
39.8
0.5
0.7
Table 2: LLM performance variance under lexical and syntactic perturbations across MMLU, SQuAD, and AMEGA. For each model, we report the original score and the absolute change under lexical and syntactic variants ( Δ Lex, Δ Syn). MMLU uses accuracy, SQuAD uses EM / F1 / SAS, and AMEGA uses the guideline adherence score out of 50 as metric. Positive Δ values indicate a drop in performance, and negative values indicate improvements. Grey backgrounds mark the highest value in each column. Asterisks mark significance (*: p<.05 , **: p<.01 , ***: p<.001 ) according to McNemar’s test.
Figure 3: Average drop in performance after lexical and syntactic perturbation across 23 LLMs for MMLU, SQuAD, and AMEGA. Lexical perturbations cause larger drops, most notably on MMLU.
Figure 4: Model performance rankings before and after lexical perturbation (top) and syntactic perturbation (bottom) for (a) MMLU, (b) SQuAD, and (c) AMEGA. Rankings are largely preserved on MMLU, while SQuAD and AMEGA show noticeably more movement.
Perturb.
Statistic
MMLU
SQuAD
AMEGA
Lexical
Kendall’s τ
0.98
0.93
0.89
95% CI (lower)
0.93
0.83
0.80
Strict agreement ( τ>0.9 )
✓ ∗
✕
✕
Mod. agreement ( τ>0.8 )
✓ ∗
✓ ∗
✓ ∗
Score shift
✓ ∗∗∗
✓ ∗∗∗
✓ ∗∗∗
Syntactic
Kendall’s τ
0.99
0.87
0.87
Table 3: Comparison of rankings on original vs. perturbed MMLU, SQuAD, and AMEGA datasets using Kendall’s τ and Wilcoxon signed-rank test. Asterisks denote significance ( ∗:p<0.05 , ∗∗:p<0.01 , ∗∗∗:p<0.001 ). Rankings are stable on MMLU but weaken on SQuAD and AMEGA.
Figure 5: Correlation between log-transformed model size and performance drop on lexically and syntactically perturbed benchmarks (MMLU, SQuAD, and AMEGA). The dashed line in each plot illustrates the Ordinary Least Squares regression fit for the points. Model size correlates positively with performance drop on MMLU and negatively on SQuAD and AMEGA.
Appendix figures & tables1 asset
Supplementary material from the paper’s appendix.
Appendix
Transformation
Required Conditions
Active to
• A nominal subject ( nsubj ).
Passive
• A direct object ( dobj ).
• The subject is not the pronoun ‘ it ’.
• The main verb is not ‘ have ’.
Passive to
• A passive nominal subject ( nsubjpass ).
Active
• A passive auxiliary verb ( auxpass ).
Appendix
Table 4: Complete list of syntactic transformations and their corresponding rule-based applicability conditions used in the syntactic perturbation pipeline. Conditions rely on dependency parsing tags.
Robustness evaluation of large language models (LLMs) remains a critical challenge, particularly in assessing their sensitivity to perturbations in input data. In this work, we systematically evaluate LLM robustness across multiple dimensions, including word error rate, character repetition and duplication, modifications in choices, and variability in instruction following. To facilitate this evaluation, we construct a synthetic and augmented dataset encompassing a diverse set of LLM benchmarks, specifically targeting multiple-choice question (MCQ) datasets and instruction-following tasks. We conduct extensive experiments on LLMs of varying scales-small, medium, and large-as well as across base and instruction-tuned variants. Our analysis quantifies the variability in model responses under perturbed conditions and highlights discrepancies relative to baseline models. The findings provide insights into the stability of LLMs across different evaluation scenarios contributing to the development of more robust and reliable language models as well as robust evaluation methodologies.
Existing evaluation methods largely rely on clean, static benchmarks, which can overestimate true model performance by failing to capture the noise and variability inherent in real-world user inputs. This is especially true for language models, which can face human-generated text queries containing mistakes, typos, or alternative ways of phrasing the same question. In this work, we introduce a theoretical framework for quantifying model sensitivity to prompt variants, or brittleness, that can enable us to disentangle data-induced difficulty from prompt-related variability. Using this framework, we design a novel evaluation pipeline, Brittlebench, to holistically evaluate the sensitivity of frontier models. We apply semantics-preserving perturbations to a suite of popular benchmarks, and observe model performance to degrade as much as 12%. However, these perturbations do not affect all models equally: even a single perturbation alters the relative ranking of models in 63% of cases, impacting conclusions about comparative model performance. Decomposing the total variance of both state-of-the-art open-weight and commercial models, we find that semantics-preserving input perturbations can account for up to half of the performance variance for a given model. Brittlebench highlights the need for more robust evaluations and models, and allows us to systematically understand model brittleness.
Large Language Models (LLMs) are increasingly used in healthcare for tasks such as clinical question answering, diagnosis support, and report summarization. Despite their promise, these models remain highly sensitive to subtle prompt perturbations, both lexical and syntactic, posing serious risks in safety-critical clinical applications. In this study, we conduct a systematic sensitivity analysis to evaluate the robustness of both general-purpose (e.g., GPT-3.5, Llama3) and medical-specific LLMs (e.g., ClinicalBERT, BioLlama3, BioBERT) using the MedMCQA benchmark. We categorize perturbations into natural and adversarial types and examine their effect on model consistency, accuracy, and reliability in clinical reasoning tasks. Our findings reveal that medical LLMs are not intrinsically safe. Even minor variations in phrasing can alter clinical advice, and targeted adversarial prompts can provoke harmful outputs. In high-stakes settings like healthcare, such unpredictability is unacceptable-models that change diagnoses due to reworded inputs or hallucinate medications when slightly rephrased cannot be reliably trusted by clinicians. While models tend to show resilience to simple lexical substitutions or paraphrasing, they often break down under syntactic reordering or misleading contextual cues. This fragility is evident across both general-purpose and domain-specific LLMs. Notably, adversarial manipulations can lead to clinically dangerous outputs, such as recommending incorrect dosages or omitting critical findings.
Mahdi Alkaeed
Department of Computer Science and Engineering, Doha, Qatar