Brittlebench: Quantifying LLM robustness via prompt sensitivity
Authors: Angelika Romanou, Mark Ibrahim, Candace Ross, Chantal Shaib, Kerem Oktar, Samuel J. Bell, Anaelia Ovalle, Jesse Dodge, Antoine Bosselut, Koustuv Sinha, Adina Williams
Organizations: FAIR at Meta · EPFL · Northeastern University
Existing evaluation methods largely rely on clean, static benchmarks, which can overestimate true model performance by failing to capture the noise and variability inherent in real-world user inputs. This is especially true for language models, which can face human-generated text queries containing mistakes, typos, or alternative ways of phrasing the same question. In this work, we introduce a theoretical framework for quantifying model sensitivity to prompt variants, or brittleness, that can enable us to disentangle data-induced difficulty from prompt-related variability. Using this framework, we design a novel evaluation pipeline, Brittlebench, to holistically evaluate the sensitivity of frontier models. We apply semantics-preserving perturbations to a suite of popular benchmarks, and observe model performance to degrade as much as 12%. However, these perturbations do not affect all models equally: even a single perturbation alters the relative ranking of models in 63% of cases, impacting conclusions about comparative model performance. Decomposing the total variance of both state-of-the-art open-weight and commercial models, we find that semantics-preserving input perturbations can account for up to half of the performance variance for a given model. Brittlebench highlights the need for more robust evaluations and models, and allows us to systematically understand model brittleness.
Figures & tables
Figure 1: The Brittlebench meta-evaluation framework. We select widely used benchmarks and apply semantics-preserving perturbations as described in Appendix 2 . We evaluate both the original and perturbed benchmarks using frontier and open-weight state-of-the-art models. Using performance measurements across benchmark–perturbation pairs, we measure the model variability by decomposing observed performance variance into components attributable to task difficulty and prompt sensitivity. Input perturbations systematically increase performance variance across models. Barplots show benchmark accuracy distributions on original ( left bars ) and perturbed ( right bars ) inputs. While median performance remains comparable, perturbations consistently inflate dispersion, indicating reduced robustness to input format variation across all model scales. Evaluating models on Brittlebench ’s perturbations provides a more comprehensive assessment by accounting for biases introduced by variations in input formats.
Model
Baseline
Word-level Perturbations
Prompt Padding
Context Augmentation
Paraphrasing
Micro-average
Acc ( ↑ ))
Drop ( ↓ )
Acc ( ↑ ))
Drop ( ↓ )
Acc ( ↑ ))
Drop ( ↓ )
Acc ( ↑ ))
Drop ( ↓ )
Acc ( ↑ ))
Drop ( ↓ )
Commercial Frontier Models
Claude 4.5 Opus
0-shot
78.64
75.42
3.23
78.64
-0.19
77.86
0.78
78.51
0.13
77.16
1.48
GPT-5
0-shot
73.97
68.44
5.53
73.97
0.01
69.93
4.04
68.96
5.01
69.95
4.02
Table 1: Average performance across all benchmarks used for Brittlebench . Each number is the average accuracy score (%) on the 6 benchmarks used ( MMLU ( Hendrycks et al., 2021 ) , ARC ( Clark et al., 2018 ) , TruthfulQA ( Lin et al., 2021 ) , MathQA ( Amini et al., 2019 ) , GPQA ( Rein et al., 2024 ) , LogiQA ( Liu et al., 2020 ) ) based on their lm-evaluation-harness implementations for different few shot settings. Perturbations have been grouped based on the type of changes they make in the input prompt.The scores with the largest performance drops are in bold. Disaggregated results on each of the perturbations and each of the benchmarks can be found in the Appendix B .
Figure 2: (a): Model sensitivity to perturbation intensity. Llama3.1-8B (top) and Qwen3-8B (bottom) accuracy (%) aggregated across benchmarks, under increasing numbers of surface-form perturbations, including typos and prompt-padding variations. Each line shows accuracy as a function of the number of perturbation occurrences, illustrating how perturbation intensity affects robustness. (b): Variance decomposition for models (top) and benchmarks (bottom) . From the model’s perspective, the Variance induced from perturbations ( Πm ) quantifies whether a model’s performance variability across tasks is dominated by prompt sensitivity rather than intrinsic item difficulty. From the benchmark perspective, the Variance induced from perturbations ( Πb ) indicates whether a benchmark primarily discriminates models based on task difficulty or on sensitivity to input perturbations.
Figure 3: Heatmap of Accuracy Drop (in %; ↓ ) from the baseline on MMLU for Qwen3-8B under single and paired input perturbations of Brittlebench . The first row reports the performance drop for individual perturbations, while each line shows the additional effect of applying a second perturbation on top of the first. Paraphrasing perturbations are always applied once. Higher values indicate larger degradation, revealing both compounding and counteracting effects between perturbations. Perturbations are sorted based on their average performance drop on all the benchmarks and models from highest (left/top) to lowest (right/bottom).
Appendix figures & tables8 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 4: Visual explanation of perturbations used in Brittlebench . Perturbations are grouped based on their type as described in Section 2 .
Model
Baseline
Typos
Drop Stop-words
Punctuation Spaces
Sequence Spaces
Word Merge
Word Split
Average
Acc ( ↑ )
Drop ( ↓ )
Acc ( ↑ )
Drop ( ↓ )
Acc ( ↑ )
Drop ( ↓ )
Acc ( ↑ )
Drop ( ↓ )
Acc ( ↑ )
Drop ( ↓ )
Acc ( ↑ )
Drop ( ↓ )
Acc ( ↑ )
Drop ( ↓ )
Commercial Frontier Models
Claude 4.5 Opus
78.64
74.36
4.28
74.08
4.56
78.45
0.19
72.15
6.49
76.72
1.92
76.74
1.90
75.42
3.22
GPT-5
73.97
64.65
9.32
65.63
8.34
70.29
3.68
69.47
4.50
70.19
3.78
70.42
3.55
68.44
5.53
Open-Weight Models
Llama3.3-70B
Appendix
Table 2: Average performance (%) across all used benchmarks on Brittlebench for Word Manipulation Perturbations . Each number is the average accuracy score on the 6 benchmarks used ( MMLU, ARC, TruthfulQA, MathQA, GPQA, LogiQA ) based on their harness-eval implementations for different few shot settings.
Model
Baseline
Persona
Emotion Prompt
Average
Acc ( ↑ )
Drop ( ↓ )
Acc ( ↑ )
Drop ( ↓ )
Acc ( ↑ )
Drop ( ↓ )
Commercial Frontier Models
Claude 4.5 Opus
78.64
77.68
0.96
78.05
0.59
77.87
0.77
GPT-5
73.97
69.96
4.01
69.9
4.07
69.93
4.04
Open-Weight Models
Llama3.1-8B
Appendix
Table 3: Average performance (%) across all used benchmarks on Brittlebench for Prompt Augmentation Perturbations . Each number is the average accuracy score on the 6 benchmarks used ( MMLU, ARC, TruthfulQA, MathQA, GPQA, LogiQA ) based on their harness-eval implementations for different few-shot settings.
Model
Baseline
Quotes
Spaces
New lines
Average
Acc ( ↑ )
Drop ( ↓ )
Acc ( ↑ )
Drop ( ↓ )
Acc ( ↑ )
Drop ( ↓ )
Acc ( ↑ )
Drop ( ↓ )
Commercial Frontier Models
Claude 4.5 Opus
78.64
76.77
1.87
80.1
-1.46
79.64
-1.00
78.84
-0.20
GPT-5
73.97
73.20
0.77
74.8
-0.83
73.86
0.11
73.95
0.02
Open-Weight Models
Llama3.1-8B
Appendix
Table 4: Average performance (%) across all used benchmarks on Brittlebench for Prompt Padding Perturbations . Each number is the average accuracy score on the 6 benchmarks used ( MMLU, ARC, TruthfulQA, MathQA, GPQA, LogiQA ) based on their harness-eval implementations for different few-shot settings.
Model
Baseline
Lexical Paraphrasing
Syntactical Paraphrasing
Rule-free Paraphrasing
Average
Acc ( ↑ )
Drop ( ↓ )
Acc ( ↑ )
Drop ( ↓ )
Acc ( ↑ )
Drop ( ↓ )
Acc ( ↑ )
Drop ( ↓ )
Commercial Frontier Models
Claude 4.5 Opus
78.64
78.56
0.08
78.26
0.38
78.71
-0.07
78.51
0.13
GPT-5
73.97
69.14
4.83
68.31
5.66
69.42
4.55
68.96
5.01
Open-Weight Models
Llama3.3-70B
Appendix
Table 5: Average performance (%) across all used benchmarks on Brittlebench for Paraphrasing Perturbations . Each number is the average accuracy score on the 6 benchmarks used ( MMLU, ARC, TruthfulQA, MathQA, GPQA, LogiQA ) based on their harness-eval implementations for different few-shot settings.
Figure 5: Comparison of chain-of-thought (CoT) and standard prompting for Claude 4.5 across benchmarks and input perturbations. Results are computed on the same evaluation examples for both prompting methods. CoT significantly improves accuracy and robustness on reasoning-heavy tasks (GPQA, LOGIQA, MATHQA, MMLU), with minimal gains on ARC and TRUTHFULQA. Significance markers denote McNemar’s test ( p ¡ 0.05, ** p ¡ 0.01, *** p ¡ 0.001).*
Figure 6: (a): Input perturbations reduce reasoning quality across most benchmarks , though the magnitude of degradation varies substantially by task. Bars show mean reasoning quality scores (0–100) assigned by an LLM judge, with 95% confidence intervals. Asterisks indicate significant differences from baseline. (b): Correct answers are associated with substantially higher reasoning quality across all benchmarks. Bars show mean reasoning quality scores (0–100) assigned by an LLM judge, with 95% confidence intervals. Asterisks indicate significant differences between correct and incorrect responses.
Zero-shot Perturbation
Rank Corr.
Few-shot Perturbation
Rank Corr.
Add punctuation spaces
0.9102
Word split
0.9673
Rule-free paraphrasing
0.8857
Add punctuation spaces
0.9592
Word split
0.8776
Typos
0.9510
Lexical paraphrasing
0.8694
Word merge
0.9429
Padding with spaces
0.8694
Add sequences of spaces
0.9347
Syntactic paraphrasing
0.8449
Drop stop words
0.9347
Appendix
Table 6: Mean Spearman rank correlation by perturbation for zero-shot and few-shot settings, averaged across tasks.
Large language model (LLM) evaluations on clean benchmarks overstate model robustness: real inputs arrive perturbed, and these meaning-preserving variants routinely move model answers. Studying this systematically requires applying perturbations one at a time, reproducibly, and identically wherever they run, yet existing tools couple them to a benchmarking stack rather than packaging them as a reusable transform layer. We present perturber, a stateless service and Python library that applies exactly one semantics-preserving perturbation per call, drawn from a first-party catalog of 68 perturbations across 11 families. It turns on a single primitive, with composition left to the caller chaining calls, so the service and the library produce identical output by construction. We evaluate the tool itself, its correctness, reproducibility, and cost, rather than any model's robustness, measuring meaning-preservation per perturbation rather than assuming it. The demonstration adds a live playground, an introspectable catalog for benchmark selection, and a one-command reproducible evaluation.
The rapid advancement of Large Language Models (LLMs) has established standardized evaluation benchmarks as the primary instrument for model comparison. Yet, their reliability is increasingly questioned due to sensitivity to shallow variations in input prompts. This paper examines how controlled, truth-conditionally equivalent lexical and syntactic perturbations affect the absolute performance and relative ranking of 23 contemporary LLMs across three benchmarks: MMLU, SQuAD, and AMEGA. We employ two linguistically principled pipelines to generate meaning-preserving variations: one performing synonym substitution for lexical changes, and another using dependency parsing to determine applicable syntactic transformations. Results show that lexical perturbations consistently induce substantial, statistically significant performance degradation across nearly all models and tasks, while syntactic perturbations have more heterogeneous effects, occasionally improving results. Both perturbation types destabilize model leaderboards on complex tasks. Furthermore, model robustness did not consistently scale with model size, revealing strong task dependence. Overall, the findings suggest that LLMs rely more on surface-level lexical patterns than on abstract linguistic competence, underscoring the need for robustness testing as a standard component of LLM evaluation.
Bogdan Kostić, Conor Fallon, Julian Risch +1
Berliner Hochschule für Technik (BHT) - Luxemburger Straße 10, 13467 Berlin · deepset GmbH - Zinnowitzer Straße 1, 10115 Berlin
Robustness evaluation of large language models (LLMs) remains a critical challenge, particularly in assessing their sensitivity to perturbations in input data. In this work, we systematically evaluate LLM robustness across multiple dimensions, including word error rate, character repetition and duplication, modifications in choices, and variability in instruction following. To facilitate this evaluation, we construct a synthetic and augmented dataset encompassing a diverse set of LLM benchmarks, specifically targeting multiple-choice question (MCQ) datasets and instruction-following tasks. We conduct extensive experiments on LLMs of varying scales-small, medium, and large-as well as across base and instruction-tuned variants. Our analysis quantifies the variability in model responses under perturbed conditions and highlights discrepancies relative to baseline models. The findings provide insights into the stability of LLMs across different evaluation scenarios contributing to the development of more robust and reliable language models as well as robust evaluation methodologies.