In other words: The influence of prompt variation on alignment evals

If alignment evaluations are phrased differently, does model behaviour change? In this post, we describe our attempt to answer this question. This project was completed as a 5-day project sprint during the Capstone Week of ARENA 8.0.

TL;DR: The data we collected were noisy! Almost every eval, model, and prompt variation direction yielded inconsistent results, making it difficult to draw clear conclusions. Nonetheless, our data suggest that prompt rephrasing can have a measurable impact on alignment-relevant properties, even on frontier models, and we think that the field of alignment evals should take seriously the idea of “fuzzing” prompts to get a more complete view of model behaviour.

Motivation

LLM sensitivity to prompt variation, where meaning-preserving changes to a prompt produce measurable changes in model performance, is a well-documented feature and presents a challenge in capability evaluations. [1] Alignment evaluations are an important tool for assessing the behaviour of models, so it is vital that they are representative, robust, and rigorous. Yet there is relatively little study into how sensitive alignment evals are to prompt variation.

This matters more given existing criticism of the rigour of such alignment evals. For example, Lessons from a Chimp: AI "Scheming" and the Quest for Ape Language argues that the AI scheming literature suffers from:

Claims hinging on anecdotal evidence.

Studies lacking hypotheses and control conditions.

Studies having weak or unclear theoretical motivation.

Findings being interpreted in exaggerated or unwarranted ways.

Sensitivity to prompt variation bears directly on 2. and 4. above: without a prompt "fuzzing" control condition, an eval cannot distinguish a real behavioural signal from an artefact of how a particular prompt happened to be phrased.

We set out to test this directly, via two main hypotheses:

Larger models are less affected by prompt variations. We hypothesised that as models scale, their higher-level understanding of the prompt improves, making responses more consistent under meaning-preserving perturbations.

Higher tiers of prompt variations have larger effects. We hypothesised that surface perturbations (e.g. formatting variations, typos) would have a smaller effect than deeper perturbations (e.g. sentiment variations).

On a personal level, we chose this project because we enjoyed the LLM evaluations week in the ARENA curriculum, and our backgrounds (neuroscience, accelerator physics, game development) drew us to undertaking an empirical, ‘science of evals’ investigation.

Related WorkSclar et al. (2023) and Mizrahi et al. (2024) show that LLMs are sensitive to subtle prompt variations such as the addition or omission of punctuation marks. However, this prior work either characterizes prompt sensitivity on capability evaluations, or studies adversarial jailbreaks. To our knowledge, no existing study treats perturbation type as the variable of interest—systematically sweeping the spectrum from surface-level formatting changes to semantic-preserving shifts in tone, sentiment, and framing—to quantify which classes induce the most variance in alignment-eval performance. In addition to this, our work provides data about how relevant prompt phrasing is for alignment evals and frontier models in mid-2026.

Methods

To capture the many different forms of prompt variation, we developed a taxonomy, shown below in Figure 1. We ordered this taxonomy into tiers based on the expected increase in sensitivity, and subdivided each tier into distinct dimensions.

Figure 1: Taxonomy of prompt variation. Each meaning-preserving variation is applied to a fixed control prompt (top row). Variations are grouped into tiers, with increasing tiers having higher expected sensitivity. Tiers are subdivided into dimenions, some of which have both a positive and negative pole.

We used GPT-4o-mini to generate 26 different variations of base user prompts—including different ‘dosages’ of the applied dimension—drawn from three sources [2]:

The known facts category of The MASK Benchmark.

The non-controversially harmful category of the Attempt to Persuade Eval (APE).

A custom-written Sycophancy eval.

Each eval used an LLM judge (GPT-4o for MASK and APE, and Sonnet 4.6 for sycophancy) to score the relevant property—honesty for MASK, persuasion for APE, and sycophancy for our custom eval. MASK and APE responses were judged in a binary fashion (honest / not honest; attempted to persuade / did not), while sycophancy responses were scored continuously between 0 and 1. Examples of the judge and system prompts are here, and the full set of prompt variations and model responses can be found here.

For our final eval run, we tested 14 different models spanning a wide range of scores on the Epoch Capabilities Index (ECI). [3] We deliberately used a very small set of base user prompts—2 each for MASK and APE, and 3 for Sycophancy—such that we could afford 20 repeats of the baseline prompt and 4 repeats of each variation, in order to quantify error. [4]

We spent roughly 100 hours combined on this project, with heavy use of Opus 4.8 for writing code and running analysis. Running the final test suite via OpenRouter cost roughly $80. [5]

Results

1. Prompt variation leads to broadly inconsistent results across evals and models

For each model in each eval, we first analysed the baseline user prompt responses to establish a baseline score and associated uncertainty. Figure 2 shows the results and reveals two limitations worth flagging. First, many of the models’ scores clustered near 0 or 1, risking floor/ceiling effects. Second, although models scored fairly consistently across repeated trials, there was substantial variability across evals. For example, a model may appear very ‘misaligned’ in MASK but not sycophancy, presumably in part because they measure different things that we’re clumping into one score. We do not attempt to work around these issues here; they should be read as caveats on the results that follow.

Figure 2: Misalignment scores are variable across models and evals. Misalignment scores on the baseline prompts across the 3 evals and 14 models. ECI = Epoch Capabilities Index.

We next examined how misalignment scores changed as we varied prompts along the different dimensions. Figure 3 shows the data is very noisy: apart from a few isolated exceptions (discussed in Section 2. below), there is no clear trend supporting either of our main hypotheses. That is: we do not observe a clear relationship between model capability and susceptibility to prompt variation, nor do higher tiers of perturbation appear to cause a larger increase in misalignment.

Figure 3: Effects of prompt fuzzing on misalignment scores are inconsistent across models and evals. The mean change in misalignment score across all evals (compared to the original control prompt) by the different prompt variations. The mean across all models is plotted in black, and the asterisks indicate significant deviations induced by prompt variation across models (blue/red colouring: decreased/increased misalignment).

These results highlight a recurring issue that we repeatedly ran into over the course of our project—our evals are messy! Although we attempted to control our experimental design by aligning prompts across models, and performed repeated rollouts for each prompt variation, we found that model responses varied wildly. The same condition would often elicit different responses within a single model, and any consistent per-model effects failed to generalise to other evals or models.

2. Hypothetical framing consistently increased sycophancy

Despite the general messiness of our data, framing prompts hypothetically in the Sycophancy eval consistently increased misalignment scores relative to the control prompt. Figure 4 shows a significant negative correlation between ECI and the change in sycophancy score, suggesting that more capable mo…