Beyond Magic Words: Sharpness-Aware Prompt Evolving for Robust Large Language Models with TARE
Authors: Guancheng Wan
Lucheng Fu
Haoxin Liu
Yiqiao Jin
Hui Yi Leong
Eric Hanchen Jiang
Hejia Geng
Jinhe Bi
Yunpu Ma
Xiangru Tang
B. Aditya Prakash
Yizhou Sun
Wei Wang
Venue: ICLR 2026 Poster (2026)
Keywords: LLM
LLM Agent
Prompt Evolving
Primary area: foundation or frontier models, including LLMs

Abstract: The performance of Large Language Models (LLMs) hinges on carefully engineered prompts. However, prevailing prompt optimization methods, ranging from heuristic edits and reinforcement learning to evolutionary search, primarily target point-wise accuracy. They seldom enforce paraphrase invariance or searching stability, and therefore cannot remedy this brittleness in practice. Automated prompt search remains brittle: small, semantically preserving paraphrases often cause large performance swings. We identify this brittleness as the **textual sharpness** of the **prompt landscape**. In this work, we provide the first formal treatment of textual sharpness in the discrete, semantic space of prompts, together with an operational robustness criterion over a semantic neighborhood; the design is black-box or API-only, requiring no gradients to update the model's parameters. Then we introduce **TARE** (Textual Sharpness-Aware Evolving), a derivative-free framework that alternates between an inner, sampling-based adversarial search that stresses a prompt with hard paraphrases and an outer, robust selection that prefers candidates whose neighborhoods remain strong. We further propose **ATARE**, which learns anisotropic weights to shape the semantic neighborhood and adapts its radius over time to balance exploration and fidelity. Diverse tasks evaluate our methods, whose design for minimizing textual sharpness gap leads to prompts that preserve accuracy under paraphrasing, outperforming accuracy-only prompt search while remaining computationally practical. The code is available for anonymous access at https://anonymous.4open.science/r/ATARE_TARE/.

Published as a conference paper at ICLR 2026
BEYOND MAGIC WORDS: SHARPNESS-AWARE PROMPT EVOLVING FOR ROBUST LARGE LANGUAGE MODELS WITH TARE
Guancheng Wan'; Lucheng Fu"; Haoxin Liu', Viqiao Jin', Hui Yi Leong', Fric Hanchen Jiang', Hejia Geng', Jinhe Bi³, Yunpu Ma², Xiangru Tang") B. Aditya Prakash? Yizhou Sun'! Wei Wang University of California, Los Angeles, GGorggia Institute of Technology.
University of Chicago, "University of Oxford, Dowano3@uclle edu, Luchengfu@gateehh edu
München, Yale University
ABSTRACT
The performance of Large Language Models (LLMs) hinges on carefully engi- neered prompts. However, prevailing prompt optimization methods, ranging from heuristic edits and reinforcement learning evolutionary search, primarily get point-wise accuracy. They seldom enforce paraphrase invariance or search- ing stability, and therefore cannot remedy this brittleness in practice. Automated prompt search remains brittle: small, semantically preserving paraphrases of- ten cause large performance swings. We identify this brittleness as the textual sharpness of the prompt landscape. In this work, we provide the first formal treatment of textual sharpness in the discrete, semantic space of prompts, to- gether with an operational robustness criterion over semantic neighborhood; the design is black-box or API-only, requiring no gradients to update the model's parameters. Then introduce TARE (Textual Sharpness-Aware Evolving), derivative-free framework that alternates between an inner, sampling-basee ad- versarial search that stresses prompt with hard paraphrases and outer, bust selection that prefers candidates whose neighborhoods remain strong, We further propose ATARE, which learns anisotropic weights shape the semantic neighborhood and adapts its radius over time to balance exploration and fidelity. Diverse tasks evaluate our methods, whose design for minimizing textual sharp- ness gap leads to prompts that preserve accuracy under paraphrasing, outperform- ing accuracy-only prompt search while remaining computationally practical. The code is available at https: : //ggttttuhss com wwaom//aaacheeggan//aaaaaaa TARRE.
INTRODUCTION
Large Language Models (LLMs) have demonstrated remarkable capabilities across wide array of natural language understanding and generation tasks (Brown et al., 2020; OpenAl, 2023). The effi- cacy of these models, however, is critically dependent the quality of their input prompts. In this vein, prompt engineerin aims at manually or automatically discovering optimal prompt structures to guide LLMs toward desired outputs. While automated methods like EvoPrompt and APE (Guo et al., 2023; Zhou et al., 2023) have shown promise, they often produce prompts that are highly sensitive perturbations. This vulnerability largely stems from their primary
minor, semantically-cquivablee focus on maximizing piint-wise accuracy, which often leads to overfitting on specific phrasings while neglecting stability across the prompt's semantic neighborhood. An optimized prompt that performs well on given set of inputs may fail dramatically when faced with slight paraphrasing or rephrasing, phenomenon we term the "sharpness" of the prompt landscape. This brittleness severely limits the real-world reliability and robustness of LLM-based systems.
"Equal contribution Corresponding authors

---

Published as a conference paper at ICLR 2026
The concept of "sharpness" in optimization landscupes is well-studied in the domain of deep neural networks. It has been shown that models converging to flat minima in the loss landscape exhibit superior generalization performance (Hochreiter & Schmidhuber, 1997). Sharpness- Aware Mini- mization (SAM) (Foret et al., 2021) and its variants have emerged as powerful techniques to ex- plicitly search these flat minima, thereby improving model robustness and generalization. These methods work by minimizing the loss in a "neighborhood" around the current parameters, effec- tively smoothing the loss landscape. However, the principles of SAM have been predominantly applied to continuous parameter spaces, such as model weights. Their application to the discrete and combinatorial nature of text-based prompts remains a significant and unexplored challenge.
Therefore, a natural research question arises: 1) How can we formally define and quantify the concept of "sharpness neighhorhood" within the discrete, semantic space of textual prompts? Due to the discrete and semanti- cally rich nature of text, traditional notions of local perturbations (e.g., infinitesimal gradient steps) are fundamentally inapplicable. Instead, must construct neighborhoods that capture for paraphras- ing and rephrasing-so that local sharpness re- flects true linguistic and behavioral proximity relevant LLMs. Defining such neighbor- hoods and associated metrics is crucial for ro- bust optimization. Building on this, a closely related question arises: III How can we de- sign a practical optimization algorithm that navigates this discrete landscape to discover prompts that are both effective and robust to semantic perturbations? This requires an al- gorithm that can efficiently explore the prompt space while incorporating measure of land- scape flatness into its search process.
refor inmrnne 10% Wie eayy Avolo tuy and wout?
aind wiher promeny
Rugrife Resd Conmen you guott coneee hend
semantic
cinvee ule oi vhla Prrpeteeen and
Dap LOMBARS
Prinpe
Figure 1: Problem Illustration. We illustrate the core challenge in prompt optimization: D conventional methods often find brittle, sharp minima (left), where a slight semantic change from an optimal prompt Prompt A to a paraphrase Prompt A results in a sig- nificant loss inerease. II) Our goal is to instead seek flat, stable solutions (right), where similar slight se- mantic change from robust prompt Prompt paraphrase Prompt B' only causes the loss to remain nearly unchanged. indicating high robustness.
its
To address these challenges, we introduce Textual Sharpness-Aware Evolving (TARE), a novel framework inspired by SAM that adapts its core principles for the discrete domain of prompt engineering. Our core contribution is a textual sharpness metric that quantifies prompt robustness by evaluating its performance over a neighbor- hood of semantically similar variants. We then propose an evolutionary optimization algorithm that iteratively refines prompts, selecting candidates that exhibit both high performance and low sharp- ness. Furthermore, we introduce an adaptive version, Adaptive Textual Sharpness-Aware Evolving (ATARE), which dynamically adjusts the neighborhood size during optimization for efficiency and effectiveness. Our contributions are threefold:
Formalizing Textual Sharpness. We introduce the first definition of sharpness tailored for the discrete, semantic space of prompts. This is accompanied by a metric to quantify prompt robust- ness by evaluating performance stability across semantically coherent neighborhood, bridging the gap between continuous optimization theory and discrete saggage--bsee optimization.
Sharpness-Awaa Prompt Evolution. We propose TARE, a novel algorithm designed to explicitly navigate the discrete prompt landscape. By integrating our textual sharpness metric directly into its fitness function, TARE effectively co-optimizes for both high task performance and low sharpness, yielding prompts that are both effective and robust. We further enhance this with an adaptive variant, ATARE, which dynamically adjusts the neighborhood radius for greater efficiency.
Superior Robustness and Generalization. Through extensive experiments on multiple bench- marks, we provide strong empirical evidence that our proposed methods, TARE and ATARE, con- sistently discover prompts that are significantly more robust and generalize better to unseen data compared to existing state-of-the--rt prompt optimization techniques.
2

---

Published as a conference paper at ICLR 2026
2
RELATED WORK
2.1 LARGE LANGUAGE MODELS
Large Language Models (LLMs) have rapidly advanced in scale and capability, from early few-shot systems such as GPT-3 (Brown et al., 2020) and GPT-4 (OpenAI, 2023) to general-purpose foun- dation and open models including PaLM (Chowdhery et al., 2022), Llama 2 (Touvron et al., 2023), Llama (Grattafiori et al., 2024), Mistral 7B (Jiang et al., 2023), and Mixtral (Jiang et al., 2024). Instruction finetuning and alignment further steer model behavior toward user intents (Ouyang et al., 2022; Rafailov et al., 2024; Leong& & Wu, 2024; Tang et al., 2025; Wang et al., 2025; 2026). Our problem setting assumes black-box (API-only) access
LLM (and optionally an evaluator), and focuses on optimizing prompts rather than modifying model parameters, making our approach complementary parameter-finttnnin and alignment.
2.2 PROMPT OPTIMIZATION
Prompt engineering has evolved from manual design to automated optimization. Early auto- mated approaches include gradient-free token editing and trigger search (AutoPrompt) (Shin al., 2020), cunnforementtllaminn-baaae
optimization (RIPrompt) (Deng et al., 2022), and bearch-based schemes such as APO (Pryzant et al., 2023). Recent work connects evolutionary algorithms with LLMs or leverages LLMs optimizers to iteratively propose and select candidates (Guo et al., 2023; Zhou et al., 2023; Fernando et al., 2023; Oh et al., 2024); programmatic frameworks like DSPy compile declarative pipelines into seff-improving prompt graphs (Khattab et al., 2023). In parallel, instruction induction and self-instruction curate high-coverage supervision for prompt- task design (Honovich et al., 2022; Wang al., 2023b); and reasoning-oriented prompting (CoT, self-consistency. ToT, ReAct, PoT)) improves average-case reasoning performance (Wei et al., 2023; Wang al., 2023a; Yao al., 2023b;a; Chen et al., 2023). These advanced prompting strate- gies increasingly allow gencral-purpose LLMs to perform complex reasoning over temporal events and abstract relational knowledge, domains that have traditionally been dominated by specialized graph-based architectures (Liang et al., 2023; 2025). Nevertheless, most of these methods primarily optimize point-wise metrics on static validation sets and seldom enforce robustness under semanti- cally preserving paraphrases. Our work explicitly targets this failure mode by formalizing textual sharpness in semantic prompt space and optimizing worst-case performance over a neighborhood.
2.3 SHARPNESS-AWARE MINIMIZATION
Generalization and robustness in deep learning have been linked to the geometry of the loss land- scape, where flat minima often correlate with better generalization (Hochreiter & Schmidhuber, 1997; Keskar et al., 2017). Sharpness-Aware Minimization (SAM) biases solutions toward flatter regions by minimizing loss under worst-case local perturbations (Foret et al., 2021). Subsequent variants extend this idea with scale-invariant updates (ASAM) (Kwon et al., 2021), efficiency- focused or surrogate-gap formulations (Du et al., 2022; Zhuang et al., 2022; Liu et al., 2022b), and friendlyytrustworthy adaptations (Li et al., 2024). Related techniques encourage wide valleys via entropy or averaging (Chaudhari et al., 2017; Izmailov et al., 2019) and adversarial weight per- turbations (Wu et al., 2020). Unlike these methods that operate in continuous parameter space with gradient access, we instantiate an analogous principle in discrete text: we define and measure sharp- ness over a semantic neighborhood of prompts and develop a black-box, derivative-free algorithm that co-optimizes task performance and local flatness.
3 PROBLEM FORMULATION
3.1 PROBLEM SETUP AND NOTATION
We consider black-box large language model and a discrete semantic space of textual prompts. For a supervised task with a training set, the empirical prompt risk is
Cx(p) = D
Σ (E.
{(M(p,))
(I)
3

---

Published as a conference paper at ICLR 2026
When the task is generative or judgment based, evaluator maps model outputs numeric loss {(M(p, a)) v) (M((p,)) y).
(2)
The same definitions apply for validation and test. We focus on robust optimization that accounts for semantic neighborhoods of prompt.
3.2 SEMANTIC NEIGHBORHOODS OF PROMPTS
To make this precise. we endow the prompt space with semantic dissimilarity measure and define the isotropic neighborhood as
(ep) := {p' E P (eea(ppp)) S Piea }.
(3)
In practice, the semantic dissimilarity (p, p') is defined not as scalar vector distance, but semantic judgment performed by high-capability LLM.
Anisotropic neighborhoods. To capture heterogeneous sensitivity across semantic components of prompt. we use anisotropic metric
dus, w, (p. == W, A(p. 11
and the corresponding ellipsoidal neighborhood
Bp (w.) {v' P dani,,, W, (p,v') Mont
3.3 TEXTUAL SHARRPESS AND ROBUST RISK
Building on these neighborhoods, the textual sharpness-aware loss defined as the local worst-case risk over a semantic neighborhood
Cs(p,Pest) = max Lr(p').
(6)
plEBip.Awe)
The corresponding robust optimization problem is
min Ls(p, Pex). pEP
This mirrors the classical SAM perspective by replacing perturbations in parameter space with tex- tual perturbations in a semantic neighborhood. In the discrete prompt setting, neighborhood explo- ration during the inner maximization can be operationalized by treating generator sampler.
4
METHODOLOGY
4.1 OVERVIEW
Accuracy-only prompt search is brittle: small paraphrases rephrasings can flip out- comes, exposing sharp, non-flat regions of the prompt landscape discussed in the introduction. Our aim is to explicitly prefer prompts that remain effective under seaaanically-prseeeviiee perturbations. We operationalize the textual sharpness formalization in Sec. into robust criterion that penalizes local fragility, so that selected prompts demonstrate stability across their semantic neighborhoods. Equivalently, we aim to shrink the textual sharpness gap Sharp (p) defined in Sec. 3.
Motivation.
Design principles. (i) Black-hox, derivative-free optimization compatible with LLM APIs and evaluator oracles; (ii) semantic neighborhoods that preserve task intent while revealing local sharp- ness; (iii) an inner worst-case search to expose adversarial neighbors;
(iv) an outer robust update that chooses candidates improving the max-risk estimate; and (v) lightweight schedules (radius and budget) for stability under limited compute.
Building on Sec. 3, our goal is to minimize the textual sharpness-aware risk by solving
min maX p'EB(p.Ata))
C(p'),
via derivative-free, LLM--riven procedure. In this discrete, black-box setting, we rely on sampling-based inner maximization and validation-driven outer selection. We describe TARE (isotropic) and ATARE (anisotropic) variants that iteratively (i) search adversarial neighbors and (ii) update the prompt to reduce the robust objective.
Alignment to research questions. ing sharpness in semantic prompt space, while our two-stage, derivative-free robust evolution ad-
The neighborhood- based objective instantiates Q1 by defin-

---

Published as a conference paper at ICLR 2026
Textual Sharpness-Awee Aware Evolving
DAO
Adversaria Scurch
(1) Feoiback
(IT)) Outer Robmttnn Updete
Generation
Inpressnont
Demapased Pronge
DAO
DAO
Text
Bsttnggic
Candiiitt Provey
Banck
Uytimtar Worg Noighoer
DAOD AEE
Senswni Chepunout
Dan
Jnctapii Nnightortiood
Masion
DA
Erwhaae
Erehsstrr
DAOO
Decooyood
DAO
R,
Resall
Lan
Feeellud
D.O.
Decline spdaa
updaoe
Pish
Cose
Naiabber
Postah
Evalonte
Componeer
Porwreed
Sevonik
O
O
Adoptive Textual phorpness-Aoe Evalving
Landscape- Aware Textual Optimizer
Systhesiond
@ Senvitiity Extimation
4li) Anisninapic Disinee and Sumplings
DAQ
eist Sullug
Companon
Amiotroppi Nelythonhhoo
Adpuli Marius
Rexsitiit
the Evelees
R
DAO
Chack
Lon
Landscape
Grematrr
Lass
An illustration of proposed TARE framework. (a) The top panel shows the main TARE loop, con- sisting of an Inner Adversarial Search, Feedback Generation, and an Outer Robustness Update. (b) The bottom- left panel details the ATARE mechanism, which uses Sensitivity Estimation to guide an efficient Anisotropic scarch. (c) The bottom-right panel presents the LATO, which perceives the local sharpness to guide updates towards flatter semantic basin.
Figure 2:
dresses Q2 by providing a practical algorithm that co-optimizes task accuracy and local flatness under semantically-prest preserving perturbations.
4.2 TARE: TEXTUAL SHARPNESS-AWAR EVOLVING
Let Pa P be initial prompt. At iteration t = 0, 1, ........ T 1, with radius pt and minibatch B, D: To make our algorithm concrete, we trace a running example for a simple text-based object counting task. Let the initial prompt Pn be:
Initial Prompt: You are helpfua counting assistant. Your task is to count the number of objects. Think step by step and then provide only the final numerical answer.
For given input text, the desired output is a single integer (e.g., "3"), and the loss function L is the output deviates from this format and otherwise.
Inner adversarial search. We sample a candidate set inside the isotropic neighborhood using the generator oracle G:
Cx. (p.( = (pi...., Pk. } Sample(G, Pt, Pe: Ke):
pk. E B(p.,Pt)
We evaluate the empirical loss on B, and pick the worst Es(pe:p)):
Pi
max p'ECK, (pe)
D(p':B.).
max
D(p's B.).
(10)
p'ECK, (ps)
To illustrate this process. consider the isotropic generator G acting Pt. The generator produces perturbations that are semantically preserving, ensuring all candidates p' remain within the defined neighborhood (ps,, Pt). The goal is test for fragility without altering the fundamental task. For example, the set of candidates Ck, (pt) might include:
initial counting prompt
Candidate 1: You are supportive counting assistant. Your job is to tally the number of objects. Consider each step carefully and then give just the final numerical result.
Candidate 2: You are a helpful assistant for counting. Your role is to determine the number of objects. Think through each step and then offer only the final number.
@ Candidate 3: You are useful assistant for counting objects. Your task is to calculate how many objects there are. Reflect on each step and then present only the final numerical answer.
5

---

Published as a conference paper at ICLR 2026
A close analysis reveals that while the phrasing, synonyms ("helpful" - "supportive". "count" - "tally"), "), and sentence structure are altered, the four foundational components of the prompt-persona, persona, task definition, reasoning process, and output format-remain intact across all variations. The algorithm then proceeds to evaluate these candidates to determine any of these seemingly innocuous rephrasings leads to a performance degradation, thereby revealing the prompt's local sharpness and identifying the adversarial worst-case Pi,adv
Outer robustness update. Using an optimizer oracle O, we produce an improvement pool condi- tioned on the current and adversarial prompts with a semantic budget ó; > 0:
..... U. (p.) == Propose(O, pt, Pi 8., M.) ( ((M))
(1I)
In essence, the Propose function is the core step where the optimizer oracle O suggests Me potential improvements by analyzing both the current prompt Pt and its perro--nrooning neighbor ai. The semantic budget ò, restricts edits preserve task intent and local coherence. We then select the next prompt by robust validation over the union of current and proposals:
P++1
arg min p' (Pe)
max qECg (pl)
Elq: B.) with CR (p') Sample(G, p², Pe, K)-
(12)
This greedy selection ensures non-increasing estimate of the robust risk (p Pt) across iterations when the minimizer is attained. Equivalently. it drives down the minibatch estimate of the textual sharpness gap. Intuition and relation SAM: SAM perturbs weights toward the ascent direction and then takes a descent step optimal under that perturbation. TARE mirrors this logic in discrete text: the inner sampling-bast based maximization uncovers the worst paraphrase within (pr. pr), and the outer selection moves toward regions whose neighborhoods are flatter, co-optimizing task performance and robustness.
Schedules and acceptance. Typical schedules include: (i) radius annealing Pt+1 Y Ps with (0, 1] when progress stalls; (ii) semantic budget ô constrained to preserve task intent; and (iii) budgets (K,, Mr, K) chosen to trade off compute and robustness. An iteration accepted based robust validation criterion that evaluates the generalization performance of the worst-cas neighbors. Specifically, the worst neighbors Pi.ad and P1+1,dv are identified on the previous training batch B
and the current training batch B., respectively. Evaluating these worst-case neighbors on a separate validation set is crucial to ensure that any observed robustness is a generalizable property and not merely an artifact of specific training minibatch. The update is therefore accepted only if the new worst neighbor demonstrates superior performance Dvalid:
E(pi+1 aavi Demaa) I E(pi,wi Dema) 7)
(13)
for tolerance 17 2 0; otherwise we increase search budgets or reduce Pt-
From TARE to ATARE. Uniform (isotropic) neighborhoods treat all prompt components equally, yet empirical sensitivity heterogeneous across a prompt's core constraints, methodological guid- ance, and stylistic elements. This uniformity is inefficient; an ideal search strategy should apply cautious, fine-grained perturbations to sensitive components where the landscape is steep, while ex- ploring robust components more broadly where the landscape is flatter. To achieve this nuanced exploration, we introduce an adaptive, anisotropic variant that learns component-win weights to shape the neighborhood accordingly, while jointly adapting the neighborhood size Pt when needed.
4.3 ATARE: ADAPTIVE TEXTUAL SHARPNESS- EVOLVING
The isotropic ball B(p, p) may under/over-explore sensitive components of p. ATARE adapts an ellipsoidal neighborhood via a diagonal weight matrix W,, diag(wr), where w, E Ry scores component-wise sensitivity.
Why anisotropy? Different parts of a prompt contribute unequally to its behavior: core con- straints, methodological guidance, and stylistic elements exhibit heterogeneous sensitivity. For in- stance, in our counting-task example, the persona "You are helpful..." is stylistic element, the instruction to "think step by step" provides methodological guidance, and the rule to "provide only the final numerical answer" is core constraint. An isotropic ball may overshoot sensitive tokens or underexplore robust ones. ATARE learns component-wisg weights to shape an ellipsoidal neighbor- hood, applying finer, more constrained perturbations where the landscape is steep, while allowing for

---

Published as a conference paper at ICLR 2026
broader exploration in more stable regions. This accelerates convergence and reduces over-editing of fragile components.
Sensitivity estimation. Formally, define the sensitivity st, of prompt component j as the worst-case performance degradation caused by its semantic perturbation. For a neighborhood of candidate prompts, this is expressed as:
8t. == max II(p' modifies j) [C(p') 4 p/ec,
(14)
where I(-) indicates whether component j is modified. Crucially, empirical observation reveals that this mathematical sensitivity maps directly semantic roles: modifying Constraints (e.g., output formats) typically triggers immediate task failure (high loss spike, resulting in large St,)), whereas varying Style induces negligible performance shifts (resulting in small 8t,5)- Leveraging this align- ment, we efficiently approximate these sensitivity values by decomposing the prompt into three hierarchical tiers: Constraint, Method, and Style. We then determine the anisotropic weights wty as a monotonic function of sensitivity, reflecting the observed hierarchy:
(15) This assignment reflects the inherent sensitivity. For instance, in our object counting task, a minor paraphrase of the output format rule (a Constraint) often leads to high loss due to parsing fail- ures; consequently, our framework assigns large weight wt, to this component strictly limit its perturbation radius.
Wt.j X 81.jo where SConsmaa >
Methed > Sstyle
Anisotropic distance and sampling. Using Wp. diag(w:). define danl (pe, p/: Wp.) I[W, / (Prr.'))l2 and the ellipsoid
Bp, (p:. pi) (p' dpi Wr.) S pp,} p.)
(16)
Here, a high weight W for a sensitive component penalizes large edits, thus requiring smaller perturbations to stay within the neighborhood. Candidate generation is therefore biased away from sensitive components by sampling edit indices with probability inversely proportional to their sensitivity:
(ededit component j} x (1/wr)) 821.
(17)
This ensures robust components explored broadly while fragile ones are perturbed cautiously. The inner/outer steps then mirror TARE with B replaced by Bp.
This anisotropic sampling process culminates in the generation of complete, holistic prompts where the degree of variation in each component reflects its learned sensitivity. For instance, in our counting-task example's 's candidates below, the low-sensitivity persona is creatively reimag- ined-from a "helpful counting assistant" to a "cheerful counter". In contrast, the high-sensitivity constraint on the output format meticulously preserved: although its phrasing is subtly varied (e.g., "give just the final number" or "present only the final digit answer") "), the core directive to output only a number remains unchanged:
You are friendly counting helper. Your task is to count the objects. through the process step by step and then give just the final number.
Candidate 1:
Work
Candidate 2: You are an assistant designed count things. First reason through the count- ing carefully, then respond with the single final numeric result.
@ Candidate 3: As cheerful counter, your role is to determine how many items there are. Go through your reasoning in order, but the end present only the final digit answer.
4.4 LANDSCAPE-AWARE TEXTUAL OPTIMIZER
The Outer robustness update step relies on an optimizer oracle O to instantiate the Propose function. We operationalize this oracle with potent, landscape-awan implementation, which we term the Landscape-Aware Textual Optimizer (LATO). LATO realizes this step as principled, landscape- guided update, formally defining the Propose function with its full set of inputs:
Mr O (pr. Pi. Elp.: B.), E(pi Bt), Feedback [(pi B.)), }
Propose
(18)
The update mechanism of LATO is designed to enhance robustness directly. Instead of merely correcting errors its current position Pt. LATO analyzes the textual feedback,

---

Published as a conference paper at ICLR 2026
Table 1: Main results across different backbone engines. report accuracy (%) the relative improve- ment over TextGrad. The best and second- best results are highlighted with bold and underline. respectively.
BACKBONE: GPT-40
BACKBONE: Claude Sounet
Dutaset
Model
COT
TEXIGRAD REVOLYE
TARE
ATARE
COT
TEXIGRAD REVOLVE TARE
GPT--3.5
77.9
88.0
89.8
y0.2
91.0gx
77.9
83.8
87.6
90.4
Gemini 1.5 Flosh
83.3
83.5
85.7
82.0
68.5
90.0y1.5
94.4
21.0
Object Countng
Gemini 1.5
94.0ro.0
94.0
94,0g0.0
97.8 18.0
97 97.3
94.0gs.0 9
97.0
97-7po.7
98.0-1.
98.8 9
lams
66.0
68.2
21.0
92
86.0 6
89.5
88.0
90.6
93.5 9
Llama
80.0,a.8
86.8
90 334..
80.0ga.0
82.0
84.3
80.6
98.0
GPT:3.5
73.0
84.0g1.0
87.5
88 15..0:7.
79.0
86.7
84.4
58.0-1.
89.0
1.5 SB
92.0, 0.5
93.0ga.5
94.3
95 2
92.0 p
94.0
94.7y0.9
95.9-1.
95. 7
Temperal Sequences
1.5 Pro
96.00 1.7
97.7
97.7
98.0 y8.0
98 0
96.0
97.0
98.0y1.0
98.5
98.8
Instruct
86.0 9.8
88.3
88.3
10.0
91.0 01.0.2.y
86.0
93.0
89.6
93.7-o.7
94.3
Llams listrrctt
84.0ro.0
84.0
84.5
85.0
88 7-4.7
84.0
91.6
89.2
94.0
94.0ya.5
GPT-3.5
02.0
60.3
65.7
72. (s.7
69.0 09.0/2.7
02.0,13.0
75.0
72.2
77.0,2.0
77. 77.0,2.0
Gemini 1.5 Ulasa 8B
82.0
80.0
22.5
68.6
93. 71..7
82.0gs.3
87.3
89.9
91.3-..
94.0
Tracking Shufflal Objorts
Gemini 1.5 Pro
99. Oyo.0
90.0
99.0
09.0 00.00..o
00 00.0
09.0gp.o
99.0
09.0
99.0ra.o
00.0
Lluma. 3.1 8B Instruct
82.0
86.3
83.7.2.4
90.0
93.5
82.0gpus
81.2
79.4.2.0
21.2
93.0
Llama Instruct
50.0,
55.5
j2.7
57.5
67.5 7-17.12
50.0,14.5
64.5
66.8
72.3
a 78. 78.5,14.0
GPT--3.5
72.9
80.9
82.1
83.0 03.0
52.3
72.9
81.1
80.1.1.
88.7
A8.
Genini 1.5 Flash 88
88.6
89.6
89.4 29.4
90.1
ro.s
88.6
88.7
88.9
80.6..
80.7
GSMBK
Gemini 1.5 Pro
92.9
93.3
93.0
95 8
Dd 1.4
02.9
95.3
95.37o o 96.1
05.5
I lams 3.1 8R Instruct
84.9
84.9
84.9
66.2
80 60.4.3.5
84.9
86.2
86.4
86.0
87. (1.5
Clama 3 Instruct
8.1.8ro.o
$1.8
81.8
8118
61.87a.0
81.87o.0
81.8
81.87o.0
81.8ro.
$1. $1.8
Feedback (C(pt.aau B.)). which is derived from the point of highest local loss. It then applies this insight to refine Pt. This process preemptively addresses the sharpest vulnerabilities in the prompt's immediate semantic neighborhood. By learning from the failure modes of its neighbors, the opti- mizer guides p. become inherently more robust against similar types of semantic perturbations in the future.
This approach is powerful because LATO is, by construction, landscape-aware. By processing the two distinct prompt-loss pairs, (pt, E(p;; B,)) and (Pi.adv C(pi B,)), it directly perceives the lo- cal sharpness of the semantic landscape. This awareness of the landscape's geometry the steepness of the loss increase from pt to Pi and this empirically found worst-case direction-allows LATO to modulate its optimization strategy. It makes more informed decisions about both the direction and magnitude of the required edits, steering the prompt trajectory towards a demonstrably "flatter" and more stable semantic basin.
To illustrate this mechanism concretely, consider an object counting task. A candidate prompt "Count the items below" might exhibit high accuracy but fail significantly when paraphrased to other prompts, revealing sharp, brittle peak (large loss gap). LATO detects this instability and steers optimization away from it. In contrast, prompt like "List the items one by one and count them" " maintains high performance across its semantic neighborhood, indicating a robust, flat basin. Unlike standard optimizers that might greedily prefer the former for its brevity or marginal point- wise advantage, LATO leverages this landscape information to correctly converge on the robust solution.
Operationally, LATO is instantiated using a powerful LLM as the core of the optimizer oracle OLATO- The update process can be expressed as the LLM generating a new prompt based on a structured meta-prompt, LLXTO, which contains all the landscape information:
(19) Here, ILAAO represents a meta-prompt template that synthesizes all the landscape-aware inputs from Equation (18) into a coherent, actionable instruction. The semantic budget ò, acts crucial constraint, ensuring that the edits proposed by the LLM remain coherent and preserve the core intent of the task. The L.LM then executes this instruction generate an improved candidate prompt
n LLM [TLAAT (pe.P..a.. Z(pe B.), C(pi. B.). Feedback (C B.)).
8

---

Published as a conference paper at ICLR 2026
g which forms element of the proposal set Propose, effectively acting reasoning engine optimization step.
that performs a
EXPERIMENTS
We comprehensively evaluate our proposed methods, TARE and ATARE, through four axes: Q1 (Su- periority), Q2 (Effectiveness), Q3 (Resilience), and Q4 (Sensitivity). The answers of Q1-Q3 are illustrated in Sec. 5.2-Sec. 5.4, and sensitivity analysis (Q4) can be found in the Appendix C.
5.1 EXPERIMENTAL SETUP
Tasks and Datasets. We evaluate methods four challenging reasoning tasks: three from the Big Bench Hard benchmark (Suzgun et al., 2022: Srivastava et al., ing. Temporal Sequences, and Tracking Shuffled Objects (Five Objects)-and the GSM8K dataset (Cobbe et al., 2021). For evaluation, our primary metric is Accuracy (Acc), measured by strict string-based exact match on the final numerical answer (Yuksekgonul al., 2024). Further details on datasets and implementation are provided in Appendix A.
Count-
LLM Backends. Our experiments are conducted on diverse set of five LLM backends: GPT- 3.5-turbo-0125, Gemini 1.5 Flash 8B. Gemini 1.5 Pro, Llama 3.1 8B Instruct, and Llama 3 8B Instruct. To ensure a fair and controlled comparison, the optimizer and evaluator oracles for all methods are powered by two universal backbones: GPT-4o and Claude 3.5 Sonnet.
Counterparts. We compare our methods, TARE and ATARE, against three key baselines: Zero-shot -f Thought (CoT) (Kojima et al., 2023; Wei et al., 2023), TextGrad (Yuksekgonul et al., 2024), and Revolve (Zhang al., 2025).
5.2 SUPERIORITY
To answer Q1, present the main prompt optimization results Tab. 1. We summa- rize our key observations as follows (Obs.):
TARE
ATARE
Obs. Our proposed methods, TARE and ATARE, consistently achieve state-of-the-art performance, outperforming all baselines, in- cluding TextGrad and Revolve, across nearly all evaluated tasks and LLM backbones. This significant performance gap stems from a fun- damental difference in optimization objectives. While baselines are designed to maximize point-wise accuracy, our framework explic- itly seeks robust solutions by optimizing for the worst-case performance within a semantic neighborhood, leading to more generalizable and effective prompts. Obs. @ ATARE consistently demonstrates performance advantage fit of its adaptive, anisotropic search mechanism, which intelligently perturbs prompt components based on their learned sensitivity. This more nuanced search strategy consistently discovers su- perior solutions within the prompt landscape. Obs. @ The framework's superiority shows broad universality, with substantial performance gains observed across diverse architectures, including proprietary models like GPT-3.5 and Gemini 1.5 Pro, as well as open-source models like the Llama Instruct series. This confirms that our sharpness-awes aware approach is model-agnostic and widely applicable solution for robust prompt optimization.
Performance
Ablation Conditions
Ablation study of the key compo- nents: the Inner Adversarial Search, the LATO, and the Robust Validation. For an in-depth analy- sis, please refer to Sec. 5.3.
Figure 3:
TARE in most scenarios. This underscores the bene-
5.3 EFFECTIVENESS
To address Q2, we conducted an ablation study on the key mechanisms of our framework using the Llama 3.1 8B Instruct model, with results shown in Figure 3. The chart clearly shows that the full TARE and ATARE frameworks perform best, and removing any of their core components leads to significant drop in performance. Specifically, the Inner Adversarial Search is essential for

---

Published as a conference paper at ICLR 2026
(>) Object Counting
Temporal Sequences
Tracking Shufiled Objects
(d)
Figure 4: Resilience analysis of TARE and ATARE under oracle degradation, where the powerful
GPT-4o oracles are replaced with a weaker Llama 3.1 8B model. For an in-depth analysis, please
refer to Sec. 5.4.
100
100
100
100
Perfermente (36)
Dedfrrmeee (56)
Perforance
50
50
50
60
70 Budget
Stow
Bustged
(b) TARE vs. & Figure 5: Sensitivity analysis of TARE and ATARE with respect to the inner adversarial search budget (K₂) and the outer robust validation budget (K). For an in-depth analysis, please refer to Ap- pendix C.
(a) TARE vs. K.
(c) ATARE vs. Kr
(d) ATARE vs.
finding challenging perturbations, the LATO optimizer uses landscape information to make smarter updates, and the Robust Validation criterion ensures that improvements generalize well. Finally, the consistent superiority of ATARE over TARE (detailed in Tab. 1) serves as a direct ablation for the Anisotropic Search, confirming the benefits of an adaptive strategy. When these components work together, the framework reaches its peak effectiveness, validating our design choices.
5.4 RESILIENCE
To assess the resilience of our framework (Q3), we evaluate its performance under two challenging conditions: (i) degrading its powerful GPT-4o oracles by separately replacing the Generator and the Optimizer with a weaker Llama 3.1 8B model, and (ii) drastically reducing the search budgets for the inner adversarial search K, and outer robust validation K. The results, illustrated in Fig- ure 4 and Figure 5, demonstrate the framework's remarkable stability. As shown in Figure 4, even when individual core oracles are weakened, the performance degradation is remarkably graceful. With the exception of the Optimizer degradation racy drop across all other conditions is consistently maintained within a 5% margin. Similarly, as shown in our sensitivity analysis (Figure 5), when the perturbation budgets (K,, K) are reduced to minimal value of 2, the framework's performance remains highly stable, exhibiting only minor decrease relative to its performance at budget of 3. This dual resilience proves that our sharpness- aware approach is robust to component degradation and computationally efficient, main- taining strong performance even under such challenging conditions.
the Tracking Shuffled Objects task, the aceu-
6 CONCLUSION
Reliable prompt optimization begins with naming the right failure mode. Our work identifies and formalizes the overlooked problem of textual sharpness-the tendency of a prompt to collapse under semantically equivalent paraphrases-and reframes prompt optimization from chasing point-wise accuracy to seeking neighborhood-stable solutions. We instantiate this perspective with TARE, a black-box, derivative-free procedure that adversarially probes semantic neighborhood and selects candidates by their worst-case minibatch performance, and with ATARE, which learns anisotropic weights and adaptively schedules the neighborhood radius balance exploration and fidelity. Both variants are API-only and gradient-free; the adaptive version adds only linear overhead in the num- ber of semantic components while enforcing a fixed-margin decrease per accepted step. Across diverse tasks, TARE and ATARE consistently reduce the textual sharpness gap and preserve accuracy under paraphrasing, surpassing accuracy-only baselines while remaining computationally practical. Looking ahead, tool-augmented settings, to design task-aw aaakeware semantic neighborhoods and edit families, and to deepen theory connecting textual sharpness with generalization in real-world LLM systems.
opportunities to extend textual sharpness aware evolution to multi-tur and
10

---

Published as a conference paper at ICLR 2026
REPRODUCIBILITY
To facilitate the reproducibility of our findings, we will release the source code for our TARE and ATARE framework upon publication, accessible via an anonymous GitHub link. All experimental settings, including key hyperparameters for the optimization process, are detailed in Appendix A.3. All prompts used to generate the experimental data are provided in Appendix E. Our experiments were conducted on server equipped with 8 NVIDIA GeForce RTX 3090 GPUs.
LLM USAGE
We acknowledge the use of Google's Gemini 2.5 Pro writing assistant in the preparation of this manuscript. Its role was confined to improving the clarity and readability of the text, offering suggestions for grammatical corrections, and refining the structure of captions for figures and tables.
The model's contributions were strictly limited to surface-level text and formatting; it was not used for research ideation, experimental design, implementation, data analysis, writing the core tech- nical content. All outputs from the model were critically reviewed, edited, and approved by the authors, who bear full responsibility for the final manuscript.
ETHICS AND SOCIETY IMPACT
The focus of this research is a new methodology for making prompts for L.LMs more robust. As purely algorithmic study, it does not involve human participants, the collection of private data, di- rect deployment in sensitive, real-world scenarios. Our contributions are limited to the optimization algorithm itself, and we do not introduce new data that could present risks related to privacy bias. We acknowledge that more capable language models can have a broad societal impact. However, our work is intended for academic purposes and is demonstrated on established reasoning benchmarks, not on applications involving potential misuse or deception. In summary, this research presents no direct ethical risks and aligns with the principles of creating trustworthy and transparent AI.
REFERENCES
Tom Brown, Benjamin Mann, Nick Ryder, et Language models are few-shot learners, 2020.
URL https::/ http:///axxvvvoo org. wttp:///g/.......////////// 14165.
Pratik Chaudhari al. Entropy-sgd: Biasing gradient descent into wide valleys, 2017. URL
https: /tas:///axiiv wwtp/oo/gg/ooooooeeeeoo 01838.
Wenhu Chen et al. Program of thoughts prompting: Disentangling computation from reasoning for numerical reasoning tasks, 2023. URL http:///////w.ooooooaa////////// 22211111. 12588.
Aakanksha Chowdhery, Sharan Narang, Jacob Devlin, et al. Palm: Scaling language modeling with pathways, 2022. URL
02311.
Hyung Won Chung et al. Scaling instruction-finetune language models, 2022. URL https: 11416.
/ //arxiv.org/abs//////
Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano. Christopher Hesse, and John Schulman. Training verifiers to solve math word problems, 2021. URL
org/ abs//b//// 22100.1...0 14168.
Mingkai Deng, Jianyu Wang, Cheng-Ping Hsieh, Yihan Wang, Han Guo, Tianmin Shu, Meng Song, Eric P. Xing, and Zhiting Hu. RIprompt: Optimizing discrete prompts with reinforcement learning, 2022. URL https: ht/aa.ivvv./// org/ abs//2000 12548.
Jiawei Du, Hanshu Yan, Jiashi Feng, Joey Tianyi Zhou, Liangli Zhen, Rick Siow Mong Goh, and Vincent Y. Tan. Efficient sharpness-award minimization for improved training of neural net- works, 2022. URL htw.s: //tpx//aa/////////////////// www. 221pg//abs//0./0//// 01..1........

---

Published as a conference paper at ICLR 2026
Chrisantha Fernando, Dylan Banarse, Henryk Michalewski, Simon Osindero, and Tim Rockt"aschi Promptbreeder: Self-referential self eof-immpoveeent via prompt evolution, 2023. URL htttps://azxiv...t http://bb//3399.1///
Pierre Foret, Ariel Kleiner, Hossein Mobahi, and Behnam Neyshabur. Sharpness-aware minimiza- tion for efficiently improving generalization, 2021.
01412.
Aaron Grattafiori et al. The Ilama herd of models, 2024. URL 2407. 21783.
Qingyan Guo et al. Connecting large language models with evolutionary algorithms yields powerful prompt optimizers, 2023. URL https://arxiv.orgg/
/2099. 08532.
Dan Hendrycks, Collin Burn,, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Ja- cob Steinhardt. Measuring massive multitask language understanding. 2021. URL https: / wwwpxiiwrrg/ab//////
03300.
Sepp Hochreiter and J'urgen Schmidhuber. Flat minima. Neural Computation, 9(1):1 1997.
Or Honovich al. Instruction induction: From few examples to natural language task descriptions, 2022. URL https:///aaaaeee wwwp:/ii.ooooooooooee..eeeoooeee org.oog/////ooooo abs /2005 10782.
Edward Hu et Lora: Low-rank adaptation of large language models, 2021. URL https:
//arxiv. org. abs/ 0296..66666........
Pavel Izmailov al. Averaging weights leads to wider optima and better generalization, 2019. URL B03. 00507..
httts:///arivv http://wwwwvvvra.a///a////
Albert Q. Jiang et al. Mistral 7b, 2023. URL https: httpss//aaa.....o//aab//////////
Albert Q. Jiang et al. Mixtral of experts, 2024. URL https: ULL/ttpss///aabbrrrrr//////// 04088.
Yiqiao Jin, Qinlin Zhao, Yiyang Wang, Hao Chen, Kaijie Zhu, Yijia Xiao, and Jindong Wang. Agentreview: Exploring peer review dynamics with Ilm agents. In EMNLP, pp. 1208-1226, 2024.
Nitish Shirish Keskar et al. On large-batch training for deep learning: Generalization gap and sharp minima, 2017. URL https: http://aavvvvoo////o. wwwpvv.oo/r/aaooooooooooooo aas///b///// / 609 04836.
Omar Khattab et al. Dspy: Compiling declarative language model calls into self-improving pipelines, 2023. URL https: //tp:///////iii////a///a//aa http:/aawwv...og/abaaa/aa opggabs//aaaaaaao/ 03714.
Takeshi Kojima, Shixiang Shane Gu, Machel Reid, Yutaka Matsuo, and Yusuke Iwasawa. Large language models are zero-shot reasoners, 2023. URL httpt::///// //tp:////vvvv////e wwtp:/orggg/a//aa/ee/ee 1191 1.
Jungmin Kwon, Jeongseop Kim, Hyunseo Park, and In Kwon Choi. Asam: Adaptive sharpness- aware minimization for invee-invrrantt learning of deep neural networks. Marina Meila and Tong Zhang (eds.), Proceedings of the 38th International Conference on Machine Learning, vol- ume 139 of Proceedings of Machine Learning Research, pp. 5905-5914. PMLR, 18-24 Jul 2021. URL https: http:/ptccecccceee
mlr. prwsspess//ee..p.. / v1 htt11///wwe/ https/////1//////1///// kww.//wollbbb...............bbbm html.
H.Y. Leong and Y. Wu. Why should next-gen I1m multi-agen, systems move beyond fixed archi- tectures to dynamic, input-driven graphs? SSRN Electronic Journal, 2024. doi: 10.2139/ssm. 5276004. URL https: ssrn. com/ abstract=527600+
Brian Lester, Rami Al-Rfou, and Noah Constant. The power of scale for parameter-efficient prompt tuning, 2021. URL https:/ arxiv. org. als 2204. 08691.
Tao et al. Friendly sharpness- aware minimization, 2024. URL https: /tta/aaxvvvvrreee/eee abs/ 2403. 12350.
12

---

Published as a conference paper at ICLR 2026
Xiang Lisa Li and Percy Liang. Prefix-tuning: Optimizing continuous prompts for generation, 2021. URL //rxiv.///iivv.//a org/ abs/ 2tss/2100 210111111.000 00190.
Ke Liang, Lingyuan Meng, Meng Liu, Yue Liu, Wenxuan Tu, Siwei Wang, Sihang Zhou, and Xin- wang Liu. Learn from relational correlations and periodic events for temporal knowledge graph reasoning. In Proceedings of the 46th international ACM SIGIR conference research and development in information retrieval, pp. 1559-1568, 2023.
Ke Liang, Lingyuan Meng, Hao Li, Jun Wang, Long Lan, Miaomiao Li, Xinwang Liu, and Huaimin Wang. From concrete to abstract: multi-view clustering on relational knowledge. IEEE Transac- fions Pattern Analysis and Machine Intelligence, 2025.
Xiao Liu et al. P-tuning v2: Prompt tuning can be comparable to fine-tuning universally across scales and tasks, 2022a. URL https:://///.. //riii/...iiv.ov/oa orggabs/2110 07602.
Yong Liu et Towards efficient and scalable sharpness-aware minimization, 2022b. URL https: //taxxvv.rgg////eeel.//
2203.027222 02714.
Sejoon Oh, Yiqiao Jin, Megha Sharma, Donghyun Kim, Eric Ma, Gaurav Verma, and Srijan Kumar. Uniguard: Towards universal safety guardrails for jailbreak attacks on multimodal large language models. arXiv:2411.01703. 2024.
OpenAI. Gpt-4 technical report, 2023. URL UBLLAttps.//arr3r.rr///a/////
Long Ouyang, Jeff Wu, Xu Jiang, Diogo Almeida, Carroll L.. Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, John Schulman, Jacob Hilton, Fraser Kel- ton, Luke Miller, Maddie Simens, Amanda Askell, Peter Welinder, Paul Christiano, Jan Leike, and Ryan Lowe. Training language models follow instructions with human feedback, 2022. URL https: / htt.xxxxvvorrg/ /bs//2033332 02155.
Reid Pryzant et Automatic prompt optimization with "gradient descent" and beam search, 2023.
URL https: /ttpss///axvvvvvv abs 2305. 03495.
Rafael Rafailov et al. Direct preference optimization: Your language model is secretly a reward model, 2024. URL /ettps://arxiv.oo
abs/2305. 11220.18899.. 18290.
David Rein, Betty Li Hou, Asa Cooper Stickland, Jackson Petty, Richard Yuanzhe Pang, Julien Dirani, Julian Michael, and Samuel R. Bowman. Gpqa: A graduate-level google-proot qa bench- mark, 2023. URL https: arxiv. org/ abs/2311111 12022.
Taylor Shin, Yasaman Razeghi, Robert L. Logan IV, Eric Wallace, and Sameer Singh. Autoprompt: Eliciting knowledge from language models with automatically generated prompts, 2020. URL
wttp://///b/..ooooo.ooo/ 15980.
Aarohi Srivastava, Abhinav Rastogi, Abhishek Rao, et al. Beyond the imitation game: Quantifying and extrapolating the capabilities of language models, 2023. URL httts://aarivv.or abs/ /ats/2206.. 04615.
Mirac Suzgun, Nathan Scales, Nathanael Schärli, Sebastian Gehrmann, Yi Tay, Hyung Won Chung, Aakanksha Chowdhery, Quoe V. Le, Ed H. Chi, Denny Zhou, and Jason Wei. Challenging big- bench tasks and whether chain-of-thougee can solve them, 2022. URL https:////// pettts://arxttt /ttp/vaxvvv..//////.e//..a org/ abs/22100 09261.
Xiangru Tang. Zhuoyun Yu, Jiapeng Chen, Yan Cui, Daniel Shao, Weixu Wang, Fang Wu, Yuchen Zhuang, Wenqi Shi, Zhi Huang. et al. Cellforge: agentic design virtual cell models. arXiv preprint arXiv:2508.022: 2025.
Hugo Touvron, Louis Martin, Kevin Stone, et al. Llama 2: Open foundation and fine-tuned chat models, 2023. URL htRpst:p:: / org/ abs /2302 /20//.22000022 09288.
Xuezhi Wang et al. Self-consistency improves chain of thought reasoning in language models, 2023a. URL
abt//bb///200 11171.
13

---

Published as a conference paper at ICLR 2026
Yiyang Wang, Chen Chen, Tica Lin, Vishnu Raj. Josh Kimball, Alex Cabral, and Josiah Hester. Companioncast: A multi-agent conversational ai framework with spatial audio for social co- viewing experiences. arXiv:2512.10918, 2025.
Yiyang Wang. Yiqiao Jin, Alex Cabral, and Josiah Hester. Mascot: Towards multi-agent socio- collaborative companion systems. arXiv:2601.1423) 14230, 2026.
Yizhong Wang et al. Self-instruct: Aligning language models with self- instructions, 2023b. URL https:://aaate org/ abs 2212. 10560.
Jason Wei et al. Chain-of-thought prompting elicits reasoning in large language models, 2023. URL
https: http://axvvvvr...r.. 2201 11903.
Dongxian Wu al.
Adversarial weight perturbation helps robust generalization, 2020. URL
Shunyu Yao et al.
React: Synergizing reasoning and acting in language models, 2023a. URL
https: httpss//aaxxiv.or//aaaao 2ttp://aabb2221.322222.
Shunyu Yao et al. Tree of thoughts: Deliberate problem solving with large language models, 2023b.
URL htttt:///axiii
htt//bbs/23300 2060.
10601.
Mert Yuksekgonul al. Textgrad: Automatic "differentiation" via text, 2024. URL https: / //taxxi.orgg///e.....//o. http://rr/abbb/20..0rr0 07446.
Peiyan Zhang et al. Revolve: Optimizing ai systems by tracking response evolution in textual optimization, 2025. URL httpt:ttt:///aat www.vorrg/aaoe httg//bs/24222 03092.
Yongchao Zhou, Andrei loan Muresanu, Ziwen Han, Keiran Paster, Silviu Pitis, Harris Chan, and Jimmy Ba. Large language models human-level prompt engineers, 2023. URL https:
//arxiv. wwwxiv.org/aba. attaaabssllllaaaaaaaaaaaaaaaaaaa
Juntang Zhuang, Boqing Gong, Liangzhe Yuan, Yin Cui, Hartwig Adam, Nicha Dvomek, Sekhar Tatikonda, James Duncan, and Ting Liu. Surrogate gap minimization improves sharpness-aware training, 2022. URL https: / //axxvv..../. org/ abs /2033. 08065.
14

---

Published as a conference paper at ICLR 2026
A EXPERIMENTAL DETAILS
A.1 DATASET DETAILS
To assess the effectiveness of our framework, we conduct experiments on four diverse and challeng- ing reasoning tasks. Consistent with prior work (Yuksekgonul et al., 2024), the evaluation metric is string-based exact match accuracy. A detailed description provided below:
BIG-Bench Hard Tasks (Suzgun et al., 2022; Srivastava al., 2023), BIG-Bench Hard is a suite of 23 challenging tasks from the BIG-Bench benchmark, specifically selected because prior language models had failed to outperform the average human-rater on them. These tasks often require multi-step reasoning, making them suitable for evaluating advanced model capabilities. From this benchmark, we select three distinct tasks:
Object Counting:
Given a list of items and their quantities, the task is to determine the total number of items belonging
specific category.
Temporal Sequences: Given series of events and activities person has completed, the task to determine a time they might have been free for another activity.
-Tracking Shuffled Objects (Five Objects): Given the initial positions of several objects and series of pairwise swaps, the task is to determine the final position of each object.
For the Object Counting task, we adopt the data split of 50 training, 100 validation, and 100 test samples from TextGrad (Yuksekgonul al., 2024). For Temporal Sequences and Tracking Shuffled Objects (Five Objects), we follow an identical splitting methodology.
GSM8K (Cobbe et al., 2021). To further assess mathematical reasoning, we use this widely-used sende-school math word problems that require multi-step reasoning. For this task, we adopt the dataset splits provided by DSPy (Khattab et al., 2023), which include 200 training, 300 validation, and 1319 test samples.
benchmark consisting
A.2 COUNTERPART DETAILS
This section provides an overview of the baseline approaches employed our study for comparison.
Zero-shot Chain-of-Thoughee (CoT) (Kojima et al., 2023; Wei et al., 2023). A foundational baseline that elicits multi-step reasoning by prompting the model with instructions like "TTink step-by-step" before it provides a final answer.
TextGrad (Yuksekgonul al., 2024). first-order optimization method that treats natural lan- guage feedback from an evaluator L.MM as a "textual gradient" to iteratively refine variables based on immediate, local feedback.
Revolve (Zhang al., 2025). An optimization method that extends first-order techniques by tracking how system responses evolve across iterations. By incorporating this historical context, Revolve aims for more stable optimization and to escape the local optima that can trap methods relying single-step feedback.
A.3 IMPLEMENTATION DETAILS
Our experiments are conducted on a diverse set of five LLM backends: GPT-3.5-turbo-0125 Gem- ini 1.5 Flash 8B, Gemini 1.5 Pro, Llama 3.1 8B Instruct, and Llama 3 8B Instruct. To ensure fair and controlled comparison, our setup relies on universal backbone engine for three key roles: generators, optimizers, and evaluators. For these backbone roles, we employ two powerful models: GPT-4o and Claude 3.5 Sonnet.
For iterative methods, we follow the experimental setup in Revolve (Zhang et al., 2025), using batch size of 3 across 12 optimization iterations, processing total of 36 training examples. For our sharpness- aware methods, we set the key search budgets to K, = 3 (inner adversarial search), Mc = (proposal pool size), and K = (outer robust validation). For LLM generation, our configuration largely mirrors that of Revolve (Zhang et al., 2025): allow maximum of 2000 new tokens and use a top-p value of 0.99. To ensure maximum reproducibility, we set the decoding temperature to 0 for all models.
15

---

Published as a conference paper at ICLR 2026
B COMPLEXITY AND PRACTICAL NOTES
Beyond asymptotic cost, the design rationale that the inner loop diagnoses textual sharpness while the outer loop enforces progress the robust objective; radius annealing preserves semantics, and acceptance tests prevent regressions. The framework is modular: 9 (candidate generators), O (opti- mizers), and evaluators & can be swapped without changing the principle. The choice of can be guided by paraphrase detection or embedding-simillat
thresholds to maintain semantic fidelity.
Each iteration evaluates K, adversarial and (Me + 1) robust losses on a minibatch, totaling O((K, + (Mr + 1) [B.]) calls to . and &, ATARE adds an ((m) overhead for weight updates and negligible cost for adaptive radius updates. In practice: (i) reuse evaluations across inner/outer loops: (ii) maintain replay buffer of high-loss neighbors to warm-start future inner maximizations; and (iii) set Pt to preserve semantic intent while revealing sharp regions.
C SENSITIVITY
To address Q4, we perform sensitivity analysis on the two key search budget hyperparameters of our framework: the inner adversarial search budget K2 and the outer robust validation budget K. As illustrated in Figure we evaluate the performance TARE and ATARE on the Llama 3.1 8B model, using GPT-4o the backbone engine, by systematically varying one budget within the range of [I, 8] while keeping the other fixed at a moderate value of 3. The results indicate that our framework not highly sensitive the precise choice of these parameters. Performance generally improves as the budgets increase from I to and then stabilizes, exhibiting only minor fluctuations for values up to 8. This demonstrates that our methods achieve strong, robust performance without requiring extensive hyperparameter tuning, as relatively small budget (e.g., K, K 3) is sufficient to capture the benefits of our sharpness-aware approach.
D SOLUTION OPTIMIZATION
While the core of our work focuses on prompt optimization, the principles of our framework can be extended other complex textual domains. A critical application is Solution Optimization, which involves the iterative refinement of multi-step reasoning chains. Unlike prompts, solutions highly structured and logically interlocked, presenting unique challenges that require a tailored approach.
D.1 APPLYING ATARE TO FRAGILE REASONING CHAINS
A key characteristic of a solution is its inherent fragility. A solution is not merely collection of sentences; a delicate, logically-interlocked chain of reasoning where each step builds upon the previous one. A minor alteration to early, correct step invalidate the entire downstream logic. This fragility renders isotropic perturbation methods like TARE ineffective, as uniform paraphrasing would inevitably disrupt the "correct reasoning backbone," creating noisy and uninformative loss landscape.
This very structure- stable, correct reasoning backbone combined with specific, identifiable flaw-makes the problem of solution optimization an ideal application for the ATARE framework. ATARE is fundamentally designed to handle textual components with varying degrees of sensitivity. The logical chain of solution presents a natural, clear-cut case of anisotropic sensitivity, making ATARE not just a possible tool, but a perfectly suited one.
Our approach applies the core components of the ATARE lifecycle to this problem as follows:
1. Semantic Sensitivity Analysis and Anisotropic Neighborhood Definition. The first step in the ATARE lifecycle is sensitivity analysis. We implement this by performing comprehensive mantic diagnosis of the entire incorrect solution identify the single, core "cognitive trap." This diagnosis effectively partitions the solution into two distinct regions of sensitivity:
16

---

Published as a conference paper at ICLR 2026
Low-Sensitivity Region:
The identified logical flaw itself. This part is considered the pri- mary target for perturbation. The rationale is that a single type of logical error can manifest in many different, deceptive forms. All solutions that commit the same conceptual error, regardless of phrasing, are considered to be within the same anisotropic semantic neighborhood.
High-Sensitivity Region: The entire chain of correct reasoning that precedes the flaw. This logical backbone is treated immutable to maintain the solution's structural integrity.
2. Inner Adversarial Search. With the sensitivity regions defined, we conduct an inner adver- sarial search within this highly constrained neighborhood. To formalize this, let 8t be the original incorrect solution given iteration t. We represent sensitivity correct backbone, denoted St.comect and its low-sensitivity flaw, denoted Sr,ftaw The set of candidate solutions, Cx, (st), is then generated by keeping the backbone fixed while using gen- erator perturb only the flaw component. This process creates of K, candidates, defined as:
composition of two parts: its high-
Cx, (st) == { (st,comest @ (st.taw)] Ke
(20)
where the correct backbone st.cerect is held fixed, Gnaw is the generator responsible for creating variations the flaw, the superscript (v) indexes each of the Ke unique generation events, and the symbol @ denotes the composition of the text segments. This process explores the defined semantic neighborhood find the variations that perform the worst on the task.
3. Outer Robustness Update. From the generated of flaw variations, identify the "worst- case" neighbor Ladd. The textual feedback derived from critiquing this worst-case scenario is then used to update the original solution 8t- By learning from the most challenging manifestation of its own core error, the solution is guided to patch this specific cognitive vulnerability. This directly im- plements the outer robustness update step of ATARE, optimizing for worst-case performance within the semantic neighborhood guide the solution toward a flatter, more robust basin in the semantic landscape.
D.2 EXPERIMENTS
Tasks and Datasets. We evaluate our solution optimization approach on two challenging bench- marks where model performance has not yet saturated.
GPQA (Rein al., 2023): The Google-proot Question Answering benchmark consists of expert- level multiple-choice questions in physies, biology, and chemistry. Its difficulty is highlighted by the performance gap between experts (81% accuracy) and skilled non-experts (22%).
MMLU (Hendrycks al., 2021): We the challenging College Physics subset from the Mas- sive Multitask Language Understanding benchmark, which designed to measure human-level performance.
We follow the experimental setup of Revolve (Zhang et al., 2025) for iterative methods: perform three iterations of optimization for each question and determine the final answer by majority voting. Consistent with prior work (Yuksekgonul et al., 2024), the evaluation metric is string-based exact match accuracy.
LLM Backends and Counterparts. We apply all methods on three distinct LLMs: GPT-40, Llama 3.1 8B Instruct, and Qwen 2.5 7B Instruct. We compare our ATARE-basce method against three primary baselines: Zero-shot Chain-of-Thought (CoT) (Kojima et al., 2023), TextGrad (Yuksekgonul et al., 2024), and Revolve (Zhang al., 2025).
Results and Analysis. The performance of our method against the baselines is presented in Ta- ble 2. As shown, our ATARE-based approach consistently outperforms all baselines-Coff TexIGrad, and Revolve-across both datasets and all evaluated LLM backends. This strong and universal im- provement validates our central hypothesis: for fragile, oogically-interlockee anisotropic optimization strategy superior. While first-order methods like TextGrad can some- times struggle with the delicate structure of solutions, and even advanced methods like Revolve may not always escape local optima, our approach demonstrates
reasoning chains, an
robust path to improvement.
17

---

Published as a conference paper at ICLR 2026
Table 2:
Results of solution optimization. report accuracy (%) and the relative improvement over Textgrad. The best and second-best results are highlighted with bold and underline. respectively.
Dataset
Model
COT
TEXTGRAD
REVOLVE
ATARE
GPT-40
48.5 48.5.4.0
52.5
49.5
f
GPQA
Llama Instruct
27.8,3.0
30.8
30.8,0.0
33.8r3.0
Qwen 2.5 7B Instruct
35.9
37.4
37.4 20.0
39.9
GPT-4o
91.0
93.5
94.1 10.6
96. 96.1,2.e
MMLU (College Physics)
Llama 3.1 8B Instruct
69.6+0.0
69.6
70.6 11.0
72.5
Qwen Instruct
78.4 78.4.0.0
78.4
78.4
79.4
By precisely targeting only the low-sensitivity "flaw region" for perturbation while preserving the high-sensitivity correct reasoning, our approach provides stable and effective optimization signal, consistently guiding the solution toward more correct state.
E PROMPT DETAILS
This section provides the detailed architecture of the core prompts that power our optimization framework. We present the prompts for the main components of our framework the perturba- tion generators for TARE and ATARE, and the LATO as well as the prompts used for the Solution Optimization task.
E.1 TARE PERTURBATION GENERATOR PROMPT
This prompt directs the TARE perturbation generator to conduct the isotropic neighborhood search required by framework. It instructs powerful LLM to create semanticall--equivaeern variations of given text. The key to this process is the explicit goal of finding weaknesses; the prompt directs the generator to explore potentially worse-performing vari- ations. This serves as the inner adversarial search, designed to identify sharp cliffs in the semantic landscape where the system's performance brittle.
of minimally-altered.
TARE Perturbation Generator Prompt
You expert in semantics and creative writing. Your task is generate {k) slightly different versions of the following text. These perturbed versions must adhere these rules:
1. Maintain Core Intent: The core intent and theme of the original text must be preserved.
2. Small Degree of Perturbation: The changes should be minor. For example, you can replace few con-essential words, make small adjustments to sentence structure, add/remove few descriptive words.
3. Preserve Factual Correctness: Do not introduce irrelevant information or factual errors.
Explore Vulnerabilities: The goal is to explore closely related, but potentially worse- performing, variations of the text.
Input Text 'system prompt text"
Output Format
The output should a Python-style list of strings, with each string being perturbed version.
Now, provide the (k) perturbed versions for original text.
E.2
ATARE PERTURBATION PROMPT
The ATARE prompt architecture implements our framework's 's anisotropic search. It operates as two-step "analyze-then-ggneraa""" chain. The first prompt performs Semantic Sensitivity Estimation,
18

---

Published as a conference paper at ICLR 2026
directing analyst LLM to decompose prompt into three tiers of sensitivity (Constraint, Method, Style). The second prompt then performs Anisotropic Perturbation, using this analysis to guide generator LLM in applying targeted, differentiated edits to each tier.
Step Sensitivity Analysis Prompt
You are a specialized Prompt Architecture Analyst. Your task is to analyze a system prompt and decompose it into three-tier hierarchy of components based on their sensitivity.
Definition of Tiers
Tier 1 (Constraint Layer- High Sensitivity): Non-negotiable rules that define success or failure. Changing these will likely break the prompt's core function format. (e.g., format rules, core task definition, absolute prohibitions).
Tier 2 (Method Layer Medium Sensitivity): Guidelines on "how" to perform the task. Changing these affects the quality and reasoning path, but not task completion itself. (e.g., "think step by step". process instructions).
Tier (Style Layer- Low Sensitivity): Persona, tone, and other stylistic elements. Chang- ing these affects the prompt's personality, not its logic. (e.g.. 'ouu are helpful assistant', politeness).
Input Prompt "aysstennppoompp_eexx""
Output Format Your output MUST be single, valid JSON object with three keys: "constraint_layen
'meethd.layer's and "sstylllayer'' Each key must have a list of strings its value.
Now, provide the three-tier JSON analysis for the original prompt.
Step 2: ATARE Perturbation Generator Prompt
You are an expert in semantics and creative writing. The goal is to explore closely related, but potentially worse-performing, variations of the text.
Inputs
1. Original Prompt: "systeen.promt..eext"
2. Three-Tier Sensitivity Analysis: (analysis.ter)
YOUR TASK & RULES Your generated versions MUST adhere these rules:
1. Maintain Core Intent (Global Constraint): All perturbed versions MUST maintain the core intent the original prompt. The goal is to create semantically close variations to find weaknesses,
write new prompt.
2. Targeted & Differentiated Perturbation: Your changes should be targeted, and their de- gree must be based on the component's ' sensitivity from the analysis:
For Tier (Constraint Layer- High Sensitivity) components, apply only MINIMAL and SUBTLE changes (e.g.. synonym swaps like "only" to "just", slight rephrasing). These are fragile and require careful stress-testing.
For Tier (Method Layer- Medium Sensitivity) components, you can apply MOD- ERATE changes (e.g., rephrasing the reasoning process, altering the sequence of steps).
For Tier 3 (Style Layer- Low Sensitivity) components, you have the most freedom. Apply CREATIVE and DIVERSE changes (e.g., completely changing the persona, tone, or conversational style).
3. No Invalid Information: Do not introduce irrelevant information, contradictions, factual errors.
Now, provide the (k} targeted, perturbed versions for the original text, strictly following all the rules above.
19

---

Published as a conference paper at ICLR 2026
E.3 LATO OPTIMIZER PROMPT
The LATO prompt is the engine for the Outer Robustness Update step. It is composed of three main parts: glossary that defines the structured tags, system prompt that outlines the optimizer's task, and an instantiated user message that provides the specific context for an optimization step.
GLOSSARY
To ensure the optimizer L.MM correctly interprets the structured inputs, we first provide it with glossary defining all the tags used in the prompt.
LATO Prompt Glossary
<ORIGINAL CORIGINAL.VARTBBLESS VARIABLE>;
The original variable that you need improve.
<PERTURBED VARIABLE>; A slightly perturbed version of the original variable that sulted in the feedback.
The performance of the original variable on the current
batch.
<FERUUBBDD.VARIIBIEE.LSS. The performance of the perturbed variable on the cur- rent batch.
<LM.SYSTEM_PROMPT>> The system prompt for the language model.
<LM.INPUT>; The input to the language model.
<LM. The output of the language model.
<FEEDBACK>: The feedback to the variable.
<CONVERSATION:: The conversation history.
<FOCUS>: The focus of the optimization.
<ROLE>: The role description of the variable.
LATO SYSTEM PROMPT
The LATO system prompt is designed to make the optimizer L.M explicitly landscape-aware. By providing rich, contextual view of the local semantic landscape and the nature of performance failure, enables more informed update than first-order methods, steering the variable towards flatter, more robust semantic basin.
LATO System Prompt
You are an expert optimizer and creative critic within an advanced Al system. You will be asked to creatively and critically improve text-based variables (prompts, solutions, code, etc.) to make them more effective and robust.
THE PROCESS To do this, you will be given an <ORIGINAL.VARTBLESS This variable was perturbed into a perturbed version resulted in critical <FEEDBAKK>.
WWA.UREEEE.AARIEEEE...... and the system's 's performance using this
YOUR TASK & OBJECTIVES Based on all available information, your goal is to generate a new, improved version the ORIGINAL VARIABLE. The new version must achieve the following objectives:
1. Address the Failure: It must resolve the specific issues pointed out in the provided
<FEEDBACK>,
2. Preserve Performance: It must maintain or improve upon the original variable's good performance.
3. Enhance Robustness: It must more resilient to similar small perturbations in the future.
GUIDING PRINCIPLES
20

---

Published as a conference paper at ICLR 2026
Preserve Core Meaning:
Whatever the edit, you must strictly preserve the core task intent and local coherence of the original text.
Analyze Noisy Feedback: The provided <FEEDBACK> may be noisy. Critically evaluate identify what is important and correct.
Consider Full Context: Always pay attention to the variable's <ROLE> and the full context which it is used to ensure your improvements are relevant.
IMPORTANT OUTPUT FORMAT You MUST give your response by send- ing the improved variable between (new.variabl atttetttttaggiiirrreer
variable] (ne..a)eewwwaaaa www.vvrraable.ed...e. tags. The text you send between the tags will directly replace the variable. GLOSSARYTEXT
EXAMPLE INSTANTIATED LATO PROMPT
The following box shows an example of a complete prompt constructed and sent to the optimizer LLM, combining the system prompt with the specific variables for single optimization step.
Example of an Instantiated LATO Prompt
Here is the role of the variable you will improve: <ROLE>strrucurre system prompt to language modei</ROLA)
The ORIGINAL variable that optimizing is:
<ORIGINAL_ SAAIIINAL_VARIBBE>>>
VARIABLE>
You will answer reasoning question. Think step by step. The last line of your response should be of the following format:
'Answer: $VALUE' where VALUE is numerical value.
</ORIGINAL VARIGABLLL
<ORIGINAL VARIABLE LOSS> 1, 1, 1
VARIABLE
When this variable was slightly perturbed into the following version:
<PERTURBED VARIABLE>
You are to solve a reasoning question. The final line your response should be in the format: "Answer: $VALUE where
VALUE is numerical value.
</PERTURBED VARIABLE> <PERTURBED SEETUUREEEDAVAAAAEEEEEE TARIABLE_LOSSY 1, 1, 1
The system received the following feedback based on the PERTURBED version's perfor-
mance:
<CONTEXT>
Here is a conversation:
<CONVERSATION>
<LM_INPUT>
have three oranges, a pig, frog, a cow, three bananas, nectarine, and snail. How many animals do have?
_ILMINNPU>>>>
<IM_OUTPUT>
To find the total number of animals, we need to identify the animals.. the total number animals is 4.
Answer: 4
</LM_One OUTPUT>
</CONVERSATION>
Here is the feedback we got the conversation:
<FEEDBACK>
21

---

Published as a conference paper at ICLR 2026
To improve the adaptively perturbed prompt variable in order to enhance the objective function, consider the following strategies:
</FEEDBACK>
</ </CONTEXT>
Based on the feedback from the perturbed version, improve the ORIGINAL variable to make it more robust.
E,4 SOLUTION OPTIMIZATION PROMPT DETAILS
This section details the prompt architecture for our ATARE-based solution optimization pipeline. The process is divided into two main stages, each with corresponding prompt.
The first stage Flaw Diagnosis, which operationalizes the Semantic Sensitivity Analysis step. The prompt below instructs expert LLM identify the core "cognitive trap" in incorrect solution, thereby defining the low- and tigh-sensitivity regions.
Flaw Diagnosis Prompt
You world-class expert in logic and science. The following solution is INCORRECT. Your task to deeply analyze its reasoning and clearly describe the core "cognitive trap" or "flawed reasoning path" that led to the wrong conclusion.
Incorrect Solution to Diagnose (s,) {solution_var wtw.ioonvvavvalleeelll
Please provide your detailed analysis of its flawed reasoning path.
The second stage is the Anisotropic Adversarial Search, executed by the ATARE Perturbation Gen- erator. This prompt takes the flaw analysis from Stage input and directs the LLM generate diverse variations of only the identified flaw, while strictly preserving the correct reasoning back- bone.
ATARE Perturbation Generator Prompt
You are creative Al that can mimic different thinking styles. You will receive an incorrect solution and an analysis its core flaw. Your task is to generate (k) new, distinct, but equally flawed solutions.
Guiding Principle Treat the solution as a reasoning chain. The correct reasoning before the identified flaw is the high-sensitivityy backbone that MUST be preserved. Your task is vary the expression of the flaw itself (the low-sensitivity target).
Rules All new solutions MUST:
Commit the same type of core error described in the "Flaw Analysis".
2. Use different phrasing, examples, intermediate steps express this error. The goal is to explore different deceptive manifestations of this single cognitive trap.
3. Ensure that the final conclusion and the chosen answer letter LOGICALLY FOLLOW from your flawed reasoning.
4. Choose your final answer from the available options in the "Problem Context". Do not invent new options.
Inputs
Problem Context: (question)
Original Incorrect Solution (s:): ieoolution.var.vllloe
Flaw Analysis Report: (flaw.analysis)
Output Format The output MUST be valid Python list of strings.
22

---

Published as a conference paper at ICLR 2026
F NOTATIONS
We present a comprehensive review of the commonly used notations and their definitions in Tab. 3.
Notation
Definition
M
The black-box LLM.
P
The discrete semantic space of textual prompts.
D
The dataset.
P
A textual prompt.
e(.-))
The loss function (or evaluator 8) mapping outputs to numeric scores. The empirical prompt risk on dataset D.
LD(P)
drea(p; v/)
The semantic dissimilarity between prompts and p'.
Phext (or Pt)
The radius of the semantic neighborhood.
B(p, Prexe)
The isotropic semantic neighborhood of prompt
Ls(p: Prext)
The textual sharpness-awwe aware loss.
Wp dani, w, (p.p²
The diagonal weight matrix for anisotropic sensitivity.
The anisotropic semantic distance metric.
Bp(P: Piea))
The anisotropic ellipsoidal neighborhood.
$1.5
The sensitivity score of the j-th prompt component.
B
The exponent parameter controlling sampling probability in ATARE.
G
The generator oracle used for sampling paraphrases. The optimizer oracle used for proposing updates. The current iteration index.
t
Be
The minibatch of data at iteration t.
Ke
The budget (number of samples) for the inner adversarial search. The set of candidate prompts sampled in the inner loop.
CR. (pr)
Piad
The adversarial (worst-case) prompt neighbor.
The estimated empirical loss on specific batch.
Me
The budget (pool size) for the optimizer proposals.
The semantic budget constraint for the optimizer.
UM. (pt)
The improvement pool generated by the optimizer.
K
The sampling budget for the outer robust validation.
The tolerance threshold for accepting update.
LLAOO
The meta-prompt template for the Landscape-Awar Textual Optimizer.
Table 3: Notation and Definitions
23


Reviews:
[{"review_id": "H6KnOYv2QL", "reviewer": "Reviewer_VtM1", "summary": "This paper tackles an important yet under-explored problem in prompt optimization: the brittleness of prompts to semantically-preserving paraphrases. The authors formalize this as \"textual sharpness\" in the prompt landscape and propose TARE (Textual Sharpness-Aware Evolving), a framework that performs inner adversarial search over semantic neighborhoods and outer robust selection. They extend this to ATARE, which learns anisotropic weights for different prompt components. Experiments across reasoning tasks (Object Counting, Temporal Sequences, Tracking Shuffled Objects, GSM8K) demonstrate consistent improvements over baselines like TextGrad and Revolve.The core contribution is adapting the SAM (Sharpness-Aware Minimization) principle from continuous parameter space to discrete, semantic prompt space—a novel and well-motivated direction. I appreciate that they optimize the entire chain and that robustness truly matters for trusting LLM outputs in practice.", "questions": "Diversity vs. Robustness Trade-off: Have you tested this on any open-ended generation tasks? I'm genuinely curious whether there's a fundamental tension between robustness (flat neighborhoods) and diversity (exploring semantic space). For tasks where we want multiple valid outputs, does TARE hurt performance?\n\nReasoning Patterns: Do you observe any patterns in how TARE performs on different reasoning types? For example, does it help more on tasks requiring arithmetic precision vs. logical deduction? Understanding this could guide when to apply the method.\n\nThinking Models: Given the rise of o1-style reasoning models (Qwen QwQ, Mistral's reasoning variants), have you considered testing TARE on these? Do prompts optimized for standard models transfer to thinking models, or do the additional reasoning tokens fundamentally change the prompt landscape?\n\nCross-Task Transfer: If I optimize a prompt for GSM8K using TARE, does it work well on other math datasets (e.g., MATH, SVAMPs)? How much does the optimized prompt overfit to the specific task distribution?\n\nOptimizer Analysis: In Table 1, you report results for GPT-4o and Claude 3.5 Sonnet backbones. But is there an analysis of which optimizer works best for which target model? Or is the optimizer choice model-agnostic? It would be interesting to see if using the target model itself as the optimizer (when possible) yields better results.\n\nComputational Cost: While you mention computational practicality, what is the wall-clock time and API cost comparison between TARE/ATARE and baselines? For practitioners, this matters a lot.\n\nFailure Cases: Are there scenarios where TARE makes prompts worse? Understanding failure modes would help users know when to apply the method.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "Novel problem formulation: Textual sharpness is an intuitive and important lens for understanding prompt brittleness. The formal treatment (Section 2) bridges optimization theory and discrete NLP in a principled way.\n\nComprehensive framework: TARE is well-designed with clear components (inner adversarial search, LATO optimizer, outer robust validation). The anisotropic extension (ATARE) demonstrates thoughtful attention to heterogeneous sensitivity across prompt components.\nStrong empirical results: Consistent improvements across multiple tasks and models. I particularly appreciate the ablation study (Figure 3) showing each component matters, and the resilience analysis (Figure 4) demonstrating graceful degradation.\n\nPractical relevance: The work addresses a real pain point in prompt engineering. Robustness to paraphrasing is crucial for building trustworthy LLM systems.\n\nThoughtful experimental design: Testing across diverse backbones (GPT-3.5, Gemini, Llama) and using two universal engines (GPT-4o, Claude 3.5 Sonnet) for fair comparison shows rigor.", "weaknesses": "1. Limited task diversity: All evaluation tasks are verifiable reasoning problems with clear right/wrong answers (counting, math, object tracking). This raises a key question: What about open-ended generation tasks where diversity matters? For creative writing, summarization, or tasks requiring pluralism (e.g., generating diverse perspectives on a political issue), optimizing for robust, flat neighborhoods might suppress desirable output diversity. I worry this approach could kill the creative variance we sometimes want from LLMs.\n\n2. Missing analysis on reasoning depth: You test on reasoning tasks, but there's no analysis of how the method performs across different reasoning complexities. Does TARE work equally well for simple arithmetic vs. multi-hop reasoning? Given the recent release of models with explicit reasoning traces (o1-style \"thinking\" models like Qwen with QwQ or Mistral's reasoning variants), it would be very valuable to test whether optimizing prompts for these models behaves differently. Do the optimized prompts transfer across reasoning-capable and standard models?\n\n3. Transferability not explored: A critical practical question is prompt transferability. If I optimize a prompt for one task/model using TARE, does it transfer to related tasks or different models? This would greatly affect the practical utility—if every prompt needs task-specific optimization, the compute cost becomes prohibitive.\n\n4. Optimizer architecture choices under-explored: You use GPT-4o and Claude 3.5 Sonnet as universal optimizers. But there's no analysis of whether certain optimizers work better for certain target models. Is there a \"universal optimal optimizer\"? Or should the optimizer match the target model's family? For instance, does using a Claude optimizer work better when optimizing Claude prompts vs. Llama prompts? This could have practical implications for cost and efficiency.\n\n5. Semantic neighborhood definition: While you provide formal definitions (Equations 3-5), the practical instantiation of \"semantic dissimilarity\" dₜₑₓₜ and how you ensure perturbations truly preserve semantics while revealing sharpness could be explained more clearly. What prevents the generator from creating trivial or overly conservative perturbations?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "y5ji7gWYdJ", "reviewer": "Reviewer_v8Q2", "summary": "The paper introduces TARE, a black-box framework that improves the robustness of large language model prompts by explicitly minimizing textual sharpness—the sensitivity of prompt performance to small paraphrases. It defines a semantic neighborhood around each prompt and optimizes for stability within that region through an inner adversarial search and an outer robustness update, with ATARE further adapting neighborhood shape and size. Experiments across reasoning benchmarks show that TARE and ATARE yield more stable and accurate prompts than existing optimization methods like TextGrad and Revolve", "questions": "n/a", "limitations": "", "rating": 6, "confidence": 2, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "1. The paper identifies an important and underexplored issue of brittleness under paraphrasing. It formalizes it as textual sharpness, bridging ideas from Sharpness-Aware Minimization to discrete text optimization.\n2. The proposed algorithms are effective and model-agnostic, achieving consistent robustness improvements across tasks and architectures without requiring gradient access.", "weaknesses": "1. While the method defines textual neighborhoods semantically, the paper does not deeply analyze how the neighborhood metric affects robustness. It remains unclear whether the choice of embedding space or paraphrase generator significantly biases outcomes.\n2. The study focuses on single-turn prompts. Extending sharpness-aware evolution to multi-turn or retrieval-augmented contexts is not explored.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "YOnTj499us", "reviewer": "Reviewer_wFGW", "summary": "To find the optimal prompt that is robust to the input perturbation and has better generalization, the authors propose a new method called TARE. More specifically, it formulates the prompt optimization problem as a min-max optimization, aiming to find the optimal prompt that minimizes the maximum empirical risk incurred by the prompts within its sharpness neighborhood. To solve the optimization problem, TARE formalizes the definition of sharpness in the discrete semantic space of prompts. To capture heterogeneous sensitivity across the semantic components of a prompt, the authors further adapted the TARE to ATARE by learning the weights of the components to reflect the heterogeneity. Experimental results show that TARE or ATARE can outperform the evaluated baselines over multiple settings.", "questions": "Please refer to the weaknesses section for my questions.", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "The strengths of the paper are listed as follows.\n1. It is great that the authors provide open-source codes to reproduce their experimental results.\n2. The proposed method is reasonable. The prompt that falls in a smooth landscape usually has a better generalization and is robust to the perturbation in the input.\n3. The min-max formulation of the problem TARE aims to solve is concise and elegant.", "weaknesses": "The weaknesses of the paper are listed as follows.    \n1. The authors did not provide a dedicated related work section in the main paper. Considering that prompt optimization is a research area with extensive existing work, it is necessary to have a section for comparing the differences between TARE and existing works in the main paper.    \n2. The authors only compare their methods with two prompt optimization works. Some important baselines are missing, for instance, APE [1], APO[2], and EvoPrompt [3].    \n3. The readability of the methodology section should be improved. First, Figure 2 contains too much information to illustrate the overview of TARE framework. Although it seems to be very comprehensive, incorporating too many details into a single figure can make the readers hard to catch the key information. Second, the authors introduce too many notations and formulas to describe their methods, where some of them are unnecessary and increase the difficulty of understanding the key ideas of TARE.   \n4. Some important technical details are not clear.      \na. For the inner adversarial search, how to implement the generator oracle and how to define the perturbation range $\\rho$ over a given prompt in the context of the prompt optimization problem. Please give more concrete details instead of the abstract formulation.     \nb. In equation (4), how to calculate the $\\Delta(p, p’)$?     \nc. In ATARE, how to define the components of a given prompt?     \nd. For the outer robustness update, how to implement the optimizer oracle and how to measure the semantic distance and budget?     \ne. It is unclear how the landscape information can be leveraged by the LATO. It would be better if some examples could be provided.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "9TB3csT3Rb", "reviewer": "Reviewer_1hhU", "summary": "This paper works on finding robust prompt landscapes with inspiration from the works on Sharpness-Aware Minimization (SAM). The idea behind SAM is to optimize a model on a continuous loss landscape and find a minimum where the loss function is flat via a minmax objective. Akin to this idea this paper tries to formulate the problem on a discrete space where they use an LLM as a sampler for potential neighbour data point samplers. Based on these neighborhoods they propose TARE to find adversarial potential prompts and use those prompts as a guidance to generate better neighborhood prompt candidates. This sampling is done iteratively akin to min max optimization to find the robust prompt landscape. Further they also proposed a componentwise weighted method for optimization in the form of ATARE.", "questions": "See weaknesses", "limitations": "", "rating": 6, "confidence": 2, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "1. Experiments were performed across multiple language families and for the sake of generalizability different tasks were used. Experiments were also performed on black box models. \n\n2. The ablation on the multiple components of the problem statement performed in the final results. \n\n3. Ablation was done on weaker and stronger oracles. \n\n4. Comparisons performed with point wise benchmarks", "weaknesses": "1. Problem formulation is hard to follow and not well defined. Notations are not explained and abruptly introduced which makes following through harder. The overall methodology can be simplified in the writing. Over use of notations that are not well defined makes it harder to follow through. \n\n2. While sharpness neighborhoods can be defined by edit distance or paraphrase distance the sampling is not guaranteed to be within these bounds. Is this accounted for in the sampling via filtering", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)