On the Worst Prompt Performance of Large Language Models
Authors: Bowen Cao
Deng Cai
Zhisong Zhang
Yuexian Zou
Wai Lam
Venue: NeurIPS 2024 poster (2024)
Keywords: Natural Language Processing
Large Language Model
Instruction following
Model Robustness
Primary area: natural_language_processing

Abstract: The performance of large language models (LLMs) is acutely sensitive to the phrasing of prompts, which raises significant concerns about their reliability in real-world scenarios. Existing studies often divide prompts into task-level instructions and case-level inputs and primarily focus on evaluating and improving robustness against variations in tasks-level instructions. However, this setup fails to fully address the diversity of real-world user queries and assumes the existence of task-specific datasets. To address these limitations, we introduce RobustAlpacaEval, a new benchmark that consists of semantically equivalent case-level queries and emphasizes the importance of using the worst prompt performance to gauge the lower bound of model performance. Extensive experiments on RobustAlpacaEval with ChatGPT and six open-source LLMs from the Llama, Mistral, and Gemma families uncover substantial variability in model performance; for instance, a difference of 45.48% between the worst and best performance for the Llama-2-70B-chat model, with its worst performance dipping as low as 9.38%. We further illustrate the difficulty in identifying the worst prompt from both model-agnostic and model-dependent perspectives, emphasizing the absence of a shortcut to characterize the worst prompt. We also attempt to enhance the worst prompt performance using existing prompt engineering and prompt consistency methods, but find that their impact is limited. These findings underscore the need to create more resilient LLMs that can maintain high performance across diverse prompts.

On the Worst Prompt Performance of Large Language Models*
Bowen Cao Pit Deng C. Zhisong Zhang Yuexian Zou
Wai Lam
Y The Chinese University of Hong Kong
V Tencent Lab Peking University
bwcaoêl ink. cuhk. edu. hk. thisisjcykcddgmall com, thisonzhang@tennent.com zouyxêpku. edu.cn, cn, wlamêse. cuhk. edu.
Abstract
The performance of large language models (LLMs) is acutely sensitive to the phrasing of prompts, which raises significant concerns about their reliability in real-world scenarios. Existing studies often divide prompts into task-level in- structions and case-level inputs and primarily foeus evaluating and improving robustness against variations in tasks-level instructions. However, this setup fails fully address the diversity of real-world of task-specific datasets. To address these limitations, we introduce ROBUSTAL- PACAEVAL,
queries and assumes the existence
benchmark that consists of semantically equivalent case-level queries and emphasizes the importance of using the worst prompt performance gauge the lower bound of model performance. Extensive experiments Ro- BUSTALPACAEVAL with ChatGPT and six open-source LLMs from the Llama, Mistral, and Gemma families uncover substantial variability model performance; for instance, a difference of 45.48% between the worst and best performance for the Alama-2--7B-chhe
model, with its worst performance dipping as low as 9.38%. We further illustrate the difficulty in identifying the worst prompt from both model- agnostic and model-dependent perspectives, emphasizing the absence of a shorteut to characterize the worst prompt. We also attempt enhance the worst prompt performance using existing prompt engineering and prompt consistency methods, but find that their impact is limited. These findings underscore the need to create more resilient LLMs that can maintain high performance across diverse prompts. http:///hhbb..omo//ww/////bbuu//
Data and code are available
Introduction
In recent years, large language models (LLMs) have made extraordinary progress (rrwnn al. 2020 Touvron et al. 2023 Jiang et al. 2023 Team et al. 2024) and one key factor in their success their ability adapt diverse tasks through prompting. However, the performance of these
LLMs is significantly sensitive to the prompts they receive (Gu et al.) 2022; Mizrahi et al. 2024
Sun et al. 2023 Li al. 2024). Even minor alterations in format, without semantic changes, can trigger substantial performance degradation (Sclar et al. 2023). Consequently, prompt engineering has surfaced as critical component, playing critical role in unlocking the full potential of these
models (Shin et al. 2020 Zhou et al. 2022a Pryzant et al. 2023 Prasad et al. 2023 Gonen et al.)
2022 Schulhoff et 2024).
*The work described this paper partially supported by a grant from Research Grant Council of the Hong Kong Special Administrative Region, China (Project Code: 14200719). i Work done during internship Tencent AT Lab.
Corresponning author.
38th Conference on Neural Information Processing Systems (NcurIPS 2024).

---

Existing Work
Real-world User Queries
Assume you customer servioe representative. Please provide customer service customer regarding their difficulties in accessing website.
Casel: customer service representative, kindly
Task-level Instruction
assist customer who is facing challenges with website, specifically reporting inability to sign in over the last four days.
The customer states that they have been unable to sign for the past four days.
Casel:
character 5-ycar-old boy with insatiable curiosity and penchant for questioning. while also harboring strong aversion to adhering to rules, Feel free to claborate on his traits and wcave in incidents that highlight his personality.
Case2: Craft a narrative that brings sketched
Case-level Inputs
Case2: customer reports that they unable complete an online purchase due to the website's checkout process consistently failing.
Figure 1: An example illustrating the gap between existing benchmarks that evaluate prompt consis- tency and real user queries.
Despite the efficacy of prompt engineering, is not without its drawbacks. First, it unrealistic to expect users to master the art of designing optimal prompts or to invest a significant amount of time in doing so. Second, automatic prompt engineering often necessitates testing on substantial labeled data to pinpoint the most effective prompts (Shi et al. 2022 Prasad et al. 2023), process that is impractical for users who just have one or a few unlabeled queries. Therefore, investigating LLMs' robustness to prompt variances is of great research and practical value.
Previous research on prompt robustmess (Mizrahi et al., 2024 Sclar al. 2023 Sun et 2023)
divides a user query into two parts: task-level instruction and case-level input. The task-level instruction is an abstract task definition and explanation supplemented by case-level concrete input (See the left part of Figure This setup is reminiscent of conventional NLP practice, where task- specific models are developed using a testing set for each well-defined NLP task. Consequently, they have focused on the LLM's s resilience to task-level instructions exclusively, reporting the average performance across testing set cases. Nonetheless, these studies have limitations. First, they disregard that the best task-level instruction might vary actoss individual cases. Second, they overlook the impact of variations in case-level input on model performance. Last but not Ieast, real-world user queries often do not explicitly segregate task-level instruction and case-level input (See the right part of Figure T. These queries may cover a wide array of tasks and it is not possible to optimize the prompts through evaluating on task-specific testing set.
In this paper, we present a comprehensive study that goes beyond the conventional approach of evaluating LLMs. We shift the focus from task- instructions to diverse real-world user queries. Our work introduces a new benchmark, ROBUSTAL AAA.SSTTA..AAAAAL... that includes semantically equivalent case-level queries across various tasks, offering more holistic analysis. We argue that the worst prompt performance, defined as the lowest performance a model exhibits across different paraphrases of a query with equal semantics and fluency, is crucial metric for assessing the lower bound of LLM performance. Our extensive experiments on ChatGPT (gpt-3.5-turbe 1106) and six open- source LLMs from the Llama, Mistral, and Gemma families reveal substantial variability in model performance. For instance, Llama-2- 2-ainaa--------- 70B-chat model shows a difference of up to 45.48 points in win- rate against GPT4 using RobustA/paccaEval. and its worst prompt performance Our findings further reveal that the worst prompts, which cause the model to perform the worst in specific cases, are not universally applicable across different models. Each model also exhibits unique preferences towards all paraphrases, as demonstrated by their inconsistent performance rankings on identical cases. Beyond the absence of aagessag traits identifying the worst prompts, model -edee-deeennent prompt features, such as perplexity and hidden states, also prove inadequate in forecasting model performance. Furthermore, we also find that different models are more sensitive in different cases, which further underscores the complexity involved in tackling the issue of worst prompt performance.
be low as 9.38%.
In summary, the contributions of this paper can be summarized as follows:
* We introduce a new benchmark, ROBUSTALPPACEVAA that encompasses semantically equiva- lent queries of diverse real-world tasks, offering more holistic assessment compared to existing benchmarks that focus solely rephrasing lese- instructions.

---

Through extensive experiments on ChatGPT and six open- source LLMs from the Llama, Mistral, and Gemma families, we unveil significant variability in model performance and highlight the difficulty in predicting prompts that lead to the worst performance.
We show the shortcomings of most existing methods in improving the worst prompt performance of models. Yet a voting-based method effectively enhances the stability of model performance.
Related Work
Existing research on prompt robustness can be classified into two categories. On the one hand, research efforts have been focused on enhancing the inherent resilience of LLMs to prompt variations, namely prompt consistency. On the other hand, progress has been made in automating prompt engineering, the process to find the optimal prompt that yields the best performance.
Prompt Consistency. Previous studies (Gu et al. 2022 Wang et al. 2023a Zhu et al. 2023 Wang et al., 2023b, Salinas and Morstatter (024) have explored the robustness of LLMs to inten- tional perturbations such as word deletion and sentence shuffling. Our work deviates from these perturbation- based studies, as we are interested in model performance across semantically equiv- alent and syntactically fluent prompts. While it is anticipated that a flawed prompt would lead to performance decline, do not expect such performance variations in our setting.
Recent research (Mizrahi et al., 2024, Sclar al.) 2023 Sun et al. 2023) has also examined the variability in model performance with semantically equivalent prompts. However, these studies solely focused on task-level instructions and overlooked the variations within case-level inputs. Moreover, the models used in these studies are trained and evaluated on traditional NLP datasets, while today's s LLMs are predominantly instruction-tune on and serve diverse user prompts. This discrepancy suggests that the findings of these studies may not fully apply to the latest generation of LLMs.
Prompt Engineering. A number of studies utilize gradient- crasient-based methods for prompt optimization (Shin al.) 2020 Shi al., 2022 Li and Liang, 2021 Qin and Eisner [021] Lester et al. 1021
Liu et al. 2023). However, their dependence on substantial labeled training data and gradient computing limits their applicability for users with only few unlabeled queries or gradient-less APIs.
Furthermore, these methods incur significant computational costs as the model scale increases.
Conversely, gradient-free methods aim to find the optimal prompt through exploration and scoring (Prasad et al. 2023 Zhou et al. 2022a Pryzant et al. 2023 Chen et al. 20233; Yang et al. 2023). During the exploration phase, they create analogous prompts using techniques such rephrasing the current prompts with an LLM. Subsequently, the best prompts are selected based on the model's performance downstream tasks. This process be iterative. Although these approaches can proficiently pinpoint prompts that result in better performance for a specific task, they all necessitate test set for prompt scoring. However, in real-world scenarios, such test sets are often absent. Gonen et al. (2022) suggests that prompt perplexity can be an effective data-free criterion. However, our experiment results tell different story, indicating that prompt perplexity is not reliable metric.
3 Benchmarking the Worst Prompt Performance
We present the construction process of our new benchmark, ROBUSTALPACAEVAL ($3.) and report the results on ChatGPT and six open-source L.LMs from Llama, Mistral, and Gemma families.
3.1 A New Benchmark: ROBUSTALPACA
Data. Our benchmark is based on ApacceEalll (Polo et al. 2024), which is condensed subset of the AlpacaEval (Li et al. 2023) benchmark, created to enable efficient assessment of LLMs. We develop ROBUSTALPACAE VAL by creating t paraphrases for each query within TinyAlpacaEwe To save manual efforts, this is first accomplished automatically through GPT4 Subsequently, each paraphrase is manually reviewed and revised to ensure semantic integrity and human-like fluency. We
'We find that 10 paraphrases are sufficient to steadily reflect the variability in the model's performance. Further details can be found in Appendix A.1
3

---

Model
Orig. Perf. 1
Worst Perf.
Best Perf.
Avg. Perf. f Standard Dev.
Gemma-1. 1-1-b--
16.32
4.42
36.60
15.27
11.78
ChatGPT
17.46
5.44
39.88
19.96
12.86
7b-inttch
24.56
4.22
45.26
21.82
14.60
Llama-2-7b-chat
25.61
5.42
43.54
19.52
13.32
Llama-2- 2-13--chatt
27.48
4.83
52.05
23.97
16,25
Gemma- coamma-..1-b--ie 1.1-7b-it
29.57
8.73
62.38
31.04
19.07
Llama-2-70b-cae 2-70b-chat
32.23
9.38
54.86
29.18
15.61
Table 1:
Results on our ROBUSTALPACAEVA benchmark. The model order is arranged according their original performance. The substantial range between the worst and best performance suggests the robustness issues in LLMs' instruction- -orrlcttoon-olooiiggg ability. Scaling up model sizes, while improving average performance, does not enhance robustness.
use carefully crafted prompts to promote the diversity of paraphrases, which is evidenced by the fact that the average of normalzze edit distance between each pair of paraphrases is 0.7234 at the word level. The few-shot paraphrasing instruction utilized in this process is detailed in Appendix A.2
Metrics. In line with common practice, we use weighted win-rate Li et al. 2023) as our per- formance metric; It uses an evaluator to compare the output of the target model against that of reference model, and estimates the winning probability of the target model. Specifically, we employ the gpt4_turbe model as the evaluator and the reference model. We term the model's performance on the original prompt as original performance. We also report the worst, best, average performances across all eleven prompts as well as the standard deviation. For each metric, we average the results across all cases in ROBUSTALPACAEVAL
3.2 Results
The results shown in Table(reveal several key findings:
There a significant gap between the worst performance (lower bound) and best performance (upper bound) for all models. For instance, the worst and best performance of 1amma-2-7B-chhie are 0.094 and 0.549, respectively, indicating a difference of 0.455. This suggests that the current LLMs' ability follow instructions is not robust enough. Even instructions with identical semantics and fluent expressions could lead models like Llama2-70B-chle to plummet from a level comparable GPT4 (0.5 indicates equivalence the reference model) far below the average level (0.292).
While scaling up models enhances their ability to follow instructions, it does not correspundingly increase their robustness. For example, the average performance of -lama-2-7B// 1BT7//////BBBBBBB chat shows a marked improvement, rising from 0.195 to 0.24, and finally to 0.292, but their robustness (indicated by the Standard Dev.) exhibits slight decline, recorded at 0.133, 0.163, and 0.156 respectively. A similar trend can be observed with the Gemma family models. Despite Gemma-7b outperforming the 2b model with average performance of 0.31 compared to 0.153, its robustness inferior, registering at 0.191 compared to the 2b model's 's 0.118.
The original performance assessment only provides narrow perspective of a model's overall performance. Specifically, the original performance serves as reliable metric for ranking within the same model family, as it aligns well with the best, worst, and average performances. However, we find that this alignment weakly correlates when comparing across different model families, such Gemma and Llama, questioning the methodological validity of using just one type of phrasing for a query to assess performance. Furthermore, the original performance does not fully encapsulate model's 's potential, including the boundary and average of its performance, and fails to reflect the stability of the model's performance.
'ee compute the edit distance between prompts and normalized by their average length as: 2 EditDistance(1, [[[[ + (vl)

---

Identifying the Worst Prompts
Given the noticeable performance disparities across semantically equivalent prompts, question is: can we identify the worst prompt among these paraphrases? This would not only aid our understanding of the model's lower bound but also be instrumental in improving model performance by guiding the refinement of prompts. We investigate this matter from both model-agnostic ($4.1 and model-dependent 4.2 perspectives.
4.1 Model-agmostic Analysis
We examine the model-agnostic attributes of the worst prompts from two perspectives: (i) we assess whether the worst prompts overlap across diverse models, and (ii) we probe whether the rankings of prompts are consistent across different models.
Liana family
Overlap of the worst prompts across different models. If many of the worst prompts are model- agnostic, there must exist certain prompts that, among their semantically equivalent paraphrases, consistently rank as the worst performing across all models. To quantify the prevalence of such prompts, we calculate the rate of the model-agnostic worst-k prompt. Let Wm.rz k) denote the worst-k- performing prompts for model m case and let the set worst-k prompts for model m on dataset D be Wm. (D,,D, k) UZED Wm (x, k). We calculate the overlap rate of the worst-k prompts for the tested models, which ranges from 0 to 1, as follows:
Denuaa family
overap rate prompts
Jamacemma/Mitral//
modes
0.3
0.1
Figure 2: The overlap rate of model-agnostic worst-k prompts across different models. The low result indicates minimal occurrence of universally poor prompts.
R(M,k, D) MMEM Wm (D,(Dk)
(1)
k [D]
As shown in Figure 2] the overlap rate of the worst-k prompts for Llama/Gemma family models is noticeably higher than that for all models, indicating stronger consistency among models from the same family. However, even so, when & = 1 (considering only the worst prompt), the metric for Llama family models is only 2% (13% for Gemma), and less than 10% (20% for Gemma) when 2. Not to mention the results of all models are much lower, nearly zero. These results suggest that the prompts showcasing the lower- bound performance of the models are often model-specifie.
Performance Rankings of prompts across different models. We continue to check if the rankings among different models are consistent. We utilize Kendall's W (Kendall and Smith 1939), commonly referred as the coefficient of concordance, as a means quantify the correlation among performance rankings derived from various models. Mathematically, Kendall's W is defined as follows:
12 12
(R; R)²
W
k22n33 - n2)
where R; represents the sum of the ranks assigned to the i-th prompt by all models. R is the mean
" of total ranks, calculated as R 1 Σx= R,. is the number of models, and n is the number of prompts being ranked. The value of W ranges from 0 to 1, where indicates agreement and 1 indicates complete agreement among the judges
We compute the average Kendall's W across all cases the overall consistency. The results presented in reveal the following observations: (i) The rankings within the Llama and Gemma family models exhibit only moderate consistency. The slightly higher consistency of the Gemma family models could be attributed to the fewer scales (2b/7b). This suggests that individual models within the same family still possess their unique strengths and weaknesses. (ii) The consistency between all models is significantly lower, underscoring the difficulty in establishing a model aggnssic standard for determining "good" and "bad" prompts.
'w values less than 0.1 are often considered as no or negligible agreement; 0.1 to 0.3 suggest weak agreement; 0.3 to 0.5 indicate moderate agreement; and W values above 0.5 show strong agreement (idney 1957.
5

---

Agreement Levels Distribution
Model
Kendall's W
Negligible
Weak
Moderate
Strong
Llama family
0,443
0
0.242
0.414
0.343
Gemma family
0,548
0.08
0.28
0.64
Llama/ Baamaa/Gema//Mittra---aaa
0,401
0.011
0.326
0.411
0.253
All models
0.238
0.053
0.723
0.202
0.021
Table 2:
We report the average value of Kendall's W across all cases. We also calculate the proportion of cases with different levels of consistency. The ranges for each level of consistency are as follows: Negligible (W 0.1), Weak (0.1 s w < 0.3), Moderate (0.3 < W 0.5), and Strong (W 2 0.5).
Overlap Sensitive Cases. The above experiment results underscore that the worst prompt is almost un- predictable advance without given the model. Our next question is whether different models suffer from the same prompt variances. Concretely, we classify a case sensitive case if and only if the model's per- formance range (the difference between the best and worst performances) exceeds threshold (e.g., 0.5)
Liama family
Gemma family
0.3
All models
IuU senstivee
0.4
0.3
0.2
Figure 10 in Appendix B presents an example of a sensitive case. We measure the overlap of sensitive cases between different models by calculating the average Intersection over Union (IoU) of each pair of models within the tested model set. Let S. (D) represent the set of sensitive cases for model m on dataset D. The overlap measure of the tested model
0.1
0.2
0.6
threshold
Figure 3: IoU fluctuation across varying sen- sitive case thresholds for diverse model sets. The IoU drops below 0.2 across all models, indicating a scarcity of model-agnostic traits.
M
(MU D) = Emm,, E.Rrs,,MMMM.. (Miigt IoU (m; mj, D)
Sm, (D) Sm, (D) IoU (m,, mj. D) Sm, (D) U Sm, (D)
Figure illustrates the fluctuation of IoU in response to varying sensitive case thresholds across diverse model sets. The observations are as follows: (i) The loU markedly higher among the Llama/Gemma family models, indicating greater commonality of vulnerabilitiis within the same model family. For models from different families, such as the models of Llama, Gemma, and Mistral, their IoU is lower despite similar overall performance (as shown in Table I.. (ii When considering all models, the IoU drops significantly to less than 0.2, suggesting the absence of a clear model-agnostic characteristic. (iii) As the threshold increases, there is consistent decrease in the IoU across all model sets. This suggests that the most sensitive cases for a model are often unique to it, thereby emphasizing the existence of distinct issues inherent to each model.
Discussion. The above experiments demonstrate that the performance rankings of different prompts are inconsistent among different models. Furthermore, different models may suffer from different prompt variances. Therefore, it is unlikely to characterize the worst prompts using model- independent features. To this end, we omit further analyses on the relationship between model performance and linguistic features of the prompts, such sentence length, syntactical complexity, wording choice, and paraphrasing methods.
4.2
Model-dependent Analysis
The findings from $4.1 suggest that we can hardly predict the prompt performance in advance without access the model. We then turn explore the possibilities of building the worst prompt predictors using model-aware features.
We also attempt to define the sensitivity through standard deviation and the coefficient of variation, finding results very similar those obtained when using range the metric.

---

709
708
00.30, 0.60)
138
(0.330, 0.00]
00.30]
(-1.00, -0.60]
60.0%
40.0%
20.0%
0.0%
20.0%
40.0%
60.0%
60.0%
40.0%
20.0%
0.0%
20.0%
40.0%
60.0%
Figure 4: Distribution of Pearson correlation coefficients between model performance and prompt perplexity (left) and prompt's 's Min-K% Prob (right) for -lama-family models across all cases. The absolute values of correlation the ranges (0, 0.3]. (0.3, 0.6], and (0.6, 1] respectively denote weak/no correlation, moderate correlation, and strong correlation.
Intra Spii
700
06
120
0.34
0.52
0.50
25
350
250
Inter Split
10
20
0.50
700
330
40
0.4
-75
-50 -25 25
50
325 150
375
200
Figure 5: (a) Visualization of Llama-2- 2-nna----B-hal model's hidden states using 2-dimensional PCA. The color gradient, from light to dark, represents the ranking of model performance each case's 11 prompts, from low to high. (b) Probing Llama-2-78 2-accht model's hidden states for prompt scoring. The x-axis stands for training steps. The y-axis represents the accuracy of the model's predictions, quantified as the proportion of correctly judged prompt pairs out all test pairs.
(022) report that lower prompt perplexity generally correlates with superior model performance. To verify this assertion, we compute the Pearson correlation coefficients between perplexity and performance across all cases. The results are illustrated in Figure 4 (left half). The layout divides correlations into negative and positive (left/right of the 0 tick), with correlation strengths categorized as weak/no (0 0.3), moderate (0.3 0.6), and strong (0.6 to 1). Analyzing the Llama family models, we note the following: (i) About 45% of cases show weak or no correlation. (ii) Positive and negative correlations are nearly equally distributed. (ii) The distribution of cases across different correlation degrees is fairly balanced. These results are consistent with observations from other models analyzed (detailed in Appendix B). indicating no definitive correlation between prompt perplexity and model performance.
Prompt Perplexity. Gonen et
Min-K % Prob. We also explore the potential relationship between model performance and the prompt's 's Min-K K% Prob (Shi al., (202)). method related pre-training data detection, which judges the model's familiarity with the text based on the average log-likelihoor of the lowest k% tokens in the sentence. Intrigued by this, we carry out an analysis akin that for perplexity, only to find weak positive correlations that lack statistical significance, shown in the right half of Figure 4
Hidden States. We shift our focus to investigate model perceptions of prompt quality through the lens of model representation, using: (i) Principal Component Analysis (PCA) for direct visualization of hidden states, as shown in Figure 5 (a). The color gradient reflects the model's performance ranking across 11 prompts per case, revealing distinct separation between different performance levels. (ii) Probing technique to quantify the extent to which the model's internal representations predictive its performance. We train reward model (a 3-layer MLP in practice) that scores prompts based on hidden states and apply the standard training loss function (Ouyang et al. 2022). which is defined as:
E (PpiPs)> [log (o (re(p,) ro (pb)))
(5)
7

---

where P represents the entire set of paraphrase pairs, each pair being formed by combining two paraphrases from the same case, rp(p) is the output of the reward model, and Py is the preferred prompt when compared to ps in a pair. We implement two training-test set partitioning strategies: (i) Intra: Dividing prompts within each case into training and testing sets at a 3:1 ratio. (ii Inter: Dividing all cases into training and testing sets at 3:1 ratio. For each case in the test set, we pair up the paraphrases and determine the correctness of the model's scoring on each pair based on their performance ranking. We report the average correctness rate across all pairs as the accuracy. As shown in Figure (b), the accuracy is near chance (0.5), suggesting hidden states provide limited insight into prompt quality.
Model Preference. We then delve into the model's ability to perceive the quality of prompts. We begin by giving the model two prompts and asking it to choose the one that would enable it to generate a more helpful, accurate, and comprehensive response. Then, we evaluate the model two ways: (i) by pairing all paraphrases and asking the model's ' preference, and (ii) by only inquiring about the model's preference between the best and worst prompts.
In all experiments, we test both arrangements of the given pair of prompts to eliminate any bias that may arise from their positioning. The metric we report is the proportion of times the model selects the prompt that leads its superior performance. As shown in Table 3 given all pairs of paraphrases, the accuracy of the Llama family models and ChatGPT hovers around 50%, with Mlmma-2-70B-hae slightly higher at 53.02%. When dealing with worst-best pairs, although the perfor- mance of all models, except for Llama-7B-chat slightly improved, the highest score only 58.92, suggesting that the models are largely unable to perceive the im- pact of the given prompts on their own performance.
Model Llamm-2-7B-chhat
All Pairs Worst-Best
50.05
49.73
Llama-2-13B-char
49.84
50.57
Llama-2-70B-chat
53.02
58.92
ChatGPT 50.16
51.00
Table 3:
In the model preference exper- iment, the model is tested with all para- phrase pairs (All Pairs) or best and worst prompt pairs (Worst-Best). We report the proportion of times the model prefers the prompt that leads to its better performance.
Discussion Our explorations over prompt perplexity, Min-k% Prob, hidden states, and model preference show that it is very challenging to identify the worst prompt in advance even with the access to the model. Note that this difficulty is often overlooked in previous studies they primarily focus on task-level instructions and assume a corresponding test set for prompt selection. Specifically, they obtain the generation results on the test set and directly measure the downstream task performance. However, this is not possible for diverse real-world user queries, which further underscores the importance of the case-level setup in ROBUSTALPACAEVAL.
Improving Worst Prompt Performance
As discussed in $2 prompt engineering and prompt consistency approaches are commonly employed to improve model performance arbitrary prompts. In this section, we investigate the effectiveness of applying these techniques to improve the worst prompt performance.
Prompt Engineering Most existing prompt engineering methodologies fall short in tackling the worst-performance issue, due to the lack of a test set for a single unlabeled prompt. Therefore, we explore two alternative strategies: (i) allowing the model to refine the prompts itself, and (ii)
implementing a voting-based generation process that takes into account all paraphrases.
Self-refinement. First, we allow the model rewrite the given prompts according its preferences, making them more conducive to generating better responses.
Voting. Another solution is to let the model perform voting- generation based on all prompts, which can be mathematically represented as:
P(u|X, = ExEx P( (x,
(6)
where represents the set of paraphrases.
8

---

Method
Orig. Perf.
Worst Perf.
Best Perf. f
Avg. Perf. t
Standard Dev. |
Llama-2-7b-chat
Raw
25.61
5,42
43.54
19.52
13.32
Self-refinement
10.09(-15.52)
1.05(-4.37)
27.38(-16.16)
9.48(-10.04)
8.72(-4.60)
Voting
22.35(-3.26)
22.35(+16:93)
22.35(-21.19)
22.35(42.83)
Distillation
18.29(-7.32)
3.89(-1.53)
40.27(-3.27)
19.31(-0.21)
12.72(-0.60)
Alama-2-13b-chle
Raw 27.48
4.83
52.05
23.97
16.25
Self-refinement
12.02(-15.46)
1.32(-3.51)
31.40(-20.65)
10.82(-13.15)
10.46(-5.79)
Voting
17.26(-10.22)
17.26(+12.43)
17.26(-34.79)
17.26(-6.71)
Distillation
25.90(11.58)
5.99(+1.16)
47.78(-4.27)
22.09(-1.88)
14.30(-1.95)
Llama-2-2 2-70b-chat
Raw 32.23
9.38
54.86
29.18
15.61
Self-refinement
13.80(-18.43)
1.02(-8.36)
49.80(-5.06)
15.65(-13.53)
17.33(+1.72)
Voting
31.36(-0.87)
31.36(+21.98)
31.36(-23.50)
31.36(42.18)
Distillation
29.30(-2.93)
7.99(-1.39)
50.15(-4.71) 26.44(-2.77)
14.83(-0.78)
Table 4: Model performance after prompt engineering (Self-refinement and Voting) and prompt consistency regularization (Distillation). The red numbers indicate a decrease performance, while the green ones represent an improvement.
Drawing inspiration from the swarm distillation method proposed by Zhou et al. 2022b), we implement unsupervised consistency regularization strategy that encourages the model's 's predictions for various paraphrases to converge.
Prompt Consistency
Swarm Distillation. To construct the training data, we utilize the SFT set (10k prompts) from the alpaca-farm dataset, and collect paraphrases based on the strategy outlined in Section For all prompts in any given case, we sample z; and zj from them and guide the output of x, based on the model's s output for z,, thereby training the model in an unsupervised manner. To devise an unsupervised model selection criterion, we define the following metrie:
N (Sig S.y)
C(X,Y) = By,ey
Σ
(7)
N
1=1
Sú
[Y, Σ
log P(Y,,u X3, Vj.ck)
(8)
where Sij is the mean of S.y overj. j. The value of C(X, Y) ranges from 0 +0C, reflecting the degree of consistency in the model's log confidence of generating outputs (Y) based on given instructions (X), with indicating totally consistent. We obverse that the consistency always decreases at first, followed by increasing, which aligns with the findings in Zhou et al. (2022b). We train models based on LoRA and stop training at the checkpoint from which C(X, Y) starts to increase.
Results Table presents several key findings: (i) Model performance significantly declines when subjected self-refined prompts, as demonstrated by -lamma--7/13/70B-000 model's average performance, which dropped by 10.04%, 13.15%, and 13.53%, respectively. This trend suggests that direct prompt engineering without reference test data can lead to degraded model behaviors. (ii) When applying the voting method, the model's best performance significantly decreases, and the average performance may also be affected (a 6.71% drop for 1-mm--2-13b-chtt However, effectively improves the worst performance, for instance, boosting the Llama-2 2--aa-----B---- 70B-chat model by 21.98, surpassing its average performance. We believe this method particularly effective in scenarios where the lower bound of model performance is of concern. This is because, even when faced with less-than-optee prompt from the user, the garaphraiigg-then-vorr deliver satisfactory results. However, this improvement comes at the cost of several-fold increase in
strategy can still

---

computational expense. (iii) While swarm distillation enhances the model's performance consistency, unfortunately results in decrease in overall performance. This is likely because the model is over-fitting to its self-generated outputs, which could introduce noise or be of lower quality than its original training data, thereby reducing the overall performance of the model.
6 Conclusion
In conclusion, this paper addressed critical gap in understanding the robustness of LLMs to prompt variations. We introduced a new benchmark that shifts the focus from task-level instructions to case- level queries. Extensive experiments on ChatGPT and six open-source LLMs, revealed the substantial performance variability across different prompts, the challenge of predicting worst prompts, and the limited efficacy of existing methods for improving the worst prompts performance. Our findings underscored the importance of continued research into prompt robustness in more realistic settings. Despite the efforts, our study is not without limitations. The range of models we examined may not be extensive enough to capture a full spectrum of insights. Additionally, alternative approaches to pinpointing worst prompts could offer deeper understanding. We advocate for future studies delve into these areas, enhancing our collective understanding.
References
Tom B. Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, Sandhini Agarwal, Ariel Herbert-Voss Gretchen Krueger, Tom Henighan, Rewon Child, Aditya Ramesh, Daniel M. Ziegler, Jeffirey Wu, Clemens Winter, Christopher Hesse, Mark Chen, Eric Sigler, Mateusz Litwin, Scott Gray, Benjamin Chess, Jack Clark, Christopher Berner, Sam McCandlish, Alec Radford, Ilya Sutskever, and Dario Amodei. Language models are few-shot learners. In Hugo Larochelle, Mare' Aurelio Ranzato, Raia Hadsell, Maria Florina Balcan, and Hsuan- Tien Lin, editors, Ad- vances in Neural Information Processing Systems 33: Annual Conference on Neural Information Processing Systems 2020, NeurIPS 2020, December 6-12, 2020, virtual, 2020.
Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open foundation and fine-tuned chat models. ArXiv preprint, abs/2307.09) 0092888, 2023.
Albert Q Jiang, Alexandre Sablayrolles, Arthur Mensch, Chris Bamford, Devendra Singh Chaplot, Diego de las Casas, Florian Bressand, Gianna Lengyel, Guillaume Lample, Lucile Saulnier, et al. Mistral 7b. ArXiv preprint, abs/2310.06825, 10.6622, 2023.
Gemma Team, Thomas Mesnard, Cassidy Hardin, Robert Dadashi, Surya Bhupatiraju, Shreya Pathak, Laurent Sifre, Morgane Rivière, Mihir Sanjay Kale, Juliette Love, et al. Gemma: Open models based on gemini research and technology. ArXiv preprint, abs/2403.08295 2024.
Jiasheng Gu, Hongyu Zhao, Hanzi Xu, Liangyu Nie, Hongyuan Mei, and Wenpeng Yin. Robustness of learning from task instructions. ArXiv preprint, abs/2212.03813 2022.
Moran Mizrahi, Guy Kaplan, Dan Malkin, Rotem Dror, Dafna Shahaf, and Gabriel Stanovsky. State of what art? call for multi-prompt Imm evaluation. ArXiv preprint, abs/2401. 200/22001.00555, 2024.
Jiuding Sun, Chantal Shaib, and Byron C Wallace. Evaluating the zero-shot robustness of instruction- tuned language models. ArXiv preprint, abs/2306. 1270, 2023.
Siheng Li, Cheng Yang, Taiqiang Wu, Chufan Shi, Yuji Zhang. Xinyu Zhu, Zesen Cheng, Deng Cai, Mo Yu, Lemao Liu, Jie Zhou, Yujiu Yang. Ngai Wong, Xixin Wu, and Wai Lam. A survey on the honesty of large language models, 2024. URL http:http/:/artttt orw. 1
Melanie Sclar, Yejin Choi, Yulia Tsvetkov, and Alane Suhr. Quantifying language models' sensitivity to spurious features prompt design or: How learned to start worrying about prompt formatting. ArXiv preprint, abs/23 11344, 2023.
10

---

Taylor Shin, Yasaman Razeghi, Robert L. Logan IV, Eric Wallace, and Sameer Singh. Auto- Prompt: Eliciting Knowledge from Language Models with Automatically Generated Prompts. In Proceedings of the 2020 Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 4222 -225.425,, Online, 2020. Association for Computational Linguisties. doi: 10.18663/v1/2020emmmpp m44...34.
Yongchao Zhou, Andrei loan Muresanu, Ziwen Han, Keiran Paster, Silviu Pitis, Harris Chan, and Jimmy Ba. Large language models are human-level prompt engineers. ArXiv preprint, abs/2211.01911 2022a.
Reid Pryzant, Dan Iter, Jerry Li, Yin Tat Lee, Chenguang Zhu, and Michael Zeng. Automatic prompt optimization with" gradient descent" and beam search. ArXiv preprint, htss/2305.034955 2023.
Archiki Prasad. Peter Hase, Xiang Zhou, and Mohit Bansal. GrIPS:
Gradient-five ffree, edit-based instruction search for prompting large language models. In Proceedings of the 17th Conference of the European Chapter of the Association for Computational Linguistics, pages 3845-3864, Dubrovnik, Croatia, 2023, Association for Computational Linguistics.
Hila Gonen, Srini Iyer, Terra Blevins, Noah A Smith, and Luke Zettlemoyer. Demystifying prompts in language models via perplexity estimation. ArXiv preprins, abs/2212.04037 2022.
Sander Schulhoff, Michael Ilie, Nishant Balepur, Konstantine Kahadze, Amanda Liu, Chenglei Si, Yinheng Li, Aayush Gupta, HyoJung Han, Sevien Schulhoff, et al. The prompt report: A systematic survey of prompting techniques. arXiv preprint arXiv:2406.0666 2024.
Weijia Shi, Xiaochuang Han, Hila Gonen, Ari Holtzman, Yulia Tsvetkov, and Luke Zettlemoyer. Toward human readable prompt tuning: Kubrick's the shining is good movie, and good prompt too? ArXiv preprint, abs/2212.1055 2022.
Boxin Wang, Weixin Chen, Hengzhi Pei, Chulin Xie, Mintong Kang, Chenhui Zhang, Chejian Xu, Zidi Xiong, Ritik Dutta, Rylan Schaeffer, et al. Decodingtrust: A comprehensive assessment of trustworthiness in gpt models. ArXiv preprint, abs/2306. 1698, 2023a.
Kaijie Zhu, Jindong Wang, Jiaheng Zhou, Zichen Wang, Hao Chen, Yidong Wang. Linyi Yang. Wei Ye, Neil Zhenqiang Gong, Yue Zhang, et al. Promptbench: Towards evaluating the robustness of large language models on adversarial prompts. ArXiv preprint, abs/2306.04528, 2023.
Jindong Wang, Xixu Hu, Wenxin Hou, Hao Chen, Runkai Zheng, Yidong Wang, Linyi Yang, Haojun Huang, Wei Ye, Xiubo Geng, et al. On the robustness of chatgpt: An adversarial and out-of- -idtt---iittiittion perspective. ArXiv preprint, 2as/2302.12095.. 2023b.
Abel Salinas and Fred Morstatter. The butterfly effect of altering prompts: How small changes and jailbreaks affect large language model performance. arXiv preprint arXiv:2401.03729 2024.
Xiang Lisa Li and Percy Liang. Prefix-tuning: Optimizing continuous prompts for generation. In Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 1 11th International Joint Conference on Natural Language Processing (Volume I: Long Papers), pages 4582-454 4597, Online, 2021. Association for Computational Linguistics. doi: 10.18653/v1/ 2021aacl-long3355
Guanghui Qin and Jason Eisner. Learning how to ask: Querying LMs with mixtures of soft prompts. In Proceedings of the 2021 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies, pages 5203-5212, Online, 2021. Association for Computational Linguistics. doi: 10.18653/v1/2021 www.l/l......aallmeeea
Brian Lester, Rami AI-Rfou, and Noah Constant. The power of scale parameter-efficient prompt tuning. In Proceedings of the 2021 Conference on Empirical Methods in Natural Language Processing, pages 3045-3059, Online and Punta Cana, Dominican Republic, 2021. Association for Computational Linguistics. doi: 10.18653/v1/200 lemnlp- cemnl-mman.... main.243.
Xiao Liu, Yanan Zheng, Zhengxiao Du, Ming Ding, Yujie Qian, Zhilin Yang, and Jie Tang. Gpt understands, too. Al Open, 2023.

---

Yulin Chen, Ning Ding, Xiaobin Wang, Shengding Hu, Hai-Tao Zheng, Zhiyuan Liu, and Pengjun Xie. Exploring lottery prompts for pre-trained language models. ArXiv preprint, abs/2305.19950 2023.
Chengrun Yang, Xuezhi Wang, Yifeng Lu, Hanxiao Liu, Quoc V Le, Denny Zhou, and Xinyun Chen. Large language models as optimizers. arXiv preprint arXiv22309.03409, 2023.
Felipe Maia Polo, Lucas Weber, Leshem Choshen, Yuekai Sun, Gongjun Xu, and Mikhail Yurochkin. tinybenchmarks: evaluating Ilms with fewer examples. ArXiv preprint, abs/2402. 14992, 2024.
Xucchen Li, Tianyi Zhang, Yann Dubois, Rohan Taori, Ishaan Gulrajani, Carlos Guestrin, Percy Liang, and Tatsunori B. Hashimoto. Alpacaeval: An automatic evaluator of instruction-folloiingg models. aitpps:/ggt thub. com http:/tttsttaa/lllaaaaaa alpaca_evaaaala 2023.
Maurice G Kendall and B Babington Smith. The problem of rankings. The annals of mathematical statistics, 10(3):275-287, 1939.
Siegel Sidney. Nonparametric statistics for the behavioral sciences. The Journal of Nervous and Mental Disease, 125(3):497, 1957.
Weijia Shi, Anirudh Ajith, Mengzhou Xia, Yangsibo Huang, Daogao Liu, Terra Blevins, Danqi Chen, and Luke Zeulemoyer. Detecting pretraining data from large language models. ArXiv preprint, 0ts/2310.16789) 2023.
Long Ouyang. Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, al. Training language models to follow instructions with human feedback. Advances in neural information processing systems, 35:27730- 27744, 2022.
Chunting Zhou, Junxian He, Xuezhe Ma, Taylor Berg-Kirkpatrick, and Graham Neubig. Prompt consistency for zero-shot task generalization. In Findings of the Association for Computational Lin- guistics: EMNLP 2022, pages 2613-2626, Abu Dhabi, United Arab Emirates, 2022b. Association for Computational Linguisties.
12

---

Number of Paraphrases
Metric
2
3
4
5
6
8
9
10
11
Worst 29.18
21.01
17.48
15.40
13.95
12.85
11.95
11.19
10.53
9.93
9.38
Best 29.18
37.34
41.97
45.17
47.55
49.42
50.94
52.18
53.23
54.11
54.86
Best
Worst
0.00
16.33
24.49
29.77
33.60
36.57
38.98
40.99
42.70
44.18
45.48
Table 5:
The average score of the Llama-2-70B-chat model across all possible combinations of different numbers paraphrases.
A Benchmark Construction
A.1 Determining the Number of Paraphrases
Basically, the worst performance decreases and the best performance increases monotonically with the number of paraphrases. While impractical to list all possible paraphrases and calculate the exact values, we find that these scores converge quickly with sufficiently large number of paraphrases. Taking Llama-2-70B as an example, we calculate the worst and best performances. along with their difference, for each combination of n (ranging from to 11) paraphrases of a case. Then, we report the average of these scores across all combinations. The results are presented Table 5] As the results show, with the increase in the number of paraphrases, the average of the model's s best/worst performance initially changes significantly and then levels off. For other models, we observe the same trend of changes. To balance the evaluation efficiency and robustness, we decided to construct 10 paraphrases for each query.
A.2 Instruction for Paraphrasing
The few-shot instruction we used for paraphrasing is as follows:
Your task is to generate 10 unique paraphrases for the given query, ensuring that the meaning of each paraphrase remains consistent, and the structure is significantly altered. Do not introduce any new information that isn' I present in the original query, and avoid omitting any crucial information from the original query. particularly any specific requirements about the output content, style, format, options, or any numbers or data. The responses to your paraphrases and the original query should be identical. If the original query contains quoted or referenced content, such as 'rewrite the following sentence: <reference>" and those enclosed in <<br><br>' you should retain this referenced content in your paraphrases and rephrase the rest of the text. Your tusk is not to answer the query, but solely to rephrase it. Please provide unique and creative rephrasing. Please note that you should provide exactly 10 paraphrases, not less. Output each paraphrase separated by "IIll".
The examples provided below are for illustrative purposes only. In the examples, only one paraphrase is provided and the other nine are omitted for brevity. However, in your output, you should provide all 10 paraphrases.
Examples:
Query:
"Why it that only proteins, carbohydrates and are deemed have caloric value? Jur>>ust to clarify-conse ciciffyccom consider the hypothetical situation below:<bre 100g of "carbohydrates' = 400kCall<br>>> 100g of "protein' 400kCal<bb> of "fat" 900kCal<br> 100g of "vitamins, minerals and/or other electrolytes' ="
Output: Why are proteins, carbohydrates, and fats the only substances considered to have caloric value? To provide further clarification, let's le''s consider the hypothetical scenario below: If 100g of carbohydrates provide 400kCal, 100g of protein provides 400kCal, and 100g of fat provides 900kCal, what would be the caloric value of 100g of vitamins, minerals, and/or other electrolytes? IIII <other nine paraphrases are omitted for brevity>
have this text: <br><br> We use professional processes. Use the photo delivery system, check the quality and send it to the customer immediately. We started editing digital photos from the first wave of 2000. Started with editing personal photos, and then spread our passion by editing wedding photos restoring old photos for loved ones, friends and family, friends and cus-
Query:
13

---

tomers. 2005 started local photo shop and started commercial photo editing, product photography for manufacturers. 2007 implemented online projects on freelancer platforns. <orrecbbbb<>bbbb Rewrite in professional style to tell a touching story."
Output: possess this text: <br><<r>> We use professional processes. Use the photo delivery system, check the quality and send it to the customer immediately. We started editing digital photos from the first wave of 2000. Started with editing personal photos, and then spread our passion by editing wedding photos restoring old photos for loved ones, friends and family. friends and customers. 2005 started a local photo shop and started commercial photo editing, product photography for manufacturers. 2007 implemented online projects freelancer platforms. <br> <or>>br>>Be <ere<bbrrriieeeee <br>Rbbhrase it in a professional manner to narrate a moving story.
Query: "I want you to act as a Tiktok Ads Keywords generator. Your task is to come up with keywords that be used in Tiktok advertising campaigns. The keywords should be relevant to the target audience and the product or service being advertised. Your responses should not include more than 5 keywords per request."
Output: Your role will be to serve as TikTok Ads Keywords generator. Your objective is to generate relevant keywords that can be utilized in TiKTok advertising campaigns. These keywords should effectively larget the desired audience and align with the product or service being promoted. Please provide no more than five keywords per request in your responses.
Now, please generate 10 paraphrases for the given query.
Query: (input__query Output:
B Identifying the Worst Prompts
mistral-7b 7b
mistral-
(0:30, 0.60]
gemma-76
[-0 30, 0.00]
00.00
gemma-2b
(-1.00, -0.60]
gemma-20
0%.0%
40.00
00.0%
20.0%
0.0%
20.0%
40.0%
60.0%
60.0%
40.0%
20.0%
0.0%
20.0%
40.0%
60.0%
Figure 6: Distribution of Pearson correlation coefficients between model performance and prompt perplexity (left) and prompt's 's Min-K% Prob (right) for Gemma family models and Mistral-7H model across all cases.
60-
20
-10-
-20
90
-00
-20
Figure 7: Visualization of the hidden states from Llama-2-13B- (left) and Llama-2-70B-chh (right) models using 2-dimensional PCA. The color gradient, from light to dark, represents the ranking of model performance each case's 11 prompts, from low to high.
14

---

100
-350 -100
-00
50
100 150
700
-10
Figure 8: Visualization of the hidden states from Mistral-7B (left) and Gemma-2B (right) models using 2-dimensional PCA. The color gradient, from light to dark, represents the ranking of model performance on each case's 1l prompts, from low to high.
-50
-100
Figure 9: Visualization of the hidden states from Gemma-7B model using 2-dimensional PCA. The color gradient, from light to dark, represents the ranking of model performance on each case's 11 prompts, from low high.
Original Instruction (Score: 0.9922)
the basis subject the email, determine whether email should treated spam Denmatologists don't like her!
Output:
Based the subject of the email, likely that the email should be treated spam. The use of the phruse "Dermatologists don't like her" likely to be sensationalized or misleading claim
Paraphrase (Score: 0.0005)
Examine the email topic ascertain if it should cutegorized spam. Subject: Dermatologists don't like her!
Output:
This emuiil topic does not appeur to be ypam. Here's why: 1. Relevance: It is not generic random topic that is often associated with spam cmails. 2. Urgency: ... 3. Porsonalization: The email is addressed to spocific person, which suggests that it may be a legitimate message rather than mass email blast. Grammar and spelling: The email appears be well-written and free obvious grammatical and spelling errors, which another indicator that it may be logitimate message. these factors, it unlikely that this email should categorized spam.
Figure 10: Example for sensitive cases. Despite providing instructions (other paraphrases are emitted for brevity) with the same semanties, the output from Llama2- Llama2-7b-chat 7b-chat completely contradictory. Furthermore, there are numerous inaccurate expressions (highlighted in red) in the underperforming response.
15

---

NeurIPS Paper Checklist
1. Claims
Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Question:
Answer: [Yes]
Justification:
In the abstract and Section | (Introduction)
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results
be expected to generalize other settings.
is fine to include aspirational goals as motivation as long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: In Section (Conclusion).
Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification. asymptotic approximations only holding locally). The authors should reflect how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low images are taken in low lighting. Or speech-to-text system might be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach address problems of privacy and faimess.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory Assumptions and Proofs
Question:
For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
16

---

Justification:
The paper does not include theoretical results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental Result Reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: In Section (Benchmarking the Worst Prompt Performance). (Identifying the Worst Prompts) and 5 (Improving Worst Prompt Performance).
Guidelines:
The answer NA means that the paper does not include experiments. If the paper includes experiments, No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome deseribe the particular way they provide for reproducibility, In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
17

---

Answer: [No]
Justification: Upon acceptance, we will make our code publicly accessible. Additionally, we will ensure to provide comprehensive details to facilitate the complete reproduction of our results.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.cc cc/
public/ wtte:/gddde/eedduuuueee ssionPolicy) for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to reproduce the results. See the NeurlPS code and data submission guidelines (https //nips.cc/pblll wttp://iiciiguuie///eeeeeeeee//e
www.isssioososiioie for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible supplemental material (appended the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental Setting/Details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: In Sections 3 (Benchmarking the Worst Prompt Performance). (Identifying
the Worst Prompts) and 5 (Improving Worst Prompt Performance).
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to a level detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, supplemental material.
7. Experiment Statistical Significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [No]
The primary focus of this paper is the development of a novel benchmark and the preliminary assessment model performance. The benchmark has been curated to assess the models" worst prompt performance, rendering the inclusion of error bars less pertinent to our primary research goals.
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for
example, train/test split, initialization, random drawing of some parameter, or overall with given experimental conditions).
18

---

The method for calculating the error bars should be explained (closed form formula, call a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma enror bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are range (e.g. negative enror rates).
If error bars reported in tables plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables the text.
8. Experiments Compute Resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [No]
Justification: Given that our experiments do not require substantial computational resources, we have not specifically outlined the computer resources needed for the experiments.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).
9. Code Of Ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics httppp///errrrs...c//o///cccttta
Answer: [Yes]
Justification: This paper adheres to the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special cireumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. if there is special consid- eration due to laws or regulations their jurisdiction).
10. Broader Impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [NA]
Justification: This paper focuses on the prompt robustness of large language models and does not introduce privacy, security, or faimess issues.
Guidelines:
The answer NA means that there no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has no societal impact why the paper does not address societal impact.
19

---

Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), faireess considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper deseribe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification:
The paper does not present any such risks.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [Yes]
Justification: In Section (Benchmarking the Worst Prompt Performance).
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website). the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in package should be provided. For popular datasets, papersswl swi thcode. swooodee com/ datasttss has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
20

---

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if has changed) should be provided.
If this information is available online, the authors are encouraged to reach out to the asset's s creators.
13. New Assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [Yes]
Justification: Yes, we will submit the data for the proposed benchmark in the supplementary materials.
Guidelines:
The answer NA means that the paper does release assets.
Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include an anonymized zip file.
14. Crowdsourcing and Research with Human Subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and sereenshots, if applicable, as well details about compensation (if any)?
Answer: [NA]
Justification: The paper does not involve crowdsoureing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: The paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and expect authors to adhere to the NeurlPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if' applicable), such the institution conducting the review.
21


Reviews:
[{"review_id": "8T6T4yCrGf", "reviewer": "Reviewer_y4yW", "summary": "This paper studies the worst performance an LLM can have on input queries by testing on paraphrases of each query and report the original, worst, best, and average performance. It has been found that there is a large gap between the best and worst performance. It is then found that there is no particular \"worst prompt\" among all models or even models from the same family. Furthermore, model-dependant features like are also not useful in identifying the worst prompt. Finally, authors explored a few approaches to try to improve the \"worst performance\". In particular, voting seems effective in improving the lower bound at the cost of harming the upper bound.", "questions": "- I wonder if you could provide a clear and reproducible definition of the worst and best performance in mentioned line 121. From the writing, I think regarding whether a query is correctly responded by the model: worst=all(prompt1, prompt2, ...) and best=any(prompt1, prompt2, ...). Is this correct? \n    - If this is the case, I think the more paraphrases we have, the higher we get for the best performance and vice versa for the worst performance. This might make the number of paraphrases a bit arbitrary. The worst-best gap might also be inflated.\n\n\n- Throughout the paper, starting with line 15, I think the phrase \"worst prompt\" is not precise---we cannot call them good or bad per se unless proven. I think that you mean the prompt paraphrase that leads to the worst performance.", "limitations": "The paper touches on limitations like not experimenting enough models and enough techniques in finding the \"worst prompt\".", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- This paper discusses an important question to study, that is the lower bound performance of LLMs on different prompts. It is interesting to know that identifying the prompt that leads to bad performance is difficulty by looking at the prompts alone or using an LLM itself.", "weaknesses": "- I think the definition of the \"worst\" or \"best\" performance is not clearly stated (line 121). If I understood correctly, the worst performance will monotonically drop if we have more paraphrases of each query. This is linked to the question below and I hope that the authors can clarify on this.\n- Using paraphrases to study prompt variation could introduce errors and paraphraser/LLM preference mismatch. It might be questioned that Table 1 and Table 4's average performance is almost always lower than the original performance. Does this mean that the paraphrasing process has introduced errors, domain shifts, etc?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your thoughtful review and highlighting our work's strengths. We appreciate your constructive feedback on areas needing further elaboration. We address each of your points below.\n\n**[W1 & Q1]: definition of the \"worst\" or \"best\" performance & the number of paraphrases**\n\n**[A1]**: Thank you for your insightful questions. Your understanding is essentially correct. In our study, \"worst\" and \"best\" performance refer to the lowest and highest performance among all paraphrases of a query. The only correction needed is that the metric we use is based on the evaluator scoring the model's output on a continuous scale from 0 to 100. Therefore, we have: worst=min(prompt1, prompt2, …), and best=max(prompt1, prompt2, …).  \n\nIndeed, the worst/best performance decreases/increases monotonically with the number of paraphrases (n). While it is impractical to list all possible paraphrases and calculate exact values, we find that these scores converge quickly with a sufficiently large number of paraphrases. Taking Llama-2-70B as an example, we calculated the worst/best performance and their difference from n=1 to 11 as below (We report the averaged score across all possible combinations and the standard deviations). For other models, we observe the same trend of changes. To balance the evaluation efficiency and robustness, we decided to construct 10 paraphrases for each query.\n\n| Metric | n=1 | n=2 | n=3 | n=4 | n=5 | n=6 | n=7 | n=8 | n=9 | n=10 | n=11 |\n| :----: | :----: | :----: | :----: | :----: | :----: | :----: | :----: | :----: | :----: | :----: | :----: |\n| Worst | 29.18(1.42) | 21.01(1.25) | 17.48(1.26) | 15.4(1.14) | 13.95(1.02) | 12.85(0.92) | 11.95(0.83) | 11.19(0.73) | 10.53(0.59) | 9.93(0.42) | 9.38(0.0) |\n| Best | 29.18(1.42) | 37.34(1.82) | 41.97(1.77) | 45.17(1.64) | 47.55(1.47) | 49.42(1.28) | 50.94(1.08) | 52.18(0.88) | 53.23(0.67) | 54.11(0.43) | 54.86(0.0) |\n| Best - Worst | 0.0(0.0) | 16.33(2.48) | 24.49(2.54) | 29.77(2.32) | 33.6(2.06) | 36.57(1.79) | 38.98(1.53) | 40.99(1.25) | 42.7(0.96) | 44.18(0.63) | 45.48(0.0) |\n\n\n**[W2]: Does the paraphrasing process introduce errors, domain shifts, etc?**\n\n**[A2]**: We would like to clarify that we manually reviewed and revised all paraphrases to ensure semantic equivalence and human-like fluency, for which errors or domain shifts are largely prevented. Regarding the relationship between the average and original performance, we consider the instances where the average performance is lower than the original to be coincidental, as there are also instances where the opposite is true (2/7 in Table 1, 5/12 in Table 4). Note that the original performance is measured only by a single paraphrase. The randomness further underscores the value of our benchmark setup.\n\n**[Q2]: Clarification on the phrase \"worst prompt\".**\n\n**[A3]**: Thank you for pointing this out. We intend to use \"worst prompt\" to refer to the paraphrase of a query that causes the model to perform the worst. We will clarify this in our next version.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "P1d9EPw6vZ", "reviewer": "Reviewer_7q8k", "summary": "This paper proposes a new benchmark, RobustAlpacaEval, a benchmark with semantically equivalent queries. The authors evaluate performance as the worst performance across all the prompts and show that many prompt consistency methods have a limited improvement on this benchmark. The paper also shows that it is difficult to predict which prompts will have a poor performance.", "questions": "- Can the authors suggest some potential directions for resolving the issue raised in the paper?\n- When creating a benchmark like this, the number of prompts can be increased arbitrarily, and the accuracy could be extremely low if the right prompts are chosen. Similarly, one could create an adversarial setting to test the robustness of each model. Why did you design the benchmark in this way?\n- How do the authors envision that this benchmark be used? For example, should all future models be forced to evaluate on RobustAlpacaEval? Because there are many more prompts for each sample, this would lead to a multiplicative factor on the cost for inference.", "limitations": "Yes", "rating": 5, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- The paper has a variety of key findings (Section 3.2). First, the authors find that there is a large gap between worst and best performance. Second, the authors find that scaling does not help robustness. Third, the authors find that there is little agreement between various models on which prompts are harder and/or easier. \n- The experiments are thorough and well conducted. \n- The findings open up doors for future research and efforts to make models more robust.", "weaknesses": "- The variance of a model to different prompts has been studied several times in the literature (for example, see [1]), and it is unclear to me how a benchmark measuring worst-case performance would be used. I would appreciate if the authors provided more clarity on how they envision that this work could shed insight and facilitate future efforts.\n- In Section 5, only Llama models are considered, which makes it unclear whether the insights discovered also apply to other models or are unique to Llama.\n- The paper would be much stronger if the authors proposed a method to mitigate the phenomenon demonstrated in the paper, or if the authors gave a detailed explanation of why the identified phenomenon occurs.\n\n[1] https://arxiv.org/abs/2401.03729", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We appreciate your in-depth review and the recognition of our novelty, the importance, and the empirical results. We understand your concerns and address them with the following clarifications.\n\n**[W1]: relation to prior work &  future impact of our work.**\n\n**[A1]**: Thank you for your insightful questions. Our work significantly differs from most previous research in two aspects. First, we focus on the model's robustness when faced with prompts that have the same meaning, unlike methods that introduce intentional perturbations, potentially affecting the semantics (e.g.,  [1] focuses on a few special prompt perturbations, including changes in output format, jailbreaks, and tipping strategies, which can alter the semantics of the original prompts). Second, We investigate the impact of paraphrasing case-level user queries, which is more aligned with real-world needs compared to past studies that focused solely on task-level instructions. We will add the discussion about [1] in our revisions. \n\nThe significance of our work lies, first and foremost, in pioneering the shift from task-level instructions to case-level queries and capitalizing on the concept of worst prompt performance. Our benchmark provides a general test for evaluating a model's ability to provide stable responses for real-world users before deploying LLMs. Our experiments highlight the great challenge of identifying the worst prompt and improving their performance in this realistic setting. Our results thoroughly examine existing efforts in reducing model sensitivity to prompt variations and clearly delineate their limitations.\n\n**[W2]: results for other models.**\n\n**[A2]**: Thanks for your constructive suggestion. We would like to emphasize that we have already presented the results using LLMs of different scales in Table 4. For other model families, we observed similar phenomena and omitted the discussion for saving space. For example, the results on Gemma-1.1-2b-it are given in the following table. We can see that the general conclusions (Line 311 to 325) regarding the effect of different methods (self-refinement, voting, and distillation) are consistent with those of the llama family.\n\n| Method | Orig. Perf.&uarr; | Worst Perf.&uarr; | Best Perf.&uarr; | Avg. Perf.&uarr; | Standard Dev.&darr; |\n| :----: | :----: | :----: | :----: | :----: | :----: |\n| Raw | 16.32 | 4.42 | 36.6 | 15.27 | 11.78 |\n| Self-Refinement | 6.75(-9.57) | 0.03(-4.39) | 18.44(-18.16) | 4.55(-10.72) | 6.06(-5.72) |\n| Voting |14.30(-2.02) | 14.30(+9.88) | 14.30(-22.30) | 14.30(-0.97) | - |\n| Distillation | 13.08(-3.24) | 1.67(-2.75) | 31.36(-5.24) | 11.28(-3.99) | 9.93(-1.85) |\n\n**[W3]: Mitigation or explanation of the phenomenon.**\n\n**[A3]**: We explored various methods to identify the worst prompt and improve the model's robustness. Unfortunately, all these methods are not effective enough to mitigate the problem. In addition to the automatic analysis presented in the paper, we conducted extensive manual analysis on the worst prompt and found no discernible difference between the worst- and best-performing prompts that humans can perceive. We believe that understanding and addressing this problem requires a deeper understanding and knowledge of the LLMs. For instance, we observe a high overlap rate of worst prompts among models within the same family, which we hypothesize stems from their shared preferences shaped by factors like the distribution of training data (which is not fully accessible to us).\n\n**[Q1]: Potential directions for resolving the issue.**\n\n**[A4]**: Our research reveals that existing efforts for reducing model sensitivity are not as effective in our setup. We are actively exploring strategies such as prompt engineering techniques, model retraining with paraphrases, and integrating external knowledge sources to alleviate this issue. \n\n**[Q2]: the number of prompts & designing the benchmark.**\n\n**[A5]**: The worst/best performance decreases/increases monotonically with the number of paraphrases (n). While it is impractical to list all possible paraphrases and calculate exact values, we find that these scores converge quickly with a sufficiently large number of paraphrases. Taking Llama-2-70B as an example, we calculated the worst and best performance from n=1 to 11 as below (We report the averaged score across all possible combinations and the standard deviations). For other models, we observe the same trend of changes. To balance the evaluation efficiency and robustness, we decided to construct 10 paraphrases for each query.\n\n| Metric | n=1 | n=2 | n=3 | n=4 | n=5 | n=6 | n=7 | n=8 | n=9 | n=10 | n=11 |\n| :----: | :----: | :----: | :----: | :----: | :----: | :----: | :----: | :----: | :----: | :----: | :----: |\n| Worst | 29.18(1.42) | 21.01(1.25) | 17.48(1.26) | 15.4(1.14) | 13.95(1.02) | 12.85(0.92) | 11.95(0.83) | 11.19(0.73) | 10.53(0.59) | 9.93(0.42) | 9.38(0.0) |\n| Best | 29.18(1.42) | 37.34(1.82) | 41.97(1.77) | 45.17(1.64) | 47.55(1.47) | 49.42(1.28) | 50.94(1.08) | 52.18(0.88) | 53.23(0.67) | 54.11(0.43) | 54.86(0.0) |\n\nIt is noteworthy that the construction of our benchmark is not tailored to any specific model but provides a general testing method to evaluate the robustness of models when faced with semantically equivalent but differently phrased instructions. As the experimental results show, different models exhibit similar fluctuations in their performance, while the worst prompts for each model are unique.\n\n**[Q3]: The usefulness of the benchmark.**\n\n**[A6]**: We envision ROBUSTALPACAEVAL as a tool in the broader toolkit for evaluating LLMs. Models can be evaluated on this benchmark to ensure they meet a minimum standard of robustness. While the increased number of prompts raises computational costs, this is balanced by the critical insight it provides into model reliability.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "UllqGHvMn9", "reviewer": "Reviewer_H71g", "summary": "In this paper, the author(s) propose a benchmark for prompt performance of large language models. In particular, the author(s) leverage GPT4 to generate variants of prompts and hence constitute a dataset. Afterwards, the author(s) evaluate the performance of these generated prompts, and explore the identification and improvement of worst cases.", "questions": "- Section 2: A related work can be added and analysed. Schulhoff, S., Ilie, M., Balepur, N., Kahadze, K., Liu, A., Si, C., ... & Resnik, P. (2024). The Prompt Report: A Systematic Survey of Prompting Techniques. arXiv preprint arXiv:2406.06608.\n- Please elaborate the motivation and result analysis for exploring the hidden states in Section 4.2.\n- I wonder if the author(s) consider sharing the dataset used in this project?\n- The author(s) can consider specifying the selection criteria of LLMs used in experiments.\n- Please consider using bold in tables to highlight the noteworthy data.\n- It will be interesting to summarize the features/patterns of worst prompts for different LLMs.\n- Please adjust the place of tables and figures to improve readability. For instance, Figure 3 is on Page 6 while it is described on Page 7.", "limitations": "- The author(s) note that the research can be extensive by including more LLMs, and applying alternative approaches to identify worst prompts.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 4, "contribution": 3, "strengths": "- This study acknowledges the variation and diversity of prompts in real-world, and adds value to the prompt engineering for LLMs.\n- The proposed benchmark is applied to multiple LLMs. Thorough comparison analysis is conducted.\n- The paper is well-organized, and the language is technical yet understandable for readers with domain knowledge.", "weaknesses": "- The methodology and result analysis of this study can be elaborated.\n- Result visualization can be improved for better readability.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your valuable insights of our work. We appreciate your thoughtful feedback, and we would like to address your concerns as follows:\n\n**[W1]: The methodology and result analysis of this study can be elaborated.**\n\n**[A1]**: We appreciate the reviewer's feedback on the need for a more detailed explanation of our methodology and result analysis. We will expand on the rationale behind our method and provide a more thorough interpretation of the results when more space is allowed.\n\n**[W2]: Result visualization can be improved for better readability.**\n\n**[A2]**: We will work on enhancing the clarity and effectiveness of our visual presentations, ensuring that key findings are prominently displayed.\n\n**[Q1]: Section 2: A related work can be added and analysed. Schulhoff, S., Ilie, M., Balepur, N., Kahadze, K., Liu, A., Si, C., ... & Resnik, P. (2024). The Prompt Report: A Systematic Survey of Prompting Techniques. arXiv preprint arXiv:2406.06608.**\n\n**[A3]**: Thank you for your suggestion. This survey has a nice summary of existing prompting techniques and we are happy to include this work in our next version.\n\n**[Q2]: Please elaborate the motivation and result analysis for exploring the hidden states in Section 4.2.**\n\n**[A4]**: As demonstrated by many previous works, hidden states can reflect a model's perception and preferences. Our motivation for studying hidden states is to determine whether there is a correlation between the model's own encoding of the prompt and its performance.\n\nWe conducted two experiments [Line 243-259]. The PCA results showed no clear boundary between the representations of prompts with different performance levels; in the other experiment, we trained a classifier to predict which prompt the model performs better on based on the hidden states, and found that the trained classifier only achieved about 50% accuracy on the test set. The results of both experiments indicate that it is difficult to predict the model's performance based on the model's representation of the prompt.\n\n**[Q3]: I wonder if the author(s) consider sharing the dataset used in this project?**\n\n**[A5]**: We have released the dataset used in this project. We will ensure that the dataset is properly documented.\n\n**[Q4]: The author(s) can consider specifying the selection criteria of LLMs used in experiments.**\n\n**[A6]**: We selected models based on their popularity and advanced nature. These models represent the state-of-the-art open-source LLMs and are widely adopted in existing research.\n\n**[Q5]: Please consider using bold in tables to highlight the noteworthy data.**\n\n**[A7]**: We will implement this to make the most significant findings and differences between conditions more apparent at a glance.\n\n**[Q6]: It will be interesting to summarize the features/patterns of worst prompts for different LLMs.**\n\n**[A8]**: We conducted extensive manual analysis and found no discernible difference between the worst- and best-performing prompts that humans can perceive. We observe a high overlap rate of worst prompts among models within the same family, which we hypothesize stems from their shared preferences shaped by factors like the distribution of training data (which is not fully accessible to us), indicating a need for a deeper understanding and knowledge of the LLMs.\n\n**[Q7]: Please adjust the place of tables and figures to improve readability. For instance, Figure 3 is on Page 6 while it is described on Page 7.**\n\n**[A9]**: We will review and adjust the positioning of these elements to ensure they appear as close as possible to their first reference in the text.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "wdCot1S9D0", "reviewer": "Reviewer_4kDi", "summary": "This paper introduces a new benchmark, ROBUSTALPACAEVAL, that contains semantically equivalent queries of diverse real-world tasks, and uses it to conduct extensive experiments on ChatGPT and six open-source LLMs. It highlights variability in model performance and difficulties in predicting the worst prompt.", "questions": "- How is prompt perplexity calculated?\n- Are there any common features among the worst-performing prompts within the same model family? The paper points out the difficulty in predicting the worst prompts, both model-independently and with model access. Given that the overlap rate of model-agnostic worst-4 prompts reaches about 40% in the Gemma family, an analysis comparing the features of the worst and best prompts could be insightful.", "limitations": "The paper includes a limited selection of LLMs, and the challenge of effectively improving the worst-performing prompts remains unresolved.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "- This work introduces a new benchmark focused on diverse real-world user queries rather than task-level instructions, which more closely mirrors real-world scenarios.\n- It conducts comprehensive evaluations across several LLMs and showcases variability in model performance across different prompts.\n- They tried several methods to improve the worst prompt and show the limitations of current method.", "weaknesses": "- The methodology utilizes gpt4_turbo as the evaluator and the reference model for outputs, which might introduce biases. A discussion of this potential bias should be included.\n- The ROBUSTALPACAEVAL benchmark contains 10 paraphrases per given query. It’s unclear how performance disparities between the worst and best prompts would change with an increased number of paraphrases. This might also affect the robustness of cases with significant performance gaps.\n- While the study explores several LLM families including Llama, Gemma, and Mistral, it includes only one version of ChatGPT and does not specify which version. Whether the prompts are uniform across different ChatGPT versions is unknown.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your thorough review and for highlighting the strengths of our work. We appreciate your constructive feedback requiring further clarifications. Below, we address each of your points in detail.\n\n**[W1]: The methodology utilizes gpt4_turbo as the evaluator and the reference model for outputs, which might introduce biases. A discussion of this potential bias should be included.**\n\n**[A1]**: Thank you for your insightful questions. The evaluation metric we use is introduced by the AlpacaEval 2.0 benchmark, which has been proven to achieve high consistency to human evaluations and has been widely adopted by the LLM research community. Additionally, following the common practice, all models are first compared with gpt4_turbo then we compare their win rates. Therefore, if the assumed bias is present, all models are affected, ensuring a fair comparison. We will include the above discussion in our revisions.\n\n**[W2]: The ROBUSTALPACAEVAL benchmark contains 10 paraphrases per given query. It’s unclear how performance disparities between the worst and best prompts would change with an increased number of paraphrases. This might also affect the robustness of cases with significant performance gaps.**\n\n**[A2]**:  Indeed, the worst/best performance decreases/increases monotonically with the number of paraphrases (n). While it is impractical to list all possible paraphrases and calculate exact values, we find that these scores converge quickly with a sufficiently large number of paraphrases. Taking Llama-2-70B as an example, we calculated the worst/best performance and their difference from n=1 to 11 as below (We report the averaged score across all possible combinations and the standard deviations). For other models, we observe the same trend of changes. To balance the evaluation efficiency and robustness, we decided to construct 10 paraphrases for each query.\n\n| Metric | n=1 | n=2 | n=3 | n=4 | n=5 | n=6 | n=7 | n=8 | n=9 | n=10 | n=11 |\n| :----: | :----: | :----: | :----: | :----: | :----: | :----: | :----: | :----: | :----: | :----: | :----: |\n| Worst | 29.18(1.42) | 21.01(1.25) | 17.48(1.26) | 15.4(1.14) | 13.95(1.02) | 12.85(0.92) | 11.95(0.83) | 11.19(0.73) | 10.53(0.59) | 9.93(0.42) | 9.38(0.0) |\n| Best | 29.18(1.42) | 37.34(1.82) | 41.97(1.77) | 45.17(1.64) | 47.55(1.47) | 49.42(1.28) | 50.94(1.08) | 52.18(0.88) | 53.23(0.67) | 54.11(0.43) | 54.86(0.0) |\n| Best - Worst | 0.0(0.0) | 16.33(2.48) | 24.49(2.54) | 29.77(2.32) | 33.6(2.06) | 36.57(1.79) | 38.98(1.53) | 40.99(1.25) | 42.7(0.96) | 44.18(0.63) | 45.48(0.0) |\n\n**[W3]: While the study explores several LLM families including Llama, Gemma, and Mistral, it includes only one version of ChatGPT and does not specify which version. Whether the prompts are uniform across different ChatGPT versions is unknown.**\n\n**[A3]**: The version of ChatGPT we utilize is gpt-3.5-turbo-1106.\n\n**[Q1]: How is prompt perplexity calculated?**\n\n**[A4]**: We calculate the average log probability of all the tokens in the prompt and take the inverse of the exponential of the average log probability as the perplexity of the prompt.\n\n**[Q2]: Are there any common features among the worst-performing prompts within the same model family? The paper points out the difficulty in predicting the worst prompts, both model-independently and with model access. Given that the overlap rate of model-agnostic worst-4 prompts reaches about 40% in the Gemma family, an analysis comparing the features of the worst and best prompts could be insightful.**\n\n**[A5]**: We conducted extensive manual analysis and found no discernible difference between the worst- and best-performing prompts that humans can perceive. We observe a high overlap rate of worst prompts among models within the same family, which we hypothesize stems from their shared preferences shaped by factors like the distribution of training data (which is not fully accessible to us), indicating a need for a deeper understanding and knowledge of the LLMs.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "14U1znRfSS", "reviewer": "Reviewer_Wkdh", "summary": "The authors propose a new benchmark to study the robustness of LLMs to prompt variations. Different from previous work, this paper mainly focuses on semantically equivalent prompts rather than taks-level instructions. The experiments demonstrate that many popular LLMs are sentitive to the form of prompts. Moreover, it is difficult to detect the worst prompt and improve the worst prompt performance.", "questions": "See Weaknesses.", "limitations": "The authors have adequately addressed the limitations.", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. Research Value: The paper tackles a highly relevant problem that has substantial implications for the practical deployment of LLMs. The issue of prompt sensitivity is critical and the paper provides valuable insights into this domain.\n\n2. Clarity of Motivation: The authors have effectively articulated the motivation behind their work. The introduction and the problem statement are clear, setting the stage for the reader to understand the importance of the study.", "weaknesses": "1. Lack of Solution: While the paper adeptly identifies the problem of prompt variability and its impact on LLM performance, it falls short of proposing an effective solution to mitigate this issue. The research would benefit from the inclusion of potential remedies or strategies to enhance prompt robustness.\n\n2. Inconsistency in Description: There appears to be a discrepancy between the textual description and the visual representation (Figure 1) regarding the focus on task-level instructions versus case-level inputs. Clarification on this point is needed to avoid any confusion for the readers.\n\n3. Limited Scope of Experimentation: The experiments, while extensive, do not include testing on more advanced models such as GPT4. The performance of the proposed benchmark on state-of-the-art models would provide a more comprehensive understanding of the robustness of the latest LLMs.\n\n4. Language Specificity: The study seems to be limited to English language prompts. Given the global application of LLMs, it would be beneficial to extend the experiments to include other languages to assess the generalizability of the findings.\n\n5. Prompt Diversity Validation: The paper does not explore whether incorporating a diverse set of prompts in the SFT stage could potentially improve model's worst prompt performance. An analysis of this nature would add depth to the paper's contribution.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for the positive feedback. We appreciate that you acknowledge the thorough evaluations and insightful guidelines in our paper. We provide point-to-point responses to address your concerns as follows:\n\n**[W1]: potential remedies or strategies to enhance prompt robustness.**\n\n**[A1]**: Thank you for your insightful questions. We explored various methods to identify the worst prompt and improve the model's robustness. Unfortunately, the investigated methods are not effective enough to mitigate the problem. We would like to clarify that the spotting of this problem is also a valuable contribution as it has been neglected by previous work. As a consequence, previous solutions fail to address the problem.\n\nThe contribution of our work lies, first and foremost, in pioneering the shift from task-level instructions to case-level queries and capitalizing on the concept of worst prompt performance. Our benchmark provides a general test for researchers to evaluate a model's ability to provide stable responses for real-world users before deploying LLMs. Our comprehensive experiments highlight the great challenge of identifying the worst prompt and improving their performance in this realistic setting. Our results thoroughly examine existing efforts in reducing model sensitivity to prompt variations and clearly delineate their limitations.\n\nWe anticipate other attempts like prompt engineering techniques, model retraining with paraphrases, and integrating external knowledge sources can potentially address this problem, and we leave them for further work.\n\n**[W2]: There appears to be a discrepancy between the textual description and the visual representation (Figure 1) regarding the focus on task-level instructions versus case-level inputs. Clarification on this point is needed to avoid any confusion for the readers.**\n\n**[A2]**: Could you please specify where you perceive a discrepancy in the statement? Currently, we use task-level instructions and case-level inputs to represent the two parts into which previous studies decompose a complete case-level query. In our setting, we study the variations of case-level queries and do not distinguish between instructions and inputs.\n\n**[W3]: The experiments, while extensive, do not include testing on more advanced models such as GPT4. The performance of the proposed benchmark on state-of-the-art models would provide a more comprehensive understanding of the robustness of the latest LLMs.**\n\n**[A3]**: We selected models based on their popularity and advanced nature. These models represent the state-of-the-art open-source LLMs and are widely adopted in existing research. Due to the limited budget for GPT4, we did not test the performance of the GPT4 model. \n\n**[W4]: The study seems to be limited to English language prompts. Given the global application of LLMs, it would be beneficial to extend the experiments to include other languages to assess the generalizability of the findings.**\n\n**[A4]**: Thank you for your suggestion. We anticipate that other languages would face similar, possibly more severe, issues given the current LLMs are mostly trained in English. We will investigate whether other languages face the same issues in future work.\n\n**[W5]: The paper does not explore whether incorporating a diverse set of prompts in the SFT stage could potentially improve a model's worst prompt performance. An analysis of this nature would add depth to the paper's contribution.**\n\n**[A5]**: In fact, current state-of-the-art LLMs (those included in our study) have been extensively fine-tuned using a huge number of diverse prompts. Nevertheless, our experiment results show that they are still not robust enough to address our benchmark. Additionally, the swarm distillation technique we used in our experiments [Line 298-310] is related to the SFT you mentioned. It works by aligning the outputs generated by the model for different paraphrases to improve the consistency of the model's results. Our results indicate that the benefits of this method are not significant.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: The paper studies the worst performance of LMMs through a new benchmark they propose as part of this study that is composed of semantically equivalent queries generated and proposes to use the lower bound of model performance that helps characterize a lower bound for model performance. The reviewers unanimously recommend its acceptance. They mention that the paper is well written, noted the importance of the problem and commended on the thoroughness of experiments. I therefore recommend its acceptance.
Decision: Accept (poster)