💬 NLP

When Do LLM Agents Treat Surface Noise Differently from Semantic Noise? A 68-Cell Measurement Study with a Held-Out Trace-Level Validation

This empirical study of 68 experimental cells across ten large language models demonstrates that meaning-bearing perturbations disrupt agent reasoning and final answers significantly more than presentation-based noise of comparable severity, a finding validated on a held-out model and attributed to a "stealth-divergence" mechanism where semantic noise induces divergence in intermediate reasoning steps rather than initial actions.

Original authors: Liyun Zhang, Jiayi Guo

Published 2026-05-26

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Liyun Zhang, Jiayi Guo

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a very smart, over-achieving student (an AI Agent) who solves complex math and logic problems by talking to themselves out loud. This student writes down every step of their thinking before giving the final answer. This is called "Chain of Thought."

The researchers in this paper wanted to know: Does it matter how you ask the student a question?

Specifically, they tested two types of "noise" or changes to the question:

The "Meaning" Change: Rewording the question using synonyms or paraphrasing it (e.g., changing "How many apples?" to "What is the total count of fruit?"). The meaning is the same, but the words are different.
The "Presentation" Change: Shuffling the order of words, changing the font, adding random distracting sentences, or messing up the spacing. The meaning is the same, but the look is different.

The Big Discovery: The "Silent Corruption"

The researchers found a surprising gap. When they changed the words (Meaning Change), the student was much more likely to get the wrong answer at the end, even though the question meant the same thing. When they just changed the format (Presentation Change), the student was much more likely to get it right.

It's as if the student is very sensitive to what you say, but not so sensitive to how you say it.

How They Tested It

They didn't just guess; they ran a massive experiment:

The Class: They used 10 different "students" (AI models) from 7 different families (like Llama, Qwen, Mistral, etc.).
The Homework: They gave them 3 different types of tests (Math, Logic, and Reading Comprehension).
The Volume: They took 1,530 original questions and created about 11,000 variations of them.
The Stress Test: They made sure the "Meaning" changes and "Presentation" changes were equally difficult to handle (so they could compare them fairly).

The Result: On average, the "Meaning" changes caused the AI to fail 20% more often than the "Presentation" changes. This happened in 64 out of 68 different test scenarios.

The "Stealth Divergence" Mystery

Here is the most interesting part. The researchers looked at the student's step-by-step notes (the "trace") to see when the mistake happened.

They expected that if you change the meaning of the question, the student would get confused immediately and start writing nonsense right away.

What they found instead: The student started correctly! The very first step of their thinking was identical for both types of changes.
The Twist: Starting from Step 2, the student's internal thoughts began to drift apart. The "Meaning" changes caused a "silent corruption." The student kept writing, but their internal logic slowly became confused, leading to a wrong answer at the end.
The Metaphor: Imagine two cars driving down the same road.
- Presentation Noise: The road signs are upside down or the paint is peeling. The driver notices immediately, stops, and corrects their path.
- Meaning Noise: The road signs look perfect, but the map inside the driver's head has a tiny, invisible smudge. The driver starts driving fine, but by the second turn, they are subtly heading the wrong way, and by the end, they are lost. They never realized they were off course until it was too late.

What They Didn't Find (The Retractions)

Science is about being honest, and the authors admitted they were wrong about two things they thought they knew:

They thought the "Meaning" changes would make the student get confused faster (at Step 1). They were wrong; the confusion started at Step 2.
They thought the student would try to "fix" their own mistakes less often with "Meaning" changes. They were wrong; the fixing rate was the same.

They also found that this "Meaning vs. Presentation" gap isn't the same for every AI. If you swap the tool used to generate the questions, the ranking of which AI is "most sensitive" changes. So, you can't say "AI Model X is always 20% worse than Model Y" without knowing exactly how the test was set up.

The Bottom Line

This paper is a measurement study. It proves that AI agents are surprisingly fragile when you rephrase a question, even if the meaning stays the same. They don't break immediately; they break slowly and silently, starting from the second step of their thinking process.

The authors released all their data and tools so other researchers can check their work, but they warn that this is a diagnostic tool for researchers, not a magic switch for fixing AI in the real world yet.

Technical Summary: When Do LLM Agents Treat Surface Noise Differently from Semantic Noise?

Problem Statement
Large language model (LLM) agents deployed in multi-step reasoning, math, and retrieval tasks often encounter inputs perturbed by upstream systems (paraphrasing, templating) or adversaries. A critical open question is whether these agents treat lexical noise (presentation operators like reordering, formatting, or adding distractors) and semantic noise (meaning-bearing operators like paraphrasing or synonym substitution) as equivalent. Prior work on perturbation robustness has largely focused on single-step models or raw success rates, failing to isolate a directional gap between meaning-bearing and presentation perturbations in multi-step agent trajectories. This paper investigates whether semantic perturbations cause significantly higher inconsistency rates in final answers compared to presentation perturbations of comparable severity.

Methodology
The authors conduct a large-scale measurement study involving 68 cells (combinations of 10 LLMs from 7 architecture families, 3 benchmarks, and 2 reasoning scaffolds) and a held-out validation on an 11th model.

Models & Benchmarks: The panel includes open-weight models (Qwen2.5, Llama-3.2/3.1, Mistral, Gemma2) and commercial APIs (MiMo-v2.5-Pro, Gemini-2.5-Flash, DeepSeek-V3). Benchmarks are GSM8K, MATH, and HotpotQA. Scaffolds are Chain-of-Thought (CoT) and ReAct.
Perturbation Operators: Five operators are used:
- Meaning-bearing: Paraphrase (whole-question rewrite), Synonym (open-class word substitution).
- Presentation: Reorder (token/clause permutation), Format (whitespace/casing), Distractor (irrelevant context insertion).
- All operators preserve the gold answer; an equivalence judge filters out variants that alter the underlying question.
Metrics:
- Inconsistency Rate (IR): The rate at which the agent's final answer changes between the original and the perturbed variant.
- The Gap ( $\Delta$ ): Defined as $IR_{sem} - IR_{sur}$ , where $IR_{sem}$ averages over meaning-bearing operators and $IR_{sur}$ over presentation operators.
- Cascade Depth: The number of consecutive steps after the first divergence where the perturbed trace fails to match any subsequent original step.
Robustness & Validation:
- Severity Matching: Variants are binned by edit distance, token Jaccard, Sentence-BERT cosine, and length-change ratio to ensure meaning-bearing and presentation perturbations are of comparable severity.
- Statistical Tests: Wild cluster bootstrap (K=10 models, K=7 families) is used to address small-cluster inference issues. Hierarchical bootstrap is applied to nested trajectory data.
- Generators & Judges: Cross-family generator swaps (Qwen vs. MiMo) and a second LLM judge (MiMo vs. Qwen) are used to audit generalizability and bias.
- Held-Out Validation: A fully independent run on qwen2.5-14B-Instruct (1,800 trajectories) validates the findings without any parameter tuning.

Key Results

Directional Inconsistency Gap: Across the 68-cell panel, the severity-matched mean gap is +19.69 percentage points (pp) ( $p < 0.0001$ ), with 64/68 cells showing a positive gap. This indicates agents are significantly more likely to change their final answer when the input is semantically perturbed than when it is presentation-perturbed, even when severity is matched.
Robustness to Severity Definitions: The gap remains stable (+18.9 to +20.9 pp) across four different severity proxies (Edit Distance, Token Jaccard, Sentence-BERT, Length Change), confirming the effect is not an artifact of a single metric.
Boundary Conditions:
- Small-Cluster Inference: The gap is not significant under wild cluster bootstrap at the model (K=10) or family (K=7) levels, indicating the finding is descriptive of the specific panel rather than a universally identified causal effect.
- Tractability: Within-benchmark tractability proxies (e.g., multi-route vs. single-route) fail to identify a significant contrast (0/3 significant). The authors retract prior claims that "topology gates the dichotomy."
- Generator Dependence: Cross-family generator swaps destroy per-cell ranking (Spearman $\rho \approx 0.14$ ), while within-family swaps preserve it. The specific magnitude of $\Delta$ is generator-conditional.
Held-Out Validation: The 11th model (qwen2.5-14B) replicates the direction of the capability $\times$ tractability partition (3/4 Group A cells positive) but not the magnitude (mean +1.08 pp vs. +19.69 pp), likely due to the held-out model's high baseline capability and low surface noise sensitivity.
Mechanism Analysis (Stealth Divergence): Trace-level analysis on the held-out model reveals a "stealth divergence" mechanism:
- M3 (Cascade Depth): Semantic perturbations cascade 0.17 steps deeper than presentation perturbations ( $p = 2.5 \times 10^{-14}$ ).
- M4 (Thought Similarity): Semantic perturbations leave the first action intact but corrupt intermediate thought content from Step 2 onward, with a per-step similarity gap of -5.6 to -10.5 pp.
- Retractions: Two prior mechanism claims are explicitly retracted: M1 (semantic perturbations diverge earlier) and M2 (semantic perturbations self-correct less often) failed to replicate on the held-out model.

Significance and Claims
The paper positions itself primarily as a measurement contribution. It documents a robust empirical phenomenon where LLM agents exhibit systematically different sensitivity to semantic versus surface noise in multi-step reasoning.

Engineering Implication: The findings suggest that input normalization strategies should prioritize handling meaning-bearing perturbations (paraphrases, synonyms) over presentation noise, as the former drives higher inconsistency rates.
Methodological Contribution: The study provides a rigorous framework for measuring perturbation sensitivity in agents, including severity matching, trace-level cascade analysis, and honest reporting of non-replicable mechanism claims (M1, M2).
Limitations: The authors emphasize that the regression coefficients do not survive strict small-cluster inference (wild bootstrap), meaning the results are descriptive associations for the tested panel rather than identified causal effects. The diagnostic tool (AgentDiff-Probe v2) is a prototype with sign accuracy tying the trivial baseline, and the authors caution against using it as a sole gate for production deployment.

The work explicitly avoids claiming cross-family generalization of the specific gap magnitude and retracts earlier linear-monotonicity claims regarding capability, reframing the relationship as a binary gate on tractable benchmarks. All code, data, and scripts are released for review.