🤖 AI

Format Sensitivity Index: Token-Controlled Prompt Wrapper Robustness and Schema Compliance in LLM Benchmarking

This paper introduces the Format Sensitivity Index (FSI) and Parseability Sensitivity Index (PSI) to demonstrate that minor formatting differences in prompt wrappers cause significant, model-dependent score variations and compliance failures, arguing that benchmarking accuracy without accounting for this variance is statistically fragile.

Original authors: Deep Pankajbhai Mehta

Published 2026-07-14

📖 4 min read☕ Coffee break read

CC0 1.0

Original authors: Deep Pankajbhai Mehta

Original paper dedicated to the public domain under CC0 1.0 (http://creativecommons.org/publicdomain/zero/1.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are a judge at a talent show, but instead of listening to the singers, you are only allowed to read their lyrics. Now, imagine that some singers are told to write their lyrics on a plain piece of paper, while others are forced to write them inside a fancy, rigid JSON box, and others still must wrap their words in a specific "BEGIN/END" sandwich.

You'd expect the singer's talent to stay the same, right? The song shouldn't change just because the paper changed. But according to this study by Deep Pankajbhai Mehta from Adobe, that's exactly what happens with AI models. The "paper" (the prompt wrapper) matters so much that it can flip the entire leaderboard, making a genius look like a novice and a novice look like a genius.

The Great Format Shake-Up
The researchers ran a massive experiment, generating 140,000 answers from four different AI models (ranging from 7 billion to 72 billion "brain cells") across seven different question-answering tasks. They tested five different "wrapper" styles:

Plain: Just the answer.
JSON: Strict computer code format.
Structured: Key-value pairs.
Structured with Delimiters: Key-value pairs with special tags like <BEGIN ANSWER>.
Deliberate: A scratchpad for thinking, followed by the answer.

The result? The models were incredibly sensitive to these formatting rules. For some models, changing the wrapper caused their accuracy to swing wildly. One model, Phi-4, was a total drama queen: its accuracy jumped by a massive 0.763 (a huge range) just by changing the wrapper. In contrast, the giant Qwen-2.5-72B was a chill rockstar, barely moving at all with a swing of only 0.024.

The "Can You Read This?" Problem
Why did the scores change so much? The paper suggests it wasn't because the AI suddenly got smarter or dumber at the actual questions. It was mostly a compliance problem.

Think of it like a vending machine that only accepts coins. If you try to feed it a dollar bill (even if it's a valid dollar), the machine rejects it. In the study, when the AI tried to follow a strict JSON rule but accidentally added a markdown code fence (like a little ``` symbol), the machine (the answer extractor) couldn't read it. The answer was marked as "unparseable," which counted as a wrong answer.

The data shows a strong link: when the AI failed to be "parseable" (machine-readable), its accuracy often crashed to near zero. For the Phi-4 model using the strict JSON wrapper, it produced outputs beginning with a markdown code fence in 85.3% of generations, yielding a parseability of just 2.8% and an accuracy of 0.7%. The researchers found that "parseability" was a huge predictor of success, explaining about 82% of the leftover differences in scores after accounting for the model and task.

What This Means for the Future
The paper argues that reporting a single accuracy number for an AI is like reporting a single temperature without saying if it's in Fahrenheit or Celsius—it's misleading. If a wrapper choice can change a score by 0.76, that single number is "statistically fragile."

The authors suggest that when we test AI, we shouldn't just pick one wrapper and hope for the best. Instead, we should:

Report the range of scores across different wrappers (like a "sensitivity index").
Check if the answers are actually parseable.
Be careful about using strict formatting in real-world apps unless the AI is forced to follow the rules by its decoder (the part that generates the text), not just by the prompt.

The Bottom Line
This study doesn't say AI is broken; it says our measuring tape is wobbly. The "Format Sensitivity Index" (FSI) and "Parseability Sensitivity Index" (PSI) are new tools to measure how much a model's score depends on the wrapper. The findings suggest that for some models, the wrapper choice is more important than the model's actual smarts. Until we fix this, the "best" AI on a leaderboard might just be the one that happened to like the specific formatting style of the person who built the test.

Technical Summary: Format Sensitivity Index and Token-Controlled Prompt Wrappers

Problem Statement

Large Language Model (LLM) benchmarks increasingly rely on prompt wrappers—templates containing delimiters, JSON instructions, or step-by-step formatting—to structure model outputs. While intended to be semantically irrelevant, these wrappers are rarely standardized across research papers, toolkits, or vendors. This lack of standardization creates a methodological failure mode: a model's reported performance can fluctuate significantly based solely on the wrapper choice rather than its underlying capability.

The core issue is that many benchmark pipelines report a single accuracy score per model per task, ignoring structured-output failure modes (e.g., schema adherence, tool calls) that dominate real-world deployments. When a model fails to parse an output according to the benchmark's extractor (e.g., due to markdown code fences or missing JSON keys), the run is scored as incorrect. This "compliance problem" can cause a model to appear near-random under a strict JSON wrapper while performing well under a delimiter-based wrapper, leading to potentially flipped leaderboard conclusions.

Methodology

The authors propose a token-controlled protocol to isolate the variance caused specifically by wrapper formatting, controlling for prompt length and token count differences.

Experimental Setup

Models: Four instruct-tuned models accessed via OpenRouter, spanning 7B to 72B parameters: Mistral-7B-Instruct-v0.3, Gemma-2-9B-IT, Phi-4, and Qwen-2.5-72B-Instruct.
Tasks: Seven widely used QA-style benchmarks (BoolQ, PIQA, ARC-Challenge, HellaSwag, WinoGrande, CommonsenseQA, GSM8K), with 200 examples sampled per task.
Wrapper Families: Five distinct wrapper types were evaluated:
1. Plain: Minimal instructions.
2. JSON: Strict JSON with an answer field.
3. Structured: Key-value fields.
4. Structured Delim: Key-value fields with explicit delimiter tokens (<BEGIN ANSWER>).
5. Deliberate: A scratchpad for reasoning followed by a final answer field.
Token Control: To mitigate the confound of varying prompt lengths, prompts were padded to a fixed character budget per task. The realized token counts were logged, and a relative token spread metric ( $\Delta_{tok}$ ) was computed. Results were reported on the full dataset and a matched subset filtered for $\Delta_{tok} \le 5\%$ .
Generation: 140,000 total generations were produced (4 models $\times$ 7 tasks $\times$ 5 wrappers $\times$ 200 examples $\times$ 5 seeds).

Metrics

The paper introduces two primary sensitivity metrics:

Format Sensitivity Index (FSI): The range of accuracy induced by wrapper choice for a given model and task ( $FSI = \max_f A_{m,t,f} - \min_f A_{m,t,f}$ ).
Parseability Sensitivity Index (PSI): The corresponding range in answer parseability ( $PSI = \max_f P_{m,t,f} - \min_f P_{m,t,f}$ ).

To address the noise sensitivity of range statistics, the authors also report normalized FSI (nFSI) and bootstrap confidence intervals.

Key Results

1. Extreme Variance Across Models

Format sensitivity varies sharply across models.

Qwen-2.5-72B demonstrated near format invariance, with a mean FSI of 0.024 (95% CI [0.014, 0.035]).
Phi-4 exhibited high sensitivity, with a mean FSI of 0.763 (95% CI [0.607, 0.872]).
The mean FSI varied by more than 30 times across the tested models.
Normalized sensitivity (nFSI) accentuated this contrast, with Phi-4 showing an nFSI of 2.37, indicating that wrapper choice can dominate the mean score.

2. Parseability as a Primary Driver

Accuracy and parseability are strongly correlated ( $r = 0.825$ ). A fixed-effects regression analysis ( $A_{m,t,f} = \beta P_{m,t,f} + \alpha_m + \gamma_t + \delta_f + \epsilon$ ) revealed that parseability is a strong predictor of accuracy ( $\hat{\beta} = 0.819$ ), explaining a substantial portion of the residual variance ( $R^2 = 0.82$ ).

Case Study: Under the strict JSON wrapper, Phi-4 produced outputs with markdown code fences in 85.3% of generations, resulting in a parseability of 2.8% and an accuracy of 0.7%.
This suggests that many wrapper-induced score changes are driven by whether the output is machine-consumable (parseable) rather than a lack of reasoning capability.

3. Wrapper Performance Distribution

No single wrapper is universally optimal. While delimiter-based structured wrappers won the most frequently (12 out of 28 model-task combinations), "deliberate" and "structured" wrappers also won non-trivially. This supports the argument for reporting a distribution of scores over wrappers rather than selecting a single "best" format.

4. Token Control Stability

The token-padding protocol successfully reduced but did not eliminate token spread. The median relative token spread was 4.1%. Crucially, conclusions remained stable when filtering for low token spread ( $\Delta_{tok} \le 5\%$ ), with mean FSI shifting only from 0.391 to 0.394.

Significance and Recommendations

The paper argues that reporting accuracy without accounting for wrapper variance and compliance is statistically fragile. The authors provide the following recommendations:

For Benchmarking: Papers and leaderboards should report:
1. The specific wrapper family used.
2. Prompt token counts.
3. Parseability rates.
4. An uncertainty-aware sensitivity metric (e.g., FSI with confidence intervals) or the accuracy interval $[\min_f A, \max_f A]$ .
For Structured-Output Deployments: Prompting alone is often insufficient for strict schemas. If downstream consumers are brittle, parseability collapse can dominate measured accuracy. The authors suggest using FSI and PSI as diagnostics to determine when decoder-time constraints (e.g., grammars, schema-constrained decoding, or vendor structured-output modes) are necessary.

Limitations

The authors acknowledge several limitations:

FSI is a range statistic susceptible to outliers, though mitigated by bootstrapping.
Token control was achieved via character padding, not strict token equalization.
The model set is small and mixes scales, meaning robustness may reflect model size as well as architecture.
The study focuses on single-turn QA; multi-turn tool use and code generation may exhibit different dynamics.
Parser strictness varies; the study reports on strict and normalized extraction but does not directly benchmark decoding-time enforcement modes.

In conclusion, the paper posits that reliable benchmarking and structured-output systems require measuring and often reducing format sensitivity, treating prompt wrappers as a significant, underreported confound in LLM evaluation.