One character of formatting decided whether the model got it right

The same question, formatted two ways

Researchers at the University of Washington and the Allen Institute for AI took one classification task, gave LLaMA-2-7B a single worked example, and wrote the example two ways. With a colon after each label, passage:{}\n answer:{}, the model scored 0.043: it was right about four times in a hundred. They changed the colon to a space, so the labels read passage {}\n answer {}, and left everything else the same. The same model, on the same task, with the same example, now scored 0.826.¹

Nothing about the task got easier, and nothing taught the model more. The only thing that changed was the string of characters it read. Getting better at a task and getting a different score on the same task are two different things, and the second is what happened here. Working out why a single character can do it comes down to what the model is actually reading.

Why a reformatted prompt is a different input

The prompt reaches the model only as tokens, with no line drawn between the instruction and the content, and the model produces its answer by conditioning on that sequence of tokens. It keeps no separate copy of what a person meant, held apart from the tokens. Two formats that look equivalent to a reader are two different token sequences to the model, and the tokens are all it has to go on.

Webson and Pavlick tested that claim head-on. Across more than 390 prompts they found models "learn just as fast with many prompts that are intentionally irrelevant or even pathologically misleading as they do with instructively 'good' prompts," and this held all the way up to GPT-3 at 175 billion parameters.² Scrambling an instruction into nonsense barely moved the result. Yet swapping which word stood for the answer, the token the model was meant to produce for yes or no, moved it a great deal: the models were "much more sensitive to the choice of the LM target words as opposed to the meaning of the instruction templates."² Read together, the two results point one way. The model responds to the tokens, and especially to the answer tokens, not to a meaning it extracted and stored.

Su and colleagues located where this happens inside the model. Changing only the single character that separates in-context examples, a comma for a newline for a semicolon, they traced the effect to attention: good separators "steer attention towards key tokens in the input."³ The surface character changes which tokens the model looks at. Sclar and colleagues, who ran the colon-to-space example, showed the same thing from the representation side. A format is an identifiable transformation of the prompt's internal vectors, and how separable a format's vector is tracks how far its score swings.¹

This part is settled engineering. A reformatted prompt is a different sequence of tokens, the model conditions on that sequence, and it holds no meaning apart from it to fall back on.

How far reformatting can move the score

The colon-to-space case is not a fluke. Sclar and colleagues measured the spread across formats that carry identical content, the same words with different separators, casing, and spacing, on more than fifty tasks. On LLaMA-2-13B the gap between the best and worst equivalent format reached 76 accuracy points, and across the tasks and models measured it averaged about 10. The gap did not close with a bigger model, more examples, or instruction tuning.¹ The changes that produced these swings are as small as the first one.

These swings all come from open models of 2021 to 2023, on classification tasks, scored by which answer the model ranked as most likely or by an exact match on its first word. Even a commercial model reached only through an interface behaves this way: on GPT-3.5-Turbo the spread across 320 formats reached 56 points.¹

The same shows up on a familiar benchmark, graded the accessible way. Kurt, Louf, and Fourrier changed only the format of a multiple-choice MMLU prompt and watched Qwen1.5-7B score 22.9% on one variation and 51.2% on another. No model was ranked the same across the eight formats they tried.⁴ And it holds across many models at once. Mizrahi and colleagues evaluated 20 models on 39 tasks and found the instruction template moves both absolute scores and the ranking between models. A single hand-picked benchmark prompt flatters a model by about 21 accuracy points over the average across paraphrases.⁵

Reordering the same examples does it too

Format is one way to change the token sequence without changing the meaning. The order of the in-context examples is another. Lu and colleagues took four labeled examples for sentiment classification and tried all 24 orders of them. Some orders scored over 85%, close to a model trained on the task; others sat near 50%, no better than a coin flip on a two-way choice.⁶ Same examples, same model, only the order moved. A bigger model did not fix it, and a good order for one model was close to useless for another: how the orders performed on a 175-billion and on a 2.7-billion parameter model correlated at only 0.05.⁶

Zhao and colleagues found part of the reason. A model reading a prompt leans on a few habits: it favors an answer that appears often among the examples, it favors whatever the prompt showed last, and it favors words that were common in its training data. Reordering the examples changes which one came last, so it changes the answer. In one sentiment prompt, permuting the same examples moved accuracy from 54% to 93%.⁷ The examples held the same information in every order; the model was reading their position.

The grader can move the score by itself

There are now two ways a score can move without the model getting better or worse at the task: the format changed the input, or the order changed the input. A third has nothing to do with the input at all. It is about how the answer is counted. Hua and colleagues re-graded the outputs of seven recent models, including GPT-4o-mini and Gemini 2.0 Flash, on standard benchmarks. Much of the measured sensitivity, they found, "stems from heuristic evaluation methods, including log-likelihood scoring and rigid answer matching, which often overlook semantically correct responses expressed through alternative phrasings."⁸ The model answered correctly, in its own words, and the scorer marked it wrong.

When they graded the same outputs with another model acting as judge instead of matching strings, the spread collapsed. On one benchmark Gemma-2's accuracy across templates had ranged from 0.25 to 0.90 under the string-matching scorer; under the judge it varied by 0.17. The agreement in how prompts ranked the models rose from 0.30 to 0.92.⁸

This is the open part. Sclar and Su both report that the effect does not shrink with scale or instruction tuning, and Su still measures swings of plus or minus 23% on a current benchmark across the Llama, Qwen, and Gemma families.¹³ Hua's result does not overturn that. The model still generates from the literal tokens, which is the settled mechanism. What Hua adds is that a large share of the reported magnitude, on multiple-choice and short-answer tasks, was the grader missing correct answers rather than the model failing. How big the effect is in today's frontier models is genuinely unsettled, and the answer turns on how the output is scored.