A new AI benchmarking paper shows how formatting can change the score

Daily AI: A New Benchmarking Paper Shows How Formatting Can Change an AI Model’s Score

Plain-English takeaway: A new AI evaluation paper argues that some model benchmark scores can move sharply when the same question is wrapped in a different output format, which means a leaderboard number may sometimes measure formatting compliance as much as reasoning ability.

A benchmark is supposed to be a measuring instrument. Today’s important AI development is a reminder that the instrument itself can bend.

A paper newly listed on arXiv, “Format Sensitivity Index: Token-Controlled Prompt Wrapper Robustness and Schema Compliance in LLM Benchmarking,” studies a deceptively ordinary part of AI evaluation: the text wrapped around the question. The question may stay the same, but the instructions around it may ask for “only the final answer,” a JSON object, a key-value field, a delimited answer block, or a brief reasoning section followed by an answer. In human terms, that sounds like stationery. In model-evaluation terms, it can be the difference between a strong-looking score and a near-failure.

The paper’s author, Deep Pankajbhai Mehta of Adobe, introduces two metrics. The Format Sensitivity Index, or FSI, measures the range of accuracy caused by changing the prompt wrapper. The Parseability Sensitivity Index, or PSI, measures the corresponding range in whether the answer can be successfully extracted by the benchmark parser. “Parseability” is a plain but crucial word here: it means whether the system can read the model’s answer in the expected format. If a benchmark asks for a clean JSON object and the model returns a markdown code block, extra prose, or a malformed field, the answer may be scored as wrong even if the model appeared to know the answer.

That is not a small housekeeping issue. The study reports 140,000 generations across seven question-answering tasks, five wrapper families, and four instruction-tuned models ranging from 7 billion to 72 billion parameters. The tasks include familiar QA-style datasets such as BoolQ, PIQA, ARC-Challenge, HellaSwag, WinoGrande, CommonsenseQA, and GSM8K. The tested models were Mistral-7B-Instruct-v0.3, Gemma-2-9B-IT, Phi-4, and Qwen-2.5-72B-Instruct, accessed through OpenRouter.

The central result is not that all benchmarks are useless. It is more precise and more useful: wrapper choice can be an underreported confound. In the paper’s results, the most robust tested model, Qwen-2.5-72B, had a mean FSI of 0.024 across tasks, meaning its accuracy barely moved across wrappers. Phi-4, by contrast, had a mean FSI of 0.763, meaning wrapper choice dominated the score in that experimental setting. The paper also reports that accuracy and parseability were strongly correlated across model-task-wrapper cells, and that parseability remained a strong predictor of accuracy after controlling for model, task, and wrapper.

The practical translation: sometimes a benchmark score is partly a score for answering the question, and partly a score for obeying the answer format.

What changed today

The news value is the paper’s framing and evidence, not the discovery that prompts matter in some vague way. Prompt sensitivity has been known for years. What this paper adds is a concrete measurement proposal for a narrow but common failure mode: wrapper-induced score variance.

A “prompt wrapper” is the surrounding instruction template used to elicit an answer. In a benchmark, one wrapper might say:

Output only the final answer.

Another might say:

Return a JSON object with exactly one key, answer.

A third might use explicit delimiters:

Put the answer between <BEGIN ANSWER> and <END ANSWER>.

The underlying question can be identical. The model’s true ability, in a clean theoretical sense, should not depend heavily on that wrapper if the wrapper is semantically equivalent. But modern language models are not clean theoretical systems. They are probabilistic text generators shaped by training data, instruction tuning, decoding settings, API behavior, and the brittle expectations of downstream software. If a benchmark parser cannot extract the answer, the answer becomes wrong by procedure.

The paper’s strongest contribution is therefore methodological. It says benchmark reports should not publish a single accuracy number without also saying how the prompt was wrapped, how many tokens were used, how often outputs were parseable, and how much the score moved across reasonable wrapper variants. That is a modest proposal with large consequences, because model comparisons often turn on small differences.

What the evidence supports

The evidence supports four careful claims.

First, in this study, wrapper choice substantially changed measured accuracy for some models. The most dramatic reported case was not a marginal shift. The paper says the same model could score near random under a strict JSON wrapper while exceeding 0.75 accuracy under a delimiter-based structured wrapper on the same set of tasks.

Second, the variation was not uniform across models. The 72-billion-parameter Qwen model was nearly format-invariant in the reported setup, while smaller or differently tuned models showed much larger swings. That does not prove that larger models are always robust to formatting. The paper itself treats scale as a confound. But it does suggest that “prompt robustness” should be measured, not assumed.

Third, parseability explains a large share of the problem. The paper reports a Pearson correlation of 0.825 between accuracy and parseability across the 140 model-task-wrapper cells. In one example, under the JSON wrapper, Phi-4 produced outputs beginning with a markdown code fence in 85.3 percent of generations, yielding parseability of 2.8 percent and accuracy of 0.7 percent. The model may have been trying to be helpful by formatting code. The benchmark, however, needed a machine-readable answer.

Fourth, the paper’s results remain meaningfully tied to evaluation practice because the author tried to control for a major obvious confound: wrapper length. Longer prompts can change model behavior simply because they consume a different number of tokens. The study pads prompts to a fixed character budget and logs realized prompt token counts, then checks a subset where wrapper token spread is limited. The paper reports that the conclusions were stable after filtering by relative token spread.

These claims are consequential, but they should not be inflated. The paper is an arXiv preprint, not a peer-reviewed final word. It tests four models, seven QA-style tasks, and single-turn settings. It does not prove that every leaderboard is unstable, that every model is format-fragile, or that real-world applications will fail in the same way. It does show that a simple formatting decision can be large enough to distort evaluation results in a controlled setting.

Why this matters beyond leaderboards

For readers outside the benchmark world, this may sound like inside baseball. It is not.

AI systems increasingly sit inside products that require structured outputs: a database field, a tool call, a spreadsheet cell, a workflow status, a compliance label, or a routing decision. If the system asks for a precise schema and the model returns something plausible but unparsable, the failure may look like an intelligence failure, a software failure, or a silent data-quality problem depending on where it lands.

That distinction matters for buyers and builders. If an AI vendor says a model achieved a certain score, the first question should not be “who is winning?” It should be “what exactly was measured?” A benchmark that accepts flexible prose and a benchmark that requires strict JSON may be testing different things. The first may reward semantic answer quality. The second may reward schema obedience. Both can be valid, but they are not interchangeable.

It also matters for procurement. Enterprises do not usually buy models to answer benchmark questions in a vacuum. They buy them to fit into workflows. A legal review tool, insurance intake system, sales-operations assistant, or data-analysis pipeline may depend on reliable structure. If the output has to be machine-consumable, then parseability is not a cosmetic metric. It is part of the product.

The paper’s recommendation is sensible: report wrapper family, prompt token counts, parseability rates, and a sensitivity measure such as FSI with confidence intervals. In plain English, tell readers not only the score, but how easy it was to make the score move.

Who is affected

Model developers are affected because benchmark claims can become less persuasive if they do not disclose prompt wrappers and structured-output behavior. A strong model should be able to show that its score is not the artifact of a friendly template.

Evaluation groups and leaderboard operators are affected because their public rankings can shape investment, procurement, hiring, and research attention. If a small prompt-format change can flip conclusions, leaderboards need to show uncertainty bands and formatting details, not just ranks.

Enterprise buyers are affected because structured-output reliability is often closer to deployment reality than leaderboard elegance. A model that answers well in a chat interface may still be a poor fit for a workflow that needs strict, repeatable fields.

Developers are affected because the paper supports a familiar lesson from production work: prompting alone is often not enough when strict schemas are required. Grammar-constrained decoding, schema-enforced API modes, validation, retries, and parser-aware testing may be necessary. The right lesson is not “never use prompts.” It is “do not confuse a prompt request with an enforced contract.”

Researchers are affected because the paper challenges the habit of treating a benchmark score as a single clean estimate of model ability. If formatting is an unreported axis of variance, then reproducibility requires the wrapper, the parser, and the failure policy.

The limitation box

There are reasons to be cautious.

The paper uses a range statistic, and ranges can be sensitive to outliers. The author addresses this with bootstrap confidence intervals and a normalized variant, but more uncertainty modeling would strengthen the finding.

The model set is small. Four models can demonstrate a problem, but they cannot map the whole market. The result for Qwen-2.5-72B also makes clear that format sensitivity is not inevitable in every model.

The tasks are single-turn question-answering tasks. Agentic tool use, long-context document work, code generation, retrieval systems, and multimodal tasks may have different failure patterns.

The study measures prompted structure, not every structured-output mechanism available in production. Systems that enforce schemas during decoding may reduce parseability failures by design. That does not erase the paper’s point; it clarifies where the fix may be.

Finally, arXiv papers can change. This should be read as a serious evaluation finding worth scrutiny, not as settled doctrine.

What to watch next

The next test is whether benchmark maintainers adopt multi-wrapper reporting. A useful leaderboard would show not only average accuracy but the range across reasonable wrappers, parseability rates, prompt templates, token counts, and extraction rules.

Watch whether model providers begin publishing structured-output reliability as a first-class metric. “Can answer a question” and “can return a valid object every time” are different capabilities.

Watch for independent replication. The paper’s strongest claims would be more useful if repeated across newer frontier models, more open-weight models, multilingual tasks, coding tasks, and tool-use benchmarks.

Watch procurement language. Serious enterprise evaluations should ask for schema-failure rates, retry behavior, parser design, and examples of malformed outputs, not just benchmark screenshots.

And watch the rhetoric. A benchmark is not a crown. It is a measuring instrument. Today’s paper is important because it points to a place where the instrument can wobble — and gives the field a way to start measuring the wobble instead of pretending it is not there.

Reader-facing sources

• Deep Pankajbhai Mehta, “Format Sensitivity Index: Token-Controlled Prompt Wrapper Robustness and Schema Compliance in LLM Benchmarking,” arXiv:2607.09665.
• arXiv record for arXiv:2607.09665.
• Referenced benchmark and evaluation work cited within the paper, including HELM, lm-evaluation-harness, PromptBench, BoolQ, PIQA, ARC-Challenge, HellaSwag, WinoGrande, CommonsenseQA, and GSM8K.

---

Shadowfetch is a technology publication. Explore Shadowfetch Linux — our own Linux build — and the Shadowfetch apps on the App Store.