A persistent tension in LLM evaluation is the gap between what benchmarks measure and what deployment actually requires. Standard accuracy on fixed prompts has become the default currency of model comparison, yet it says nothing about whether a model will behave consistently when the same question arrives phrased differently by different users. A new paper, Same Question, Different Answers: Evaluating LLM Reliability Beyond Accuracy, addresses this directly, and the findings are uncomfortable for anyone who takes leaderboard numbers at face value.
What Problem Does This Address?
The core issue is well-motivated. In real deployment, users paraphrase. They ask the same thing in dozens of ways, and a system that answers correctly only when the wording matches training distribution patterns is not actually reliable. Prior work has touched on this, but mostly in multiple-choice settings where output variability is structurally constrained, or by using aggregate accuracy shifts as the primary signal. Both approaches obscure what the authors call instance-level instability: the phenomenon where a model answers a specific question correctly under one phrasing and incorrectly under another, even though both phrasings are semantically identical.
The paper situates itself carefully against related work. Sclar et al. showed that trivial formatting changes can swing accuracy by up to 76 points. GSM-Symbolic demonstrated that minor symbolic variations cause large performance variance on math problems. Lunardi et al. found that paraphrasing benchmark questions produces significant accuracy drops while preserving leaderboard rankings. What this new paper adds is a systematic, instance-level analysis across free-form generation tasks, with rigorous semantic validation of the paraphrases themselves, something prior work largely skipped.
Methodology
The experimental setup is more carefully controlled than most work in this space. The authors generate paraphrase sets using a constrained generation procedure followed by strict semantic verification, including human annotation from five annotators and a multi-judge LLM evaluation framework requiring agreement from at least three of four independent judge models. This matters because observed inconsistency could otherwise be attributed to meaning drift in the paraphrases rather than model instability.
All model evaluations use deterministic decoding, which eliminates sampling stochasticity as a confound. The study spans four benchmarks (SimpleQA, TruthfulQA, GSM8K, MATH-500) and 13 models, including GPT-3.5-Turbo, GPT-4o, GPT-4.1, GPT-4.1-Mini, Llama-3 8B, Llama-3.1 8B, Qwen-2.5-7B, and six Qwen-3 variants from 0.6B to 32B parameters.
Three accuracy metrics are defined to separate distinct aspects of capability:
- A_orig: accuracy on the original fixed prompt, the standard benchmark metric
- A_dist: expected accuracy averaged across all paraphrases
- A_MV: majority vote accuracy across paraphrases
- A_any: latent capability, whether the model gets at least one paraphrase correct
- A_strict: reliable capability, whether the model gets every paraphrase correct
The gap between A_any and A_strict is the reliability gap, and it turns out to be substantial.
Key Findings
The headline result is that aggregated accuracy is a poor proxy for reliability. Across models and benchmarks, A_dist and A_MV deviate from A_orig by only 0 to 7.3 percentage points. That looks reassuring. The instance-level metrics tell a different story entirely.
- Mismatch rates (where majority vote disagrees with the original answer) reach as high as 23.12% even when the aggregate accuracy gap is exactly zero
- Up to 47.55% of paraphrase sets contain conflicting predictions, meaning the model gives different correctness labels to different phrasings of the same question
- Correctness flips are bidirectional: models frequently answer the original correctly but fail on paraphrases, and also fail on the original but succeed on at least one paraphrase
- The apparent stability of aggregate scores is often a statistical artifact of offsetting errors rather than genuine consistency
The Qwen-3 family allows a controlled analysis of scale and chain-of-thought reasoning. Larger models are more consistent, and enabling long chain-of-thought reasoning improves both accuracy and consistency. However, even the largest reasoning-enabled models exhibit non-trivial flip rates and mismatch rates. CoT is helpful but not sufficient to eliminate surface-form sensitivity.
A particularly telling result concerns latent knowledge. For many questions where models fail on the original prompt, they succeed on at least one paraphrase. The knowledge is present but inconsistently retrieved. This motivates the paper's inference-time intervention: self-paraphrasing, where the model generates multiple semantically equivalent versions of the input question and conditions its final answer on all of them. Across 6 of 7 tested models on SimpleQA, this improves correctness, sometimes substantially. GPT-3.5-Turbo goes from 9.2% correct to 12.3%, and the not-attempted rate drops from 51.3% to 19.4%.
Limitations and Open Questions
The authors acknowledge finite paraphrase coverage as a limitation. Each question receives a fixed number of paraphrases, so A_any and A_strict are approximations of the true latent and reliable capability. The self-paraphrasing experiments are also limited to a subset of SimpleQA, so the generalisability of that intervention across tasks and model families is not fully established.
A deeper open question is mechanistic. The paper demonstrates that instability exists and characterises it well, but does not explain why particular phrasings succeed or fail. Understanding whether instability correlates with syntactic distance, lexical overlap with training data, or specific semantic constructions would be valuable for targeted mitigation. The benchmark contamination discussion in the appendix touches on related concerns, but this remains an area for further work.
There is also a question about whether the multi-judge evaluation framework fully resolves ambiguity in borderline cases, particularly for open-ended factual questions where correctness is not always binary. The three-way rubric (Correct, Incorrect, Not Attempted) helps, but the agreement threshold of three out of four judges still leaves room for systematic evaluator bias on edge cases.
For the field broadly, this paper makes a strong case that single-prompt evaluation is not just imprecise but actively misleading. The practical implication for benchmark design is that reporting A_strict alongside standard accuracy would give a much clearer picture of what models can actually be relied upon to do. The self-paraphrasing result also points toward a class of lightweight inference-time strategies that could improve reliability without retraining, though more work is needed to understand when and why they help.
The full paper is available at arxiv.org/abs/2607.22554.