Lion Cipher Lab
Measure how much your security eval score depends on prompt format, not capability, and report it honestly (deterministic stub models)
- AI Security
- Intermediate
- ~90 min
- Free · no account required
Why it matters
Security teams pick models from eval tables: which one maps CVEs to CWEs best, which one triages alerts best. Those tables usually come from ONE prompt template, and research by Sclar and colleagues and by Mizrahi and colleagues shows that changing only the formatting - a colon for a dash, A. for 1), the order of two fields - can move a score by tens of points and reorder the models. If you do not measure that, you can buy, deploy or publish the wrong model and believe a number that was really a formatting accident. This lab makes the effect visible on a keyed security eval, shows why the…
What you'll learn
- building a 200-item answer-keyed CVE-description to CWE multiple-choice eval where every key is exact because each description was generated from its CWE
- writing 12 semantically equivalent prompt templates from four format factors - option label style, separator, instruction wording and field order - and locking one before any scoring
- measuring per-model format spread: atlas 0.495 to 0.880 (sd 0.117), brio 0.630 to 0.830 (sd 0.066), cobalt 0.640 to 0.905 (sd 0.100), against a trailing-space control whose sd is only 0.025 to 0.044
- showing a leaderboard order is a property of the template: 4 different orders in 12 templates, with every model ranked first on at least 3
- proving that tuning the template per model inflates the gap (0.060 vs 0.006) and does not survive fresh items or held-out templates
- reporting the fix: locked template beside mean +/- sd over a declared template set, plus a paired comparison across templates with a plain TIE verdict when the interval crosses zero
- deciding when format sensitivity matters (close leaderboards, model selection, vendor claims) and when it does not (one model tracked over time with one frozen template)
Steps in this lab
- The words first: eval, template, spurious format features, spread, and the fact that the models here are STUBS
- Open a terminal and make a scratch folder (Windows, macOS, Linux)
- Build 200 answer-keyed CVE-to-CWE items
- Write 12 equivalent templates, and lock one before you score anything
- Meet the three STUB models and what they react to
- Score the grid: 3 models x 12 templates x 200 items, and measure the spread
- Watch the leaderboard flip with the template
- Why this happens, and when NOT to worry about it
- The honest negative: give every model its best template, and watch it fall apart
- Fix the reporting: locked template, mean +/- sd, and a paired verdict
- How a pro runs a format-robust eval, and where the neighbour labs take over
- Optional appendix: run the same test on a free local model with Ollama
- Ship it: the reporting policy, what to log, and one experiment to run yourself