Dear reviewer k56Q,

Thank you for engaging with our work. A lot to respond to with little space, forgive us for being brief.

---

A. Expanding on embedding evaluation

Your critique that the embedding function choise is not adequately addressed is well taken.

First, we agree that not all embedding functions would work well. There are a few properties we implicitly require but do not explicitly mention in our paper. Umportantly, the embedding should preserve semantic differences in a way that the similarity metric s becomes a sufficient statistic for a hypothesis test. This means that the embedding should induce a metric space where the distance correlated with semantic dissimilarity and it should ensure that the induced similarity distributions $P_0$ and $P_1$ are well separated under $H_1$ (if there is separation), and overlapping under $H_0$. Since this paper is not intended to analyze the properties of embedding spaces generally, we will leave links to relevant works in the paper but note that this is an active area of research (with papers coming out as recently as 2025 March).

Second, does the choice of embeddings impact result? In our implementation, we wanted to use an industry standard that is cheap, fast, and strong, so we used ada-002 embeddings. However, we run tests to evaluate if the embedding function matters.

• Results are here. Main takeaway: they matter because embeddings have different properties. However, they still show important signal within the same embedding function. We expand our Appendix to evaluate 4 embeddings across 8 models.

Third, is it reasonable to expect people tot have embedding functions? We think yes, as they are either open-source and free or extremely cheap for state-of-the-art models. We in fact modeled costs of such an approach.

• Financial analysis here. This makes this framework very practical cost-wise with state-of-the-art embeddings.

---

(B) Expanding the evaluation methodology and empirical validation

You proposed to expand the evaluation framework. We agree. Regarding your negation example, we focused on three cases where minimal input changes produce significant meaning changes: a negation in a sentence, a temporal change (describing different time periods) and a topic change.

• Results for LLama-8B are here.

We run results on more models. Briefly, the outcome is that DBPA seems to capture the differences in responses very well relative to the control.

Discussion. We agree evaluation is tricky but with the three case conditions (Negation, time change, topic change), across smaller and more consistent models, we see we are able to capture such differences well.

---

(C) Other similarity preserving metrics

Q: Why choose cosine? A: We chose cosine for its empirical success historically. Motivated by your question about how different metrics impact results, we have varied $\omega$ to different distances and replicated Experiment 4.1.

• Experiment results here.

Some metrics have a much tighter null distribution and are therefore more sensitive to changes in the prompt. We think this is a useful feature of the framework which we highlight in the updated manuscript.

Q: Can we reason about the effect sizes? A: Not directly. However, it still has practical utility; We can (a) evaluate statistical significance of a perturbation; (b) compare the relative effect of two perturbations on which one induces larger changes in output distributions; (c) quantify FPR/TPR rates for a given $\alpha$; (d) compare model alignment or (e) other use cases in Table 1.

Q: Can we have a practical example of rejecting the null as a decision metric? A: Yes! We can in fact quantify TPR/FPR for a given $\alpha$. One can obtain FPR/TPR metrics such as here.

---

(D) Eight new experiments

As a part of the response, we have run eight new experiments. Their descriptions and key findings are presented here and they have now been included in the Appendix.

• Experiment summary here

We believe these new experiments significantly expand the paper's contribution.

---

(E) ACTIONS TAKEN

Based on your feedback we have:

• Added section 4.4 "Other evaluations" discussing the expanded test cases
• Enhanced Section 4 with additional experiments
• Expanded the appendix
• Added a discussion on reasoning about effect sizes
• Added clarifying notes to Eq 10 on one-sided p-values
• Included a discussion on KL to match the Appendix A writeup.
• Added embedding analysis
• Incorporated 8 new experiments

---

Thank you

Thank you for your engagement. You have helped us improve our work significantly. If we have addressed your concerns, we hope you would consider raising your score to a 4 to reflect that you think this paper should be featured at ICML2025.

Dear reviewer 62GP,

Thank you for your thoughtful feedback on our work. We appreciate your recognition that our work presents a framework for measuring how input perturbations affect LLM outputs, that our case studies are clear and backed up with convincing evidence, and that our evaluation is well suited for the problem.

---

(A) We have clarified comparisons with existing methods

We will answer your concern by breaking this question down into two pieces.

Comparison with other methods. The primary reason we do not compare against other methods is because DBPA is a proposed framework for quantifying perturbation impacts. There is no ground-truth and therefore all evaluations are inherently misleading. We in fact do provide a related work disscussion in Table 4.

Could BLEU and ROUGE be compared against? We do not see much utility in comparing against BLEU and ROUGE as these metrics are not designed to quantify perturbation impacts. Furthermore, even if we did, we could not evaluate which approach is "better" as they serve fundamentally different purposes.

That said, we still run additional studies to evaluate how to incorporate BLEU and ROUGE into our framework. We have performed this analysis for the role-play experiment, which results in the table below.

• Please find experiment here

Discussion. The BLEU and ROUGE metrics are very sensitive to small perturbations. However, any analyses should be taken with caution as they operate on the text space and won't capture the null distribution well.

ACTIONS TAKEN. We have updated Section 4.2 with an additional discussion and have expanded the Appendix.

---

(B) We have examined how the choice of the metric affects results

Motivated by your question about how different metrics impact results, we have varied $\omega$ to different distances and replicated Experiment 4.1. Specifically, we vary $\omega$ by computing in addition the Euclidean, Wassesterin, and Energy distances.

• Experiment results here.

Discussion. Because the $\omega$ has a different magnitude for each metric, these measures are not normalized. Some metrics have a much tighter null distribution and are therefore more sensitive to changes in the prompt. We think this is a useful feature of the framework which we highlight in the updated manuscript.

Takeaway. In the paper, we compute our results using a baseline JSD $\omega$ and here we have added an enhanced view with different metrics.

ACTIONS TAKEN. We have enhanced Section 4 with an additional experiment on the metrics and a discussion, and updated the appendix.

---

(C) Providing more context on p-value and real-world translations

We will answer your concern by breaking down the question into two parts: unintended bias and others aspects of model's behavior

p-value and practical significance. Our paper examines how p-values reveal information about role-play, prompt robustness, and model alignment (sections 4.1-4.3). In this paper, we ask whether the answers of a language model change which we formulate as a hypothesis testing problem and therefore use p-values as a useful way to answer this question.

Measuring bias. While not intended for it, DBPA could potentially analyze unintended bias through sensitivity analysis – designing scenarios where LLM output should be deterministically influenced by specific input factors, then testing if irrelevant input changes affect output.

---

(D) Comment: Testing the model in real-world applications.

To address your concern about how we have tested the framework, we will highlight: (a) what is this used for and (b) what we have tested for?

(a) What is DBPA used for? We see DBPA as being useful at least in four different scenarios due to the broad nature of the framework: prompt robustness, training stability, model comparison, and adversarial attacks. We explain how each framework is useful below. We describe this in Table 1 of the paper.

As a part of the response, we have run eight new experiments. Their descriptions and key findings are presented here and they have now been included in the Appendix.

• Experiment summary here

We believe these new experiments significantly expand the paper's contribution.

---

Thank you

Thank you for your engagement. You have helped us improve our work significantly. We have made revisions to multiple parts of the paper as a result and think it's now in better shape than before.

If we have addressed your concerns, we hope you would consider raising your score to a 4 to reflect that you think this paper should be featured at ICML2025. We are certain this paper opens doors to multiple new research directions and has clear, practical relevance for researchers in diverse domains who care about model auditing and evaluation.

Dear Reviewer grUt,

Thank you for your thoughtful feedback on our work. We appreciate your recognition that our work presents a novel framework for assessing how input perturbations affect the outputs of LLMs, that our case studies effectively demonstrates the efficacy of our proposed methods, and that our evaluation is new and insightful.

We'll structure our response as follows:

• (A) Handling complex input sequences. We have examined DBPA across complex input sequences.
• (B) Evaluating input/output semantic correspondence. We have examined DBPA from various semantic perspectives.
• (C) Eight new experiments

---

(A) Handling complex input sequences

You noted that our examples in Section 4.1 primarily featured role-play scenarios and you questioned whether DBPA can effectively analyze longer and more complex input sequences. We agree this is an important consideration.

Can DBPA focus on longer input sequences, theoretically? While the paper focused on simpler examples for clarity of exposition, DBPA is designed to handle arbitrary input perturbations regardless of sequence length or complexity. The framework operates on distributions of semantic embeddings rather than raw text. Therefore, it is robust to input complexity. In fact, this is precisely one of our motivations for developing this framework, as DBPA provides a new way to distinguish long-form natural language responses.

Inspired by your comment, we have conducted additional experiments with more complex input sequences. We have modified the experiment setup in section 4.1 such that there are now multiple input prompts with different lengths. As the input prompt increases in length, so does the amount of information the prompt carries.

• Find the experiment here.

Comment on the results. We see that this effect is more pronounced in the shorter prompts and less so in more complex prompts. We think this explains well-observed empirical phenomena, such as [1], in a quantitative sense.

Takeaways of these experiments. We show how to highlight how we can extend DBPA to longer, more complex input sequences. The experiment shows (i) less consistency and (ii) larger level of response randomness for longer and more complex input prompts. In addition to [1], we believe this has the potential to open a new avenue of research within the field.

ACTIONS TAKEN. We have updated Section 4.1 with a discussion of these experiments.

---

(B) Evaluating input/output semantic correspondence.

Here, we address your concern on the input/output correspondence between semantic meaning and distributions.

(a) Can we capture semantic meaning? The only reason why DBPA captures semantic meaning is by the choie of its $\omega$ function that operates on the embedding space. It's well understood that text embedding methods map text data to a space where semantic correspondence is similar to distance (see even by now forgotten works such as [2]). While this in itself is an active area of research [3-4], it's common (and useful) to map text to embedding spaces for such purposes.

(b) Choice of the metric used. We can further change which $\omega$ we use. While we use the cosine($\cdot$) function due to it naturally capturing directionality, users of DBPA can map it to their own preferred metrics if they have improved domain knowledge.

(c) Existence of a control group. Lastly, one important reason why we claim our method does, in fact, find semantic meaning is that while we operate in an embedding space, we have a control group (the null distribution) which helps us account for what would have happened had there been no perturbation. Therefore, any changes we observe quantify the probability of observing an event as extreme as the one observed (the definition of the p-value) which implicitly has natural variability as a control.

[1] https://direct.mit.edu/tacl/article/doi/10.1162/tacl_a_00638/119630 [2] https://arxiv.org/abs/1301.3781 [3] https://arxiv.org/abs/2410.16608 [4] https://arxiv.org/abs/2406.07640

---

(C) Eight new experiments

As a part of the response, we have run eight new experiments. Their descriptions and key findings are presented here and they have now been included in the Appendix.

• Experiment summary here

We believe these new experiments significantly expand the paper's contribution.

---

Thank you

Thank you for your engagement. You have helped us improve our work significantly. We have made revisions to multiple parts of the paper as a result and think it's now in better shape than before.

Dear Reviewer jcUj,

Thank you for your thoughtful feedback on our work. We appreciate your recognition that our work effectively addresses issues related to sensitivity-based measures, that our case studies effectively verify our method, that our approach is insightful, and that our evaluation is novel.

---

(A) Experiment 4.1. We have examined the significance of DBPA across more models.

To address your concern about a single model being analyzed, we replicate that study with two closed-source and large models (GPT-4 and GPT-3.5) and six smaller, open-source models. We replicate the same setup with different "Act as" prompts, following Experiment 4.1. Results are provided below.

• Results for large closed-source models are here
• Results for smaller open-source are here

Takeaways: These findings reveal: (1) less consistency and (2) greater response randomness in smaller models. This analysis demonstrates why smaller models are less suitable for these tasks—their baseline responses diverge significantly from expected outcomes.

Actions taken: We've added these experiment results and discussion in Section 4.1 and Appendix B.1 "Replicating with more models."

---

(B) Experiment 4.3. Answering your question on more fundamental analysis of LLM alignment

To address your concern on alignment, we'd like to first answer what do we mean by alignment? and then show how to evaluate alignment more generally?

(a) What do we mean by alignment? In the context of Experiment 4.3, we say two models are aligned if their responses (technically, response distributions) are the same for a given prompt. This is intuitive because we desire two models to have similar responses to similar questions.

Therefore, we measure alignment via $\omega$ as the difference between a baseline model response and the new model response. This is why lower $\omega$ indicates higher alignment. In this experiment, our main contribution is showing that DBPA can be used as a way of measuring alignment

(b) Is there a way to measure alignment more fundamentally? In response to your question, we develop another experiment where we vary our measure $\omega$ to evaluate the degree to which alignment is consistent across these models. Concretely, we vary $\omega$ by computing the Euclidean, Wassesterin, JSD, Energy distances.

• Experiment results here.

Discussion: The varying magnitudes of $\omega$ across metrics indicate these measures aren't normalized. However, they reveal alignment patterns across different evaluation metrics. As expected, Child and Reviewer roles show greater divergence from baseline than Doctor or Nurse roles. Some metrics (like energy distances) prove too sensitive to minor changes for practical application.

Takeaway: Alignment measures how well response distributions match between two language models for a given prompt. We demonstrate alignment using baseline JSD $\omega$ and enhance this view with additional metrics. This represents just one alignment perspective; DBPA framework implementation may vary by task, potentially using different embedding functions or distance metrics.

(c) Are there future work that can be done to evaluate alignment? We believe our work opens up a new avenue for alignment referencing in language models. There are some works that could be fruitful as extensions of our work in the future, but are significantly out-of-scope for our paper. Examples include: (i) developing concrete real-time model alignment metrics that are cheap to quantify or (ii) evaluating alignment by looking at stability during training (and comparing output consistency.

ACTIONS TAKEN. Enhanced alignment discussion with additional results in Section 4.3 and extended discussion in an Appendix.

---

(C) Practical implications of our work

We see DBPA as being useful at least in four different scenarios due to the broad nature of the framework: prompt robustness, training stability, model comparison, and adversarial attacks. This is illustrated in Table 1.

---

(D) Eight new experiments

As a part of the response, we have run eight new experiments. Their descriptions and findings are presented here and they have now been included in the Appendix.

• Experiment summary here

We believe these new experiments significantly expand the paper's contribution.

---

Thank you

Thank you for your engagement. You have helped us improve our work significantly. We have made revisions to multiple parts of the paper as a result and think it's now in better shape than before.

If we have addressed your concerns, we hope you would consider raising your score to a 4 to reflect that you think this paper should be featured at ICML2025. We are certain this paper opens doors to multiple new research directions and has clear, practical relevance for researchers.