Executive Summary

Key figures

Source: Gan et al., How Output Format Confounds Data Quality and Capability in Instruction Tuning, arXiv:2609.02015v1 (September 2, 2026), main text and Appendices A through F

What the paper calls an output interface is the surface in which the same content is written down. A plain answer, a raw span cut from the input, a JSON field, a tagged span. Those four carry the training runs and the gradient measurements, while two more are held out of training entirely: an answer written as a sentence, and a bracketed token. The held-out pair exists so that transfer can be read on surfaces the selection rule has never seen.

The authors start from a number that is visible before any training happens. Hold the instruction and the gold answer fixed, swap only the format, and the accuracy of the untrained base model moves by up to 70 points on ARC-C. Average across the six tasks that were evaluated under all four formats and the shift is still 22.5 points. If a score moves when only the format changes, the score measured the wrapper rather than the content, and that sentence runs through the whole paper.

Format sensitivity itself is not news. Sclar and colleagues showed in 2024 that swapping between semantically equivalent formats moves few-shot accuracy by as much as 76 points, and Do and colleagues reported in 2025 that format preference biases benchmark rankings. Both were measured on a fixed model at generation time. What moves here is the point of observation. The analysis drops from the score at inference into the gradient that the training data itself produces, and asks how format enters both the quality judgment and the capability measurement.

The test bed is 12 classification and multiple-choice tasks: sst2 and yelp for sentiment, rte and qnli for natural language inference, boolq for yes-or-no question answering, copa, piqa, hellaswag, winogrande, arc_challenge and commonsense_qa for commonsense and reasoning, and ag_news for topic classification. Data conditions hold the format fixed and damage the content in four ways. Clean pairs each input with its gold answer, shuffled labels replaces every answer with a different valid label from the same task, content mismatch pairs an input with another example's answer, and format only keeps the scaffolding while stripping the content it wraps. The models are Qwen3.5-4B, Qwen3.5-9B and Mistral-7B-v0.3, all trained through low-rank adapters.

To keep the comparison fair, every selector works inside the same budget of 24 units at 64 examples each. That closes the door on any explanation of the form that one method simply got more data. A pre-registration document fixes the decision rules, from the width of the blindness band to the pass mark for the intervention experiment, before any of the results were seen.

One recent family of data quality metrics summarizes the gradient spectrum of a training update in a single scalar, such as effective rank or nuclear norm. Theorem 1 in the paper opens by proving why that choice is fragile. A functional that reads only the singular values keeps the scale of the update and discards its direction, and the direction is exactly where the interface offset and the interface-by-content interaction live. The rotation the theorem assumes is an idealization, and real format changes only approximate it, so the authors say plainly that the load-bearing evidence is not the proof but the measurement that follows.

The measurement follows the proof. Pooled across the three corruption conditions, the ability to rank clean units above corrupted ones reads 0.415, 0.545 and 0.588 for effective rank across the three model families, and 0.468, 0.517 and 0.399 for nuclear norm. All six readings sit inside the blindness band of 0.35 to 0.65 that the authors fixed before the third family was run, and the signs scatter with no consistent direction. That pattern fits a metric that is blind by construction better than one carrying a faint signal.

The scores that read direction behaved differently. Residual alignment reached 0.789 on the 4B family, with matched alignment close behind at 0.784. On 9B it reads 0.579 and on Mistral 0.670, and the 0.579 on 9B falls inside the blindness band. On the hardest corruption condition, a full label shuffle, 9B and Mistral both miss the pre-registered margin of 0.10 and are recorded as limited by scale. So for those two families the case for direction-reading rests not on the pooled figure but on the specificity test below. When semantic corruption rises in three steps, residual alignment selectivity on 4B climbs monotonically from 0.556 to 0.676 to 0.706. It tracks how much content was damaged, not merely whether it was.

So what is this residual? It is what remains of the four formats' gradients once the shared component is subtracted. A corrupted unit produces a noisier gradient, so its residual alignment could simply fall through attenuation, with no content in it at all. The authors ruled that alternative out with a pre-registered specificity test. In every one of the 48 clean units, the unit's own task ranked first among the 12 candidate targets. That is a hit rate of 1.00 against a chance rate of 1 in 12, or 0.083. Own-target alignment was 0.978 against a mean of 0.404 to other targets, and the result reproduced on all three model families with a permutation p below 1 in 10,000.

Once the measurement side is settled, the capability side remains. The authors trained a separate adapter for each task under each of the four formats, then evaluated every adapter under all four, producing a 4 by 4 transfer map. The diagonal holds the gain on the same format, and the off-diagonal cells hold how much of that gain carries to the others. A cell counts as locked when the same-format gain clears 10 points while the transfer ratio to other formats stays under 0.2.

Four model settings produced maps: two seeds of 4B, then 9B and Mistral. Of the 24 cells, the ones with a same-format gain of 10 points or more numbered 14, 14, 18 and 24, and the fully locked ones among them numbered 5, 7, 6 and 2.

The sharpest case is RTE learned as a raw span. Same-format accuracy climbs between 41 and 46 points while transfer to the other three formats stays near zero. The skill is legible only at the address where it was written. Two checks say this is not one unlucky draw. The pairing of qnli with the raw span locked in all four maps, spanning three architectures and two seeds, and rte with the raw span locked in three of the four. The five cells that locked under the first 4B seed locked again, all five of them, under the second.

The format decides not only where a skill can be read but whether it is learned at all. COPA gains 43 points on the same format when it is learned as a raw span, and only 4 points when the identical content is learned as a plain answer. ARC runs the other way. The raw span buys 66 points, while putting the same examples into a JSON field costs 1.3 points of accuracy. Which format helps varies by task. What holds across tasks is only that the format can decide the outcome.

The selectors themselves are hard to fault. Direction-reading selection in the LESS lineage came within about 2.5 points of a gold-label oracle on the training format and beat random selection by 15.6 points. The trouble is that the oracle does not clear the format either. On 4B its 25.2-point gain on the training format drops to 7.4 points on the formats held out of training. That is why the authors ask for held-out-interface transfer to be reported next to the seen-interface gain.

On the evaluation side the same work was done not by the format but by a budget. The authors reran GSM8K exact match with the prompt, the decoding parameters and the answer extraction rule all held fixed, and varied only the generation budget from 192 tokens to 768. The 192 is the value the original selection pipeline used.

Only one thing moved, and it was the untrained base model. On 4B it went from 19.5 to 78.0, and on 9B from 1.0 to 24.0. Every fine-tuned system stayed flat within half a point no matter which selector had chosen its data, and the gold-label oracle was no different at 21.0 on 4B. The oracle condition was not run on 9B.

The cause was truncation rather than ability. Under the short budget the base model writes out a long solution, around 650 characters at the median, and runs into the 192-token ceiling before it finishes. Between 66 and 85 percent of the extracted answers therefore contain no number at all, and the scorer marks them wrong. The fine-tuned model answers in about 20 characters and stops at its end token, so a larger budget changes nothing for it.

The sign of the reported conclusion changes with it. Read at the short budget, fine-tuning looks like it raised GSM8K, and the evidence for that is the 9B pair going from 1.0 to 14.0, a thirteen-point gain. Correct the budget so the base model is allowed to finish, and the same training reads as a loss of about 58 points on 4B and about 10 points on 9B. The reversal is independent of the selector and holds for the gold-label oracle as well. In the authors' words, "the short protocol measured whether a model stops early, not whether it can reason."

Spectra are useless and direction works. It is tempting to shrink the conclusion to that, but the paper does not close that way. The authors drew the edge of their own claim with three pre-registered tests, and one of them shows the place where direction-reading breaks down.

The first is that alignment scores are pulled by the input surface. A corruption that leaves the label supervision intact and injects unrelated distractor sentences into the input moved residual alignment more than flipping half the labels did. The contrast between the two corruptions is -0.11 on 4B and -0.27 on 9B, and it grows with scale. A score reported as a measure of semantic damage is also reading how the input looks.

On data where the damage arose in the world rather than by experimental design, the result reverses. Pairing the original Alpaca outputs against a community-cleaned variant under the same instructions, the alignment reading that had caught a signal in every corruption the authors built managed an AUC of 0.56. With an exact p of 0.44 it fell short of the pre-registered threshold of 0.60 and was recorded as a failure. On the same pool effective rank read 1.00 and nuclear norm 0.00, separating the two groups almost perfectly. That perfection, though, was tracking response length rather than quality.

None of this makes direction-reading useless. On another corruption family the authors did not hand-build, in which a model fluently rewrites the input of a different example while the original answer is left attached, alignment sat at the ceiling with 1.00, 1.00 and 0.98 across the three families, while the spectrum fell to 0.12, 0.01 and 0.14, outside the blindness band in the direction opposite to the registered prediction. Which corruption you face decides which metric is right. That is the sum of the three tests.

A single proposition in the appendix nails down a limit of principle as well: a measurement taken through one format, with no reference to compare against, cannot separate semantic quality from format fit. Too many combinations produce the same observation for either to be identified. Separating them requires a second reference: comparing against the gradient of a target task pins the semantic axis, and reading the four formats together pins the format axis. That also explains why the dual selector, which adds residual alignment on top of consensus alignment, never beat consensus alone. The two scores are not two more precise readings of one axis. They read different axes.

No corrective handle has been found either. If the residual reads the format axis, then erasing that axis during training ought to free a locked skill, and the authors tried exactly that. Projecting a rank-3 format subspace out of the low-rank update across five seeds, the two most reliably locked cells gained 0.25 and 1.05 points of transfer. The bootstrap intervals touch zero, far short of the pre-registered pass mark of 5 points. A manipulation check confirmed the projection had fired, removing 6.5 percent of the update energy. The attempt to forecast which cells would lock from pre-training gradient geometry also failed, reaching an AUC of 0.21 on 4B, reversed from the registered direction, and 0.486 with a p of 0.55 on the 18-cell confirmatory set on 9B, indistinguishable from chance.

The reach of the experiments is narrow, and the authors do not hide where the line falls. The runs cover classification and multiple-choice tasks with low-rank adapters on three model families below ten billion parameters, and the deepest seed replication sits on the smallest of the three. Extending to long-form generation or full fine-tuning is left to future work. This is also why the authors write, "We take the nulls as scope rather than failure." Gradient geometry is sharp as a diagnosis of the format confound and is not yet usable as a knob that removes it during training.

Even so the paper sets down four things to do now. Report the gain on the held-out formats alongside the gain on the format used in training. Score a quality meter by its selectivity for semantic corruption rather than by a figure pooled over every condition. Measure capability under a budget at which the base and the tuned model both stop on their own. And read the consensus direction across formats rather than the spectrum of a single one.

From here on, this is not what the paper tested but this article's reading of its results and recommendations laid over organizational data.

For a team that trusts data quality scores as dashboard numbers, the first thing to check is what those scores are attached to. The paper's closing sentence is that "Data quality is not a property of a unit alone but of a unit paired with a format." If the same instruction with the same gold answer scores differently as a JSON field than as a raw span, then a score table that does not record the format is a table that will not reproduce.

Reporting a fine-tuning result works the same way. Measured only on the format used in training, a capability looks larger than it is, and measured only on another format it looks smaller. The reason the authors held two formats out of training entirely was to make that gap visible, and even the oracle that knew the gold labels fell from 25.2 points to 7.4.

We ran into a gap of the same shape in our earlier piece on tabular foundation models. There the unit attached to a value was missing from the schema; here the format attached to a score is missing from the record. In both cases keeping the value while discarding the conditions around it removes any way of tracing back what was measured.

Three things are worth checking now.

• Whether the record of a quality score says which output format the data was wearing when it was scored. A score without a format will not reproduce under a different one.
• Whether fine-tuning results are measured only on the format used in training. Holding one format out for evaluation makes format lock-in visible at once.
• Whether the generation budget and the answer extraction rule were the same before two systems' benchmark scores are compared. What flipped the sign of the conclusion in this paper was the protocol, not the model.

The question of assembling the data itself continues in The Conditions for AI-Ready Data.

Thank you for reading this far. The full paper is at arXiv:2609.02015, and every figure in this article was checked directly against the main text and Appendices A through F. If your team already records the conditions of measurement alongside quality scores or benchmark results, we would be glad to hear how you write them down.

Pebblous Data Communication Team
September 7, 2026

• 1.Gan, C., Wei, H., Liang, Y., Zhang, Q., Ni, S., Cai, Z. (2026). "How Output Format Confounds Data Quality and Capability in Instruction Tuning." arXiv:2609.02015.
• 2.Sclar, M., Choi, Y., Tsvetkov, Y., Suhr, A. (2024). "Quantifying Language Models' Sensitivity to Spurious Features in Prompt Design or: How I learned to start worrying about prompt formatting." ICLR 2024.
• 3.Do, X.L., Ngoc, H.N., Sim, T., Dao, H., Joty, S., Kawaguchi, K., Chen, N.F., Kan, M-Y. (2025). "LLMs Are Biased Towards Output Formats! Systematically Evaluating and Mitigating Output Format Bias of LLMs." NAACL 2025.