TL;DR
This study shows how to audit an LLM advisor that builds its recommendation on a single client self-report (say, "How much risk are you willing to take?"). You take the exact same person with the same facts and change only the answer to that one question, moving it to the neighboring option. Then you see how far the advice moves. If it moves a lot, the system has a problem. The fix is one clarifying question before the recommendation.
People don't answer these questions consistently themselves. In a US national survey, 41% of households picked a different option two years later. In a lab retest six months apart, a third of people shifted by 2 points or more on a 0–10 scale. Models, however, treat the answer as a precise measurement. Seven models from five providers changed the stock allocation by 10–16 pp on average, and when the answer actually changed, by 24–35 pp. Meanwhile, the identical prompt asked twice produced a spread of just 0.6–4.2 pp. So it's the answer that rocks the boat, not generation randomness. The reason is simple: the model takes the risk answer as its main signal and barely accounts for how noisy it is.
What helps. The phrase "this answer is unreliable" doesn't help everywhere. It shifts weight onto the client's age and drags cautious clients toward a "middle-of-the-road" allocation: people who want no risk at all get told to hold 22% stocks instead of 4%. Three extra questions reduce the spread for some models, but they add more caution than stability. One clarifying question ("you answered X, can you confirm?") wiped out almost all of the spread for a client who corrected their answer: 33.5 → 1.9 pp. And the response to a change the client confirmed stayed intact.
Want this for your own case? Apply this study to your task: AI adapts its method to what you are working on and writes the prompt.
Method Blueprint
AUDIT (testing the system):
STEP 1: Take a client profile (facts are fixed)
STEP 2: Run it with answer A and with answer B (that's the only difference)
STEP 3: Control: the same prompt twice → this is "generation noise"
STEP 4: Compare the difference in recommendation (A vs B) and (repeat vs repeat)
FIX (in the advisor's system prompt):
STEP 1: The client answers the risk question
STEP 2: The model asks back: "You picked X — is that really you?"
STEP 3: Confirmed → use the answer. Corrected → use the corrected one
STEP 4: Only then — the recommendation
Everything happens in one chat or one system prompt. The audit takes several runs.
Example
Task: You're building an assistant bot for retail investors, Robinhood- or Wealthfront-style. The risk questionnaire is a single question, and the bot outputs the stock share of the portfolio. You need to make sure a client doesn't get 70% stocks on Monday and 30% on Friday just because they were in a bad mood and tapped the neighboring option.
Audit prompt (run several times in separate chats):
You are an investment advisor. Return JSON: {"stock_share_percent": number}.
Client profile:
- Age: 34, Chicago
- Income: $9,500/month
- Financial assets: $120,000
- Horizon: 15 years
- Question: "What level of financial risk are you willing to accept?"
- Client's answer: "Moderate risk: willing to accept swings for moderate returns"
What share of assets should be held in stocks?
Then run the exact same prompt, but with the answer "High risk: willing to accept big losses for big gains." As a control, run the first version one more time.
Result: You'll get three numbers: two from the same answer (the model's own spread) and one from the neighboring answer. If the gap between the answers is many times larger than the gap between the repeats, your advisor is blindly following the questionnaire. Next, add a clarification step to the system prompt (template below) and rerun the check.
Why It Works
The weakness. The model reads the risk answer as a fact, not as a noisy measurement. Someone who answered "moderate" might pick "high" next week for reasons that have nothing to do with money: mood, wording, the morning news. The model doesn't know that and pipes the noise straight into the recommendation. A generic line like "the answer may be inaccurate" doesn't fix it: the model starts leaning on age and drifts toward averaged-out advice.
The strength. The model is good at following an explicit procedure and responds to new input. If the client writes "yes, I confirm," that's a reliable signal, and the model uses it. If the client corrects the answer, the model takes the correction.
How the method exploits this. The clarifying question turns a noisy measurement into a confirmed one. A corrected mistake stops affecting the recommendation (33.5 → 1.9 pp). A genuine change that the client confirmed still moves the advice. In other words, the model doesn't "go deaf" to the answer the way it does with a generic noise warning. It gets a cleaner answer.
Levers: - What to re-ask → only the key answer the decision hinges on. Ask about everything and the client gets fatigued. - How to phrase the question → name the selected option and simply ask for confirmation, with no hint about the "right" answer. Otherwise you're pressuring the client (the paper discusses this as a client-autonomy issue). - The post-correction rule → "the corrected answer overrides the first one." Spell it out explicitly so the model doesn't average. - The audit → change the answer to a neighboring option and to an extreme one, so you see both the small and the large shift.
Prompt Template
The exact wording of the clarifying question isn't in the accessible part of the paper (it's in the appendix). Below is a reconstruction based on the description: one question, confirmation or correction, then the advice.
You are {advisor_role}. Your task is to give a recommendation on {recommendation_subject}.
<Profile>
{client_facts}
</Profile>
<KeyAnswer>
Question: {questionnaire_question}
Client's answer: {client_answer}
</KeyAnswer>
<Procedure>
1. Before the recommendation, ask ONE clarifying question: name the option the client selected and ask whether they confirm it or want to choose a different one. Do not hint at the "right" option.
2. Wait for the client's reply.
3. If the client confirmed — use the original answer as is.
4. If the client corrected it — use ONLY the corrected answer.
5. Only then give the recommendation: {recommendation_format}.
</Procedure>
Do not add generic caveats like "the answer may be inaccurate," and do not shift the recommendation toward the middle without a reason.
What to plug in. {advisor_role} and {recommendation_subject} describe your task: stock allocation, pricing plan, training program. {client_facts} — everything known reliably: age, income, horizon. {questionnaire_question} and {client_answer} — that one subjective answer. {recommendation_format} — for example, JSON with a number.
🚀 Quick start — paste into the chat:
Here's an advisor template with a clarifying question. Adapt it to my task: [your task].
Ask me questions to fill in the fields.
[paste the template above]
The LLM will ask which client answer drives the recommendation, which facts are known for sure, and what output format you need. That way the confirmation step lands on the right key answer instead of on everything in sight.
Limitations
⚠️ The study is about financial advice: it tested the stock share of a portfolio. Carrying it over to HR screening, plan selection or medical intake forms makes sense, but the authors didn't test that.
⚠️ The clarifying question was tested on a scripted setup: a client with a predefined scenario either "corrected" or "confirmed." How real people will respond to such a question is unknown.
⚠️ There's no "correct" advice: the authors measure stability, not recommendation quality. A model can give consistently bad advice.
⚠️ The "excess" estimate depends on assumptions: the conclusion that the spread is 2.4–3.3 times above normal rests on assumptions about linearity and answer reliability. If the answer is actually more reliable (0.8 instead of 0.47), the excess drops to 1.1–1.5 times. The instability itself was measured directly and doesn't depend on assumptions.
⚠️ A generic noise caveat backfires: it stabilizes some models but turns cautious clients into "average" ones (22% stocks instead of 4%). For a client who genuinely doesn't want risk, that's bad advice.
⚠️ Extra questions: three additional money questions add caution more than stability. No noticeable improvement relative to the between-person differences was found.
How They Ran the Study
The idea was simple: take real people who answered the same risk question twice and see how that changes the AI's advice. The first source is the American panel Survey of Consumer Finances (SCF): 3,712 households that answered in both 2007 and 2009. The test-retest correlation of the answers was just 0.47: 41% chose a different option. To rule out the effect of the 2008 crisis, they added the Basel–Berlin lab retest with a six-month interval.
They took 800 profiles from the panel. For each one, they made two requests that differed only in the answer (2007 or 2009). Seven models from five providers returned the stock share in JSON. Control measurement: the first 200 profiles were queried twice with the identical prompt to isolate generation noise. It turned out to be an order of magnitude smaller than the answer effect.
The result was stress-tested for robustness. They varied the wording (a "fiduciary" role, the client speaking in first person, a stocks/bonds/cash breakdown), the sample, and the temperature (0 vs. default). The spread stayed within the same range. One more surprise: the phrase "this answer is highly reliable" barely changed the advice. Five models kept 96–100% of their responsiveness even without it, while two Claude models responded more weakly (77–89%). So by default, models treat the answer as highly reliable. In practice this means: without your instruction, the model won't double-check a self-report.
In total they sent 77,014 requests. Beyond the measurements, the authors released the code and all responses so anyone can rerun the audit on their own advisor.
Adaptations and Extrapolations
🔧 Technique: drop the generic noise warning → replace it with confirmation
Don't write "the client's answer may be unreliable" in the prompt. Instead, spell out a re-ask step. The warning works like "slide toward the middle," while the re-ask works like "get cleaner data."
Do not judge the reliability of the answer yourself. Instead, ask for confirmation of the key answer and use the confirmed option.
Extrapolation: audit your own "scorer" prompts. If you use an LLM to score leads, résumés or risk based on a questionnaire, apply the same trick. Take 10 typical cases and for each one run two neighboring answers to a subjective question ("willing to travel for work: probably yes / definitely yes"). Then compare against a repeat of the same prompt.
Rate the candidate on a 0–100 scale and return only the number.
Résumé: {resume}
Self-report: "Openness to change — {answer_option}"
If the score jumps by 20+ points when you switch to the neighboring option, add a clarification step or turn the subjective answer into a verifiable fact ("have you ever relocated for a job?"). This is my extrapolation, not a finding of the paper.
Resources
- Paper: Same Person, Different Advice: Auditing LLM Financial Advice with Repeated Risk-Tolerance Responses
- Authors: Soovadeep Bakshi, Apurba Bose, Aishwarya Bose, Sandip Nandi (independent researchers)
- Code and all 77,014 model responses: https://anonymous.4open.science/r/financial-advice-wobble-B279/
- Data: Survey of Consumer Finances (2007–09 panel, 2022 cross-section); Basel–Berlin Risk Study (0–10 risk scale)
- Related work: Ross & Lo; Fieberg et al.; Rumpf et al. (LLMs are 3 times more sensitive than humans to stated risk)
The paper text in the request was truncated: sections 9–10 and the appendices are available only as summarized in the abstract.