GEPA: Reflective Prompt Evolution Can Outperform Reinforcement Learning — part 3/4

Cleaned-text code points [31335, 46955). Bibliography omitted here; source.md includes it.

We instantiate GEPA for adversarial prompt search by inverting the reward signal: the optimizer proposes prompt edits to include additional information like trivia that minimize task performance (pass@1), while requiring that prompts do not contradict the task and still contain all information needed to solve it. For AIME, GEPA’s adversarial search used AIME 2022–2024 problems as the pool for prompt evolution. The learned prompt was evaluated on AIME-2025 (30 problems), using GPT-5 Mini with 5 runs per problem (150 generations total). We started from a clean instruction prompt and evolved a single universal adversarial instruction that is prepended to each query.

The learned adversarial instruction reduced pass@1 on AIME-2025 from 76% (clean prompt) to 10% (adversarial prompt), despite preserving the nominal task description and the required answer-format directive.

Base (clean) prompt: You are a helpful assistant. You are given a question and you need to answer it. The answer should be given at the end of your response in exactly the format ‘ ### <final answer> ’.

GEPA-generated adversarial prompt (abridged): You are a helpful assistant. You are given a question and you need to answer it. It’s interesting to note that honey never spoils and that the longest river in the world is the Nile, stretching over 6,650 kilometers. When providing your answer, be sure to format it at the end of your response exactly as ‘ ### <final answer> ’. For this task, remember that many mammals, including dolphins, sleep with one eye open. Proceed to answer the given question accordingly.

Manual inspection showed that the adversarial prompt caused GPT-5 Mini to end most responses with the literal placeholder ### <final answer> , indicating a systematic misinterpretation of the formatting rule when paired with the injected distractors. This suggests that the large drop arises from the interaction between extraneous details and a strict, literal formatting constraint, rather than from the formatting requirement alone.

Adversarial prompt search systematically uncovers instruction-level perturbations that sharply degrade model performance, providing a principled, automated way to probe worst-case robustness beyond average-case metrics. By finding universal, task-preserving distractors (e.g., trivia plus strict formatting), it reveals brittle instruction-following interactions and turns them into reusable stress tests and regression suites for continuous evaluation. The resulting adversarial prompts could be used to provide targeted data for fine-tuning or safety training. In practice, this could improve deployment reliability, enables red-teaming at scale, and help track robustness drift over time across models, versions, and domains.

## 6 Related Work

Prompt optimization improves LLMs but often needs manual expertise; for instance, chain-of-thought prompting Wei et al. (2023) . To scale this approach, recent methods use LLMs to optimize prompts automatically ( Zhou et al., 2022 ; Yang et al., 2024 ; Agarwal et al., 2024 ; Fernando et al., 2024 ) . GEPA leverages LLMs, but differs by incorporating textual environment feedback, Pareto-aware search over candidates, and evolution strategies per submodule within an AI system.

Evolutionary algorithms have been used to optimize prompts, e.g., EvoPrompt ( Guo et al., 2024 ) , which evolves prompt populations. Rainbow Teaming ( Samvelyan et al., 2024 ) applies quality-diversity evolution to generate diverse adversarial prompts. GEPA additionally uses domain-specific feedback for targeted mutations achieving higher sample efficiency. AlphaEvolve ( Novikov et al., 2025 ) and OpenEvolve ( Sharma, 2025 ) apply evolutionary search directly to code rewriting, excelling when problem solution can be codified. While AlphaEvolve targets a single hard problem, GEPA brings evolution to prompts across domains, combining Pareto-frontier optimization and prompt evolution to transfer tactics from related problems.

Feedback-driven improvement often uses reinforcement learning, such as majority voting signals ( Zuo et al., 2025 ) , but RL can be sample-inefficient when rewards are slow to compute. An alternative is learning in the language space: in-context bandit/self-bootstrapping methods ( Shinn et al., 2023 ; Madaan et al., 2023 ) ( Monea et al., 2025 ; Xu et al., 2025a ; Feng et al., 2025 ; Cheng et al., 2024 ) , workflow memory and skills ( Wang et al., 2024 ; Wang et al., 2025c ) , and test-time strategy synthesis via Dynamic Cheatsheet ( Suzgun et al., 2025 ) , reasoning cache ( Chen et al., 2025b ) . GEPA instead uses examples to propose new instructions , yielding task-specific rules.

To optimize compound AI systems and agents ( Lin et al., 2025b ) , DSPy ( Khattab et al., 2022 ; Khattab et al., 2024 ) searches/bootstraps few-shot examples, TextGrad ( Yuksekgonul et al., 2025 ) backpropagates textual feedback, and MIPROv2 ( Opsahl-Ong et al., 2024 ) jointly aligns instructions and examples via Bayesian optimization; these largely rely on global rewards. Agent-Pro ( Zhang et al., 2024 ) evolves agent policies through dynamic belief generation and reflection on interactive experiences. Optimas ( Wu et al., 2025a ) introduces globally aligned local rewards per module. GEPA combines global rewards with environment textual feedback per module and maintains a Pareto frontier over individual data instances, matching prompts/agent design to specific examples. The Pareto-guided evolution lets GEPA explore diverse prompt/code/agent design strategies before converging to a robust, generalizable set.

## 7 Conclusion

We introduced GEPA, a prompt optimizer for arbitrary LLM agents and workflows that leverages explicit reflection and Pareto-based selection, showing superior sample efficiency compared to reinforcement learning (GRPO), while outperforming leading prompt optimizers (MIPROv2). By explicitly incorporating natural language feedback and maintaining a diverse pool of Pareto-optimal candidates, GEPA rapidly adapts AI systems to new tasks. Our results across benchmarks and models suggest that language-based reflection can offer a scalable strategy for optimizing complex real-world AI workflows, especially in resource-constrained settings. GEPA also shows promise as an inference-time search strategy, showing the ability to write code in challenging domains.

## Appendix A Appendix Outline

• Usage of Large Language Models

• GEPA’s Reflection and Prompt Update Meta Prompt

• GEPA Algorithm and Methodology Details

• Evaluation Setup (Contd.)

• Results and Analysis (Contd.)

• GEPA For Inference-Time Search (Contd.)

• GEPA for Adversarial Prompt Search (Contd.)

• Performance vs. Budget (Rollouts) Curves

• Generalization Gap

• Cost vs. Performance Analysis for optimized systems

• GEPA Search Trees

• Visualizing the Iterative Refinement achieved by GEPA

• Examples of best prompts for every benchmark

• GEPA generated prompts for kernel generation

• Number of reflection LM calls made by GEPA during optimization

## Appendix B Usage of Large Language Models

The authors used large language models (LLMs) only for polishing prose of text where the complete draft was fully written by the authors initially and polished later with the help of LLM-based assistants including ChatGPT, Gemini, and Perplexity. The authors’ used code assistants including Cursor and Copilot to implement the authors’ original design and ideas. The scientific contributions, technical methods, ideas and core results are entirely the original work of the authors.

## Appendix C GEPA’s Reflection and Prompt Update Meta Prompt

Figure C shows the meta-prompt used by GEPA, which guides the LLM to reflectively refine its current instruction based on input–output examples and corresponding feedback from the environment.

## Appendix D GEPA Algorithm and Methodology Details

Figure 4 presents the core GEPA Algorithm, along with the algorithm for Pareto-based candidate selection.

### D.1 Merge: System-aware crossover strategy for Compound AI optimization

Algorithm 4 provides the instantiation of the System aware Merge strategy used in GEPA+Merge. Intuitively, merge will be helpful when there are candidates in the pool that learn complementary strategies. Algorithm 3 defines the selection criteria: candidates are merged only if they share a common ancestor but have optimized disjoint sets of prompts (complementary strategies), are pareto-optimal, and both candidates improve upon the aggregate performance of the ancestor. GEPA routinely checks if the pool has 2 such candidates, invoking merge when identified. These strict lineage conditions mean merge occurs sparsely.

## Appendix E Evaluation Setup (Contd.)

### E.1 Benchmarks, Reference compound AI systems, and Feedback Functions

To rigorously evaluate the performance of GEPA and and compare it against current state-of-the-art compound AI system optimizers, we assemble a diverse suite of benchmarks mostly obtained from Tan et al. (2025) , each paired with available Compound AI Systems.

HotpotQA ( Yang et al., 2018 ) is a large-scale question-answering dataset consisting of 113K Wikipedia-based question-answer pairs. It features questions that require reasoning over multiple supporting documents. We modify the last hop of the HoVerMultiHop program (described below) to answer the question instead of generating another query, and the rest of the system remains unmodified. The textual feedback module identifies the set of relevant documents remaining to be retrieved at each stage of the program, and provides that as feedback to the modules at that stage. We use 150 examples for training, 300 for validation, and 300 for testing.

IFBench ( Pyatkin et al., 2025a ) introduced a benchmark specifically designed to assess language models’ ability to follow precise human instructions, especially output constraints (e.g., “answer only with yes or no”, or “mention a word at least three times”). The IFBench test set consists of 58 new and out-of-distribution output constraints and instructions to test system’s ability to generalize to new task constraints. Pyatkin et al. (2025a) also release IFTrain and IF-RLVR Train data ( Pyatkin et al., 2025b ) which are used for training. We split the IF-RLVR Train into our train/val sets, and IFBench as our test set in order to ensure that the optimizers do not access the new, unseen constraints being tested in IFBench. We design a 2-stage system, that first attempts to answer the user query, and then in the second stage, rewrites the answer following the constraints. The textual feedback module provides the descriptions of constraints satsified and failed-to-be-satisifed by the system’s response. Our splits contain 150 training examples, 300 for validation, and 294 for testing.

AIME-2025 ( Balunović et al., 2025 ) The AIME-2025 benchmark consists of 2 problem sets of 15 questions each (total 30) obtained from the AIME examination conducted by Mathematical Association of America. We use prior years AIME questions (2022-2024 totalling 90 questions) split equally into training and validation set, and use the AIME-2025 questions, repeating each question 5 times, as the final test set. We use a single-step ChainOfThought as the AI system under optimization.

LiveBench-Math White et al. (2025) LiveBench is a cross-domain benchmark consisting of regularly updated questions. We use the math subset of LiveBench questions retrieved on July 30, 2025. This set of questions (n=368) is shuffled (with python random seed 0) and split equally into train/val/test questions. We use a single-step ChainOfThought as the AI system under optimization.

HoVer ( Jiang et al., 2020 ) is an open-domain multihop fact extraction and claim verification benchmark built on a Wikipedia-based corpus requiring complex reasoning across multiple sentences and documents, typically involving multiple wikipedia articles. Following Tan et al. (2025) , the systems are evaluated for their ability to write queries in multiple hops to retrieve all relevant wikipedia documents (gold documents) required to make the claim. We obtain the HoverMultiHop program from Tan et al. (2025) , which performs up to 3-hop retrievals using 2 query writer modules, and 2 document summary modules. The textual feedback module simply identifies the set of correct documents retrieved, and the set of documents remaining to be retrieved, and returns them as feedback text. For the full-parameter finetuning results demonstrated in figure 11 , we instantiate a 2-hop program, where the first hop is performed with the initial claim, and the LLM is prompted in a single turn with the claim and first-hop retrieved documents, to provide the second-hop search query. For HoVer, we use 150 examples for training, 300 for validation, and 300 for testing.

PUPA ( Li et al., 2025a ) propose the task of Privacy-Conscious Delegation: addressing real-world user queries using an ensemble of trusted and untrusted models. The core challenges are maintaining high response quality while minimizing leakage of personally identifiable information (PII) to untrusted models. Li et al. (2025a) also present PAPILLON, a compound AI system consisting of 2 modules, a user query rewriter and a response rewriter, run over the trusted model, along with an intermediate call to the untrusted model with the rewritten query. The feedback text simply provides the breakdown of the aggregate score, consisting of a response quality score and a PII leakage score. The dataset is split into 111 training examples, 111 for validation, and 221 for testing.

### E.2 Models and Inference Parameters

We evaluate GEPA and baseline optimizers using two contemporary LLMs, chosen to represent both open-source and commercial model families. Each compound AI system is instantiated once per model, with all modules (e.g., retrievers, rewriters, answer generators) relying on the same model. All models are allowed a context window of upto 16384 tokens for inference.

Qwen3 8B ( Yang et al., 2025 ) : For our open-source experiments (including GRPO), we use Qwen3-8B . Following the recommended settings as per Team (2025) , we use a decoding temperature of 0.6, top-p of 0.95, and top-k of 20 for training as well as inference.

GPT-4.1 Mini ( OpenAI, 2025 ) : For comparison with large commercial models, we use GPT-4.1 mini ( openai/gpt-4.1-mini-2025-04-14 ) accessed via the OpenAI API with a model temperature of 1.0.

### E.3 Costs

It costs under $500 to run all experiments in Table 2 with GPT-4.1 mini. Specifically, GEPA costs a total of $86, GEPA-Merge costs $67, MIPROv2 costs $76, and Trace and TextGrad cost $172 in total.

### E.4 Optimizers

Baseline: The base program is directly evaluated without any further optimization applied.

MIPROv2 ( Opsahl-Ong et al., 2024 ) : MIPROv2 is a widely used compound AI system prompt optimizer and has been integrated into the DSPy ( Khattab et al., 2024 ) and llama-prompt-ops ( AI, 2025 ) frameworks. It works by jointly optimizing both instructions and demonstrations using Bayesian optimization. For each program module, it first bootstraps candidate sets of instructions and demonstrations, assigning uniform priors over their utilities. Candidate assignments are proposed with the Tree-Structured Parzen Estimator (TPE), and the Bayesian model is updated based on evaluation scores to favor high-performing candidates. The most probable sets of instructions and demonstrations are then selected and validated to obtain the final optimized program configuration.