Generative AI
Few-Shot Demonstrations and Prompt Datasets
Use in-context demonstrations to communicate task behavior while controlling order effects, contamination, and brittle pattern copying.
By the end you can
- Explain how demonstrations condition behavior without updating model weights
- Select examples for coverage, contrast, and boundary clarification
- Identify order effects, label imbalance, format copying, and prompt contamination
- Evaluate demonstration sets as versioned product assets
Examples teach by showing, but they also teach accidents
A few-shot prompt puts a handful of input-output examples in front of the new request. The model reads a local pattern off them — labels, formatting, tone, procedure — and answers accordingly. Nothing in its parameters changes.
That framing is not folklore. It is how GPT-3 was evaluated in the first place. The 175-billion-parameter model was tested at NeurIPS 2020 in zero-, one- and few-shot settings, with the demonstrations reaching it only through the prompt. Brown and 30 co-authors put the condition in the abstract: “For all tasks, GPT-3 is applied without any gradient updates or fine-tuning, with tasks and few-shot demonstrations specified purely via text interaction with the model.”
The same mechanism transmits what you did not intend to teach. A demonstration block can make the model copy an irrelevant detail. It can push the model toward the label it saw last. It can let examples that are too alike stand in for the rule they were meant to illustrate. Demonstration selection is a small dataset-design problem inside the context window. The measurements in this lesson show how small the margin for carelessness is.
A prompt example communicates both the intended rule and every accidental regularity it contains.
Visual
Demonstrations can solve four different interface problems
Choose examples according to the behavior you need to teach. Format examples show fields, ordering, units, or a valid schema instance. Boundary examples contrast cases that differ on one decisive condition. Procedure examples demonstrate intermediate tool use, evidence handling, or escalation. Style examples set audience, tone, density, or vocabulary under a stable task. Failure examples show abstention, missing evidence, and out-of-scope behavior.
Name which of these a given example is for. It is the cheapest way to notice that a set holds five of one kind and none of the rest.
Format examples
Show fields, ordering, units, or a valid schema instance.
Boundary examples
Contrast cases that differ on one decisive condition.
Procedure examples
Demonstrate intermediate tool use, evidence handling, or escalation.
Style examples
Set audience, tone, density, or vocabulary under a stable task.
Failure examples
Show abstention, missing evidence, and out-of-scope behavior.
Comparison
Similarity and coverage support different goals
Nearest examples are not automatically the best teaching set. Both halves of that sentence have been measured.
Retrieving examples that resemble the query does work, and there is a published baseline for how well. A 2022 method called KATE does exactly that: instead of sampling demonstrations at random, fetch the ones semantically closest to the test query. Jiachang Liu and colleagues report that “the retrieval-based prompt selection approach consistently outperforms the random selection baseline”. In the published version it reaches 45.5% on open-domain question answering over Natural Questions, and 44.3% on the ToTTo table-to-text dataset.
Coverage is the answer to where that strategy runs out. Levy and colleagues tested compositional generalization in 2023 and found that “selecting similar demonstrations is insufficient, as often no example will be similar enough to the input”. Selecting instead a diverse set that covers the structures the output has to contain substantially improved performance across three compositional semantic parsing datasets.
The three strategies are goals, not a ranking. A static curated set is easy to version and audit and stays consistent across requests; it can also waste context on irrelevant cases and miss rare input types. A similarity-selected set adapts to domain and terminology, but it depends on embedding quality, can reinforce a wrong neighborhood, and needs diversity and label-balance controls. A coverage-oriented set makes contrasts explicit and supports systematic testing; it is often less lexically similar, and you need a task taxonomy before you can build one at all. The two results above tell you which goal is the one currently failing.
Static curated set
A fixed group of examples represents the task contract.
- Easy to version and audit
- Consistent across requests
- Can waste context on irrelevant cases
- May miss rare input types
Similarity-selected set
Retrieve examples close to the current input.
- Adapts to domain and terminology
- Depends on embedding quality
- Can reinforce a wrong neighborhood
- Needs diversity and label-balance controls
Coverage-oriented set
Select examples that span known decision boundaries.
- Makes contrasts explicit
- Supports systematic testing
- May be less lexically similar
- Requires a task taxonomy
Example
A demonstration set can leak its own shortcuts
These failures are common even when each example is individually correct. The first and the last of them have been quantified.
- Recency effect: The model overuses the label or style shown in the final example. Position sensitivity of this kind has a measured shape. “Lost in the Middle”, published in Transactions of the ACL in 2024, documented a U-shaped positional curve — primacy and recency bias: “we observe that performance is often highest when relevant information occurs at the beginning or end of the input context, and significantly degrades when models must access relevant information in the middle of long contexts, even for explicitly long-context models”. Put the answer-bearing document in the middle, and GPT-3.5-Turbo answering multi-document questions falls below its own closed-book accuracy of 56.1%. Give it that one document alone and it scores 88.3%.
- Class imbalance: Four positive cases and one negative case imply the wrong prior for the request. Zhao and colleagues named this majority-label bias in 2021, alongside recency bias and common-token bias. Their repair was contextual calibration: fit the model so that a content-free input such as “N/A” comes out uniform. It improved GPT-3 and GPT-2 accuracy by up to 30.0% absolute.
- Template copying: The output reproduces names, numbers, or phrases that belong only to the demonstration. That is why surface details in examples should be perturbed while the rule is held fixed.
- Contradictory labels: Similar inputs receive different targets, because the examples came from different policy versions. Nothing in the prompt records which version an example belongs to.
- Prompt leakage: The evaluation example, or its answer, is sitting inside the selected demonstrations. The first systematic audit of indirect data contamination in closed-source LLMs, “Leak, Cheat, Repeat”, appeared in 2024: “By analysing 255 papers and considering OpenAI's data usage policy, we extensively document the amount of data leaked to these models during the first year after the model's release. We report that these models have been globally exposed to ∼4.7M samples from 263 benchmarks.” The leakage route was chiefly researchers pasting benchmark data into prompts. That is the same act as selecting a demonstration.
Case
Random labels barely hurt, and example order moved everything
Three groups took the obvious levers of a few-shot prompt and measured them. The results do not point where intuition does.
Replacing the labels in the demonstrations with random ones barely changes the outcome. Min and colleagues did exactly that in 2022 and found that “randomly replacing labels in the demonstrations barely hurts performance”, on classification and multi-choice tasks, consistently across 12 different models including GPT-3. What the demonstrations mainly supply, on their account, is the label space, the input distribution, and the sequence format.
Other properties of the same block moved results by large margins. Zhao and colleagues opened their 2021 paper with the instability itself: “We show that this type of few-shot learning can be unstable: the choice of prompt format, training examples, and even the order of the examples can cause accuracy to vary from near chance to near state-of-the-art.” They traced it to majority-label, recency and common-token bias. Their contextual calibration recovered up to 30.0% absolute.
Order alone accounts for much of that range. Lu and colleagues held the examples fixed and permuted them: “We demonstrate that the order in which the samples are provided can make the difference between near state-of-the-art and random guess performance: essentially some permutations are “fantastic” and some not.” The effect persists across model sizes and does not transfer between models. Their entropy-based probing method, run over an artificial development set, was worth a 13% relative improvement for GPT-family models across eleven text classification tasks.
Three results, one shape. The label content mattered least. The arrangement of the set mattered most. The set is the unit, not the example.
Position
Another correct example is rarely the repair
Demonstrations do teach. They do not mostly teach the answer. Replacing the labels at random “barely hurts performance” on classification and multi-choice tasks, and that held consistently across 12 different models including GPT-3 — Min and colleagues, 2022. Whatever those examples were buying, it was not mainly the correctness of their labels. It was the label space, the input distribution, and the sequence format.
Meanwhile the arrangement of the block moved results by large margins. Calibrating away majority-label, recency and common-token bias recovered up to 30.0% absolute. Lu and colleagues held the examples fixed and permuted them, and the order alone “can make the difference between near state-of-the-art and random guess performance: essentially some permutations are “fantastic” and some not”. Their entropy-based ordering method gained 13% relative across eleven text classification tasks, without adding a single example.
So when a few-shot prompt returns a wrong answer, adding a fifth correct example is the move this evidence supports least. Change the balance. Change the order. Add a contrast that differs on one decisive condition, and re-measure. All three results were obtained on sets, not on single examples — and the two largest gains, 30.0% absolute and 13% relative, came from leaving the examples exactly as they were.
A wrong answer is weak evidence that the examples were wrong.
Key idea
Prompt examples are runtime data with privacy and rights obligations
Selecting historical user interactions as demonstrations can expose personal information to later requests, logs, or third-party services. The reassurance that the records were sanitized first is the part that has been tested. It failed.
The Netflix Prize dataset was released as anonymous ratings from 500,000 subscribers. Narayanan and Shmatikov took that release, used the Internet Movie Database as background knowledge, identified individual subscribers' records and inferred apparently sensitive attributes. Their 2008 paper is deliberately modest about how much the attacker needs: “We demonstrate that an adversary who knows only a little bit about an individual subscriber can easily identify this subscriber's record in the dataset.” Removing direct identifiers does not make sparse, high-dimensional records safe to release. A demonstration set drawn from real interactions is exactly such a release, made once per request.
Use synthetic or explicitly approved examples where possible. Minimize retained detail and apply access controls. Example provenance should be visible to the team that owns the prompt.
In-context data does not become harmless merely because it avoids a weight update.
Steps
Build a compact demonstration suite
Treat examples as a dataset with a measurable purpose. The measurements above set the order of work.
1. Name the behavior. Specify whether the examples teach format, boundary, procedure, or style.
2. Add contrasts. Pair similar inputs with different outcomes driven by one condition. That is the point of the compositional-generalization result: “selecting similar demonstrations is insufficient, as often no example will be similar enough to the input”.
3. Balance labels and slices. Control class frequency, language, domain, and risk coverage. Majority-label bias is one of the three effects that had to be calibrated away for up to 30.0% absolute.
4. Randomize order tests. Measure whether position changes the prediction. This step is not a precaution. Permutation alone spans near state-of-the-art to random guessing, and entropy-based ordering was worth 13% relative across eleven text classification tasks.
5. Perturb surface details. Replace names, values, and wording while preserving the rule, so that template copying shows up as a failure rather than as a passing score.
6. Version and evaluate. Lock examples with the prompt and a protected regression set. Roughly 4.7 million evaluation samples from 263 benchmarks reached GPT-3.5 and GPT-4 in the first year after release, largely through prompts. That is what an unversioned example pool does to an evaluation set over time.
1. Name the behavior
Specify whether the examples teach format, boundary, procedure, or style.
2. Add contrasts
Pair similar inputs with different outcomes driven by one condition.
3. Balance labels and slices
Control class frequency, language, domain, and risk coverage.
4. Randomize order tests
Measure whether position changes the prediction.
5. Perturb surface details
Replace names, values, and wording while preserving the rule.
6. Version and evaluate
Lock examples with the prompt and protected regression set.
Few-shot prompting is local data engineering
Demonstrations earn their place when they communicate distinctions that instructions describe poorly. The published results say precisely where that value sits. Not in the correctness of each label — Min and colleagues randomized those at little cost. It sits in the label space, the input distribution, the format, the balance, and the order. Demonstrations are costly when they consume context, leak data, or create brittle copying.
The next lesson moves from examples to decomposition. Instead of showing complete answers, a workflow can divide a task into stages with observable intermediate contracts.
Key takeaways
- Few-shot demonstrations condition current behavior without updating model parameters. GPT-3, a 175-billion-parameter model, was evaluated at NeurIPS 2020 with the demonstrations supplied purely through the prompt.
- Examples can teach format, decision boundaries, procedures, style, and failure behavior. Every example also teaches whatever else it happens to contain.
- Similarity, coverage, and contrast are different selection goals. KATE beat random selection in 2022, reaching 45.5% on Natural Questions; under compositional generalization, similarity selection turned out to be insufficient on its own.
- Arrangement outweighs label content. Random labels barely hurt across 12 models, while order alone spans near state-of-the-art to random guessing and contextual calibration recovered up to 30.0% absolute.
- Historical examples create privacy, rights, and provenance risks at inference time. Narayanan and Shmatikov re-identified subscribers in the anonymous 500,000-subscriber Netflix Prize ratings using the Internet Movie Database.
- A demonstration set should be balanced, perturbation-tested, versioned, and evaluated like a small dataset. Roughly 4.7 million evaluation samples from 263 benchmarks leaked to closed-source models in one year, chiefly through prompts.