Individually harmless prompt constraints combine into a 12-point accuracy drop, on some model families only.

A full-factorial 3x3x3 over output format, persona and urgency across all 164 HumanEval+ problems and five OpenAI models, 22,140 greedy evaluations, decomposing each compound condition into an additive prediction plus a residual interaction. The GPT-4o family shows 3-12 point super-additive degradation, the worst being -12.2 pp on GPT-4o-mini for JSON plus expert persona plus moderate urgency. JSON interacts worse than XML, the GPT-4.1 family is largely resistant, and o3-mini improves under structured output. Vulnerability tracked architecture, not size. Test your production prompt as a compound, not as ablated single factors. arXiv 2609.03156