CoChat
Sign Up
PreprintCited by 12Adversarial Robustness in Machine LearningSpam and Phishing DetectionEthics and Social Impacts of AI

The DOI matches its DataCite record; 4 of the 4 references it cites were found in a registry or an index.

Improving Your Model Ranking on Chatbot Arena by Vote Rigging

Open access
Min, Rui, Pang, Tianyu, Du, Chao, Liu, Qian, Cheng, Minhao, Lin, Min·2025·arXiv
DOI 10.48550/arxiv.2501.17858arXiv 2501.17858
Open this paper in CoChat — free accountOpen PDF

Abstract

Chatbot Arena is a popular platform for evaluating LLMs by pairwise battles, where users vote for their preferred response from two randomly sampled anonymous models. While Chatbot Arena is widely regarded as a reliable LLM ranking leaderboard, we show that crowdsourced voting can be rigged to improve (or decrease) the ranking of a target model $m_{t}$. We first introduce a straightforward target-only rigging strategy that focuses on new battles involving $m_{t}$, identifying it via watermarking or a binary classifier, and exclusively voting for $m_{t}$ wins. However, this strategy is practically inefficient because there are over $190$ models on Chatbot Arena and on average only about $1\%$ of new battles will involve $m_{t}$. To overcome this, we propose omnipresent rigging strategies, exploiting the Elo rating mechanism of Chatbot Arena that any new vote on a battle can influence the ranking of the target model $m_{t}$, even if $m_{t}$ is not directly involved in the battle. We conduct experiments on around $1.7$ million historical votes from the Chatbot Arena Notebook, showing that omnipresent rigging strategies can improve model rankings by rigging only hundreds of new votes. While we have evaluated several defense mechanisms, our findings highlight the importance of continued efforts to prevent vote rigging. Our code is available at https://github.com/sail-sg/Rigging-ChatbotArena.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.2501.17858

Cites

4 of 4 references verified0 citation errors · 0 not checkable

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Adversarial voting is a critical concern for the reliability of crowd-sourced evaluation platforms like Chatbot Arena.

    “Various previous works have shown that adversarial voting is a critical concern for the reliability of any crowd-sourced evaluation platform like Chatbot Arena (Huang et al., 2025) (Min et al., 2025).”

    From The Leaderboard Illusion (2025) · cites this paper as Min et al., 2025

  • Chatbot Arena rankings can be artificially inflated through various adversarial voting strategies.

    “Zhao et al. (2024); Min et al. (2025) suggest that Chatbot Arena rankings can be artificially inflated through various adversarial voting strategies.”

    From The Leaderboard Illusion (2025) · cites this paper as Min et al., 2025

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Flagged first, then by citations

Research works printed but not linked: 56

  1. Abdin, M., Aneja, J., Awadalla, H., Awadallah, A., Awan, A. A., Bach, N., Bahree, A., Bakhtiari, A., Bao, J., Behl, H., et al. Phi-3 technical report: A highly capable lan- guage model locally on your phone. arXiv preprint arXiv:2404.14219, 2024. · arXiv
  2. Achiam, J., Adler, S., Agarwal, S., Ahmad, L., Akkaya, I., Aleman, F. L., Almeida, D., Altenschmidt, J., Altman, S., Anadkat, S., et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774, 2023. · arXiv
  3. Bai, J., Bai, S., Chu, Y., Cui, Z., Dang, K., Deng, X., Fan, Y., Ge, W., Han, Y., Huang, F., et al. Qwen technical report. arXiv preprint arXiv:2309.16609, 2023. · arXiv
  4. Bassi, A. Voting systems and strategic manipulation: An experimental study. Journal of Theoretical Politics, 27 (1):58-85, 2015.
  5. Brown, T., Mann, B., Ryder, N., Subbiah, M., Kaplan, J. D., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G., Askell, A., et al. Language models are few-shot learners. Advances in neural information processing systems, 33: 1877-1901, 2020.
  6. Chen, M., Tworek, J., Jun, H., Yuan, Q., Pinto, H. P. D. O., Kaplan, J., Edwards, H., Burda, Y., Joseph, N., Brockman, G., et al. Evaluating large language models trained on code. arXiv preprint arXiv:2107.03374, 2021. · arXiv
  7. Chen, Y., Kang, H., Zhai, V., Li, L., Singh, R., and Raj, B. Token prediction as implicit classification to identify llm-generated text. arXiv preprint arXiv:2311.08723, 2023b. · arXiv
  8. Chiang, W.-L., Li, Z., Lin, Z., Sheng, Y., Wu, Z., Zhang, H., Zheng, L., Zhuang, S., Zhuang, Y., Gonzalez, J. E., et al. Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality. See https://vicuna.lmsys.org (accessed 14 April 2023), 2(3):6, 2023b.
  9. Chiang, W.-L., Zheng, L., Sheng, Y., Angelopoulos, A. N., Li, T., Li, D., Zhu, B., Zhang, H., Jordan, M., Gonza- lez, J. E., et al. Chatbot arena: An open platform for evaluating llms by human preference. In International Conference on Machine Learning (ICML), 2024.
  10. Christ, M., Gunn, S., and Zamir, O. Undetectable water- marks for language models. In The Thirty Seventh Annual Conference on Learning Theory, pp. 1125-1139. PMLR, 2024.
  11. Cobbe, K., Kosaraju, V., Bavarian, M., Chen, M., Jun, H., Kaiser, L., Plappert, M., Tworek, J., Hilton, J., Nakano, R., et al. Training verifiers to solve math word problems. arXiv preprint arXiv:2110.14168, 2021. · arXiv
  12. Dou, Y., Forbes, M., Koncel-Kedziorski, R., Smith, N. A., and Choi, Y. Is gpt-3 text indistinguishable from human text? scarecrow: A framework for scrutinizing machine text. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pp. 7250-7274, 2022.
  13. Dubey, A., Jauhri, A., Pandey, A., Kadian, A., Al-Dahle, A., Letman, A., Mathur, A., Schelten, A., Yang, A., Fan, A., et al. The llama 3 herd of models. arXiv preprint arXiv:2407.21783, 2024. · arXiv
  14. Dubois, Y., Galambosi, B., Liang, P., and Hashimoto, T. B. Length-controlled alpacaeval: A simple way to debias automatic evaluators. arXiv preprint arXiv:2404.04475, 2024. · arXiv
  15. Elo, A. E. The proposed uscf rating system, its development, theory, and applications. Chess life, 22(8):242-247, 1967.
  16. Feng, Q., Sun, Y. L., Liu, L., Yang, Y., and Dai, Y. Voting systems with trust mechanisms in cyberspace: Vulnera- bilities and defenses. IEEE Transactions on Knowledge and Data Engineering, 22(12):1766-1780, 2010.
  17. Fernandez, P., Chaffin, A., Tit, K., Chappelier, V., and Furon, T. Three bricks to consolidate watermarks for large lan- guage models. In 2023 IEEE International Workshop on Information Forensics and Security (WIFS), pp. 1-6. IEEE, 2023.
  18. Gemma, T., Mesnard, T., Hardin, C., Dadashi, R., Bhupati- raju, S., Pathak, S., Sifre, L., Rivière, M., Kale, M. S., Love, J., et al. Gemma: Open models based on gemini re- search and technology. arXiv preprint arXiv:2403.08295, 2024a. · arXiv
  19. Gemma, T., Riviere, M., Pathak, S., Sessa, P. G., Hardin, C., Bhupatiraju, S., Hussenot, L., Mesnard, T., Shahri- ari, B., Ramé, A., et al. Gemma 2: Improving open language models at a practical size. arXiv preprint arXiv:2408.00118, 2024b. · arXiv
  20. Gibbard, A. Manipulation of voting schemes: a general result. Econometrica: journal of the Econometric Society, pp. 587-601, 1973.
  21. GLM, T., Zeng, A., Xu, B., Wang, B., Zhang, C., Yin, D., Zhang, D., Rojas, D., Feng, G., Zhao, H., et al. Chatglm: A family of large language models from glm-130b to glm-4 all tools. arXiv preprint arXiv:2406.12793, 2024. · arXiv
  22. Guo, B., Zhang, X., Wang, Z., Jiang, M., Nie, J., Ding, Y., Yue, J., and Wu, Y. How close is chatgpt to human experts? comparison corpus, evaluation, and detection. arXiv preprint arXiv:2301.07597, 2023. · arXiv
  23. Hartvigsen, D. The manipulation of voting systems. Journal of business ethics, 80:13-21, 2008.
  24. Hendrycks, D., Burns, C., Basart, S., Zou, A., Mazeika, M., Song, D., and Steinhardt, J. Measuring mas- sive multitask language understanding. arXiv preprint arXiv:2009.03300, 2020. · arXiv
  25. Huang, Y., Nasr, M., Angelopoulos, A., Carlini, N., Chiang, W.-L., Choquette-Choo, C. A., Ippolito, D., Jagielski, M., Lee, K., Liu, K. Z., et al. Exploring and mitigating adversarial manipulation of voting-based leaderboards. arXiv preprint arXiv:2501.07493, 2025. · arXiv
  26. Hubinger, E., Denison, C., Mu, J., Lambert, M., Tong, M., MacDiarmid, M., Lanham, T., Ziegler, D. M., Maxwell, T., Cheng, N., et al. Sleeper agents: Training deceptive llms that persist through safety training. arXiv preprint arXiv:2401.05566, 2024. · arXiv
  27. Kim, D., Park, C., Kim, S., Lee, W., Song, W., Kim, Y., Kim, H., Kim, Y., Lee, H., Kim, J., et al. Solar 10.7 b: Scaling large language models with simple yet effective depth up-scaling. arXiv preprint arXiv:2312.15166, 2023. · arXiv
  28. Kirchenbauer, J., Geiping, J., Wen, Y., Katz, J., Miers, I., and Goldstein, T. A watermark for large language models. In International Conference on Machine Learning, pp. 17061-17084. PMLR, 2023.
  29. Kirchenbauer, J., Geiping, J., Wen, Y., Shu, M., Saifullah, K., Kong, K., Fernando, K., Saha, A., Goldblum, M., and Goldstein, T. On the reliability of watermarks for large language models. In The Twelfth International Conference on Learning Representations, 2024.
  30. Li, Y., Li, T., Chen, K., Zhang, J., Liu, S., Wang, W., Zhang, T., and Liu, Y. Badedit: Backdooring large language models by model editing. In The Twelfth International Conference on Learning Representations, 2024d.
  31. Liu, Y., Ott, M., Goyal, N., Du, J., Joshi, M., Chen, D., Levy, O., Lewis, M., Zettlemoyer, L., and Stoyanov, V. Roberta: A robustly optimized bert pretraining approach. arXiv e-prints, pp. arXiv-1907, 2019.
  32. Liu, Y., Yao, Z., Min, R., Cao, Y., Hou, L., and Li, J. Rm- bench: Benchmarking reward models of language models with subtlety and style. arXiv preprint arXiv:2410.16184, 2024. Mosaic. Introducing mpt-7b: A new standard for open- source, commercially usable llms, 2023. URL https: //www.databricks.com/blog/mpt-7b. · arXiv
  33. Ouyang, L., Wu, J., Jiang, X., Almeida, D., Wainwright, C., Mishkin, P., Zhang, C., Agarwal, S., Slama, K., Ray, A., et al. Training language models to follow instructions with human feedback. Advances in neural information processing systems, 35:27730-27744, 2022.
  34. Peng, X., Xie, K., Alabdulkarim, A., Kayam, H., Dani, S., and Riedl, M. Guiding neural story generation with reader models. In Findings of the Association for Computational Linguistics: EMNLP 2022, pp. 7087-7111, 2022.
  35. Peters, H. and Veselova, Y. On the safety of group ma- nipulation. Social Choice and Welfare, 61(3):713-732, 2023.
  36. Rando, J. and Tramèr, F. Universal jailbreak back- doors from poisoned human feedback. arXiv preprint arXiv:2311.14455, 2023. · arXiv
  37. Sainz, O., Campos, J. A., García-Ferrero, I., Etxaniz, J., de Lacalle, O. L., and Agirre, E. Nlp evaluation in trou- ble: On the need to measure llm data contamination for each benchmark. In The 2023 Conference on Empirical Methods in Natural Language Processing, 2023.
  38. Shi, J., Yuan, Z., Liu, Y., Huang, Y., Zhou, P., Sun, L., and Gong, N. Z. Optimization-based prompt injection at- tack to llm-as-a-judge. arXiv preprint arXiv:2403.17710, 2024. · arXiv
  39. Shu, M., Wang, J., Zhu, C., Geiping, J., Xiao, C., and Goldstein, T. On the exploitability of instruction tuning. Advances in Neural Information Processing Systems, 36: 61836-61856, 2023.
  40. Touvron, H., Martin, L., Stone, K., Albert, P., Almahairi, A., Babaei, Y., Bashlykov, N., Batra, S., Bhargava, P., Bhosale, S., et al. Llama 2: Open foundation and fine- tuned chat models. arXiv preprint arXiv:2307.09288, 2023. · arXiv
  41. Tunstall, L., Beeching, E., Lambert, N., Rajani, N., Ra- sul, K., Belkada, Y., Huang, S., von Werra, L., Fourrier, C., Habib, N., et al. Zephyr: Direct distillation of lm alignment. arXiv preprint arXiv:2310.16944, 2023. · arXiv
  42. Verma, V., Fleisig, E., Tomlin, N., and Klein, D. Ghost- buster: Detecting text ghostwritten by large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Com- putational Linguistics: Human Language Technologies (Volume 1: Long Papers), pp. 1702-1717, 2024.
  43. Wang, A., Singh, A., Michael, J., Hill, F., Levy, O., and Bowman, S. R. Glue: A multi-task benchmark and anal- ysis platform for natural language understanding. In International Conference on Learning Representations, 2018.
  44. Wang, D., Muller, T., Irissappane, A. A., Zhang, J., and Liu, Y. Using information theory to improve the robustness of trust systems. In AAMAS, pp. 791-799, 2015.
  45. Wang, G., Cheng, S., Zhan, X., Li, X., Song, S., and Liu, Y. Openchat: Advancing open-source language models with mixed-quality data. arXiv preprint arXiv:2309.11235, 2023. · arXiv
  46. Xu, C., Sun, Q., Zheng, K., Geng, X., Zhao, P., Feng, J., Tao, C., and Jiang, D. Wizardlm: Empowering large language models to follow complex instructions. arXiv preprint arXiv:2304.12244, 2023. · arXiv
  47. Xu, J., Ma, M., Wang, F., Xiao, C., and Chen, M. Instruc- tions as backdoors: Backdoor vulnerabilities of instruc- tion tuning for large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pp. 3111-3126, 2024.
  48. Yan, J., Yadav, V., Li, S., Chen, L., Tang, Z., Wang, H., Srini- vasan, V., Ren, X., and Jin, H. Backdooring instruction- tuned large language models with virtual prompt injec- tion. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pp. 6065-6086, 2024.
  49. Yang, S., Chiang, W.-L., Zheng, L., Gonzalez, J. E., and Stoica, I. Rethinking benchmark and contamination for language models with rephrased samples. arXiv preprint arXiv:2311.04850, 2023. · arXiv
  50. Yoo, K., Ahn, W., Jang, J., and Kwak, N. Robust multi-bit natural language watermarking through invariant features. In Proceedings of the 61st Annual Meeting of the Asso- ciation for Computational Linguistics (Volume 1: Long Papers), pp. 2092-2115, 2023.
  51. Young, A., Chen, B., Li, C., Huang, C., Zhang, G., Zhang, G., Li, H., Zhu, J., Chen, J., Chang, J., et al. Yi: Open foundation models by 01. ai. arXiv preprint arXiv:2403.04652, 2024. · arXiv
  52. Yuan, L., Chen, Y., Cui, G., Gao, H., Zou, F., Cheng, X., Ji, H., Liu, Z., and Sun, M. Revisiting out-of-distribution robustness in nlp: Benchmarks, analysis, and llms eval- uations. Advances in Neural Information Processing Systems, 36:58478-58507, 2023.
  53. Zhao, W., Rush, A. M., and Goyal, T. Challenges in trust- worthy human evaluation of chatbots. arXiv preprint arXiv:2412.04363, 2024. · arXiv
  54. Zheng, L., Chiang, W.-L., Sheng, Y., Zhuang, S., Wu, Z., Zhuang, Y., Lin, Z., Li, Z., Li, D., Xing, E., et al. Judging llm-as-a-judge with mt-bench and chatbot arena. Ad- vances in Neural Information Processing Systems, 36: 46595-46623, 2023a.
  55. Zheng, X., Pang, T., Du, C., Liu, Q., Jiang, J., and Lin, M. Cheating automatic llm benchmarks: Null models achieve high win rates. arXiv preprint arXiv:2410.07137, 2024. · arXiv
  56. Zhu, B., Frick, E., Wu, T., Zhu, H., Ganesan, K., Chiang, W.-L., Zhang, J., and Jiao, J. Starling-7b: Improving help- fulness and harmlessness with rlaif. In First Conference on Language Modeling, 2024. Llama-2-7b-chat-hf Llama-2-13b-chat-hf Meta-Llama-3-8B-Instruct c4ai-command-r-v01 gpt-4o-mini-2024-07-18 Mistral-7B-Instruct-v0.2 Mistral-7B-Instruct-v0.1 gemma-2-27b-it gemma-2b-it gemma-2-9b-it Qwen1.5-7B-Chat Qwen1.5-14B-Chat Starling-LM-7B-alpha Starling-LM-7B-beta Yi-34B-Chat Yi-1.5-34B-Chat chatglm3-6b zephyr-7b-beta zephyr-7b-alpha Phi-3-small-8k-instruct vicuna-7b-v1.3

Cited by

Sorted by citations

Metadata

Authors
Min, R., Pang, T., Du, C., Liu, Q., Cheng, M., & Lin, M.
Affiliations
  • Hong Kong University of Science and Technology (HK)
  • Pennsylvania State University (US)
ORCID
Venue
arXiv
Publisher
arXiv
Published
2025
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2501.17858
arXiv
2501.17858
OpenAlex
W4406975857
Cited by
12
References
4
Citations by year
2026: 7 · 2025: 5
Type
posted content
Language
en
Open access
Licence
arxiv.org/licenses/nonexclusive-distrib/1.0/
Locations
  • arXiv (Cornell University) (submittedVersion)
  • Rare & Special e-Zone (The Hong Kong University of Science and Technology) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Information Systems › Spam and Phishing Detection
  • Physical Sciences › Computer Science › Artificial Intelligence › Ethics and Social Impacts of AI
Keywords
electoral fraud, Chatbot Arena, Elo rating, watermarking

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review