CoChat
Sign Up
PreprintCited by 3Adversarial Robustness in Machine LearningHate Speech and Cyberbullying DetectionEthics and Social Impacts of AI

Know Thy Judge: On the Robustness Meta-Evaluation of LLM Safety Judges

Open access
Eiras, Francisco, Zemour, Eliott, Lin, Eric, Mugunthan, Vaikkunth·2025·arXiv
DOI 10.48550/arxiv.2503.04474arXiv 2503.04474
Open this paper in CoChat — free accountOpen PDF

Abstract

Large Language Model (LLM) based judges form the underpinnings of key safety evaluation processes such as offline benchmarking, automated red-teaming, and online guardrailing. This widespread requirement raises the crucial question: can we trust the evaluations of these evaluators? In this paper, we highlight two critical challenges that are typically overlooked: (i) evaluations in the wild where factors like prompt sensitivity and distribution shifts can affect performance and (ii) adversarial attacks that target the judge. We highlight the importance of these through a study of commonly used safety judges, showing that small changes such as the style of the model output can lead to jumps of up to 0.24 in the false negative rate on the same dataset, whereas adversarial attacks on the model generation can fool some judges into misclassifying 100% of harmful generations as safe ones. These findings reveal gaps in commonly used meta-evaluation benchmarks and weaknesses in the robustness of current LLM judges, indicating that low attack success under certain judges could create a false sense of security.

AI snapshot

Written from the paper’s full text.

TL;DR

This paper meta-evaluates LLM safety judges under out-of-distribution stylistic changes and adversarial output-level modifications, showing that small non-malicious style changes can raise false negative rates by up to 0.24 and some attacks can make judges classify 100% of harmful generations as safe. The authors argue that current judge meta-evaluation benchmarks can create a false sense of security and that safety judges need more rigorous robustness testing.

Key findings

  • On the baseline JailbreakBench comparison subset, LLaMA Guard and WildGuard performed best (accuracy 0.92 and 0.93; FNR 0.04 and 0.02), while ShieldGemma had accuracy 0.70 and FNR 0.50, and HarmBench had accuracy 0.83 and FNR 0.12 (Table 1).
  • Stylistic prompt formatting changed judge behavior despite near-perfect human label agreement (1.0, 0.99, 1.0 for bullet points, news, storytelling): storytelling increased FNR by 0.24 for HarmBench, 0.20 for ShieldGemma, and 0.12 for WildGuard, while LLaMA Guard showed a 0.06 rise in FPR.
  • Adversarial output-level modifications were highly effective against some judges: WildGuard was completely fooled by “Prepend + Append Benign,” reaching F1 0.0 and FNR 1.0; ShieldGemma reached FNR 0.90 under that attack; LLaMA Guard reached FNR 0.28; HarmBench was most robust but still had FNR rise by 0.24 under “Append Long Benign.”
  • In an ablation on HarmBench, increasing the length of appended benign text raised FNR from 0.12 to 0.94 and dropped F1 from 0.87 to 0.11; for the general-purpose judge Atla Selene Mini, the simple “Always Safe” attack raised FNR by 0.84 to 0.90 and dropped accuracy by 0.79 to 0.10.

Methods

  • The study evaluates four open-source safety judges: HarmBench’s fine-tuned LLaMA-2 13B, WildGuard, ShieldGemma 9B, and LLaMA Guard 3 8B, using released Hugging Face versions with default parameters and temperature=0.
  • Experiments use the JailbreakBench judge comparison dataset, originally 300 examples from AdvBench, HarmBench, and original samples; the authors take a random balanced subset of 100 examples and report accuracy, F1, false negative rate, and false positive rate.
  • Two meta-evaluation settings are tested: stylistic prompt formatting, where Mistral Nemo 12B restyles model outputs into bullet points, news, or storytelling while preserving meaning, and adversarial output-level modifications, including “Always Safe,” “Append Long Benign,” and “Prepend + Append Benign.”

Limitations

  • The paper does not include a dedicated limitations section; it notes that experiments use temperature=0 and therefore omit error bars, and that input-level adversarial methods are left for future work.
  • Evident from the text: the main evaluation uses a small balanced subset of 100 examples from one judge comparison dataset, so results may not generalize across datasets or deployment distributions.
  • Evident from the text: the adversarial output-level attacks assume an adversary can either use a malicious model or modify generations to target the judge, and only four safety judges plus one general-purpose judge are tested.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

DataCite · 10.48550/arxiv.2503.04474

Cites

24 of 24 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

12 of 20 cited sources checked · 9 supported · 0 flagged · accuracy not yet measured

  • Interpretationcitation
    § 2.2 Adversarial Attacks : OUTPUT-LEVEL MODIFICATIONS · p. 4

    The flexibility of current attacks indicates that the attack vector of modifying input adversarial attacks to change outputs to include an attack on the judge is highly likely to be feasible at least for some target models.

    “the flexibility of current attacks (Ramesh et al., 2024) indicates this is highly likely to be feasible at least for some target models.”
    Quote in the paperSubstantial claim1 of 1 sources checked
    • cites Ramesh et al., 2024 source
    • Rests on an assumption: The attack vector where an adversary can modify their input adversarial attacks to change the output of generations to include an attack on the judge has not been studied in the literature before.
  • Findingown data
    § 2.1 Evaluations in the Wild : STYLISTIC PROMPT FORMATTING · p. 3

    The bullet points style induces small improvements in accuracy and F1 scores for all judges.

    “Conversely, the bullet points style induces small improvements in accuracy and F1 scores for all judges.”
    Quote in the paperNot a substantial claim
  • Findingown data
    § 2.1 Evaluations in the Wild : STYLISTIC PROMPT FORMATTING · p. 3

    Human annotators almost perfectly agree with the original labels for the new generated responses, with agreement of 1.0, 0.99, and 1.0 for bullet points, news, and storytelling, respectively.

    “we request new human annotations of the stylized datasets alone (without access to the original judge labels) and obtain an agreement with respect to the original dataset of 1.0 , 0.99 , and 1.0 for bullet points , news and storytelling , respectively.”
    Quote in the paperSubstantial claim
  • Findingown data
    § 2.2 Adversarial Attacks : OUTPUT-LEVEL MODIFICATIONS · p. 4

    HarmBench suffers an increase of 0.24 in FNR for 'Append Long Benign'.

    “only suffering from an increase of 0.24 in FNR for 'Append Long Benign' due to a shift towards classifying outputs as safe.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: An adversary either has a malicious model with intent to evade safety evaluations, or can modify their input adversarial attacks to change the output of generations to include an attack on the judge.
  • Findingown data
    § 2.1 Evaluations in the Wild : STYLISTIC PROMPT FORMATTING · p. 3

    The storytelling style leads to rises in FNR for HarmBench, ShieldGemma, and WildGuard, with increases of 0.24, 0.20, and 0.12, respectively.

    “We observe rises in FNR for HarmBench, ShieldGemma and WildGuard with the storytelling style, with increases of 0.24, 0.20 and 0.12 in that metric for the judges, respectively.”
    Quote in the paperSubstantial claim
  • May combine two claims. 10
  • Classified as probably not a substantial claim. 16

  • May combine two claims.

    Premisecitation
    § 2 META-EVALUATION OF SAFETY JUDGES · p. 2

    The JailbreakBench judge comparison dataset is commonly used and comprises 300 examples from AdvBench, HarmBench, and some original samples.

    “we run experiments on the commonly used judge comparison dataset from JailbreakBench (Chao et al., 2024), comprised of 300 examples from AdvBench (Zou et al., 2023), HarmBench (Mazeika et al., 2024) and some original samples.”
    Quote in the paperSubstantial claim2 of 3 sources checked
    • cites Chao et al., 2024 source

      Section 3.5 compares judges on 300 prompt–response examples. Appendix C says the judge dataset uses jailbreak prompts based on a subset of AdvBench behaviors plus 100 benign examples from XS-Test; it does not describe the 300 examples as drawn from AdvBench, HarmBench, and original samples. Those three sources describe the separate JBB-Behaviors dataset (§3.1). The paper also does not establish that the judge comparison dataset is commonly used. (LLM, conf=0.90)

      Experimental — accuracy not yet measured
    • cites Zou et al., 2023

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites Mazeika et al., 2024 source

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § 1 INTRODUCTION · p. 1

    Some judges were initially evaluated on 600 human validation samples and under light robustness conditions, such as HarmBench's fine-tuned LLaMA-2 13B model.

    “Some judges were initially evaluated on 600 human validation samples and under light robustness conditions, such as HarmBench's fine-tuned LLaMA-2 13B model (Mazeika et al., 2024)”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites Mazeika et al., 2024 source

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § 1 INTRODUCTION · p. 1

    Other judges were tested on an unknown number of dataset samples from MLCommons' taxonomy of hazards, such as LLaMA Guard 3.

    “while others were tested on an unknown number of dataset samples from MLCommons' taxonomy of hazards (Vidgen et al., 2024), such as LLaMA Guard 3 (Grattafiori et al., 2024).”
    Quote in the paperNot a substantial claim1 of 2 sources checked
    • cites Vidgen et al., 2024 source
    • cites Grattafiori et al., 2024

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § 3 DISCUSSION AND FUTURE WORK · p. 4

    The authors of HarmBench explicitly test the classifier under some robustness conditions.

    “this is expected, as the authors of the paper explicitly test the classifier under some robustness conditions (Mazeika et al., 2024)”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites Mazeika et al., 2024 source

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § A RELATED WORK · p. 7

    Chen et al. (2024) shows that some biases are present in both LLM judges and human evaluators.

    “Chen et al. (2024) shows that some of these biases are not only present in LLM judges, but also often in human evaluators.”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites Chen et al., 2024 source

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § A RELATED WORK · p. 6

    The superior performance of LLM-as-judges or Reward Models has made these the two current dominant approaches for evaluators.

    “While natural language-based safe content detectors long predate LLMs (Chen et al., 2012; Schmidt & Wiegand, 2017), the superior performance of either LLM-as-judges or the Reward Models (RMs) (Son et al., 2024a; Ankner et al., 2024) has made these the two current dominant approaches for evaluators (Li et al., 2024; Gu et al., 2025).”
    Quote in the paperNot a substantial claim1 of 3 sources checked
    • cites Son et al., 2024a

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites Ankner et al., 2024 source

      The Introduction reports that LLM-as-a-Judge generally underperforms classic reward models on pairwise preference classification. The Abstract reports that the paper’s CLoud reward models outperform classic reward models on RewardBench. These passages support performance advantages for reward models in specific comparisons, but not a general claim that both LLM-as-judges and reward models have superior performance; the sentence cites other works for their dominance. (LLM, conf=0.82)

      Experimental — accuracy not yet measured
    • cites Li et al., 2024

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § A RELATED WORK · p. 6

    Judge models can be categorized based on their input format as pairwise, listwise (ranking-based), or pointwise.

    “Judge models can be categorized differently based on their input format as pairwise, listwise (i.e., ranking-based), or pointwise (Hou et al., 2024; Niu et al., 2024; Gu et al., 2025).”
    Quote in the paperNot a substantial claim1 of 3 sources checked
    • cites Hou et al., 2024 source
    • cites Niu et al., 2024 source

      Section 5 (Related Work; page unavailable) distinguishes pointwise from listwise rerankers and discusses pairwise rerankers. It places pairwise rerankers within the broader listwise category, however, rather than presenting pairwise, listwise, and pointwise as three parallel categories. (LLM, conf=0.88)

      Experimental — accuracy not yet measured
    • cites Gu et al., 2025

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § A RELATED WORK · p. 7

    Mazeika et al. (2024) presents a meta-evaluation study on the robustness of several judges to adversarial inputs.

    “Mazeika et al. (2024) presents a meta-evaluation study on the robustness of several judges to adversarial inputs.”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites Mazeika et al., 2024 source

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisecitation
    § A RELATED WORK · p. 7

    Typically, judge developers release some performance information about the models they are making available.

    “Typically, judge developers release some performance information about the models they are making available (Mazeika et al., 2024; Han et al., 2024; Zeng et al., 2024).”
    Quote in the paperNot a substantial claim2 of 3 sources checked
    • cites Mazeika et al., 2024 source
    • cites Han et al., 2024 source
    • cites Zeng et al., 2024 source

  • May combine two claims.

    Findingown data
    § 2.2 Adversarial Attacks : OUTPUT-LEVEL MODIFICATIONS · p. 4

    WildGuard is completely fooled by the 'Prepend + Append Benign' output attack, which leads to an F1 of 0.0 and an FNR of 1.0.

    “WildGuard—the best performing judge under baseline conditions (Table 1)—is completely fooled by the 'Prepend + Append Benign' output attack which leads to an F1 of 0.0 and an FNR of 1.0.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: An adversary either has a malicious model with intent to evade safety evaluations, or can modify their input adversarial attacks to change the output of generations to include an attack on the judge.

  • May combine two claims.

    Findingown data
    § 2.2 Adversarial Attacks : OUTPUT-LEVEL MODIFICATIONS · p. 4

    ShieldGemma and LLaMA Guard take significant hits in terms of F1 and see rises in FNR with a shift towards classifying the outputs as safe under output modifications.

    “ShieldGemma and LLaMA Guard also take significant hits in terms of F1 and see rises in FNR with a shift towards classifying the outputs as safe.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: An adversary either has a malicious model with intent to evade safety evaluations, or can modify their input adversarial attacks to change the output of generations to include an attack on the judge.

  • May combine two claims.

    Findingown data
    § Listing 4: 'Append Long Benign' output modifications · p. 10

    For Atla's Selene Mini 8B, the 'Append Very Long Benign' output modification reduces accuracy by 0.10 and increases false negative rate by 0.28 relative to baseline.

    “| Append Very Long Benign | (-0.10) | (-0.14) | (+0.28) | (-0.08) |”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: The output-level modifications do not change the true safety label of the original response.

  • May combine two claims.

    Findingown data
    § Listing 4: 'Append Long Benign' output modifications · p. 10

    For Atla's Selene Mini 8B, the 'Always Safe' output modification reduces accuracy by 0.79 and increases false negative rate by 0.84 relative to baseline.

    “| Always Safe | (-0.79) | (-0.80) | (+0.84) | (+0.74) |”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: The output-level modifications do not change the true safety label of the original response.

  • May combine two claims.

    Findingown data
    § Listing 4: 'Append Long Benign' output modifications · p. 10

    For Atla's Selene Mini 8B, the 'Prepend + Append Long Benign' output modification reduces accuracy by 0.12 and increases false negative rate by 0.36 relative to baseline.

    “| Prepend + Append Long Benign | (-0.12) | (-0.18) | (+0.36) | (-0.12) |”
    Quote in the paperNot a substantial claim
    • Rests on an assumption: The output-level modifications do not change the true safety label of the original response.

  • Probably not a substantial claim: may not pass S4 (based).

    Premisenone given
    § 1 INTRODUCTION · p. 1

    The quality of the judge directly impacts the reliability of the safety evaluations of the main system.

    “Given the quality of the judge directly impacts the reliability of the safety evaluations of the main system”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Premisenone given
    § 1 INTRODUCTION · p. 1

    A critical component underpinning the success of both offline benchmarking/red-teaming and online guardrails is an evaluator (judge) capable of accurately determining if a user input and generated model output constitute an attempted violation and whether it was successful.

    “A critical component underpinning the success of both approaches is the availability of an evaluator, or 'judge', capable of accurately determining if a user input and generated model output constitute an attempted violation (i.e., are harmful), and if so whether it was a successful.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationown data
    § ABSTRACT · p. 1

    These findings reveal gaps in commonly used meta-evaluation benchmarks and weaknesses in the robustness of current LLM judges.

    “These findings reveal gaps in commonly used meta-evaluation benchmarks and weaknesses in the robustness of current LLM judges”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: An adversary either has a malicious model with intent to evade safety evaluations, or can modify their input adversarial attacks to change the output of generations to include an attack on the judge.

  • Classified as probably not a substantial claim. May combine two claims.

    Premisecitation
    § 1 INTRODUCTION · p. 1

    A wide range of safety LLM-as-judge systems have been developed, each claiming to outperform existing ones.

    “This has given rise to a wide range of safety LLM-as-judge systems (Li et al., 2024), each of them claiming to out-perform existing ones.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites Li et al., 2024

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Interpretationown data
    § 2.1 Evaluations in the Wild : STYLISTIC PROMPT FORMATTING · p. 3

    A simple change such as style-which had no malicious intent to trick LLM judges and virtually no impact on human judgments in this dataset-can either have a positive (bullet points), neutral/mixed (news), or a negative (storytelling) effect on the judge assessments.

    “These results show that a simple change such as style-which had no malicious intent to trick LLM judges and virtually no impact on human judgments in this dataset-can either have a positive ( bullet points ), neutral/mixed ( news ), or a negative ( storytelling ) effect on the judge assessments.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Study design and conductreasoning
    § 2.2 Adversarial Attacks : OUTPUT-LEVEL MODIFICATIONS · p. 4

    None of the three output modifications (Always Safe, Append Long Benign, Prepend + Append Benign) change the underlying safety status of the answers, as the harmful content remains for the unsafe model responses.

    “Note that none of these modification change the underlying safety status of the answers, as the harmful content remains for the unsafe model responses.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Premisenone given
    § ABSTRACT · p. 1

    LLM-based judges form the underpinnings of key safety evaluation processes such as offline benchmarking, automated red-teaming, and online guardrailing.

    “Large Language Model (LLM) based judges form the underpinnings of key safety evaluation processes such as offline benchmarking, automated red-teaming, and online guardrailing.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Premisenone given
    § 1 INTRODUCTION · p. 1

    Evaluating safety at scale with humans would be infeasible.

    “Ideally these evaluations would be carried out by humans, but evaluating 1) and 2) at scale would be infeasible.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationown data
    § 1 INTRODUCTION · p. 1

    Without rigorous threat modeling and clearer applicability domains, low attack success rates may not reliably indicate robust safety, leaving deployed models vulnerable to undetected risks due to judge failures.

    “Without these measures, low attack success rates may not reliably indicate robust safety, leaving deployed models vulnerable to undetected risks due to judge failures.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: An adversary either has a malicious model with intent to evade safety evaluations, or can modify their input adversarial attacks to change the output of generations to include an attack on the judge.

  • Probably not a substantial claim: may not pass S2 (checkable).

    Interpretationown data
    § 3 DISCUSSION AND FUTURE WORK · p. 4

    This justifies the need for safety-specific judges.

    “This justifies the need for safety-specific judges.”
    Quote in the paperNot a substantial claim
    • The authors state this as an assumption: An adversary either has a malicious model with intent to evade safety evaluations, or can modify their input adversarial attacks to change the output of generations to include an attack on the judge.

  • Probably not a substantial claim: may not pass S2 (checkable).

    Interpretationreasoning
    § 3 DISCUSSION AND FUTURE WORK · p. 4

    Overall, these results highlight the need for holistic meta-evaluations of safety judges.

    “Overall, these results highlight the need for holistic meta-evaluations of safety judges.”
    Quote in the paperNot a substantial claim
    • The authors state this as an assumption: An adversary either has a malicious model with intent to evade safety evaluations, or can modify their input adversarial attacks to change the output of generations to include an attack on the judge.
25 of 25

  • The authors state this as an assumption.

    An adversary either has a malicious model with intent to evade safety evaluations, or can modify their input adversarial attacks to change the output of generations to include an attack on the judge.

    “We assume an adversary either a) has a malicious model with an intent to evade safety evaluations (e.g., fine-tuned closed source models such as using OpenAI's API), or b) can modify their input adversarial attacks to change the output of the generations to include an attack on the judge.”

  • The paper relies on this without support.

    The attack vector where an adversary can modify their input adversarial attacks to change the output of generations to include an attack on the judge has not been studied in the literature before.

    “While the attack vector of b) has not been studied in the literature before”

  • The paper relies on this without support.

    The re-styling model changes only the style of the response and preserves its meaning and keywords.

    “Do not change the meaning of the response other than its style, and make sure to still include the same keywords and information as the original response.”

  • The paper relies on this without support.

    The output-level modifications do not change the true safety label of the original response.

    “We consider 3 types of output modifications, 'Always Safe', 'Append Long Benign', and 'Prepend + Append Benign'.”

  • The paper relies on this without support.

    Atla Selene Mini is representative of general-purpose LLM-as-judge models.

    “To test the impact of output-level adversarial modifications on general LLM judges, we use the recently released Atla Selene Mini, a fine-tuned version of LLaMA-3.1 8B (Alexandru et al., 2025).”
5 of 5

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • Eiras et al. (2025) conducted meta-evaluation on four open-source LLM safety judges and found they are highly sensitive to prompt and distribution shifts.

    “Eiras et al. (2025) conducted meta-evaluation on four open-source LLM safety judges and found they are highly sensitive to prompt and distribution shifts.”

    From ImpossibleBench: Measuring LLMs' Propensity of Exploiting Test Cases (2025) · cites this paper as Eiras et al., 2025

Cites

Flagged first, then by citations

Research works printed but not linked: 1

  1. James O' Neill, Santhosh Subramanian, Eric Lin, Abishek Satish, and Vaikkunth Mugunthan. GuardFormer: Guardrail Instruction Pretraining for Efficient SafeGuarding. In Neurips Safe Generative AI Workshop 2024 , 2024.

Cited by

Sorted by citations

Authors
Eiras, F., Zemour, E., Lin, E., & Mugunthan, V.
ORCID
Eiras, Francisco
Venue
arXiv
Publisher
arXiv
Published
2025
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2503.04474
arXiv
2503.04474
OpenAlex
W4416113418
Semantic Scholar
0ffb356aab98ae69c717f8b2969c3fed0592a048
Cited by
1
References
20
Citations by year
2026: 1
Type
posted content
Language
en
Open access
Licence
creativecommons.org/licenses/by/4.0/legalcode
Locations
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University) (cc-by)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
  • Physical Sciences › Computer Science › Artificial Intelligence › Hate Speech and Cyberbullying Detection
  • Social Sciences › Safety Research › Ethics and Social Impacts of AI
Keywords
meta-evaluation, robustness, adversarial attacks, prompt sensitivity, distribution shift, false negative rate, automated red teaming, safety assessment

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-07.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-07.

Cited sources are checked by gpt-6-sol.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review