CoChat
Sign Up
PreprintCited by 36

LLMs Cannot Reliably Judge (Yet?): A Comprehensive Assessment on the Robustness of LLM-as-a-Judge

Li, Songze, Xu, Chuokun, Wang, Jiaying, Gong, Xueluan, Chen, Chen, Zhang, Jirui, Wang, Jun, Lam, Kwok-Yan +1 more·2025·arXiv
DOI 10.48550/arxiv.2506.09443arXiv 2506.09443
Open this paper in CoChat — free account

Abstract

Large Language Models (LLMs) have demonstrated exceptional capabilities across diverse tasks, driving the development and widespread adoption of LLM-as-a-Judge systems for automated evaluation, including red teaming and benchmarking. However, these systems are susceptible to adversarial attacks that can manipulate evaluation outcomes, raising critical concerns about their robustness and trustworthiness. Existing evaluation methods for LLM-based judges are often fragmented and lack a unified framework for comprehensive robustness assessment. Furthermore, the impact of prompt template design and model selection on judge robustness has rarely been explored, and their performance in real-world deployments remains largely unverified. To address these gaps, we introduce RobustJudge, a fully automated and modularly extensible framework designed to systematically evaluate the robustness of LLM-as-a-Judge across task datasets, judge prompt templates, judge models, attacks, and defenses. Specifically, RobustJudge investigates the effectiveness of 15 attack methods and 8 defense strategies across 13 models (RQ1), examines the impact of prompt template design and model selection (RQ2), and evaluates the security of real-world deployments (RQ3). Our study yields three main findings: (1) LLM-based judges remain susceptible under both pointwise and pairwise protocols. The combined Attack exhibits the strongest and most transferable performance among those evaluated, while the evaluated defenses exhibit no universal dominance across robustness, benign utility, and computational cost. (2) Robustness is highly sensitive to both prompt-template and judge model choices. (3) Optimization-based attack combined with long suffixes can substantially inflate scores returned by both PAI-Judge variants.

AI snapshot

Written from the paper’s full text.

TL;DR

The paper introduces RobustJudge, a fully automated framework for systematically evaluating the adversarial robustness of LLM-as-a-Judge systems across attacks, defenses, prompt templates, judge models, and a real-world deployment. It finds that LLM judges remain vulnerable under both pointwise and pairwise protocols, no defense dominates robustness/utility/cost, and robustness is highly sensitive to prompt and model choices.

Key findings

  • Combined Attack (H6) is the strongest and most transferable evaluated attack, achieving an ASR of 94.55% and a P-ASR of 51.06% across four judges; Fake Reasoning (H5) is the second strongest heuristic attack.
  • Task vulnerability varies: code summarization (T4) has the highest P-ASR at 74.0%, followed by text summarization (T2) at 69.6% and code generation (T5) at 61.7%; logical reasoning, mathematics, and knowledge recall are less vulnerable, with P-ASRs from 28.3% to 30.9%.
  • No defense dominates: re-tokenization achieves the lowest eASR (16.79%) but retains only 29.67% benign utility, while the naive LLM detector yields the lowest BDR (30.33%) at the cost of one additional LLM call.
  • Robustness is highly sensitive to prompt template and judge model: the optimized prompt reduces Qwen2.5-7B’s average P-ASR across H4–H6 to 3.61% versus Arena-Hard’s 15.42% and Google Vertex’s 9.76%, and cuts Mistral-7B’s H4 P-ASR from 96.25% (Arena-Hard) to 14.17%. No model family is uniformly robust; JudgeLM-13B has the lowest mean ASR (62.26%), while GPT-4o has the lowest mean iSDR.
  • In a real-world black-box case study, standard attacks had limited effect on PAI-Judge, but PAIR-optimized inputs combined with long suffixes substantially inflated scores for an unchanged flawed response; this is reported as a single-instance case study.

Methods

  • RobustJudge evaluates LLM-as-a-Judge across 8 tasks in 3 categories: text translation and summarization; code translation, summarization, and generation; and logical reasoning, mathematics, and knowledge recall. Datasets include FLORES-200, CNN/DailyMail, CodeTransOcean, CodeXGLUE, CodeSearchNet, Big-Bench Hard, AMC12/USAMO, and MMLU-Pro, with sample sizes such as 600 translation instances, 300 each for summarization/code tasks, 56 logical reasoning, 98 math, and 134 knowledge recall.
  • The framework instantiates 8 heuristic attacks (H1–H8) and 7 optimization-based attacks (O1–O7), plus 8 defenses (3 detection-based, 5 prevention-based), and evaluates pointwise and pairwise protocols using metrics including SDR, iSDR, ASR, P-ASR, and ASR@1. Content-quality evaluators include BLEURT for text, CodeBLEU for code, and exact match or rule-based checkers for knowledge-intensive tasks.
  • Experiments use 3 random seeds with mean, standard deviation, and 95% confidence intervals; prompt optimization uses coordinate ascent over six prompt components; the real-world evaluation treats Alibaba Cloud’s PAI Judge and PAI Judge Plus as black-box services.

Limitations

  • Stated: the evaluation does not assume defense-aware adaptive attacks, where the attacker knows the system prompt, filtering rules, or detection mechanism; dynamic multi-turn attacks that adapt across turns are also left for future work.
  • Stated: optimization-based attacks use fixed iteration budgets, so results characterize a bounded-compute setting rather than unconstrained attack performance; the PAI-Judge finding is a single-instance case study requiring broader evaluation.
  • Paper-acknowledged/evident: the lack of an architecture-matched untuned baseline prevents attributing JudgeLM-7B to 13B robustness improvement solely to model scale or judgment tuning; PAI-Judge’s internal prompts, aggregation rules, and defenses are unavailable, so the source of its resistance to standard attacks cannot be determined.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

DataCite · 10.48550/arxiv.2506.09443

Cites

53 of 53 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

6 of 7 cited sources checked · 5 supported · 0 flagged · accuracy not yet measured

  • Premisecitation
    § LLMs Cannot Reliably Judge (Yet?): A Comprehensive Assessment on the Robustness of LLM-as-a-Judge · p. 1

    LLM-as-a-Judge systems are susceptible to adversarial attacks that can manipulate evaluation outcomes through subtle perturbations.

    “However, these systems are susceptible to adversarial attacks that can manipulate evaluation outcomes, raising critical concerns about their robustness and trustworthiness.”
    • Also stated in: § I. INTRODUCTION · p. 1 · plain
      “Recent studies [31, 6, 51, 36] have revealed that LLM-as-a-Judge systems are inherently vulnerable to various forms of adversarial attacks, which can manipulate evaluation outcomes through subtle perturbations.”
    Quote in the paperSubstantial claim4 of 4 sources checked
    • cites [31] [31] Vyas Raina, Adian Liusie, and Mark Gales. Is LLM-as-a-judge robust? investigating universal adversarial attacks on zero-shot LLM assessment. arXiv preprint arXiv:2402.14016 , 2024. - source
    • cites [6] [6] Yiming Chen, Chen Zhang, Danqing Luo, Luis Fernando D'Haro, Robby T Tan, and Haizhou Li. Unveiling the achilles' heel of NLG evaluators: A unified adversarial framework driven by large language models. arXiv preprint arXiv:2405.14646 , 2024. - source
    • cites [51] [51] Xiaosen Zheng, Tianyu Pang, Chao Du, Qian Liu, Jing Jiang, and Min Lin. Cheating automatic LLM benchmarks: Null models achieve high win rates. arXiv preprint arXiv:2410.07137 , 2024. - source
    • cites [36] [36] Jiawen Shi, Zenghui Yuan, Yinuo Liu, and et al. Optimizationbased prompt injection attack to LLM-as-a-judge. In ACM SIGSAC Conference on Computer and Communications Security , pages 660-674, 2024. - source
  • Premisecitation
    § D. LLM Judges · p. 7

    Prior research has demonstrated that the input order of candidate responses can influence the evaluation outcome.

    “Prior research on LLM-as-a-Judge systems [50] has demonstrated that the input order of candidate responses can influence the evaluation outcome.”
    Quote in the paperSubstantial claim1 of 1 sources checked
    • cites [50] [50] Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, et al. Judging LLM-as-a-judge with mt-bench and chatbot arena. Advances in Neural Information Processing Systems , 36:46595-46623, 2023. - source
  • Findingown data
    § I. INTRODUCTION · p. 2

    Many attack methods, such as Fake Reasoning and Combined Attacks, consistently achieve high attack success rates across multiple tasks and models.

    “The results indicate that many attack methods, such as Fake Reasoning [36] and Combined Attacks [24], consistently achieve high attack success rates across multiple tasks and models, highlighting vulnerabilities in LLM-based judges.”
    • Also stated in: § This paper makes the following key contributions: · p. 2 · plain
      “Our analysis reveals that LLM-based judges exhibit significant vulnerabilities across various tasks, with attacks such as combined attacks achieving high success rates, while no defense achieves the optimal trade-off among robustness, utility, and cost.”
    Quote in the paperSubstantial claim
  • Findingown data
    § I. INTRODUCTION · p. 2

    JudgeLM-13B attains the lowest mean ASR among the evaluated judge models.

    “JudgeLM-13B attains the lowest mean ASR, whereas GPT-4o attains the lowest mean iSDR, and the evaluated reasoning-oriented and stronger-inference models provide no consistent robustness advantage.”
    Quote in the paperNot a substantial claim
  • Findingown data
    § I. INTRODUCTION · p. 2

    No judge model family is uniformly robust.

    “Additionally, our evaluation of 10 judge models shows that no model family is uniformly robust.”
    Quote in the paperSubstantial claim
  • May combine two claims. 32
  • Classified as probably not a substantial claim. 18

  • May combine two claims.

    Premisecitation
    § D. LLM Judges · p. 6

    BLEURT effectively captures content-level deviations while remaining efficient for large-scale evaluation.

    “This metric effectively captures content-level deviations while remaining efficient for large-scale evaluation.”
    Quote in the paperNot a substantial claim1 of 1 sources checked
    • cites [35] [35] Thibault Sellam, Dipanjan Das, and Ankur P Parikh. BLEURT: Learning robust metrics for text generation. arXiv preprint arXiv:2004.04696 , 2020. - source

      The Introduction (p. 2) describes BLEURT’s lexical- and semantic-level training signals, and the Conclusion (p. 8) reports strong agreement with human assessment; these support the claim that it captures more than surface-level differences. The Introduction (p. 1) says automatic metrics are cheap to compute, but our copy does not establish that BLEURT itself is efficient for large-scale evaluation. (LLM, conf=0.82)

      Experimental — accuracy not yet measured

  • May combine two claims.

    Findingown data
    § I. INTRODUCTION · p. 2

    Naive LLM-based detection provides a better balance between robustness and utility than other evaluated defenses, although it requires one additional LLM call for each evaluated response.

    “In contrast, naive LLM-based detection [13] provides a better balance between robustness and utility, although it requires one additional LLM call for each evaluated response.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data
    § I. INTRODUCTION · p. 2

    Among the evaluated defenses, re-tokenization achieves the greatest reduction in residual attack success, but it also causes a substantial loss in benign utility.

    “Among the evaluated defenses, re-tokenization [18] achieves the greatest reduction in residual attack success, but it also causes a substantial loss in benign utility.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data
    § A. Attack and Defense Effectiveness (RQ1) · p. 10

    The adapted StruQ defense offers moderate protection while preserving most benign behavior, although its effectiveness varies across translation directions.

    “The adapted StruQ defense offers moderate protection while preserving most benign behavior, although its effectiveness varies across translation directions.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data
    § A. Attack and Defense Effectiveness (RQ1) · p. 8

    Combined Attack (H6) is the only method that ranks first for all four judges across all three attack metrics, and it consistently achieves the highest ASR, iSDR, and P-ASR across evaluated judges.

    “Combined Attack (H6) is the only method that ranks first for all four judges across all three attack metrics”
    • Also stated in: § A. Attack and Defense Effectiveness (RQ1) · p. 9 · plain
      “with the Combined Attack (H6) consistently achieving the highest ASR, iSDR, and P-ASR across evaluated judges.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data
    § A. Attack and Defense Effectiveness (RQ1) · p. 10

    The naive LLM detector reduces attack success while preserving more benign utility than the other detection methods.

    “It reduces attack success while preserving more benign utility than the other detection methods.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data
    § A. Attack and Defense Effectiveness (RQ1) · p. 9

    ASR@1 decreases most sharply when the number of candidates increases from two to three and generally remains lower with larger candidate sets.

    “As shown in Figure 5, ASR@1 decreases most sharply when the number of candidates increases from two to three and generally remains lower with larger candidate sets.”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim.

    Findingown data
    § D. LLM Judges · p. 5

    The evaluated judge prompt templates share a common structural format composed of key functional components.

    “We observe that these templates share a common structural format composed of key functional components.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data
    § I. INTRODUCTION · p. 2

    Optimized inputs combined with long suffixes bypass PAI-Judge's defenses and alter its evaluation results.

    “However, optimized inputs combined with long suffixes bypass its defenses and alter the evaluation results.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data
    § A. Attack and Defense Effectiveness (RQ1) · p. 8

    Response level black box methods perform best within this category but remain less transferable than H6 in pairwise evaluation.

    “Response level black box methods perform best within this category but remain less transferable than H6 in pairwise evaluation.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data
    § A. Attack and Defense Effectiveness (RQ1) · p. 10

    PPL and WinPPL exhibit a similar pattern, suppressing attacks effectively while causing considerable utility loss.

    “PPL and WinPPL exhibit a similar pattern, suppressing attacks effectively while causing considerable utility loss.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data
    § A. Attack and Defense Effectiveness (RQ1) · p. 10

    The naive LLM detector achieves the best overall balance and the lowest BDR among all evaluated defenses.

    “The naive LLM detector achieves the best overall balance and the lowest BDR among all evaluated defenses.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data
    § A. Attack and Defense Effectiveness (RQ1) · p. 8

    White box and vocabulary search methods show limited transfer across models and negative mean iSDR for all four judges under the evaluated budgets.

    “White box and vocabulary search methods show limited transfer across models and negative mean iSDR for all four judges under the evaluated budgets.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data
    § A. Attack and Defense Effectiveness (RQ1) · p. 9

    Averaged across three attacks and four judges, code summarization (T4) has the highest P ASR at 74.0%, followed by text summarization (T2) at 69.6% and code generation (T5) at 61.7%.

    “Averaged across three attacks and four judges, code summarization (T4) has the highest P ASR at 74 . 0% , followed by text summarization (T2) at 69 . 6% and code generation (T5) at 61 . 7% .”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data
    § A. Attack and Defense Effectiveness (RQ1) · p. 10

    Delimiter insertion, sandwich prompting, and instruction augmentation preserve more than 92% of benign utility but provide limited robustness gains.

    “By contrast, delimiter insertion, sandwich prompting, and instruction augmentation preserve more than (92%) of benign utility but provide limited robustness gains.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingown data
    § C. Real-World Case Study (RQ3) · p. 12

    For PAI Judge, the average subscore reaches approximately 8.0 at an input length of 2,000 characters.

    “Both reach approximately 8.0 at an input length of 2,000 characters.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data
    § User Prompt: · p. 11

    Under Context Ignoring, GPT-OSS-120B's ASR and iSDR reach 99.72% and 0.8600, respectively.

    “Under Context Ignoring, its ASR and iSDR reach 99 . 72% and 0 . 8600 , respectively.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data
    § User Prompt: · p. 11

    Increasing JudgeLM model size from 7B to 13B reduces the mean ASR from 76.67% to 62.26%, a decrease of 14.41 percentage points, and lowers the mean iSDR from 0.2455 to 0.1696.

    “Increasing the model size from 7B to 13B reduces the mean ASR from 76 . 67% to 62 . 26% , a decrease of 14 . 41 percentage points, and lowers the mean iSDR from 0 . 2455 to 0 . 1696 .”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data
    § C. Real-World Case Study (RQ3) · p. 12

    The scores returned by both services vary substantially and non-monotonically as the input length changes.

    “The scores returned by both services vary substantially and non-monotonically as the input length changes.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data
    § User Prompt: · p. 11

    JudgeLM13B attains the lowest mean ASR, whereas GPT-4o attains the lowest mean iSDR.

    “JudgeLM13B attains the lowest mean ASR, whereas GPT-4o attains the lowest mean iSDR”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data
    § B. Impact of Prompts and Model Choices (RQ2) · p. 11

    On Qwen2.5-7B, the optimized prompt reduces the average P-ASR across H4-H6 to 3.61%, outperforming Arena-Hard (15.42%) and Google Vertex (9.76%).

    “On Qwen2.5-7B, it reduces the average P-ASR across H4-H6 to 3.61%, outperforming Arena-Hard (15.42%) and Google Vertex (9.76%)”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data
    § A. Attack and Defense Effectiveness (RQ1) · p. 10

    Re-tokenization achieves the lowest eASR (16.79%) but retains only 29.67% benign utility.

    “Re-tokenization achieves the lowest eASR ( 16 . 79% ) but retains only 29 . 67% benign utility”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingown data
    § C. Real-World Case Study (RQ3) · p. 12

    For PAI Judge, the overall score reaches approximately 8.0 at an input length of 2,000 characters.

    “Both reach approximately 8.0 at an input length of 2,000 characters.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data
    § User Prompt: · p. 11

    GPT-OSS-120B is more vulnerable on both metrics, with a mean ASR of 92.10% and a mean iSDR of 0.2564.

    “GPT-OSS-120B is more vulnerable on both metrics, with a mean ASR of 92 . 10% and a mean iSDR of 0 . 2564 .”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingown data
    § A. Attack and Defense Effectiveness (RQ1) · p. 10

    The Naive LLM detector requires one additional LLM call.

    “the Naive LLM detector requires one additional LLM call.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data
    § User Prompt: · p. 11

    JudgeLM13B achieves the lowest mean ASR (62.26%), although its attack-specific ASR ranges from 26.67% to 95.83%.

    “JudgeLM13B achieves the lowest mean ASR ( 62 . 26% ), although its attack-specific ASR ranges from 26 . 67% to 95 . 83% .”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingnone given
    § A. Attack and Defense Effectiveness (RQ1) · p. 10

    PPL requires two token-wise evaluations, 2 F PPL, for the candidate and reference.

    “PPL requires two token-wise evaluations, 2 F PPL , for the candidate and reference”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data
    § User Prompt: · p. 11

    GPT-4o achieves the lowest mean iSDR but a higher mean ASR of 71.26%.

    “GPT-4o achieves the lowest mean iSDR but a higher mean ASR of 71 . 26% .”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data
    § B. Impact of Prompts and Model Choices (RQ2) · p. 11

    Under H4, Mistral-7B yields a P-ASR of 37.50% with the Vanilla prompt, which increases to 96.25% with the Arena-Hard prompt.

    “under H4, Mistral-7B yields a P-ASR of 37.50% with the Vanilla prompt, which increases to 96.25% with the Arena-Hard prompt.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingreasoning
    § A. Attack and Defense Effectiveness (RQ1) · p. 10

    The extra inference cost of each defense could be estimated from the number of samples involved.

    “the extra inference cost of each defense could be estimated from the number of samples involved”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data
    § User Prompt: · p. 11

    The general-purpose and judgment-tuned groups exhibit similar mean ASRs of 75.63% and 75.50%, respectively, while their mean iSDRs are 0.1331 and 0.2766.

    “The general-purpose and judgment-tuned groups exhibit similar mean ASRs of 75 . 63% and 75 . 50% , respectively, while their mean iSDRs are 0 . 1331 and 0 . 2766 .”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingnone given
    § A. Attack and Defense Effectiveness (RQ1) · p. 10

    WinPPL requires (W+1) F PPL, where W is the number of non-overlapping five sentence candidate windows.

    “WinPPL requires ( W +1) F PPL , where W is the number of non-overlapping five sentence candidate windows”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingown data
    § A. Attack and Defense Effectiveness (RQ1) · p. 10

    The naive LLM detector yields the lowest observed BDR (30.33%) at the cost of one additional LLM call.

    “the naive LLM detector yields the lowest observed BDR ( 30 . 33% ) at the cost of one additional LLM call.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data
    § User Prompt: · p. 11

    GPT-5 exhibits a high mean ASR of 82.82% but a relatively low mean iSDR of 0.1184.

    “GPT-5 exhibits a high mean ASR of 82 . 82% but a relatively low mean iSDR of 0 . 1184”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S4 (based). May combine two claims.

    Interpretationreasoning
    § A. Threat Scenario · p. 3

    Standard security mechanisms cannot defend against content-author attacks because the adversarial content is part of the legitimate submission, integrity verification passes, and the manipulation targets semantic understanding rather than data transmission.

    “Standard security mechanisms (e.g., digital signatures, encrypted channels) cannot defend against such attacks because: (i) the adversarial content is part of the legitimate submission, (ii) integrity verification passes as the content authentically originates from the authorized submitter, and (iii) the manipulation targets semantic understanding rather than data transmission.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim.

    Study design and conductnone given
    § A. Dataset Construction · p. 3

    The low-quality candidate answers were manually verified to exhibit the intended quality defects.

    “We use OpenChat-3.5-0106 to generate an intentionally low-quality candidate answer, which is manually verified to ensure that it exhibits the intended quality defects.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given
    § A. Attack and Defense Effectiveness (RQ1) · p. 9

    Summarization and generation require judges to balance partly subjective criteria such as fluency, relevance, and completeness, making superficial manipulation difficult to distinguish from genuine quality.

    “Summarization and generation require judges to balance partly subjective criteria such as fluency, relevance, and completeness, making superficial manipulation difficult to distinguish from genuine quality.”
    Quote in the paperNot a substantial claim

  • Classified as probably not a substantial claim. May combine two claims.

    Study design and conductown data
    § V. EXPERIMENT · p. 8

    All stochastic evaluations were conducted with 3 random seeds, and main robustness metrics include 95% confidence intervals.

    “We conduct all stochastic evaluations with 3 random seeds and present the mean and standard deviation. For the main robustness metrics, including ASR and iSDR, we further include 95% confidence intervals.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationreasoning
    § A. Threat Scenario · p. 3

    The threat model of content-author attacks applies to high-stakes scenarios including academic assessment, model benchmarking, code competitions, and content moderation.

    “This threat model applies to many high-stakes scenarios, including academic assessment, model benchmarking, code competitions, and content moderation.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationnone given
    § A. Attack and Defense Effectiveness (RQ1) · p. 10

    RobustJudge is modularly extensible.

    “RobustJudge is modularly extensible, but full-suite evaluation still has nonnegligible cost.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Study design and conductnone given
    § A. Defense-aware adaptive attacks · p. 13

    The current evaluation does not assume that the attacker has full knowledge of the deployed defense mechanism.

    “Our current evaluation does not assume that the attacker has full knowledge of the deployed defense mechanism.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationown data
    § User Prompt: · p. 11

    Substantial variation across attacks and the lack of an architecture-matched untuned baseline prevent attributing the improvement solely to model scale or judgment tuning.

    “However, substantial variation across attacks and the lack of an architecture-matched untuned baseline prevent us from attributing the improvement solely to model scale or judgment tuning.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationown data
    § User Prompt: · p. 11

    Attacks frequently alter GPT-5's decisions but generally cause limited score changes.

    “indicating that attacks frequently alter its decisions but generally cause limited score changes.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Study design and conductown data
    § C. Real-World Case Study (RQ3) · p. 12

    The experiment on the composite attack is a single-instance case study.

    “Figure 7 presents a single-instance case study and should not be interpreted as an aggregate result.”
    • Also stated in: § C. Real-World Case Study (RQ3) · p. 12 · plain
      “However, as this experiment is a single-instance case study, broader evaluation is required to determine the prevalence of this behavior.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning
    § C. Real-World Case Study (RQ3) · p. 12

    Because the internal mechanisms are unavailable, we cannot determine whether this resistance results from filtering, sanitization, or other defenses.

    “because the internal mechanisms are unavailable, we cannot determine whether this resistance results from filtering, sanitization, or other defenses.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Study design and conductreasoning
    § B. Dynamic multi-turn attacks · p. 13

    The evaluation does not include dynamically staged attacks where the attacker observes intermediate responses and adapts later turns during deployment.

    “However, we do not include dynamically staged attacks where the attacker observes intermediate responses and adapts later turns during deployment.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationown data
    § User Prompt: · p. 11

    Attack frequency and attack severity capture distinct aspects of robustness, and no single model performs best on both metrics.

    “Thus, attack frequency and attack severity capture distinct aspects of robustness, and no single model performs best on both metrics.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Study design and conductreasoning
    § B. Dynamic multi-turn attacks · p. 13

    The evaluation can support attacks against a fixed conversation context.

    “Therefore, our evaluation can support attacks against a fixed conversation context.”
    Quote in the paperNot a substantial claim
    • The authors state this as an assumption: In the authors' setting, a multi-turn conversation can be represented as a fixed dialogue history.
48 of 48

  • The paper relies on this without support.

    Existing evaluation methods for LLM-based judges are fragmented and lack a unified framework for comprehensive robustness assessment.

    “Existing evaluation methods for LLM-based judges are often fragmented and lack a unified framework for comprehensive robustness assessment.”
    “However, existing assessment methods for these systems are fragmented, lacking a unified, systematic, and automated framework for comprehensive evaluation.”

  • The paper relies on this without support.

    The impact of prompt template design and model selection on judge robustness has rarely been explored.

    “Furthermore, the impact of prompt template design and model selection on judge robustness has rarely been explored, and their performance in real-world deployments remains largely unverified.”
    “Furthermore, the optimal prompt configuration and model selection for different tasks and evaluation protocols are insufficiently explored, with limited guidance on best practices.”

  • The paper relies on this without support.

    The robustness of real-world LLM-as-a-Judge deployments in adversarial settings remains largely unverified.

    “Furthermore, the impact of prompt template design and model selection on judge robustness has rarely been explored, and their performance in real-world deployments remains largely unverified.”
    “Finally, while real-world LLM-as-a-Judge applications have recently demonstrated promising effectiveness in content evaluation, their robustness in adversarial settings remains largely unverified.”

  • The paper relies on this without support.

    Existing benchmarks for LLM-based judges overlook the robustness and security of the evaluators themselves.

    “While these benchmarks provide valuable insights into overall evaluation quality, they overlook a critical dimension: the robustness and security of the evaluators themselves.”

  • The paper relies on this without support.

    In pointwise evaluation, the verified low-quality candidate is expected to receive a low score from the judge.

    “In pointwise evaluation, the verified lowquality candidate is expected to receive a low score.”

  • The paper relies on this without support.

    In pairwise evaluation, the judge is expected to prefer the reference answer over the low-quality candidate.

    “In pairwise evaluation, the judge is expected to prefer the reference answer, and an attack is considered successful only when the low-quality candidate is selected over the reference answer.”

  • The authors state this as an assumption.

    In the authors' setting, a multi-turn conversation can be represented as a fixed dialogue history.

    “In our setting, a multi-turn conversation can be represented as a fixed dialogue history.”
7 of 7

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

  • Qwen Vanilla average does not match its three attack results

    Minor

    The mean of 5.000%, 15.83%, and 14.16% is approximately 11.66%, not the reported 11.99%.

    Reported 11.99 · recomputed 11.663333

  • Llama Vanilla average does not match its three attack results

    Minor

    The mean of 6.670%, 25.00%, and 11.67% is approximately 14.45%, not the reported 13.00%.

    Reported 13 · recomputed 14.446667

2 of 2

Cites

Flagged first, then by citations

12 of the 65 references couldn’t be matched to a known paper.

Research works printed but not linked: 4

  1. [10][10] Yann Dubois, Percy Liang, and Tatsunori Hashimoto. Lengthcontrolled alpacaeval: A simple debiasing of automatic evaluators. In First Conference on Language Modeling , 2024. -
  2. [11][11] Zhaopeng Feng, Yan Zhang, Hao Li, and et al. Improving LLMbased machine translation with systematic self-correction. arXiv e-prints , pages arXiv-2402, 2024. -
  3. [22][22] Chin-Yew Lin. Rouge: A package for automatic evaluation of summaries. In Text Summarization Branches out , pages 74-81, 2004. -
  4. [33][33] Shuo Ren, Zhi Tu, Long Zhang, and et al. Codebleu: A method for evaluating code generation. In Conference on Empirical Methods in Natural Language Processing , pages 8779-8785, 2020. -

Cited by

Sorted by citations

Authors
Li, S., Xu, C., Wang, J., Gong, X., Chen, C., Zhang, J., Wang, J., Lam, K.-Y., & Ji, S.
Venue
arXiv
Publisher
arXiv
Published
2025
DOI
10.48550/arxiv.2506.09443
arXiv
2506.09443
Semantic Scholar
346affb6001b4f339d7e396d6aa3c6261c86072d
References
65
Type
Preprint
Licence
arxiv.org/licenses/nonexclusive-distrib/1.0/

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-07.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-07.

Cited sources are checked by gpt-6-sol.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review