Pith. sign in

REVIEW 5 cited by

Is LLM-as-a-Judge Robust? Investigating Universal Adversarial Attacks on Zero-shot LLM Assessment

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2402.14016 v2 pith:GVEIEBVX submitted 2024-02-21 cs.CL

Vyas Raina , Adian Liusie , Mark Gales This is my paper · ORCID
classification cs.CL
keywords adversarialassessmentjudge-llmsattackllmsscoresuniversalattacks
verification ladder T0 review T1 audit T2 compute T3 formal
0 comments
read the original abstract

Large Language Models (LLMs) are powerful zero-shot assessors used in real-world situations such as assessing written exams and benchmarking systems. Despite these critical applications, no existing work has analyzed the vulnerability of judge-LLMs to adversarial manipulation. This work presents the first study on the adversarial robustness of assessment LLMs, where we demonstrate that short universal adversarial phrases can be concatenated to deceive judge LLMs to predict inflated scores. Since adversaries may not know or have access to the judge-LLMs, we propose a simple surrogate attack where a surrogate model is first attacked, and the learned attack phrase then transferred to unknown judge-LLMs. We propose a practical algorithm to determine the short universal attack phrases and demonstrate that when transferred to unseen models, scores can be drastically inflated such that irrespective of the assessed text, maximum scores are predicted. It is found that judge-LLMs are significantly more susceptible to these adversarial attacks when used for absolute scoring, as opposed to comparative assessment. Our findings raise concerns on the reliability of LLM-as-a-judge methods, and emphasize the importance of addressing vulnerabilities in LLM assessment methods before deployment in high-stakes real-world scenarios.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 5 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Chain-of-Models: Cross-Model Auditing for Bias-Robust LLM Judges

    cs.CL 2026-05 conditional novelty 6.0 of 10

    Per-bias selection of a cross-family LLM auditor lifts biased-judgment accuracy from 0.805/0.824 baselines to 0.884.

  2. One Token to Fool LLM-as-a-Judge

    cs.LG 2025-07 conditional novelty 6.0 of 10

    LLM reward models falsely accept empty 'master key' responses such as ':' or 'Thought process:' across many models, and a fine-tuning defense reduces these false positives to near zero.

  3. Attack-in-the-Chain: Bootstrapping Large Language Models for Attacks Against Black-box Neural Ranking Models

    cs.IR 2024-12 conditional novelty 6.0 of 10

    Attack-in-the-Chain uses chain-of-thought prompting to iteratively select anchor documents and allocate word-level perturbations, boosting target documents in black-box neural ranking models on MS MARCO and TREC DL19.

  4. TripTailor: A Real-World Benchmark for Personalized Travel Planning

    cs.AI 2025-08 reject novelty 5.0 of 10

    A travel-planning benchmark is claimed in the abstract, but the full text is an unrelated supernova spectroscopy paper, leaving the central claim completely unsupported.

  5. Towards Understanding the Robustness of LLM-based Evaluations under Perturbations

    cs.CL 2024-12 conditional novelty 4.0 of 10

    Gemini's scores align poorly with human judgments on summarization and dialog quality, and its scores drop sharply when the prompt includes a deliberately inverted human rating.

Pith tools