{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/is-llm-as-a-judge-robust-investigating","title":"Is LLM-as-a-Judge Robust? Investigating Universal Adversarial Attacks on Zero-shot LLM Assessment","arxiv_id":"2402.14016","date":"2024-02-21","proceeding":null,"authors":["Vyas Raina","Adian Liusie","Mark Gales"],"abstract":"Large Language Models (LLMs) are powerful zero-shot assessors used in real-world situations such as assessing written exams and benchmarking systems. Despite these critical applications, no existing work has analyzed the vulnerability of judge-LLMs to adversarial manipulation. This work presents the first study on the adversarial robustness of assessment LLMs, where we demonstrate that short universal adversarial phrases can be concatenated to deceive judge LLMs to predict inflated scores. Since adversaries may not know or have access to the judge-LLMs, we propose a simple surrogate attack where a surrogate model is first attacked, and the learned attack phrase then transferred to unknown judge-LLMs. We propose a practical algorithm to determine the short universal attack phrases and demonstrate that when transferred to unseen models, scores can be drastically inflated such that irrespective of the assessed text, maximum scores are predicted. It is found that judge-LLMs are significantly more susceptible to these adversarial attacks when used for absolute scoring, as opposed to comparative assessment. Our findings raise concerns on the reliability of LLM-as-a-judge methods, and emphasize the importance of addressing vulnerabilities in LLM assessment methods before deployment in high-stakes real-world scenarios.","url_abs":"https://arxiv.org/abs/2402.14016v2","url_pdf":"https://arxiv.org/pdf/2402.14016v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"is-llm-as-a-judge-robust-investigating","repo_url":"https://github.com/rainavyas/attack-comparative-assessment","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"adversarial-robustness","task_name":"Adversarial Robustness"},{"task_slug":"benchmarking","task_name":"Benchmarking"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2402.14016","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2402.14016"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/rainavyas/attack-comparative-assessment","reach":null}],"summary":{"ran":3,"unverified":4},"by_repo_kind":{"official":{"samples":7,"ran":3,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":7,"samples":[{"code_sha256_prefix":"c751c48283f89ab3","entry":"comparative_evals","repo":"rainavyas/attack-comparative-assessment","repo_kind":"official","path":"src/attacker/greedy.py","file_url":"https://github.com/rainavyas/attack-comparative-assessment/blob/HEAD/src/attacker/greedy.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"c751c48283f89ab3"}},{"code_sha256_prefix":"42ad8d850594ddc0","entry":"load_prompt_template","repo":"rainavyas/attack-comparative-assessment","repo_kind":"official","path":"src/attacker/greedy.py","file_url":"https://github.com/rainavyas/attack-comparative-assessment/blob/HEAD/src/attacker/greedy.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"42ad8d850594ddc0"}},{"code_sha256_prefix":"7ef950ed1649e351","entry":"next_dir","repo":"rainavyas/attack-comparative-assessment","repo_kind":"official","path":"src/attacker/greedy.py","file_url":"https://github.com/rainavyas/attack-comparative-assessment/blob/HEAD/src/attacker/greedy.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"7ef950ed1649e351"}},{"code_sha256_prefix":"01fed6edf77646d6","entry":"BaseAttacker","repo":"rainavyas/attack-comparative-assessment","repo_kind":"official","path":"src/attacker/greedy.py","file_url":"https://github.com/rainavyas/attack-comparative-assessment/blob/HEAD/src/attacker/greedy.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"01fed6edf77646d6"}},{"code_sha256_prefix":"393ab376c804510c","entry":"BaseComparativeAttacker","repo":"rainavyas/attack-comparative-assessment","repo_kind":"official","path":"src/attacker/greedy.py","file_url":"https://github.com/rainavyas/attack-comparative-assessment/blob/HEAD/src/attacker/greedy.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"393ab376c804510c"}},{"code_sha256_prefix":"a77ff2accb07cdfb","entry":"BaseGreedyAttacker","repo":"rainavyas/attack-comparative-assessment","repo_kind":"official","path":"src/attacker/greedy.py","file_url":"https://github.com/rainavyas/attack-comparative-assessment/blob/HEAD/src/attacker/greedy.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"a77ff2accb07cdfb"}},{"code_sha256_prefix":"aefa45d1e5d9d27e","entry":"GreedyComparativeAttacker","repo":"rainavyas/attack-comparative-assessment","repo_kind":"official","path":"src/attacker/greedy.py","file_url":"https://github.com/rainavyas/attack-comparative-assessment/blob/HEAD/src/attacker/greedy.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"aefa45d1e5d9d27e"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}