A Coin Flip for Safety: LLM Judges Fail to Reliably Measure Adversarial Robustness
Fuente:
arXiv
Saved in:
| Main Authors: | , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2026
|
| Subjects: | |
| Online Access: | |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866914394916519936 |
|---|---|
| author | Schwinn, Leo Ladenburger, Moritz Beyer, Tim Mofakhami, Mehrnaz Gidel, Gauthier Günnemann, Stephan |
| author_facet | Schwinn, Leo Ladenburger, Moritz Beyer, Tim Mofakhami, Mehrnaz Gidel, Gauthier Günnemann, Stephan |
| contents | Automated \enquote{LLM-as-a-Judge} frameworks have become the de facto standard for scalable evaluation across natural language processing. For instance, in safety evaluation, these judges are relied upon to evaluate harmfulness in order to benchmark the robustness of safety against adversarial attacks. However, we show that existing validation protocols fail to account for substantial distribution shifts inherent to red-teaming: diverse victim models exhibit distinct generation styles, attacks distort output patterns, and semantic ambiguity varies significantly across jailbreak scenarios. Through a comprehensive audit using 6642 human-verified labels, we reveal that the unpredictable interaction of these shifts often causes judge performance to degrade to near random chance. This stands in stark contrast to the high human agreement reported in prior work. Crucially, we find that many attacks inflate their success rates by exploiting judge insufficiencies rather than eliciting genuinely harmful content. To enable more reliable evaluation, we propose ReliableBench, a benchmark of behaviors that remain more consistently judgeable, and JudgeStressTest, a dataset designed to expose judge failures. Data available at: https://github.com/SchwinnL/LLMJudgeReliability. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2603_06594 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | A Coin Flip for Safety: LLM Judges Fail to Reliably Measure Adversarial Robustness Schwinn, Leo Ladenburger, Moritz Beyer, Tim Mofakhami, Mehrnaz Gidel, Gauthier Günnemann, Stephan Computation and Language Artificial Intelligence Automated \enquote{LLM-as-a-Judge} frameworks have become the de facto standard for scalable evaluation across natural language processing. For instance, in safety evaluation, these judges are relied upon to evaluate harmfulness in order to benchmark the robustness of safety against adversarial attacks. However, we show that existing validation protocols fail to account for substantial distribution shifts inherent to red-teaming: diverse victim models exhibit distinct generation styles, attacks distort output patterns, and semantic ambiguity varies significantly across jailbreak scenarios. Through a comprehensive audit using 6642 human-verified labels, we reveal that the unpredictable interaction of these shifts often causes judge performance to degrade to near random chance. This stands in stark contrast to the high human agreement reported in prior work. Crucially, we find that many attacks inflate their success rates by exploiting judge insufficiencies rather than eliciting genuinely harmful content. To enable more reliable evaluation, we propose ReliableBench, a benchmark of behaviors that remain more consistently judgeable, and JudgeStressTest, a dataset designed to expose judge failures. Data available at: https://github.com/SchwinnL/LLMJudgeReliability. |
| title | A Coin Flip for Safety: LLM Judges Fail to Reliably Measure Adversarial Robustness |
| topic | Computation and Language Artificial Intelligence |
| url | https://arxiv.org/abs/2603.06594 |