Adversarial Judge-Gaming

LLM-as-judge evaluations feel rigorous. You define a rubric, feed it to a powerful model, and get a structured score. The score looks like measurement. It is often opinion with a confidence interval.

The opinion is gameable. Not by adversarial users trying to break your system — by the outputs themselves, which can trigger systematic biases in your judge prompt without anyone trying. Understanding these biases is the difference between a judge that measures quality and a judge that measures compliance with what judges happen to prefer.

What Judge-Gaming Actually Means

Judge-gaming does not require a bad actor. It is a structural property of how LLMs evaluate text.

When you ask an LLM to score a response, the model is not measuring against an objective standard. It is pattern-matching against its training distribution of "good responses." That training distribution has systematic properties: it includes more long, detailed responses that were rated highly; more bullet-pointed outputs that look organized; more responses that agree with the framing of the question. These patterns are baked into the judge's priors.

A response that exploits these priors will score higher than an equally-correct or more-correct response that does not. This is judge-gaming, and it happens without intent.

The Five Bias Classes

Each bias class has a characteristic signal, a detection probe, and a structural fix. The fix is always architectural — you cannot prompt-engineer your way out of a position bias or a sycophancy bias by adding "be objective" to the judge prompt. The structure of the evaluation must change.

Sycophancy bias is the most insidious because it is hard to see from the outputs alone. A sycophantic response agrees with the framing of the question, validates the implicit premise, and hedges away from clear statements that might contradict what the evaluator wants to hear. These responses often sound more thoughtful than direct, accurate responses. The judge was trained on human feedback where thoughtful-sounding often correlated with highly rated. The probe: present a clearly wrong answer that agrees with an implicit bias versus a clearly correct answer that contradicts it. A biased judge scores the wrong-but-agreeable higher.

Length bias is well-documented and still chronically underaddressed. The probe is simple: pad a correct answer with filler content and check if the score goes up. In most judges without explicit length-neutrality instructions, it does. The fix requires making length a negatively-scored dimension or explicitly penalizing responses that exceed the task specification.

Format bias manifests most often as a preference for bullet points and markdown over prose, regardless of what the task specified. A response that uses bullets when prose was requested has failed a constraint — but judges often score it higher than a correct prose response, because bullets visually signal organization. The fix: evaluate format compliance as a separately-gated dimension with a pass/fail requirement before content scoring runs.

Self-preference bias is harder to test in production because you rarely know which model generated the response being evaluated. The evidence from alignment research is that models rate outputs from their own family higher when attribution is provided. The fix: strip model attribution before evaluation, and use judges from a different model family than the generator.

Position bias affects pairwise evaluation systems. When you ask a judge to compare two responses, it systematically favors one position — commonly the first candidate, though the direction varies by model and prompt (some judges instead favor the last/most-recent candidate). The point is that the score depends on order at all, not on a fixed direction — which is exactly why the probe runs both orderings rather than assuming which way the bias leans. For any pairwise evaluation, test this by running the evaluation twice with candidates in opposite order. A well-designed judge produces similar scores regardless of order.

Multi-Judge Disagreement as a Signal

Running a single judge is an efficiency decision. Running multiple judges from different model families is a calibration decision.

When judges agree, the consensus is a stronger signal than any single judge. When judges disagree, the disagreement is itself information — not noise to be averaged away.

High disagreement (score range > 0.30 across judges) tells you one of three things: the output is genuinely ambiguous, one judge is miscalibrated for this input type, or the rubric is underspecified for this case. All three cases require human attention. Routing high-disagreement outputs to human review is not a failure of the automated system — it is the automated system correctly identifying its own uncertainty.

The thresholds above are starting points. Calibrate them against your own system by reviewing a sample of outputs at each spread level and checking whether the human reviewers agreed or disagreed with the automated verdict. If humans often agree with the mean score even at spread 0.25, your threshold can be relaxed. If humans often disagree with the mean even at spread 0.10, tighten it.

Designing a Probe Suite

A probe suite is a collection of adversarial test cases that you run against your judge before deploying it. Each probe targets one bias class. The probe has two inputs: a "good" response that is correct on content, and a "biased" response that is wrong or format-violating but triggers the bias. A judge that scores the biased response higher than the good response on the probe has been "fooled."

The probe suite serves two purposes. First, it measures your judge's current bias levels — you know going in which biases are present and at what magnitude. Second, it becomes a regression test for the judge itself. When you update the judge prompt or switch judge models, re-run the probe suite to verify you have not introduced new biases.

The Structural Fixes

Probe results tell you what is wrong. The fixes are architectural:

For sycophancy: use closed factual questions with known correct answers in calibration. Include explicit rubric language: "Score correctness only. Do not reward agreement with the question's framing."

For length: add a concision dimension with a ceiling, not just a floor. Responses that exceed the task specification's length should lose points, not gain them.

For format: make format compliance a hard gate. If the format constraint is violated, the response fails before content scoring runs. Do not let a well-formatted incorrect response outperform a poorly-formatted correct response.

For position bias: evaluate candidates independently, never pairwise. If you must compare two candidates, run both orders and average.

For self-preference: rotate judge models. Do not use the same model family as your generator as your judge. This does not eliminate self-preference (models are trained on similar data) but it significantly reduces it.

None of these fixes require exotic tooling. They require deliberate design of the evaluation architecture before you ship the judge to production.