Adversarial Cues in Decision Models Used as Judges: The Role of Request Presentation
A single colon raised LLM judge Jev's false acceptance of wrong answers from about 1% to 26%.
Researchers found that adding one colon to a candidate answer can make a decision model used as a judge accept an explicitly wrong final value, depending on request presentation. On 200 unused DROP and GSM8K clusters, the edit raised Jev's false acceptance from 1.0% to 26.0% with three labels and from 3.0% to 26.5% under four-label grading with sorted JSON keys. Both variants were rejected under insertion presentation. GPT-6 Sol showed no observed cue-condition false acceptances, with missing responses unresolved.
- Colon edit lifted Jev false acceptance from 1.0% to 26.0% on 200 clusters.
- Four-label sorted-JSON grading rose from 3.0% to 26.5% false acceptance.
- Insertion presentation rejected both candidate variants.
- Most excess acceptances involved larger numerical errors.
- GPT-6 Sol showed no observed cue-condition false acceptances.
Full article192 words · extracted from arxiv.org · click to collapse
An answer judge instructed to grade the final commitment should reject an explicitly wrong final value even when an earlier value matches the reference. We show that adding one colon to a candidate can violate this requirement depending on the presentation of the structured judging request. Numeric references certify the error, and paired interventions distinguish the candidate edit from the integration's presentation choices. On 200 previously unused DROP and GSM8K source clusters, the edit increased Jev's false acceptance from 1.0% to 26.0% with three output labels and from 3.0% to 26.5% with the published four-label grading instruction under sorted JSON keys. Both candidate variants were rejected under insertion presentation. These interactions passed the prespecified statistical correction even though Jev met the control thresholds under both grading configurations and presentations. Most excess acceptances occurred among candidates assigned larger numerical errors. GPT-6 Sol produced no observed cue-condition false acceptances, with missing responses unresolved. The result shows that basic judging competence can coexist with sharply different vulnerability to a fixed candidate edit across logically equivalent request presentations. The reference-aware grammar and compound ordering change limit the finding's operational scope and leave its internal cause unmeasured.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2610.11436