利用语言模型的风格偏好，伪造文本骗过评分模型并提高得分。
Turning Bias into Bugs: Bandit-Guided Style Manipulation Attacks on LLM Judges
- 将风格修改建模为上下文无关的强化学习问题，自适应选择能骗过评分模型的改动。
- 在多种评分任务中攻击成功率超65%，得分提升1-2分（9分制）且语义不变。
- 攻击隐蔽性强，可绕过主流风格控制和检测方法，适合评估模型安全性的人看。
LLM评分模型中存在的已知风格偏差（如偏好冗长或特定句式）构成未被充分关注的安全漏洞。本文提出BITE（BIas exploraTion and Exploitation），一种黑盒对抗性框架，通过学习语义保持的文本改写来误导LLM评分模型，人为提升其打分。我们将风格修改的选择建模为上下文关联的带状决策问题，采用LinUCB策略在不访问模型参数或梯度的情况下自适应选择最大化评分的修改。实验覆盖多种LLM评分模型与任务，包括聊天机器人排行榜和AI评审基准中的点对点及成对比较。BITE在9分制下实现超过65%的攻击成功率，得分提升1-2分，同时保持语义等价。进一步评估显示，BITE能规避标准风格控制手段和多个检测基线。研究揭示了LLM作为评分者范式的根本缺陷，推动构建更具鲁棒性的、抗攻击的评估体系。代码开源地址：https://github.com/xianglinyang/llm-as-a-judge-attack。
原文摘要 · Abstract (English)
The known stylistic biases in LLM judges, such as a preference for verbosity or specific sentence structures, present an underexplored security vulnerability. In this work, we introduce BITE (BIas exploraTion and Exploitation), a black-box adversarial framework that learns semantics-preserving edits to mislead an LLM judge and artificially inflate the scores it assigns. We cast the selection of stylistic edits as a contextual bandit problem and use a LinUCB policy to adaptively choose edits that maximize the judge's score without access to model parameters or gradients. Empirically, we test BITE across a diverse range of LLM judges and tasks, including both pointwise and pairwise comparisons on chatbot leaderboards and AI-reviewer benchmarks. BITE achieves an attack success rate exceeding 65% and raises scores by 1-2 points on a 9-point scale, all while preserving semantic equivalence. We further assess the attack's stealthiness, showing that BITE evades standard style-control methods and several detection baselines. Our findings expose a fundamental weakness in the LLM-as-a-judge paradigm and motivate robust, attack-aware evaluation. Our code is available at https://github.com/xianglinyang/llm-as-a-judge-attack.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。