分片机制让大模型评审更可靠,防止因任务过载导致判断失效。
Sharding Prevents LLM Oversight Failures and Adversarial Exploitation

- 将评审要求分组,每组独立调用模型,再合并结果
- 分片后评审准确率提升,即使模型和预算不变
- 有效抵御伪装攻击,适合高可靠性场景
当单次调用需返回多个判断时,即使拥有相同令牌或工具预算,模型的判断仍会因任务过载而弱化证据依据。在专家评分的研究复现、法律工作与临床试验评估中,每次调用的判断数量越多,与专家意见的一致性越低。我们识别出分片(sharding)可缓解此问题:将要求划分为小组,分别调用模型,再聚合结果。相比使用相同模型、证据、总预算和单个判断预算的完整调用,分片显著提升一致性。结果显示,较弱但分片的评审模型可超越更强但非分片的模型,甚至在后者获得完整预算时也能匹敌。此外,分片对对抗攻击具鲁棒性:攻击者仅改变呈现方式,不修改内容,即可使过载模型接受未达标标准数倍增加;分片能消除该优势,保持误接受率稳定。但分片无法防御逐项说服的攻击,在此情形下,结合辩论式反制可有效应对自适应优化。
原文摘要 · Abstract (English)
Giving an LLM judge more compute does not necessarily make it check more requirements. When one call must return many verdicts, some decisions become weakly grounded in the evidence, even when that call receives the same token or tool budget as a panel of separate calls. Across expert-graded research replications, legal work, and clinical-trial assessments, agreement with experts falls as the number of verdicts per call grows. We identify sharding as the intervention that mitigates this failure in model-based oversight. Sharding partitions the requirements into smaller groups, assigns each group to a separate call, and aggregates the verdicts. Against a single call with the panel's full budget, sharding improves agreement while holding the model, evidence, total budget, and per-decision budget fixed. Overall, we find that a sharded weaker judge can outperform a more capable holistic judge and match that judge even when the latter receives the panel's full budget. Additionally, we find that sharding exhibits robustness against adversaries. A best-of-N adversary can hold the underlying work fixed, vary only its presentation, and increase an overloaded judge's acceptance of genuinely unmet criteria severalfold. Wherever sharding reduces baseline error, it removes this adversarial advantage, keeping over-acceptance low even as the adversary's search widens. Sharding does not address attacks that persuade the judge separately on each criterion rather than exploiting overload. In that setting, we find that debate-style opposition on top of sharding withstands such adaptive re-optimization.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。