Turning Bias into Bugs: Bandit-Guided Style Manipulation Attacks on LLM Judges

2026/05/24 by Xianglin Yang, Bryan Hooi, Gelei Deng +2 · 1 voice
Computer Science · #cs.AI #cs.CR #cs.LG

paper · pdf · doi:10.48550/arxiv.2605.26156

arxiv published 2026/05/24 · arxiv updated 2026/05/28

Abstract

The known stylistic biases in LLM judges, such as a preference for verbosity or specific sentence structures, present an underexplored security vulnerability. In this work, we introduce BITE (BIas exploraTion and Exploitation), a black-box adversarial framework that learns semantics-preserving edits to mislead an LLM judge and artificially inflate the scores it assigns. We cast the selection of stylistic edits as a contextual bandit problem and use a LinUCB policy to adaptively choose edits that maximize the judge's score without access to model parameters or gradients. Empirically, we test BITE across a diverse range of LLM judges and tasks, including both pointwise and pairwise comparisons on chatbot leaderboards and AI-reviewer benchmarks. BITE achieves an attack success rate exceeding 65% and raises scores by 1-2 points on a 9-point scale, all while preserving semantic equivalence. We further assess the attack's stealthiness, showing that BITE evades standard style-control methods and several detection baselines. Our findings expose a fundamental weakness in the LLM-as-a-judge paradigm and motivate robust, attack-aware evaluation. Our code is available at https://github.com/xianglinyang/llm-as-a-judge-attack.

Citations

• MLR-Bench: Evaluating AI Agents on Open-Ended Machine Learning Research
• Assessing Judging Bias in Large Reasoning Models: An Empirical Study
• BadJudge: Backdoor Vulnerabilities of LLM-as-a-Judge
• Preference Leakage: A Contamination Problem in LLM-as-a-judge
• Exploring and Mitigating Adversarial Manipulation of Voting-Based Leaderboards
• Emoji Attack: Enhancing Jailbreak Attacks Against Judge LLM Detection
• Defense Against Prompt Injection Attack by Leveraging Attack Techniques
• Cheating Automatic LLM Benchmarks: Null Models Achieve High Win Rates
• Justice or Prejudice? Quantifying Biases in LLM-as-a-Judge
• Style Outweighs Substance: Failure Modes of LLM Judges in Alignment Benchmarking
• From Lists to Emojis: How Format Bias Affects Model Alignment
• LLMs Are Biased Towards Output Formats! Systematically Evaluating and Mitigating Output Format Bias of LLMs
• Reward Models in Deep Reinforcement Learning: A Survey
• Trust or Escalate: LLM Judges with Provable Guarantees for Human Agreement
• Finding Blind Spots in Evaluator LLMs with Interpretable Checklists
• From Crowdsourced Data to High-Quality Benchmarks: Arena-Hard and BenchBuilder Pipeline
• LLM Evaluators Recognize and Favor Their Own Generations
• Optimization-based Prompt Injection Attack to LLM-as-a-Judge
• Aligning with Human Judgement: The Role of Pairwise Preference in Large Language Model Evaluators
• Is LLM-as-a-Judge Robust? Investigating Universal Adversarial Attacks on Zero-shot LLM Assessment
• Humans or LLMs as the Judge? A Study on Judgement Biases
• Tree of Attacks: Jailbreaking Black-Box LLMs Automatically
• Jailbreaking Black Box Large Language Models in Twenty Queries
• Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena
• On the Interplay Between Misspecification and Sub-optimality Gap in Linear Contextual Bandits
• Adapting to Misspecification in Contextual Bandits
• MiniLM: Deep Self-Attention Distillation for Task-Agnostic Compression of Pre-Trained Transformers
• Misspecified Linear Bandits
• A Contextual-Bandit Approach to Personalized News Article Recommendation

Discussions

• #cs.CR #cs.AI #cs.LG Origin | Interest | Match [bsky, 0 points, 0 comments]

Related

• Selective Adversarial Attacks on LLM Benchmarks
• Investigating the Vulnerability of LLM-as-a-Judge Architectures to Prompt-Injection Attacks
• Know Thy Judge: On the Robustness Meta-Evaluation of LLM Safety Judges
• Is LLM-as-a-Judge Robust? Investigating Universal Adversarial Attacks on Zero-shot LLM Assessment
• Fooling LLM graders into giving better grades through neural activity guided adversarial prompting