评分标准作为攻击面：LLM裁判中的隐蔽偏好漂移
Rubrics as an Attack Surface: Stealthy Preference Drift in LLM Judges
AI总结：
研究揭示了基于评分标准的LLM裁判中隐蔽的偏好漂移问题，通过评分标准攻击可系统性降低目标领域准确性，影响模型对齐流程。
摘要：
大型语言模型的评估和对齐流程越来越多地依赖于基于LLM的裁判，其行为由自然语言评分标准引导，并在基准测试上得到验证。我们识别出这一工作流中一个此前未被充分认识的漏洞，我们称之为评分标准诱导的偏好漂移（RIPD）。即使评分标准的修改通过基准验证，它们仍然可能在目标领域产生系统性和方向性的偏好转移。由于评分标准作为高层决策接口，这种漂移可能来自看似自然、标准保持不变的修改，并且通过聚合基准指标或有限的抽查难以检测。我们进一步展示这种漏洞可以通过基于评分标准的偏好攻击来利用，在这种攻击中，通过评分标准的修改可以引导判断远离固定的真人或可信参考，系统性地引发RIPD，并将目标领域准确性降低高达9.5%（有用性）和27.9%（无害性）。当这些判断用于生成下游训练后的偏好标签时，诱导的偏见会通过对齐流程传播，并被内化到训练后的策略中。这导致模型行为中持续且系统性的漂移。总体而言，我们的发现强调了评估评分标准作为敏感且可操控的控制接口，揭示了一个超越评估者可靠性之外的系统级对齐风险。代码可在：https://github.com/ZDCSlab/Rubrics-as-an-Attack-Surface 上获得。警告：某些部分可能包含潜在有害内容，可能不适合所有读者。
英文摘要：
Evaluation and alignment pipelines for large language models increasingly rely on LLM-based judges, whose behavior is guided by natural-language rubrics and validated on benchmarks. We identify a previously under-recognized vulnerability in this workflow, which we term Rubric-Induced Preference Drift (RIPD). Even when rubric edits pass benchmark validation, they can still produce systematic and directional shifts in a judge's preferences on target domains. Because rubrics serve as a high-level decision interface, such drift can emerge from seemingly natural, criterion-preserving edits and remain difficult to detect through aggregate benchmark metrics or limited spot-checking. We further show this vulnerability can be exploited through rubric-based preference attacks, in which benchmark-compliant rubric edits steer judgments away from a fixed human or trusted reference on target domains, systematically inducing RIPD and reducing target-domain accuracy up to 9.5% (helpfulness) and 27.9% (harmlessness). When these judgments are used to generate preference labels for downstream post-training, the induced bias propagates through alignment pipelines and becomes internalized in trained policies. This leads to persistent and systematic drift in model behavior. Overall, our findings highlight evaluation rubrics as a sensitive and manipulable control interface, revealing a system-level alignment risk that extends beyond evaluator reliability alone. The code is available at: https://github.com/ZDCSlab/Rubrics-as-an-Attack-Surface. Warning: Certain sections may contain potentially harmful content that may not be appropriate for all readers.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
