安全性的硬币翻转：LLM裁判无法可靠地衡量对抗鲁棒性
A Coin Flip for Safety: LLM Judges Fail to Reliably Measure Adversarial Robustness
AI总结：
本文指出现有LLM裁判框架在评估对抗鲁棒性时存在分布偏移问题，提出ReliableBench和JudgeStressTest以提升评估可靠性。
摘要：
自动化"LLM作为裁判"框架已成为自然语言处理可扩展评估的标配。在安全评估中，这些裁判被用来评估有害性以基准对抗攻击的鲁棒性。然而，我们证明现有验证协议未能考虑红队中固有的显著分布偏移：不同受害者模型表现出不同的生成风格，攻击扭曲输出模式，语义模糊性在 jailbreak 情景中差异显著。通过使用6642个人验证标签的全面审计，我们发现这些偏移的不可预测交互常导致裁判性能降至接近随机水平。这与先前工作中报告的高人类一致率形成鲜明对比。关键发现是许多攻击通过利用裁判不足来提高成功率，而非产生真正有害内容。为实现更可靠的评估，我们提出ReliableBench，一个更一致可裁判的行为基准，以及JudgeStressTest数据集，旨在暴露裁判失败。数据可在https://github.com/SchwinnL/LLMJudgeReliability获取。
英文摘要：
Automated \enquote{LLM-as-a-Judge} frameworks have become the de facto standard for scalable evaluation across natural language processing. For instance, in safety evaluation, these judges are relied upon to evaluate harmfulness in order to benchmark the robustness of safety against adversarial attacks. However, we show that existing validation protocols fail to account for substantial distribution shifts inherent to red-teaming: diverse victim models exhibit distinct generation styles, attacks distort output patterns, and semantic ambiguity varies significantly across jailbreak scenarios. Through a comprehensive audit using 6642 human-verified labels, we reveal that the unpredictable interaction of these shifts often causes judge performance to degrade to near random chance. This stands in stark contrast to the high human agreement reported in prior work. Crucially, we find that many attacks inflate their success rates by exploiting judge insufficiencies rather than eliciting genuinely harmful content. To enable more reliable evaluation, we propose ReliableBench, a benchmark of behaviors that remain more consistently judgeable, and JudgeStressTest, a dataset designed to expose judge failures. Data available at: https://github.com/SchwinnL/LLMJudgeReliability.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
