mlsanityData to 7 Oct 2026

Turning Bias into Bugs: Bandit-Guided Style Manipulation Attacks on LLM Judges

arXiv 2605.26156 ↗First posted 24 May 2026cs.CR cs.AI cs.LGcited by 3

Not on the map. Why?

Abstract (arXiv)

The known stylistic biases in LLM judges, such as a preference for verbosity or specific sentence structures, present an underexplored security vulnerability. In this work, we introduce BITE (BIas exploraTion and Exploitation), a black-box adversarial framework that learns semantics-preserving edits to mislead an LLM judge and artificially inflate the scores it assigns. We cast the selection of stylistic edits as a contextual bandit problem and use a LinUCB policy to adaptively choose edits that maximize the judge's score without access to model parameters or gradients. Empirically, we test BITE across a diverse range of LLM judges and tasks, including both pointwise and pairwise comparisons on chatbot leaderboards and AI-reviewer benchmarks. BITE achieves an attack success rate exceeding 65% and raises scores by 1-2 points on a 9-point scale, all while preserving semantic equivalence. We further assess the attack's stealthiness, showing that BITE evades standard style-control methods and several detection baselines. Our findings expose a fundamental weakness in the LLM-as-a-judge paradigm and motivate robust, attack-aware evaluation. Our code is available at https://github.com/xianglinyang/llm-as-a-judge-attack.

Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Builds on 28 of its 36 references that are in the map. First posted on arXiv 24 May 2026.

Builds on

28 of 36 references.

References · 28

  1. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,393
  2. 2020MiniLM: Deep Self-Attention Distillation for Task-Agnostic Compression of Pre-Trained Transformerscited by 1,414
  3. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
  4. 2024LLM Evaluators Recognize and Favor Their Own Generationscited by 651
  5. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 619
  6. 2024From Crowdsourced Data to High-Quality Benchmarks: Arena-Hard and BenchBuilder Pipelinecited by 484
  7. 2024Justice or Prejudice? Quantifying Biases in LLM-as-a-Judgecited by 354
  8. 2024Humans or LLMs as the Judge? A Study on Judgement Biasescited by 314
  9. 2024Aligning with Human Judgement: The Role of Pairwise Preference in Large Language Model Evaluatorscited by 146
  10. 2024Optimization-based Prompt Injection Attack to LLM-as-a-Judgecited by 123
  11. 2025Preference Leakage: A Contamination Problem in LLM-as-a-judgecited by 119
  12. 2024Is LLM-as-a-Judge Robust? Investigating Universal Adversarial Attacks on Zero-shot LLM Assessmentcited by 117
16 more
  1. 2024Trust or Escalate: LLM Judges with Provable Guarantees for Human Agreementcited by 99
  2. 2021Adapting to Misspecification in Contextual Banditscited by 81
  3. 2025MLR-Bench: Evaluating AI Agents on Open-Ended Machine Learning Researchcited by 57
  4. 2024From Lists to Emojis: How Format Bias Affects Model Alignmentcited by 48
  5. 2024Cheating Automatic LLM Benchmarks: Null Models Achieve High Win Ratescited by 42
  6. 2017Misspecified Linear Banditscited by 41
  7. 2024Style Outweighs Substance: Failure Modes of LLM Judges in Alignment Benchmarkingcited by 35
  8. 2024Finding Blind Spots in Evaluator LLMs with Interpretable Checklistscited by 32
  9. 2024Defense Against Prompt Injection Attack by Leveraging Attack Techniquescited by 31
  10. 2025Assessing Judging Bias in Large Reasoning Models: An Empirical Studycited by 30
  11. 2024LLMs Are Biased Towards Output Formats! Systematically Evaluating and Mitigating Output Format Bias of LLMscited by 24
  12. 2025Reward Models in Deep Reinforcement Learning: A Surveycited by 24
  13. 2024Emoji Attack: Enhancing Jailbreak Attacks Against Judge LLM Detectioncited by 20
  14. 2025Exploring and Mitigating Adversarial Manipulation of Voting-Based Leaderboardscited by 19
  15. 2025BadJudge: Backdoor Vulnerabilities of LLM-as-a-Judgecited by 13
  16. 2023On the Interplay Between Misspecification and Sub-optimality Gap in Linear Contextual Banditscited by 6

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 3.

3 papers.

  1. 2026The Emerging AI Paper-Review Arms Race: Adversarial Co-Evolution in Scholarly Publishingcited by 1
  2. 2026ImpossibleRubrics: Stress-Testing Generated Rubrics as Reward Signalscited by 0
  3. 2026A Missing Piece for Trustworthy AI Reviewers: From Benchmarking Rhetorical Robustness to SciCore Reviewcited by 0