Opening LLM Judges: Recovering Preference Signals Beyond the Final Verdict
Organizations: Microsoft Research
Abstract
LLM judges are widely used to evaluate model outputs, but their verdicts can be unreliable: a judge may favor the worse answer for its position, length, or other surface features. When a judge is wrong, is the information needed to judge correctly absent from the model, or present in its internal representations but not reflected in the output? We study this across 64 open-weight evaluators and 14 datasets, including causal interventions on 41 judges (editing activations mid-run to see whether the verdict changes). On LLMBar, built so the superficially better answer is the worse one, the verdicts of 50 judges agree with human labels only 0.456 of the time, even after averaging both answer orders. Yet a small probe on the same judges' activations, with no weight updates, reaches 0.846, and 0.686 once surface features such as length and position are residualized out (0.507 with shuffled labels). The gap holds across eight benchmarks and model families, but is not universal: a score of how well surface features alone predict the human label, computed before any probe is trained, predicts the size of the gain (Spearman rho = 0.90). On rubric tasks that score one answer at a time, leaving no surface cue to exploit, reading the internals gives no advantage. The interventions also show that editing activations mid-network already changes the verdict, before it can be read off directly, and locate the pathways carrying position and length bias. At the same label budget, the recovered signal lets a judge flag cases where it is likely wrong and yields better labels for preference learning. A wrong verdict, then, does not mean the judge lacks the information, and a simple diagnostic shows when it is worth recovering.
Figures & tables
| Work | Internal | Causal | Surface | Predicts | Downstream | Judge | Scale |
| read-out | localization | controls | when useful | use | format | (models) | |
| Maiya et al. (2025) | ✓ | – | pos. only | – | – | both | families |
| Lai et al. (2025) | ✓ | – | – | – | data sel. | point-wise | |
| Girrbach et al. (2025) | ✓ | – | – | – | BoN, routing | point-wise | |
| Li et al. (2026) | ✓ | – | – | – | data sel. | point-wise | |
| Feldhus et al. (2026) | (✓) | ✓ | – | – | – | point-wise | families |
| Bench. | cf | raw | o - avg | probe | resid | ||
| rb2 | .96 | .620 | .684 | .840 | .907 | ||
| llmbar | .80 | .483 | .456 | .758 | .846 | ||
| rb-easy | .77 | .690 | .815 | .868 | .879 | ||
| mtbench | .62 | .626 | .697 | .739 | .756 | ||
| arena | .59 | .566 | .616 | .623 | .631 | ||
| judgebench | .52 | .516 | .545 | .540 | .548 |
Appendix figures & tables17 assets
Supplementary material from the paper’s appendix.
Appendix
| Section | What it is for | Tables and figures |
|---|---|---|
| § A.1 Additional Definitions | Definitions of dimensional collapse and of the concept directions used in steering and ablation. | – |
| § A.2 Claim–Evidence Matrix | Every load-bearing claim against the evidence for it. | Tab. 5 : claim, evidence, causal or not, scale, and the claims we do not make. |
| § A.3 Main-Paper Figure and Table Guide | Panel and column definitions for Figs. 2 – 6 and Tabs. 2 a, 3 a and 3 b. | Tab. 6 : what every panel and column means. |
| § A.4 Additional Figures | Companion figures to the main results. | Fig. 4 : where the decision forms. Fig. 5 : the read-out end to end. Fig. 6 : the ten-panel version of Fig. 3 . |
| § A.5 Model Registry and Dataset Sheet | The 64 models and 14 datasets, with roles, sizes, and provenance. | Tab. 7 : all 64 models by role. Tab. 8 : instruments, controls, compute. Tab. 9 : the 8 pairwise benchmarks. Tab. 10 : the 6 auxiliary sets. |
| § A.6 Deployable Read-Out Recipe | The read-out written out as runnable steps, with no weight updates. | Alg. 1: cache the residual stream, order-average, fit the probe. |
| Claim | Evidence | Causal? | Scale | Where |
|---|---|---|---|---|
| Preference is decodable from frozen activations when the verdict is wrong | CV probe, | no (L1) | 50 judges, LLMBar-adv | § 4 |
| That signal is not only surface | 9-dim residualization, length balancing, shuffle control | no (L1) | 50 judges | § 4 |
| The gap generalizes | ladder, benchmarks, of cells | no | cells | § 4 |
| … and is not an artifact of treating judges as independent | family-clustered bootstrap; CIs exclude ; positive in families | no | families | § 4 |
| Intervention changes the verdict from mid-stack | residual patching, steering | yes (L2) | judges | § 5 |
| … before it is lens-decodable | paired per-judge test, , | yes (L2) | judges | § 5 |
| Panel | What it shows, and how it was computed |
|---|---|
| Fig. 4 : where the decision forms | |
| – | A forward-pass residual patch places the causal decision at of depth, before the lens first decodes the verdict; per judge this ordering holds on judges (Fig. 2 d). On easy items the verdict is linearly readable without extra fitting; on adversarial items the untrained read-out is wrong at every depth, which is why the deployable reader is a trained probe. |
| Fig. 5 : the read-out, end to end (50 judges 8 benchmarks) | |
| (a) | A small-label lens probe (blue) and a residual-stream probe (green) exceed the stated verdict (rose) on all 8 benchmarks, mean , every one significant under FDR-BH; the margin is largest where the verdict collapses to chance. Training-free order-averaging (sand) beats raw on . |
| (b) | Selective prediction: abstaining on the lowest-confidence items raises accuracy monotonically as coverage falls. At coverage accuracy reaches – . |
| (c) | Over all judge benchmark cells, absolute probe accuracy rises with judge quality (slope ) and of cells sit above , so the weak-judge gain is range compression rather than headroom. |
| Family | Models (sizes as loaded) |
| Role A, the flagship adversarial panel: 50 generative judges. | |
| The forward-pass causal suite intervenes on the 41 of these that expose | |
| hookable decoder blocks within our memory budget; all 50 are read out. | |
| Qwen2.5 | 0.5b, 1.5b, 3b, 7b, 14b, 32b |
| Qwen3 | 8b, 14b, 30b-a3b, 32b |
| Llama-3 | 3.2-1b, 3.1-8b, tulu-3-8b |
| Component | What we use |
| Cached read-out surrogates | |
| Lenses | logit lens; tuned lens (learned affine per layer) |
| Attribution | direct logit attribution over heads and MLPs |
| Patching | activation patching, path patching, causal scrubbing |
| Features | Gemma-Scope sparse autoencoders |
| Probes | -logistic, 5-fold CV, shuffled-label control |
| Dataset | Label / form | Role in this paper |
| LLMBar (natural, adversarial ) | human pairwise, surface decoupled from quality | flagship confounded regime; the verdict falls below chance here |
| RewardBench 2 | human pairwise | highest confound score ( ); largest probe gain |
| RewardBench (easy) | human pairwise | mid-confound control |
| JudgeBench | human pairwise, length-neutral | the null : no surface cue, no probe gain |
| MT-Bench (human) | human pairwise | human–human agreement (inter-annotator, not a label ceiling) |
| Chatbot Arena | k human preferences | scale / in-the-wild preference |
| Auxiliary set | exps. | Result reported in this paper |
| Samiksha | Out-of-domain confirmation over judges ( ): emitted score , held-out best layer , probe ; best layer beats final on of judges, matching the the confound account predicts | |
| Pariksha | Out-of-domain confirmation over judges ( ): / / ; best layer beats final on of judges | |
| BiGGen-Bench | Rubric-format control: standalone rubric scoring commits at – of depth, latest of any format | |
| HelpSteer2 | Multi-attribute rank-collapse measurements (§ 5 ) | |
| m-RewardBench | Cross-lingual direction geometry and transfer | |
| UltraFeedback | Preference pool for the DPO labeling experiment (§ 7 ) |
| Reader (256-label) | Mean | llmbar | judge | pku |
| Raw verdict | ||||
| Probe (0 updates) | ||||
| LoRA / PEFT fine-tune |
| Bench | AUC int. | AUC verd. | / % win |
| llmbar | 0.822 | 0.431 | / 100% |
| rb2 | 0.921 | 0.744 | / 98% |
| rb-easy | 0.939 | 0.876 | / 74% |
| mtbench | 0.823 | 0.780 | / 48% |
| pku-safe | 0.697 | 0.677 | / 56% |
| arena | 0.671 | 0.667 | / 32% |
| Bench. | by verdict | by internals | |
| rewardbench2 | .58 | skywork-crit-8b | unchanged |
| llmbar-adv | .20 | skywork-crit-8b | mistral-sm-24b |
| rb-easy | .71 | qwen2.5-14b | qwen2.5-32b |
| mtbench | .54 | phi-4 | ds-r1-qwen-32b |
| arena | .71 | mistral-sm-24b | gemma-3-27b |
| judgebench | .32 | qwen2.5-32b | ds-r1-qwen-32b |
| Arm | fwd/item | grad. steps | params upd. | stored |
| raw verdict | – | |||
| order-average | – | |||
| self-consistency ( ) | – | |||
| calibrated prompt | – | |||
| lens probe | B | |||
| residual-stream probe | MB |
| Property (behavioral probe) | Measure | Value |
| Bias & safety pathologies | ||
| Position-bias flip rate | swap-flip frac. | |
| Swap non-invariance | agreement | up to |
| Eval-awareness shift | lens | |
| Self-preference (cross-gen) | win rate | |
| scaling with size | Spearman | |
| Bench. | cf | Measure | Abstain | Layers | Budget | Label |
| diagnostic | acc. | AUC | content | budget | DPO | |
| rewardbench2 | .96 | |||||
| llmbar-adv | .80 | |||||
| rb-easy | .77 | – | – | |||
| mtbench | .62 | – | – | |||
| arena | .59 | – |
| bench judge | pol. | verd. | probe | gold | |
| llmbar q7b | 1.5b | 0.463 | 0.787 | 0.825 | |
| llmbar q7b | 3b | 0.625 | 0.775 | 0.863 | |
| rb2 q7b | 1.5b | 0.906 | 0.931 | 0.960 | |
| rb2 g9b | 1.5b | 0.940 | 0.951 | 0.963 | |
| rb2 q7b | 3b | 0.923 | 0.934 | 0.963 | |
| rb2 3b label-efficiency (pool probe verd.) | |||||
LLM-as-a-Judge
Large language model (LLM)-as-a-judge research uses language models to score, compare, and verify AI outputs as scalable alternatives to human evaluation.
See all 529 papers