PaperlayerView exact revision on arXiv

Source-linked AI summary

Improving Your Model Ranking on Chatbot Arena by Vote Rigging

Rui Min, Tianyu Pang, Chao Du, Qian Liu, Minhao Cheng, Min Lin

arXiv:2501.17858v2cs.CLcs.AIcs.CRcs.LG

TL;DR

Crowdsourced votes can manipulate Chatbot Arena rankings, while target-only rigging is inefficient because the target appears in few battles. The paper proposes omnipresent strategies that manipulate votes whether or not the target is involved, and reports ranking improvements using only hundreds of new votes.

  • Problem

    Chatbot Arena’s crowdsourced votes can be maliciously rigged to raise or lower a target model’s ranking, while target-only attacks are inefficient because the target appears in only about 1% of new battles.

    Source: §1 · pp. 1–2

  • Method

    Omnipresent rigging uses a multi-class classifier to identify models and strategically manipulate every new vote, including battles without the target model.

    Source: §1 · p. 2, §3.2 · p. 3

  • Results

    Omnipresent strategies improve model rankings with only hundreds of new votes and are more efficient than target-only strategies and other baselines.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The study presents proof-of-concept evidence that adversaries could use model de-anonymization to boost a target’s ranking, underscoring the need for stronger protections.

    Source: §9 · p. 9

    The threat models distinguish whether an adversary can access historical votes or only BT scores from the public leaderboard.

    Source: §2.2 · p. 2

Abstract

from arXiv · show

Chatbot Arena is a popular platform for evaluating LLMs by pairwise battles, where users vote for their preferred response from two randomly sampled anonymous models. While Chatbot Arena is widely regarded as a reliable LLM ranking leaderboard, we show that crowdsourced voting can be rigged to improve (or decrease) the ranking of a target model $m_{t}$. We first introduce a straightforward target-only rigging strategy that focuses on new battles involving $m_{t}$, identifying it via watermarking or a binary classifier, and exclusively voting for $m_{t}$ wins. However, this strategy is practically inefficient because there are over $190$ models on Chatbot Arena and on average only about $1\%$ of new battles will involve $m_{t}$. To overcome this, we propose omnipresent rigging strategies, exploiting the Elo rating mechanism of Chatbot Arena that any new vote on a battle can influence the ranking of the target model $m_{t}$, even if $m_{t}$ is not directly involved in the battle. We conduct experiments on around $1.7$ million historical votes from the Chatbot Arena Notebook, showing that omnipresent rigging strategies can improve model rankings by rigging only hundreds of new votes. While we have evaluated several defense mechanisms, our findings highlight the importance of continued efforts to prevent vote rigging. Our code is available at https://github.com/sail-sg/Rigging-ChatbotArena.

1. Introduction

Chatbot Arena’s vote-based rankings can be maliciously manipulated, while target-only rigging is inefficient because a target appears in few battles. The paper proposes omnipresent rigging and reports that it improves rankings with only hundreds of new votes.

1. Introduction

  • Crowdsourced votes can still be maliciously rigged to raise or lower a target model’s ranking despite measures intended to reduce voting noise and bias.Those measures include controls for response length and style, anomaly and bot detection, prompt categorization, and invalidation when model identities are revealed.Source: §1 · p. 1
  • Target-only rigging identifies battles involving the target and votes exclusively for its wins, but targets appear in only about 1% of new battles.With more than 190 models, improving one rank position may require more than 10,000 rigged votes or interactions.Source: §1 · p. 2
  • Omnipresent rigging manipulates every new vote, using a multi-class classifier to identify both models even when the target is absent.The approach relies on the Bradley-Terry scores being connected through pairwise logistic relationships, so any new vote can influence the target’s ranking.Source: §1 · p. 2
  • Hundreds of new votes let omnipresent strategies improve model rankings and outperform target-only strategies and other baselines.Figure 1 illustrates a 15-rank improvement for the target model under omnipresent rigging, compared with one rank under normal voting after approximately 27,000 new votes.Source: Figure 1 · p. 1, §1 · p. 2

2. Preliminaries

Chatbot Arena samples model pairs for user comparisons, records the selected outcomes, and computes model ratings from the collected votes. The paper frames rigging threats by the adversary’s access to historical data, model identities, the sampling distribution, and other users’ votes.

2.1. Chatbot Arena

  • User votes record a sampled pair’s preferred response, with wins and ties appended to the vote set and abstentions leaving it unchanged.The sampled models are queried with a prompt from the natural-language space.Source: §2.1 · p. 2
  • Bradley-Terry scores rate the models by fitting logistic relationships to the collected votes, using binary cross-entropy loss and a sigmoid function.The score vector’s k-th entry is the rating for the k-th model.Source: §2.1 · p. 2

2.2. Threat Model

  • The threat model distinguishes adversaries by access to historical votes or public BT scores, sampled-model identities, the sampling distribution, and concurrent votes from other users.Simulations use around 1.7 million historical records across 129 models, splitting 90% into VH and the remainder into VO.Source: §2.2 · pp. 2–3

3. Vote Rigging Strategies

The section contrasts target-only rigging, which acts only on battles predicted to involve the target, with omnipresent strategies that manipulate every vote. Omnipresent rigging exploits the connected Bradley–Terry relationships so votes on battles without the target can still affect its rank.

3. Vote Rigging Strategies

  • Rigging strategies combine a de-anonymizing function that predicts model identities with a manipulation function that selects a win, tie, or abstention option.The manipulation function may also use historical votes or ranks.Source: §3 · p. 3

3.1. Target-Only Rigging

  • Target-only rigging manipulates only new votes predicted to involve the target; with over 190 Chatbot Arena models and uniform sampling, a target appears in about 1% of battles.Improving one position (e.g., rank 129 to 128 or 5 to 4) requires over 10,000 votes for low-ranked models and more than 20,000 for high-ranked models.Source: §3.1 · p. 3, §3.2 · p. 3

3.2. Omnipresent Rigging

  • Omnipresent rigging exploits the fact that any new vote can influence the target’s ranking, even when the target is not in that battle.The paper attributes this to the connected pairwise logistic relationships underlying BT scores after sufficient votes have been collected.Source: §3.2 · p. 3
  • Omni-BT uses historical votes to evaluate options for each battle, with its objective based on the target’s relative rating increase against the model ranked immediately ahead.The available options are either model winning, a tie, or abstention.Source: §3.2 · pp. 3–4
  • Omni-On approximates BT-score updates with online Elo scores and chooses voting options using a differentiable surrogate of the target’s rank.The option-dependent parameter γ is 1 for an a win, 0 for a b win, and 0.5 for a tie; abstention sets µ to 0.Source: §3.2 · p. 4

4. Sanity Check with Idealized Rigging

In an idealized setting, the paper compares rigging strategies using 20,000 new votes across several target models. All strategies improve average rank over no rigging, while omnipresent strategies promote targets more than target-only strategies.

4. Sanity Check with Idealized Rigging

  • The initial comparison rigs 20,000 new votes under uniform model sampling and includes a no-rigging case using the normal user voting distribution.The analysis covers six named target models, with results for 22 additional models deferred to Appendix C.2.Source: §4 · p. 4
  • With 20,000 new votes, both omnipresent rigging strategies yield approximately 10-rank promotions in mt’s ranking, outperforming target-only rigging, which achieves an average increase of 4 ranks.Source: §4 · p. 4
  • Across rigging strategies, target models improve by an average of 6 ranks compared with scenarios without rigging.The paper reports this result for the target models shown in Figure 2.Source: §4 · p. 4

5. On Exploring the Rigging Capability

The paper stress-tests rigging under inaccurate de-anonymization, unknown sampling distributions, and concurrent user voting. Omnipresent strategies retain effectiveness in scenarios where target-only rigging weakens, while concurrent votes have a comparatively small reported effect.

5. On Exploring the Rigging Capability

  • The stress tests evaluate practical limits from reduced target sampling, imperfect identity prediction, and votes from other users.The scenarios correspond to unknown sampling distributions, anonymous model identities, and concurrent voting.Source: §5 · pp. 4–5

5.1. Rigging with Inaccurate De-Anonymization

  • With inaccurate de-anonymization, all strategies promote rankings less; T-Tie and T-Random have no manipulation effect when half of battles have anonymous model identities.Omni-On is more resistant than the other strategies, which the authors attribute to using initial rBT^VH without updating it with manipulated votes.Source: §5.1 · p. 5

5.2. Rigging with Unknown Sampling Distribution

  • When the target’s sampling probability falls, target-only strategies lose effectiveness, but omnipresent strategies still improve rank by over 5 even when the target is absent from battles.At β = 0.3, most target-only strategies fail completely.Source: §5.2 · p. 5

5.3. Rigging with Concurrent User Voting

  • Concurrent user votes introduce an average 1-rank decrease even when the concurrent-vote set contains 100,000 votes.The authors characterize the influence of concurrent votes as minor and the strategies as resilient to it.Source: §5.3 · p. 5

6. Case Study: Rigging Chatbot Arena

The case study tests omnipresent rigging in simulated Chatbot Arena settings and finds it effective across practical variations, including unseen prompts, unrecognized models, and the length-control leaderboard.

6.1. Towards Simulating Real-world Vote Rigging

  • The simulation uses 25 models and around 23,000 English-specific votes, with four candidate targets and separate target-only and omnipresent setups.Target-only uses idealized T-Abstain; omnipresent classifiers are trained on HC3 and Quora data.Source: §6.1 · p. 6
  • Omni-BT and Omni-On achieve average promotions of 5 and 3 ranks, respectively, with more than 50% ranking improvement compared to idealized T-Abstain rigging.Table 4 reports rigging with Quora and HC3 prompts.Source: Table 4 · p. 6, §6.1 · p. 6

6.2. Ablation Studies on Omnipresent Rigging

  • Both omnipresent strategies retain effective ranking improvement with unseen prompts, despite the risk that reusing training prompts could trigger prompt-deduplication checks.The authors interpret this as potential scalability from classifier-based de-anonymization rather than memorized responses.Source: §6.2 · p. 6, Figure 3 · p. 7
  • With five unrecognized models added to the simulation, both omnipresent strategies outperform target-only rigging, showing some resilience to models outside the classifier’s range.The comparison is shown in Figure 3(b).Source: §6.2 · p. 6, Figure 3 · p. 7
  • Omnipresent rigging achieves an average 4-rank improvement on the length-control leaderboard, and Vicuna-7B rises substantially more than under original-leaderboard rigging.The authors identify a possible vulnerability if adversaries optimize prompts to reduce response-length discrepancies.Source: Table 5 · p. 7, §6.2 · p. 7
  • The classifier distinguishes responses generated through Chatbot Arena APIs, supporting its effectiveness on realistic platform responses.The evaluation uses responses from three models and is summarized in Table 6.Source: §6.2 · p. 7, Table 6 · p. 7
  • For evaluation, 1,000 responses per model were generated using unseen prompts, and average accuracy showed comparable classifier performance when its training dataset was reduced to half its original size.Source: §6.2 · p. 7

7. Defense against Vote Rigging

The section evaluates defenses based on duplicate-vote detection, anomalous voting behavior, and filtering votes by historical pairwise win rates; none fully eliminates rigging.

7. Defense against Vote Rigging

  • Duplicate-vote detection reduces ranking increases against T-Abstain by 80%, even with a detection threshold of η = 100.The example defense discards the next 200 votes after detecting continuous duplication over η battles.Source: §7 · p. 7
  • Likelihood testing detects T-Random and Omni-BT, but Omni-BT evades detection when around 20% of votes follow the public ranking.At that mix, detection accuracy falls to 20% while ranking promotion decreases by less than 15%; Omni-On is harder to detect without adaptation.Source: §7 · p. 8
  • Omnipresent strategies still achieve over 6-rank improvement with vote filtering at τ = 0.7, although filtering reduces ranking improvement overall.The proposed filter discards votes that exceed a threshold based on historical pairwise win rates.Source: §7 · p. 8
  • The authors conclude that thoroughly defending against vote rigging remains difficult and that more effective defenses are needed to improve leaderboard integrity.Multiple accounts may weaken anomalous-user detection, motivating vote filtering as an additional defense.Source: §7 · pp. 7–8

8. Related Work

Prior work evaluates LLMs with static benchmarks, LLM judges, and human-voted platforms, while also documenting vulnerabilities in automated and social voting systems. This paper focuses on manipulating Chatbot Arena’s human votes, including battles where model identities are initially anonymous.

LLM evaluation

  • Static benchmarks struggle to capture open-ended generation and raise contamination and out-of-distribution concerns; LLM judges can exhibit verbosity and position bias.Chatbot Arena instead aggregates diverse human votes between anonymous models.Source: §8 · p. 8

Vulnerability of LLM evaluation

  • Prior attacks target LLM-as-a-Judge, whereas this work studies rigging human-voted Chatbot Arena and unifies target-only and omnipresent strategies.The paper notes that watermarking and binary-classifier approaches can be treated as target-only rigging.Source: §8 · p. 8

Vulnerabilities of social voting systems

  • Unlike earlier social-voting settings with visible candidates, Chatbot Arena begins with anonymous models, motivating model identification and general-purpose rigging objectives.The authors report that their RBT and ROn objectives outperform baselines and two relevant prior works in efficiency.Source: §8 · p. 9

LLM identification through model responses

  • Model-source identification includes active watermarking and backdoors, as well as passive analysis of response style.Guo et al. (2023) fine-tuned a RoBERTa-based model to distinguish LLM-generated responses from human-written documents.Source: §8 · p. 9

9. Conclusion

The paper shows that target-only and omnipresent strategies can manipulate Chatbot Arena rankings, with the latter improving rigging efficiency even when the target is absent from a battle. The authors describe the experiments as proof of concept and call for stronger defenses for Chatbot Arena and other voting-based evaluation systems.

9. Conclusion

  • Omnipresent rigging improves efficiency over target-only rigging and can boost a target model without directly rigging its battles.The conclusion frames the experiments as proof of concept and calls for effective anti-rigging defenses.Source: §9 · p. 9

Impact Statement

The impact statement warns that rigged rankings could bring promotional benefits to adversaries while disadvantaging other developers and undermining trust in Chatbot Arena. It says early defense attempts have difficulty completely eliminating manipulation and urges stronger defenses for voting-based evaluation systems.

Impact Statement

  • Manipulated rankings could benefit adversaries, put other model developers’ interests at risk, and undermine Chatbot Arena’s reliability and trustworthiness.The authors say initial defense attempts highlight the difficulty of completely eliminating manipulation.Source: Impact Statement · p. 9

A.1. An Informal Proof of Omni-Property

The appendix explains why votes on battles that exclude the target can still affect its BT score, then compares objective choices and describes classifier-based model identification and training-data construction. Its reported ablations favor relative-rating and average-win-rate objectives and caution against online Elo updates.

A.1. An Informal Proof of Omni-Property

  • A vote on a battle excluding the target changes the two involved models’ BT scores, and sufficient pairwise connectivity makes the target’s score depend on those changes.The proof assumes a sufficiently large vote set and nonzero sampling probability for all battle pairs.Source: §A.1 · p. 13

A.2. Does Improving Relative Rating Increase Better than Improving Absolute Rating Increase for Omni-BT

  • Maximizing relative rating gain over the model one position ahead gives more stable and efficient ranking promotion than maximizing the target’s absolute rating gain.The comparison uses average ranking improvement across manipulated votes.Source: §A.2 · p. 13, Figure 5 · p. 13

A.3. What if Maximizing the Win Rate of One Model for Omni-On

  • RON-Max averages a 7-position ranking increase, while ROn-Min is inferior and unstable, lowering the average ranking by 4.The authors take this as support for average win rate as a more stable objective.Source: §A.3 · pp. 13–14

A.4. Explanation of Why We Do not Update rBT VH when Using the Omni-On Strategy

  • Updating rBT VH yields significantly inferior rigging performance, even versus T-Abstain, because unstable online Elo produces inaccurate pairwise win rates and vote selection.The comparison is reported for the Omni-On strategy.Source: §A.4 · p. 14

B.1. Mechanisms of De-Anonymizing Functions Aomni(·)

  • The de-anonymizing mechanism trains a response-based classifier on labeled model outputs and predicts an identity from its logits.The classifier is parameterized by fθ, and the prediction selects the highest-scoring model index.Source: §B.1 · pp. 14–15

B.2. Details of Model Selection in the Case Study

  • The case study trains on 25 models and adds five models to simulate newly added systems outside the initial classification range, testing on 1,000 responses per model from unseen HC3 and Quora prompts.The evaluations use responses generated from unseen prompts.Source: §B.2 · p. 15

B.3. Details of Training Dataset Construction

  • Training-data construction discards responses under 100 tokens and removes three Markdown symbol types to reduce classifier bias toward those features.The described symbols are Markdown headers, bold, and list symbols.Source: §B.3 · pp. 15–16

C.1. Rigging Results with Various Numbers of Votes

Across varying vote counts and additional target models, the omnipresent strategies outperform target-only rigging. The appendices also provide model-response examples and details of vote filtering.

C.1. Rigging Results with Various Numbers of Votes

  • Omnipresent strategies remain effective across different numbers of new votes compared with target-only rigging.The comparison reports average rigging performance across vote counts in Table 9.Source: §C.1 · p. 16

C.2. Rigging Results with Additional Target Models

  • For additional target models, omnipresent strategies achieve over double the ranking promotion of target-only strategies.The comparison uses a target model among 22 diverse models from Huang et al. (2025).Source: §C.2 · p. 16

D. Example of Different Model Responses

E. Details of Vote Filtering

  • Algorithm 1 takes collected and historical voting records plus a threshold and outputs filtered voting records.Its shown conditions exclude votes when the winning model's historical-record score exceeds the threshold; otherwise, the vote is retained.Source: E. Details of Vote Filtering · p. 16, §C.2 · p. 16
  • Figure 7 reports text-classifier accuracy on HC3 and Quora using responses to unseen prompts not used to generate the training corpus.The supplied caption describes the evaluation setting but gives no accuracy values.Source: Figure 7 · p. 17

Related papers

Loading 2501.17858v2…