PaperlayerView exact revision on arXiv

Source-linked AI summary

JudgeStealer: Extracting LLM Judging Capabilities across Evaluation Protocols

Chen Chen, Yaolin Chen, Xuehan Sun, Juan Lin, Xueluan Gong, Yuhang Zheng, Qian Wang, Kwok-Yan Lam

arXiv:2608.26982v1cs.CL

TL;DR

LLM judges expose valuable evaluation capabilities through black-box interfaces, but existing extraction methods provide limited support for judges and multiple protocols under restricted query budgets. JUDGESTEALER uses pointwise supervision, cross-protocol transformation, informative-input selection, and multi-protocol surrogate adaptation; it outperforms existing baselines across protocols and remains effective against representative defenses.

  • Problem

    Existing model-extraction methods do not specifically target LLM judges and provide limited support for multiple evaluation protocols under restricted query budgets.

  • Method

    JUDGESTEALER acquires pointwise supervision, transforms it into pairwise and listwise signals without additional victim queries, and adapts a unified surrogate using dynamic selection, smoothing, and multi-protocol review.

  • Results

    JUDGESTEALER consistently outperforms existing extraction baselines across all three evaluation protocols, with reported accuracies up to 73.3%, 87.0%, and 71.6% for pointwise, pairwise, and listwise evaluation, respectively.

  • Takeaways & Limitations

    The findings indicate that LLM judging capabilities can be replicated with limited black-box supervision across protocols, model scales, adaptation strategies, and reasoning settings.

  • Takeaways & Limitations

    Prior extraction methods often degrade under low query budgets, and their robustness to practical defenses has not been sufficiently demonstrated.

Abstract

from arXiv · show

Large language model (LLM) judges are increasingly used across various evaluation scenarios, making their judgment capabilities valuable intellectual property. However, black-box access exposes these capabilities to model extraction attacks. Existing extraction methods do not specifically target LLM judges and provide limited support for multiple evaluation protocols under restricted query budgets. In this study, we propose JUDGESTEALER, the first query-efficient model extraction framework for replicating judging capabilities across pointwise scoring, pairwise comparison, and listwise ranking protocols. JUDGESTEALER exploits the strong cross-protocol agreement to acquire pointwise scores and transform them into pairwise and listwise supervisions without additional victim queries. To capture informative judge patterns and improve query efficiency, JUDGESTEALER dynamically selects pointwise inputs based on semantic diversity, predictive uncertainty, and potential judge biases. It further applies score smoothing and multi-protocol review to preserve the ordinal structure of scores and mitigate catastrophic forgetting during surrogate adaptation. Extensive experiments on state-of-the-art LLM-as-a-judge and reward models show that JUDGESTEALER consistently outperforms existing extraction baselines, achieving up to 73.3%, 87.0%, and 71.6% accuracy for pointwise, pairwise, and listwise evaluation, respectively. JUDGESTEALER also remains effective across different sur- rogate model scales, adaptation strategies, and reasoning settings. Moreover, JUDGESTEALER demonstrates robustness against representative extraction defenses.

1 Introduction

JUDGESTEALER addresses the underexplored extraction of LLM judging capabilities across multiple evaluation protocols under black-box access and restricted query budgets. It combines cross-protocol supervision, informative-input selection, surrogate adaptation, and broad evaluation to replicate judging behavior efficiently.

  • Motivation: Black-box access lets adversaries repeatedly query evaluation services and reproduce proprietary judging behavior in locally controlled models.Such functionality stealing can bypass service providers and potentially cause economic losses.
  • Research gap: Existing model-extraction studies rarely target LLMs, and none specifically investigates extracting evaluation capabilities from LLM judges.Prior work also relies on assumptions such as access to victim architecture, logits, or internal states, limiting realistic API applicability.
  • Research gap: LLM judging spans pointwise scoring, pairwise comparison, and listwise ranking, but extracting each protocol independently increases query costs and weakens consistent cross-protocol performance.The paper targets unified replication across these protocols under restricted budgets.
  • Method: JUDGESTEALER converts acquired pointwise scores into pairwise comparisons and listwise rankings, using cross-protocol agreement without additional victim queries.Original and transformed data jointly train a unified surrogate judge.
  • Method: Dynamic input selection prioritizes candidates using semantic diversity, predictive uncertainty, and potential judge biases estimated from the latest surrogate state.The mechanism is designed to improve informativeness under limited query budgets.
  • Method: Score smoothing preserves ordinal structure, while multi-protocol review revisits earlier pointwise supervision alongside newly constructed data to mitigate catastrophic forgetting.Together, these adaptation components regularize surrogate predictions during progressive multi-protocol learning.
  • Results: 73.3%, 87.0%, and 71.6% accuracy are achieved for pointwise, pairwise, and listwise evaluation, respectively, across proprietary and open-source judges and reward models.The experiments also report effectiveness across surrogate scales, adaptation strategies, and reasoning settings.
  • Results: JUDGESTEALER remains practically robust against representative defenses, including anomaly detection, anti-distillation perturbation, and ownership tracing.The framework is presented as the first extraction method spanning these protocols under black-box access.

2 Background

LLM-based judging can be implemented through prompted evaluators or learned reward functions, both supporting pointwise, pairwise, and listwise judgments. The background also situates JUDGESTEALER among functionality and component extraction attacks and existing defense families.

  • LLM-based judging: Prompted judges evaluate responses using instructions, candidate outputs, criteria, and optional context, while reward models learn scalar rewards from preference data.Prompted judges can vary with wording, response order, and decoding randomness; reward models’ criteria are determined by training data.
  • Evaluation protocols: Pointwise evaluation scores one response, pairwise evaluation compares two responses, and listwise evaluation orders multiple responses from best to worst.These protocols provide distinct forms of supervision for content evaluation.
  • Reward models: Reward models provide scalar feedback commonly used for policy optimization in RLHF, with comparisons and rankings obtained by comparing or sorting rewards.Unlike prompted judges, reward models usually provide no textual explanation.
  • Model extraction: Model extraction seeks a surrogate that approximates an API-accessible victim and includes functionality extraction and parameter or architecture extraction.Earlier studies primarily targeted image classifiers, with fewer works targeting LLMs.
  • Extraction defenses: Existing defenses include output perturbation, watermarking or ownership tracing, and query detection of suspicious API traffic.The cited background describes these as distinct defense families, with dedicated LLM extraction defenses still limited for some categories.

3 Threat Model

The threat model considers a malicious user extracting proprietary content-evaluation functionality from a reward model or general-purpose LLM through repeated service queries. The attacker operates through black-box outputs while training a local surrogate from available data.

  • Attacker scenario: The victim is an API-accessible reward model or general-purpose LLM that provides proprietary content evaluation functionality.The attacker is modeled as a malicious service user who repeatedly queries the victim to collect responses.
  • Attacker capability: The attacker observes only service outputs and has no access to the victim’s training data, architecture, parameters, or output logits.This defines the extraction setting as black-box access.
  • Attacker capability: The attacker can train a local surrogate and use publicly available or synthetically generated data to construct candidate queries.The threat model does not grant access to the victim’s internal information.
  • Attacker goal: A successful attack should reproduce victim judging behavior across pointwise, pairwise, and listwise protocols while maximizing information per interaction and reducing required queries.The stated objectives combine attack effectiveness across protocols with attack efficiency under query constraints.

4 Methodology

JUDGESTEALER extracts multi-protocol judging behavior by querying informative pointwise instances, transforming their scores into pairwise and listwise supervision, and consolidating the surrogate with smoothing. Its selection mechanism combines semantic diversity, predictive uncertainty, and judge-bias signals under a limited query budget.

  • Overview: Cross-protocol agreement supports transforming pointwise scores into pairwise comparisons and listwise rankings without additional victim queries.Pointwise scoring is used because it provides fine-grained supervision from which the other protocols can be inferred.
  • Sample Selection: The iterative selection score aggregates semantic diversity, predictive uncertainty, and potential judge biases to choose high-value query batches.Selection uses the latest surrogate state and samples a candidate subset before prioritizing the highest-scoring instances.
  • Sample Selection: Semantic diversity favors underrepresented regions of the input space, while density filtering excludes candidates in the lowest 10% of local density.The density filter reduces the risk that distance-based selection prioritizes isolated outliers.
  • Workflow: JUDGESTEALER uses two stages: informative pointwise querying and surrogate initialization, followed by transformed multi-protocol training and consolidation.Adaptive smoothing is applied in both stages.
  • Sample Selection: Predictive uncertainty is estimated from normalized entropy over the surrogate’s pointwise score distribution, with higher entropy indicating potentially higher-value supervision.The surrogate distribution is conditioned on each query-response pair under the pointwise-scoring prompt.
  • Sample Selection: Judge-bias scoring probes verbosity and position sensitivity using response-prefix perturbations and reversed response orders, then averages the resulting signals.These probes prioritize candidates that may expose systematic surrogate judge biases.
  • Victim Querying: Victim queries submit every query-response pair in each selected instance under the pointwise protocol, using returned scores as supervision.Chain-of-Thought explanations, when available, are retained only as auxiliary metadata.

5 Experiments

Experiments evaluate JUDGESTEALER across datasets, victim and surrogate models, protocols, adaptation strategies, reasoning settings, and ablations. It consistently outperforms baselines while retaining effectiveness under varied model scales, query budgets, and training conditions.

  • JUDGESTEALER outperforms baselines in 475 of 480 metric-level comparisons across victims, surrogates, and datasets.
  • For GPT-5 on Alpaca, pointwise Acc±1 rises from 0.4865 to 0.5905, pairwise Acc from 0.6240 to 0.7707, and listwise Acc from 0.6300 to 0.6345.
  • Average pointwise Acc improves by 0.094, while synthesized pairwise and listwise supervision also outperforms strongest baselines with few marginal exceptions.
  • Results across Surrogate Model Scale: Increasing surrogate scale generally improves extraction, especially for pointwise and listwise evaluation, while pairwise gains become smaller beyond 4B parameters.
  • Results across Training Strategies: LoRA and full fine-tuning achieve comparable extraction performance across scales and protocols, so LoRA is adopted for its lower computational cost.
  • Results across Reasoning Settings: JUDGESTEALER remains effective with Chain-of-thought judgments and on UniRRM, where it achieves pointwise MAE 0.6354, pairwise Acc 0.8356, and listwise Acc@Top 0.7967.
  • Impact of the Sample Selection Mechanism: Removing any sample-selection signal generally degrades performance; without selection on GPT4All, pairwise Acc drops from 0.783 to 0.740 and pointwise Acc±1 from 0.610 to 0.582.
  • Ablation Studies: Adaptive smoothing is stronger overall than no or fixed smoothing, while removing consolidation lowers Alpaca pointwise Acc by 28.7% and GPT4All pointwise Acc by 33.5%.

6 Robustness against Defense Methods

JUDGESTEALER is evaluated against anomaly detection, anti-distillation, and ownership-tracing defenses. The reported results indicate that it evades anomaly detection, retains performance under anti-distillation, and avoids detectable watermark inheritance.

  • Anomaly Detection: JUDGESTEALER queries evade the anomaly detector, with W values clearly above the threshold τW for both evaluated surrogate models.
  • Anti-Distillation: Against anti-distillation, Qwen3-1.7B accuracy decreases by only 0.001, 0.002, and 0.007 for pointwise, pairwise, and listwise evaluation.
  • Ownership Tracing: With ownership tracing, the Qwen3-32B victim has average Z-score 6.917, whereas extracted Qwen3-1.7B and Llama-3.2-1B-Instruct surrogates show Z-scores of −0.219 and −0.256.

7 Conclusion

JUDGESTEALER extracts LLM judging capabilities across pointwise, pairwise, and listwise protocols using limited black-box supervision. Its effectiveness persists across model scales, adaptation and reasoning settings, while remaining robust to representative defenses.

  • JUDGESTEALER is presented as the first black-box extraction framework spanning pointwise scoring, pairwise comparison, and listwise ranking.
  • The framework transforms pointwise supervision into pairwise and listwise signals without additional victim queries, alongside dynamic selection, adaptive smoothing, and consolidation.
  • Its effectiveness persists across surrogate scales, adaptation strategies, and reasoning settings, while remaining robust against representative extraction defenses.

Ethical Considerations

The paper frames judge extraction as an ethical security risk while limiting experiments to black-box functionality extraction and withholding deployable commercial-service attack artifacts.

  • Copying proprietary judging capabilities may cause intellectual-property loss and weaken downstream safeguards.The study also aims to help measure vulnerability and design stronger defenses.
  • The study observes only outputs exposed through standard interfaces and does not recover parameters, prompts, logits, training data, credentials, logs, or infrastructure details.
  • Released artifacts support validation and open-source reproduction but are not provided as a turnkey extraction tool for commercial judging services.

Open Science

The paper plans public release of code, prompts, configurations, seeds, evaluation scripts, and data-reconstruction utilities, while excluding sensitive proprietary materials.

  • The artifact repository will be publicly available upon acceptance.
  • The repository will include JUDGESTEALER implementation, prompts, configurations, random seeds, defense scripts, and main-result reproduction scripts.
  • Data utilities will download and preprocess Alpaca and GPT4All and reconstruct judging instances when redistribution is unavailable.
  • Commercial credentials, non-redistributable proprietary outputs, and checkpoints imitating proprietary judges will not be released.Open-source experiments are reproducible end-to-end, whereas proprietary-victim experiments depend on service availability and terms.

A.1 Datasets

The experiments construct query and response pools from Alpaca and GPT4All, pre-collect victim judgments, and evaluate surrogates across pointwise, pairwise, and listwise protocols.

  • Datasets and instance construction: For GPT-5.4, the study samples 18K queries from Alpaca and GPT4All; Claude Sonnet 4.5 uses 10K per dataset, while other combinations use 2K.
  • Datasets and instance construction: Three responses per query are randomly sampled from a pool of 25 LLMs spanning diverse model families.The response generators increase content and quality diversity while reducing reliance on one model family.
  • Datasets and instance construction: Victim judgments are collected in advance so every method receives identical supervision without repeated remote API calls.
  • Evaluation metrics: Pointwise evaluation reports Acc, Acc±1, and MAE, with Acc±1 counting predictions within one score point and MAE measuring score deviation.
  • Evaluation metrics: Pairwise evaluation uses Acc for preference agreement, while listwise evaluation reports exact ranking-match Acc and R-MAE for ranking-position deviation.Higher Acc and lower R-MAE indicate stronger agreement with victim listwise behavior.
  • Evaluation metrics: For reward models, pointwise evaluation reports only MAE and listwise evaluation uses Acc@Top because scores are continuous and the model selects the best response.

C Implementation Details

Implementation uses 4-bit LoRA adaptation with specified optimization settings and a sample-selection module balancing diversity, uncertainty, and judge bias.

  • Adaptation settings: Unless otherwise specified, surrogates use LoRA with 4-bit loading, AdamW, learning rate 1×10^-4, 10% warmup, batch size 1, and 16-step accumulation.The maximum sequence length is 4096, with rank 8, scaling factor 16, and dropout 0.05.
  • Sample selection: The sample-selection weights are λ1=1.0 for semantic diversity, λ2=0.25 for predictive uncertainty, and λ3=1.0 for judge bias.
  • Sample selection: Selection initializes with 80 randomly sampled instances and subsequently chooses K=20 instances per iteration from 100 candidates.

D Additional Experiment Results

Additional experiments show that JUDGESTEALER transfers supervision across protocols effectively, remains competitive with protocol-specific extraction, and incurs measurable computational overhead. Cross-protocol agreement is stronger among more capable judges, while the framework is also evaluated against representative defenses.

  • Cross-Protocol Transformation: JUDGESTEALER remains competitive with protocol-specific extraction and can surpass it without querying the victim under pairwise or listwise protocols.On GPT4All, pairwise accuracy reaches 0.783 versus 0.753 for pairwise-only, while listwise performance closely approaches or slightly surpasses listwise-only settings.
  • Cross-Protocol Agreement: Higher-capability judges exhibit stronger cross-protocol agreement, increasing opportunities to reuse supervision for query-efficient extraction.Less capable Qwen3 judges show relatively low agreement, whereas stronger agreement among capable judges supports cross-protocol exploitation.
  • Runtime Analysis: The complete extraction pipeline takes 65 min 34 s under the reported Alpaca, Qwen3-1.7B, and 600-query setting.Sample selection accounts for 23.28% of runtime, while pointwise, pairwise, and listwise training account for 7.76%, 13.68%, and 13.74%, respectively.
  • Robustness and Settings: Additional evaluations examine surrogate models across scales and adaptation strategies, alongside anomaly-detection and ownership-tracing defenses.These experiments are reported in Tables 8, 10, and 11.
Loading 2608.26982v1…