A Coin Flip for Safety: LLM Judges Fail to Reliably Measure Adversarial Robustness

Automated ``LLM-as-a-Judge" frameworks have become the de facto standard for scalable evaluation across natural language processing. For instance, in safety evaluation, these judges are relied upon to evaluate harmfulness in order to benchmark the robustness of safety against adversarial attacks. However, we show that existing validation protocols fail to account for substantial distribution shifts inherent to red-teaming: diverse victim models exhibit distinct generation styles, attacks distort output patterns, and semantic ambiguity varies significantly across jailbreak scenarios. Through a comprehensive audit using 6642 human-verified labels, we reveal that the unpredictable interaction of these shifts often causes judge performance to degrade to near random chance. This stands in stark contrast to the high human agreement reported in prior work. Crucially, we find that many attacks inflate their success rates by exploiting judge insufficiencies rather than eliciting genuinely harmful content. To enable more reliable evaluation, we propose ReliableBench, a benchmark of behaviors that remain more consistently judgeable, and JudgeStressTest, a dataset designed to expose judge failures.

AI safety researchers usually rely on one AI to judge the harmfulness of another AI's responses under attack. We hand-labeled over 6,000 examples and found these AI judges are barely better than a coin flip in judging harmfulness in realistic attack settings. That means many recently reported "successful" jailbreaks are not real breakthroughs but artifacts of unreliable judges, with some attacks essentially gaming the judge rather than breaking the attacked model. We release two datasets to help the community measure safety more reliably going forward.