Turning Bias into Bugs: Bandit-Guided Style Manipulation Attacks on LLM Judges

The known stylistic biases in LLM judges, such as a preference for verbosity or specific sentence structures, present an underexplored security vulnerability. In this work, we introduce BITE (BIas exploraTion and Exploitation), a black-box adversarial framework that learns semantics-preserving edits to mislead an LLM judge and artificially inflate the scores it assigns. We cast the selection of stylistic edits as a contextual bandit problem and use a LinUCB policy to adaptively choose edits that maximize the judge's score without access to model parameters or gradients. Empirically, we test BITE across a diverse range of LLM judges and tasks, including both pointwise and pairwise comparisons on chatbot leaderboards and AI-reviewer benchmarks. BITE achieves an attack success rate exceeding 65% and raises scores by 1–2 points on a 9-point scale, all while preserving semantic equivalence. We further assess the attack's stealthiness, showing that BITE evades standard style-control methods and several detection baselines. Our findings expose a fundamental weakness in the LLM-as-a-judge paradigm and motivate robust, attack-aware evaluation. Our code is available at https://github.com/xianglinyang/llm-as-a-judge-attack.

Large language models are increasingly used to judge AI outputs, but these judges can be influenced by superficial writing style rather than actual answer quality. This motivated us to study whether known stylistic biases, such as preferences for longer or more polished responses, could be exploited as a security vulnerability. We introduce BITE, a black-box framework that learns how to make meaning-preserving stylistic edits that artificially raise an LLM judge’s score. BITE treats the choice of edits as a learning problem, trying different edits and adapting based only on the scores returned by the judge. Across multiple LLM judges and tasks, including chatbot leaderboards and AI-reviewer benchmarks, BITE successfully increased scores while preserving the original meaning. In some cases, it raised scores by 1–2 points on a 9-point scale and achieved attack success rates above 65%. We also found that these edits can evade common style-control and detection methods. This research highlights the need for more robust, attack-aware evaluation methods that reward true quality rather than style.