LLM as a judge: when the score deserves trust

Take two answers of matched quality and ask a model to evaluate both. Then repeat, telling it who wrote each one.

The score moves by 0.43 points, on a scale of seven. The content is the same. The label moved the verdict.

And the judge is useful anyway. Strong judges agree with human preference in over 80% of cases, which is the same level of agreement humans reach with each other.

This post is about the distance between those two sentences: where the score serves a decision, where it deceives, and what corrects it for real.

The number that opened that door is three years old. In "Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena", presented at NeurIPS 2023, Lianmin Zheng and twelve other authors measured the agreement between strong judges such as GPT-4 and human preference (arXiv 2306.05685, accessed 28 August 2026).

The result: over 80% agreement, both against controlled preference and against open voting. The base was 80 MT-Bench questions, 3 thousand expert votes and 30 thousand conversations with recorded human preference.

The sentence that made the method catch on is the comparison: this is the same level of agreement humans reach with each other. If two human annotators disagree that often, demanding more than that from the model is demanding what the task never offers.

Hence the adoption. Among those who evaluate, 53.3% use a judge, a number yesterday's post carried alongside the other three kinds of check. The judge exists to reach what contract and assertion cannot: whether the text answers the question, whether the tone serves, whether the argument holds.

Five biases appear by name in the literature: position, verbosity, style, self-preference and authorship label.

Two of them have recent, specific measurements.

Self-preference. In "Self-Preference Bias in LLM-as-a-Judge", Koki Wataoka, Tsubasa Takahashi and Ryokan Ri, from SB Intuitions, measured the phenomenon over 33 thousand Chatbot Arena dialogues, in pairwise comparison with position control (arXiv 2410.21819v2, June 2025). On a fairness metric running from −1 to 1, GPT-4 scored 0.520, the highest in the set. Its true positive rate was around 0.945, against 0.425 true negative. Vicuna-13b and Koala-13b also showed relevant bias; the rest landed near zero or negative.

Authorship label. In "Self- and Other-Labels Induce Bidirectional Bias in LLM Judges", Songeun Chae, Min Kim, Donghoon Jung, Seojin Choi and Seohyon Jung put ten models, five commercial and five open, into the double role of generator and judge (arXiv 2608.18091, 2026).

The label's average effect was +0.43 on a seven-point scale, with a 95% confidence interval between +0.39 and +0.47 and p below 0.001. By dimension evaluated, it ranged from +0.29 to +0.57. Six of the ten judges showed the symmetric pattern, with their own label inflating and someone else's deflating, and three showed a one-sided version.

The authors' conclusion is the sentence that sums the section up: with quality matched, the label, not the content, moves the evaluation.

The natural reaction to all of that is swapping the free-form score for a rubric with objective criteria. If the judge answers "yes or no" on verifiable items, taste leaves the equation.

It does not leave.

In "Self-Preference Bias in Rubric-Based Evaluation of Large Language Models", Pombal, Rei and Martins ran the first study of the bias in that format, using IFEval, a benchmark whose criteria a program can verify (arXiv 2604.06996, 2026).

The result dismantles the obvious solution. Among the criteria the generator failed, the judge is up to 50% more prone to mark them as met by mistake when the output is its own.

What that means deserves a second of attention. The criterion was checkable by code. The right answer existed and was binary. And the judge still approved its own failure more often than it would approve someone else's.

The authors point out where that hurts most: in recursive improvement scenarios, when a model gets used to evaluate and guide the development of another from the same family.

<!-- [UNIQUE INSIGHT] -->

Here is the part that changes what you do about it.

The intuitive reading of self-preference is that the model recognizes itself and favors itself. If that were it, instructing impartiality would help, since asking it to ignore authorship would be enough.

The authors of the SB Intuitions study tested another hypothesis and it explains the data better. Models assign higher scores to texts of lower perplexity than human evaluators would assign, regardless of whether the output is self-generated.

And the text a model generates has, by construction, low perplexity for itself.

That explains the bias without requiring self-recognition. The judge has no idea that text is its own. It recognizes a pattern that comes easy to predict, and confuses ease with quality.

The practical consequence is direct: asking for impartiality does nothing, because no "self" gets consulted for ignoring. It is the same pattern that appeared in the lock layer, when I compared a classifier against structural control. Whatever depends on the model cooperating is no guarantee.

The list of biases circulating in almost every piece on the subject starts with position and verbosity. A recent systematic evaluation suggests the order runs the other way.

In "Judging the Judges: A Systematic Evaluation of Bias Mitigation Strategies in LLM-as-a-Judge Pipelines", Sadman Kabir Soumik tested nine mitigation strategies, across five judge models, three benchmarks and four kinds of bias (arXiv 2604.23178, 2026).

Style bias is the one almost nobody mentions, and it was the largest. Translated into practice: the same content formatted with headings, lists and bold tends to receive a better score than in running text. If you compare two versions of a system and one of them started formatting its output better, part of the gain the judge measured can be formatting.

And position bias, the most cited of all, came out near zero in that set.

The same systematic evaluation measured the gain from the correction strategies. The ones that survived the statistical correction landed between +4.5 and +11.5 percentage points of agreement, depending on the model and the strategy.

The best configuration tested reached 71.0% agreement, with a kappa of 0.549, at around US$0.001 per evaluation, around fifteen times cheaper than the best setup with a frontier model.

Note the number: 71.0% was the ceiling in that set, against the over 80% of MT-Bench. A different benchmark and task produce different levels, and that variation is the reason for calibrating against your own data instead of importing someone else's number.

The first row has the best return. Hiding authorship is free, and the label effect data shows it matters.

The last is the most uncomfortable, because it often means hiring a second vendor for evaluation alone. If avoiding it is impossible, the minimum is declaring the dependency in the report: saying the judge belongs to the same family as the evaluated model changes how the number should be read.

And there is calibration, which is current practice reported by people who operate these gates: compare the judge's score against human labels using Cohen's kappa, adjust the prompt until the correlation rises, and retest from time to time. I treat it as practice, and not as a measured result.

How to audit your judge in an afternoon

You need neither accept nor reject the method on faith. Measuring your judge's bias with a small test works.

Assemble pairs of matched quality. Take twenty cases where a person judged two outputs equivalent. The matching is what makes the rest interpretable: any score difference that appears came from somewhere other than the content.

Run four conditions. No label and order A-B. No label and order B-A. With the true label. With the labels swapped.

What each comparison reveals:

The third row is what closes the diagnosis. If the score follows the label even when the label is wrong, the judge is reacting to the label and not to the text.

A test like that costs eighty evaluations and one afternoon. It is little against discovering later that six months of version comparison measured formatting.

What to do with the result depends on the size. A small, consistent difference becomes a fixed correction in the process: hide the label, alternate the order. A large difference on one specific dimension shows that dimension has to leave the judge's rubric and become a deterministic check, where possible. And a difference that flips sign between models is the clearest sign that the judge needs replacing.

And connecting that to the verification layer pays off: the model never finds its own error, and evaluating its own output is a variation on the same problem. In both cases, whoever points has to come from outside.

Ask the judge for a choice between A and B, and not for a score from 0 to 10.

The reason is structural. An absolute score requires a stable anchor, meaning what 7 stands for and what separates 7 from 8, and that anchor holds across neither rounds nor model versions nor evaluation batches. A comparison requires ordering alone, which is an easier and more stable question.

The consequence for your gate: use the judge to detect regression between versions, and not to assert absolute quality. "The new version came out worse than the previous one in 12 of 30 cases" is a sentence that holds up. "Average quality is 7.4" does not.

That talks to yesterday's post about the tolerance band. A judge's score is the clearest example of a metric deserving a warning and a review, and not an automatic block.

One operational note: if you already instrumented the trace layer, attach the score to the span of the evaluated run. With the verdict alongside the trace, a score drop becomes investigable instead of mysterious, by the same reasoning as the span tree.

Four situations where the answer is something else.

A deterministic check answers the same question. Contract and assertion first, every time. The judge is the most expensive and the most fragile of the four kinds of check, and it should never answer what an if answers.

The criterion admits an objective check by code. Here IFEval's lesson weighs: even with a binary, checkable criterion, the judge approved its own failure more often. If code can check it, let code check it.

The cost per evaluation makes the frequency unworkable. A gate that runs once a week catches the problem a week later. Checking the arithmetic by the same reasoning as cost per usage pattern pays off before putting a judge on every commit.

The judge belongs to the same family as the evaluated model and replacing it is impossible. There the number exists, and it serves for tracking an internal trend. It serves neither for comparing against another vendor nor for publishing as evidence.

<!-- [PERSONAL EXPERIENCE] -->

Saying where this blog fits into that literature is worth doing, because the fit is bad.

The operation producing these texts uses a model to write and to judge its own writing. The passes for style review and humanization amount to self-evaluation, done by the same system that generated the text, with the familiarity bias described above operating from inside.

It is the worst case in all the literature cited in this post, and it is what runs here.

What reduces the damage is an accident of design, and explaining why pays off. The checks that decide something are deterministic: word count, Flesch, sentence-length deviation, worn phrase occurrence, duplicate links, entities in the schema. None of them asks the model whether it came out good. They are contract, assertion and proxy, the three kinds that depend on no judgment.

What stays exposed is everything that becomes no number. The decision to rewrite a sentence, to cut a section, to accept a value outside the band with a justification. That is judgment, and it is the judgment of whoever wrote it.

The real mitigation here has a name and it is the oldest one there is: Sergio reads before publishing. Human review remains the most used method among those who evaluate, at 59.8%, and in this case it is the only thing between the bias and the reader.

I have no elegant correction to offer. Swapping model family to review my own text is possible and I still do not do it. It goes on the record as what it is: a known gap, with the mechanism understood and the correction unimplemented.

What is LLM as a judge?

It is the use of a language model to evaluate another system's output, assigning a score, classifying or comparing alternatives against a rubric. It serves to judge dimensions a deterministic check cannot reach, such as whether a text answers the question or whether the tone is right. Among the teams that evaluate agents, 53.3% use that method.

Can one model be trusted to evaluate another?

For comparison between versions, yes, with cautions. Strong judges reach over 80% agreement with human preference, the same level humans reach with each other, per the work presented at NeurIPS 2023. The minimum cautions are hiding authorship, running both orders in a pairwise comparison and using a judge from a different family than the evaluated model. For a publishable absolute score, calibrate against human labels first.

Can a model evaluate its own output?

It can, and it is the scenario with the most documented bias. GPT-4 scored 0.520 on a self-preference metric running from −1 to 1. Worse: the bias persists even with objective rubrics a program can verify, where the judge is up to 50% more prone to mark as met a criterion it failed itself. If the evaluation will decide something, swap the judge.

How do I reduce the judge's bias?

Start with what is free: hide authorship, since the label alone moves the score by 0.43 points on a scale of seven. Then run both orders in pairwise comparisons and average them. Use a formatting-agnostic rubric, because in a systematic evaluation style bias was the largest, favoring markdown over plain text. Last, pick a judge from a family other than the evaluated model's.

Does the judge have to be a large model?

Not in every case, and data exists on that. In the systematic evaluation of nine bias correction strategies, the best configuration tested used a fast, cheap model with a combined strategy, reaching 71.0% agreement at around US$0.001 per evaluation, around fifteen times cheaper than the best setup with a frontier model. Investing in correcting bias and calibrating pays more than hiring the most expensive judge available.

Is it better to ask for a score or for a comparison?

A comparison. An absolute score depends on an anchor the model holds unstable across rounds, while comparing A with B requires ordering alone. In practice, use the judge to detect regression between versions and avoid treating the average of the scores as a measure of quality.

• A strong judge agrees with a human as much as a human agrees with a human. That is the realistic ceiling.
• The authorship label alone moves the score by +0.43 on a scale of 7, with quality matched.
• An objective rubric fails to fix it. On a criterion verifiable by code, the judge approves its own failure up to 50% more.
• The mechanism is familiarity, not vanity. That is why asking for impartiality corrects nothing.
• Style bias was the largest in a systematic evaluation, and position bias the smallest. Folklore has it inverted.
• Hide authorship, swap the order, use a judge from another family. And prefer comparing to scoring.

That closes the week on measuring. The next one covers what the agent carries while it works: context, memory and what is worth keeping. The map of the five layers continues in the pillar on harness engineering.