Gaming the Answer Matcher: Examining the Impact of Text Manipulation on Automated Judgment

TL;DR

This study assesses the robustness of automated answer matching as a scalable evaluation method against inexpensive text-manipulation attacks. Using four matcher models and two examinee models across MMLU-Pro and GPQA Diamond datasets, it compares binary and continuous scoring under three manipulation strategies (verbosity, forward embedding, strategic multi-answer). The results show that these attacks rarely inflate scores; baseline prompts often outperform adversarial prompts, and binary judgments tend to be more robust than continuous scoring, though certain model-specific anomalies occur. The work supports answer matching as a viable pre-deployment validation tool when reference answers are available, and points to future work on stronger adversaries and defense mechanisms to further improve robustness across architectures and languages.

Abstract

Automated answer matching, which leverages LLMs to evaluate free-text responses by comparing them to a reference answer, shows substantial promise as a scalable and aligned alternative to human evaluation. However, its reliability requires robustness against strategic attacks such as guesswork or verbosity that may artificially inflate scores without improving actual correctness. In this work, we systematically investigate whether such tactics deceive answer matching models by prompting examinee models to: (1) generate verbose responses, (2) provide multiple answers when unconfident, and (3) embed conflicting answers with the correct answer near the start of their response. Our results show that these manipulations do not increase scores and often reduce them. Additionally, binary scoring (which requires a matcher to answer with a definitive "correct" or "incorrect") is more robust to attacks than continuous scoring (which requires a matcher to determine partial correctness). These findings show that answer matching is generally robust to inexpensive text manipulation and is a viable alternative to traditional LLM-as-a-judge or human evaluation when reference answers are available.

Figures (6)

• Figure 1: Experiment Workflow. This image gives a high level overview of our methodology that is expanded upon below
• Figure 2: Average alignment using binary scoring for the GPT-4.1-mini and Qwen-2.5-7B examinees on GPQA Diamond across each answer matcher model. The scores are split over the two data subsets (qualitative and quantitative) and aggregated over examinees.
• Figure 3: Average alignment using binary scoring for the GPT-4.1-mini and Qwen-2.5-7B examinees on MMLU-Pro across each answer matcher model. The scores are split over the two data subsets (qualitative and quantitative) and aggregated over examinees.
• Figure 4: Benchmark accuracies using GPT-4.1-mini and Qwen 2.5 7B as LLM-as-a-judge and answer matchers with binary and continuous scoring paradigms.
• Figure 5: Average alignment with binary scoring paradigm for the GPT-4.1 mini and Qwen2.5-7B examinees on GPQA Diamond across answer-matching models. Scores are split over the two data subsets: qualitative and quantitative.