Can You Trick the Grader? Adversarial Persuasion of LLM Judges (2025)

Abstract: As large language models (LLMs) take on growing roles as automated evaluators in practical settings, a critical question arises: Can individuals persuade an LLM judge to assign unfairly high scores? This study is the first to reveal that strategically embedded persuasive language can bias LLM judges when scoring mathematical reasoning tasks, where correctness should be independent of stylistic variation. Grounded in Aristotle’s rhetorical principles, we formalize seven persuasion techniques (Majority, Consistency, Flattery, Reciprocity, Pity, Authority, Identity) and embed them into otherwise identical responses. Across six math benchmarks, we find that persuasive language leads LLM judges to assign inflated scores to incorrect solutions, by up to 8% on average, with Consistency causing the most severe distortion. Notably, increasing model size does not substantially mitigate this vulnerability. Further analysis demonstrates that combining multiple persuasion techniques amplifies the bias, and pairwise evaluation is likewise susceptible. Moreover, the persuasive effect persists under counter-prompting strategies, highlighting a critical vulnerability in LLM-as-a-Judge pipelines and underscoring the need for robust defenses against persuasion-based attacks.

## introduction as large language models (llms) continue to advance in cognitive reasoning @xcite @xcite , their emerging role as automatic evaluators, often referred to as llm-as-a-judge, has attracted growing attention in both academic and practical domains @xcite . notably, llm judges are capable of interpreting and evaluating long-form, open-ended answers with a level of coherence and nuance that closely mirrors human judgment @xcite . building on these capabilities, llm judges show growing candidate solution llm judge question evaluation prompt 2.6 3.1 charisma works for 8 hours every day. ... how many minutes has she walked? your task is to evaluate the overall score of the given math solution based on its correctness. to solve this problem, we need to ... ## data configuration this study aims to assess whether persuasive techniques can mislead an automated llm grader in the context of single-instance grading of mathematical problem-solving. in this task, a math problem and a proposed solution are provided as input, and an llm-based judge assigns a score on a scale from 0 to 5. in this section, we present the configuration and statistical properties of the math dataset used in our experiments. ## experiments the objective of the main experiment is to examine whether the persuasive techniques categorized in section 3 can influence llm-based judges when embedded in the mathematical solutions of the dataset constructed in section 4. ## conclusion this study examines whether llms can be manipulated by persuasive language during evaluation tasks, a critical vulnerability for their deployment as judges. leveraging seven persuasion strategies inspired by aristotle, we show that llms often assign higher scores to flawed solutions when persuasive cues are present, even though the underlying content remains unchanged. our analysis reveals that (1) all judge models examined exhibit notable vulnerability to persuasion; (2) persuasion remains effective in pairwise comparison settings, where biased solutions overturn originally correct rankings; and (3) stacking multiple persuasive techniques amplifies the manipulation effect. these findings underscore the urgent need for more robust, manipulation-resistant evaluation frameworks if llm judges are to play a fair and reliable role in real-world applications.