Detecting Prompt Injection and Evaluation Manipulation in LLM-as-a-Judge

Develop methods to detect prompt injection and other evaluation manipulation attacks that bias the decisions of LLM-as-a-Judge systems.

Background

Adversaries can embed hidden instructions or adversarial patterns within candidate responses, steering judge models away from intended criteria. Such attacks undermine the integrity of assessment pipelines by covertly influencing scoring or selection.

The paper calls for dedicated detection approaches to identify and flag prompt injections and related manipulation tactics before they alter evaluation results.

References

The open research problems in this context are: Design methods for detecting prompt injection and evaluation manipulation attacks.

— Security in LLM-as-a-Judge: A Comprehensive SoK  (2603.29403 - Masoud et al., 31 Mar 2026) in Section 7.1, Vulnerability to Adversarial Prompt Manipulation (Challenges and Open Problems)

With 161 Score questions, we read the small effect of commands on Score as not detected rather than absent.

— JevAdvBench: A Benchmark and Black-Box Attacks for Reinforcement Learning for Calibrated Decisions Models  (2609.31142 - Hu et al., 25 Sep 2026) in Section 4.1, “RQ1: Which inputs move decisions?”; Appendix E, paragraph “Rankings differ by primitive”

Successful reference-blind construction remains untested in this example.

— Adversarial Cues in Decision Models Used as Judges: The Role of Request Presentation  (2610.11436 - Liu, 8 Oct 2026) in Appendix, Section “Fresh certified contract and generative comparator,” paragraph beginning “One inspected secondary example”