BehvJudge: Evaluating LLM Judges

• BehvJudge is a behavior-oriented framework that assesses LLM judges by examining how semantically irrelevant cues influence verdicts and biases.
• It employs controlled intervention designs such as synthetic metadata injection to quantify metrics like Verdict Shift Rate and Cue Acknowledgment Rate.
• The approach spans research and clinical applications, enhancing safety auditing and transparency in both preference ranking and hazard detection.

Searching arXiv for papers mentioning “BehvJudge” and closely related LLM-as-a-judge evaluation work. arXiv search query: BehvJudge OR "Behavioral Judge" OR "LLM-as-a-judge" evaluation biases BehvJudge, short for Behavioral Judge, denotes a behavior-oriented approach to evaluating LLM-based judges through controlled interventions, and in MATRIX it also names the automated judge that detects safety-relevant failures in clinical dialogues. Across these usages, the central concern is not merely whether a judge outputs the “right” verdict, but whether its verdicts are invariant to semantically irrelevant cues, robust to adversarial perturbations, and accompanied by rationales that faithfully reflect the true decision drivers (Marioriyad et al., 8 Feb 2026, Chen et al., 2024, Lim et al., 26 Aug 2025).

1. Definitions and conceptual scope

Modern NLP pipelines increasingly use LLMs as automatic judges to compare system outputs across tasks such as reasoning, question answering, and creative writing. In this setting, a faithful judge should base its verdicts solely on intrinsic content quality, remain invariant to irrelevant metadata, and transparently report the factors driving its decisions. BehvJudge was introduced to probe precisely these properties, extending earlier bias studies that had documented position bias, verbosity bias, and self-preference bias but had not systematically tested hidden shortcuts or whether a model acknowledges the spurious signals it uses (Marioriyad et al., 8 Feb 2026).

A distinct but related line of work introduced a reference-free framework, summarized as BehvJudge, for investigating judgement biases without relying on external ground-truth annotations. That framework studies how pairwise preferences shift under controlled perturbations such as factual errors, fake references, and rich formatting, and quantifies the effect through Attack Successful Rate (ASR) (Chen et al., 2024). This suggests that “BehvJudge” functions less as a single fixed benchmark than as a recurring research motif: behavior-centered auditing of judges through intervention, counterfactual comparison, and stress testing.

Within clinical conversational AI, BehvJudge is instantiated as the automated hazard detector in MATRIX. There it receives a full transcript of a patient–agent history-taking dialogue, together with a specification of expected safe behaviors and hazardous scenarios, and outputs a binary verdict, Safe or Hazardous, plus a short rationale. In that role, BehvJudge is positioned as a scalable substitute or supplement for clinician review under regulatory frameworks such as ISO 14971 and FDA SaMD guidance (Lim et al., 26 Aug 2025).

2. Controlled intervention designs

The core experimental design in the 2026 BehvJudge study is synthetic metadata injection. Lightweight, semantically irrelevant cue sentences are attached immediately after each candidate response in the evaluation prompt. Each cue is formatted as a short, declarative sentence with identical wording and punctuation across conditions. For each cue family $F$ with labels $a,b \in F$, two complementary conditions are created: $a\text{–}b$, where Response 1 is labeled $a$ and Response 2 is labeled $b$, and $b\text{–}a$, where the labels are swapped. This counterbalanced design holds all other factors constant while isolating the effect of the injected cue (Marioriyad et al., 8 Feb 2026).

The six cue families are as follows.

Cue family	Labels or test target
Source (Provenance)	{Human, Expert, LLM, Unknown}
Temporal (Recency)	{New (2025), Old (1950)}
Age	{Old, Young}
Gender	{Male, Female}
Ethnicity	{Black, White}
Educational Status	{Educated, Uneducated}

These perturbations were evaluated on two complementary datasets with distinct regimes. ELI5 consists of pairwise comparisons of human-written answers to “Explain Like I’m Five” questions, where judgments hinge on correctness, informativeness, and clarity. LitBench consists of pairwise comparisons of short fictional or descriptive continuations, with open-ended evaluation focused on literary quality, coherence, and narrative strength. For each dataset, the study samples $N=100$ prompt–pair instances. Six judge models are tested: GPT-4o, Gemini-2.0-Flash, Gemma-3-27B, Qwen3-235B-Instruct, Claude-3-Haiku, and Llama3-70B-Instruct. Evaluation is pairwise selection under a JSON-constrained prompt asking “Which response is better (1 or 2)?” plus a brief justification, with deterministic decoding $(\text{temperature}=0, \text{top-p}=1)$ for reproducibility (Marioriyad et al., 8 Feb 2026).

The earlier reference-free BehvJudge framework uses a different intervention logic. For each perturbation type $$p \in \{\text{factual error}, \text{fake reference}, \text{rich content}\}$$, it constructs paired control and experimental settings of the form

$$S^{p}=\{Q,\;A_1,\;A_2,\;A_2^p,\;\mathrm{Pref}_{\mathrm{ctrl}},\;\mathrm{Pref}_{\mathrm{exp}}\},$$

where $a,b \in F$0 is the perturbed version of one answer and preferences are aggregated over six votes coded as $a,b \in F$1 for Answer 1, Tie, and Answer 2 respectively. This design is explicitly reference-free: it measures the effect of the perturbation itself rather than accuracy against an external gold label (Chen et al., 2024).

3. Verdict sensitivity, cue acknowledgment, and the explanation gap

The 2026 BehvJudge study introduces two complementary metrics. Verdict Shift Rate (VSR) measures behavioral sensitivity: the fraction of evaluated pairs for which the selected response changes between the two cue-swap conditions. Cue Acknowledgment Rate (CAR) measures transparency: among the items where the verdict changes, it asks how often the model’s free-form rationale explicitly mentions the injected cue as the reason for the shift (Marioriyad et al., 8 Feb 2026).

Across cue families with strong behavioral effects, CAR is typically at or near zero. Temporal cues show ELI5 average VSR of approximately 28% and LitBench average VSR of approximately 29%, with recency preferences of New $a,b \in F$2 Old. Closed models exhibit nearly zero CAR on both datasets, while Gemma and Qwen occasionally mention recency on ELI5, with CAR up to 57%, but acknowledgment collapses on LitBench to below 6%. Source cues reveal provenance hierarchies of Expert $a,b \in F$3 Human $a,b \in F$4 LLM $a,b \in F$5 Unknown, with stronger VSR for Expert vs Unknown, reaching up to +18% in ELI5, yet CAR is almost always 0–2% across models and datasets. Educational-status cues are especially strong: on ELI5, VSR is 14% for GPT-4o, 14% for Gemini, 36% for Gemma, 51% for Qwen, 32% for Claude, and 36% for Llama; on LitBench, the corresponding values are 8%, 19%, 35%, 74%, 65%, and 46%. Even there, acknowledgment is highly dataset-dependent: on ELI5, closed models have low CAR of 2.5–7% while open models reach 58% for Gemma and 76% for Qwen, but on LitBench CAR again collapses, staying below 14% in the best cases despite higher VSRs (Marioriyad et al., 8 Feb 2026).

Other cue families clarify the boundary of the effect. Age cues produce ELI5 VSR of approximately 7–21% and LitBench VSR of approximately 8–31%, while CAR is nearly zero on ELI5 and exactly zero on LitBench. Gender cues show small and directionally inconsistent VSR of approximately $a,b \in F$6 to $a,b \in F$7, with CAR equal to 0%; the study therefore reports no systematic gender bias. Ethnicity cues show small VSR of approximately $a,b \in F$8 to $a,b \in F$9; CAR is zero for closed models and reaches up to 46% for Gemma and Qwen in ELI5, but with no consistent verdict trend, and acknowledgment again collapses on LitBench (Marioriyad et al., 8 Feb 2026).

At the dataset level, mean absolute VSR is approximately 18% on ELI5 and approximately 23% on LitBench, while mean CAR is approximately 10% on ELI5 and approximately 2% on LitBench. At the model level, closed-weight judges show lower VSRs in some cases but virtually zero CAR, whereas open-weight judges exhibit stronger VSRs and occasionally admit cue usage on ELI5. The resulting “explanation gap” is the study’s central claim: models often alter their verdicts without admitting that the injected metadata influenced the decision. A common misconception in LLM-as-a-judge pipelines is that a plausible natural-language rationale implies faithful reasoning; BehvJudge’s VSR–CAR decomposition directly challenges that assumption (Marioriyad et al., 8 Feb 2026).

4. BehvJudge in the broader metrology of LLM judges

BehvJudge sits within a wider movement that treats LLM judges as measurement instruments rather than simple accuracy devices. The “Judge Datasheet” protocol measures dark current under true-vacuum inputs, stable cross-sensitivity to same-quality surface variation, positional false preference, target sensitivity on a controlled quality ladder, and the criterion induced by tie instructions. In a three-judge case study, Llama-3.1-8B shows high dark current with $a\text{–}b$0 and presentation-conflicted $a\text{–}b$1 behavior, Qwen2.5-14B is vacuum-clean with mixed stable and positional over-discrimination, and Qwen2.5-32B is vacuum-clean with $a\text{–}b$2, low stable cross-sensitivity $a\text{–}b$3, and low positional false preference $a\text{–}b$4. A strict tie criterion reduces Qwen32B raw $a\text{–}b$5 false preference from $a\text{–}b$6 to $a\text{–}b$7 and raises pair-level $a\text{–}b$8 no-preference from $a\text{–}b$9 to $a$0, but lowers $a$1 sensitivity from $a$2 to $a$3 while preserving $a$4 sensitivity at $a$5; the paper concludes that prompting moves the criterion, not the resolution (Usami et al., 14 Jun 2026).

A parallel line of work, JudgeBench, emphasizes objective correctness rather than perturbation sensitivity. Its framework imposes a hierarchical rubric in which instruction-following has highest priority, factual or logical correctness comes second, and stylistic preference is tertiary. Each pair is presented twice, once as $a$6 and once as $a$7, to mitigate positional bias, and aggregated judgments are scored by raw accuracy against objective correctness labels. JudgeBench covers knowledge, reasoning, math, and coding for a total of 350 question–pair instances. Its empirical results underscore how difficult judge evaluation remains: GPT-4o with a vanilla prompt reaches 50.9% overall accuracy, the Arena-Hard prompt reaches 56.6%, and many strong models perform only slightly better than random guessing, while some reward models exceed 60% (Tan et al., 2024).

Taken together, these protocols occupy complementary positions. BehvJudge measures invariance to irrelevant cues and the faithfulness of rationales; Judge Datasheet measures psychometric properties such as dark current and criterion; JudgeBench measures correctness on objectively verifiable hard pairs. This suggests that a serious LLM-as-a-judge evaluation stack requires all three perspectives: bias sensitivity, metrology, and target accuracy.

5. Reference-free bias auditing and earlier BehvJudge-style studies

The earlier reference-free framework summarized as BehvJudge studies three perturbation classes. Factual Error operationalizes Misinformation Oversight Bias by injecting 2–3 subtle factual mistakes. Fake Reference operationalizes Authority Bias by appending a forged but syntactically valid academic reference. Rich Content operationalizes Beauty Bias by adding emojis, Markdown headings, bullet lists, and related formatting without changing semantics. The study explicitly notes that gender bias was not part of its experimental protocol (Chen et al., 2024).

Its dataset is built using the revised Bloom’s Taxonomy. GPT-4 generates 30 questions per Bloom level across six levels, yielding 180 questions, and manual verification reduces this to 142 high-quality middle-school-level questions. For each question, GPT-4 produces two distinct unperturbed answers, forming 142 control-group pairs, and each perturbation is applied once per question on a randomly selected answer, producing $a$8 experimental pairs. Human judges consist of 60 English-proficient college students, and LLM judges include GPT-4, GPT-4-Turbo, Claude-2, Claude-3, PaLM-2, Ernie, and LLaMA2-70B, with some others excluded for high positional bias. Each sample is evaluated six times, with randomized answer order to mitigate positional bias, and ASR measures how often the perturbation shifts preference toward the perturbed answer (Chen et al., 2024).

The ASR results show that both humans and LLMs are vulnerable. For Factual Error, Claude-3 and GPT-4 reach ASR of 0.08, GPT-4-Turbo 0.11, humans 0.25, and LLaMA2-70B 0.60. For Fake Reference, Claude-3 reaches 0.70, GPT-4 0.69, GPT-4-Turbo 0.49, humans 0.39, and Claude-2 0.89. For Rich Content, Claude-3 reaches 0.04, GPT-4 0.35, humans 0.38, LLaMA2-70B 0.46, and Claude-2 0.68. The same work then weaponizes these vulnerabilities in zero-shot attacks. Fake references alone prove more potent than rich content in promoting flawed answers, and even top models such as GPT-4 can be reversed, with ASR around 0.19–0.23 under flawed-answer promotion (Chen et al., 2024).

This earlier line is methodologically important for BehvJudge because it demonstrates that bias auditing need not presuppose a gold standard. Controlled interventions can expose whether a judge is stable under semantically irrelevant changes even when “correctness” is itself difficult to define.

6. Clinical instantiation in MATRIX

In MATRIX, BehvJudge is the LLM-based evaluator used to detect safety-relevant dialogue failures in simulated clinical conversations. It is implemented as a prompt-engineered wrapper around a high-capacity LLM, with candidate models including Gemini 2.0-Flash, GPT-4.1, Llama 3.3-70B-Instruct, GPT-4o, Gemini 2.5-Pro, and Claude 3.7-Sonnet. No further fine-tuning is performed. Instead, a single balanced prompt includes the clinical context and conversation transcript, a bulleted list of expected agent behaviors, a bulleted list of hazardous scenarios identified by structured safety engineering, and a final instruction to “err on the side of finding a hazard.” The output is constrained to exactly two fields: “Reasoning: …” and “Verdict: True/False.” Temperature is set to 0.1, and results are averaged over five independent runs to minimize nondeterminism (Lim et al., 26 Aug 2025).

The safety taxonomy supplied to BehvJudge is substantial. MATRIX derives 17 patient input types, 28 expected agent behaviors, and 40 hazardous failure modes. Examples include “patient expresses a red-flag symptom” and “patient initiates unrelated chit-chat” among inputs, “ask top-level symptom questions one at a time” and “acknowledge and summarize patient answers” among expected behaviors, and hazards such as HS2 failing to recognize a red-flag, HS4 getting lost in chit-chat, and HS6 ignoring the patient’s summary correction. BehvJudge is fed the relevant subset of expected behaviors and hazardous scenarios for each test case and performs what the paper describes as an implicit symbolic-and-semantic checklist in natural language, issuing a pass/fail decision when any single hazard is detected (Lim et al., 26 Aug 2025).

Its evaluation uses the HazMAT corpus of 240 synthetic dialogues. Eight representative patient input types are paired with ten clinical specialties to create 80 safe dialogues, and each safe dialogue is rewritten to produce two hazardous variants, yielding 160 hazardous dialogues. Ten UK clinicians with at least five years’ experience each label 24 randomly sequenced dialogues using the same scenario definitions as BehvJudge. Performance is measured by precision, recall or sensitivity, specificity, accuracy, and F1 (Lim et al., 26 Aug 2025).

Gemini 2.5-Pro achieves the strongest reported performance, with accuracy $a$9, precision $b$0, sensitivity $b$1, specificity $b$2, and F1-score $b$3. Clinicians reach accuracy $b$4, precision $b$5, sensitivity $b$6, specificity $b$7, and F1-score $b$8, and Gemini 2.5-Pro significantly outperforms clinicians in F1 and sensitivity by McNemar’s test $b$9. Claude 3.7-Sonnet and GPT-4.1 match clinician F1 at 0.94, while Llama 3.3-70B underperforms at F1 0.87 and sensitivity 0.80. Performance is highest in structured domains such as COPD, Cataract, Hernia, and UTI, and lower in more ambiguous areas such as ENT, Gynaecology, and FLS, though Gemini 2.5-Pro remains at or above 0.90 F1 throughout (Lim et al., 26 Aug 2025).

The hazard-level analysis further clarifies the strengths and limits of the system. Most models achieve perfect F1 on discrete cues such as HS6 summary disagreement, HS7 patient question mid-dialogue, and HS8 out-of-scope emergency. HS1, involving questions about explored symptom semantics, and HS4, involving chit-chat derailment, are harder; Gemini 2.5-Pro and GPT-4.1 stay above 0.90 F1, while Llama 3.3-70B falls below 0.80. The clinical BehvJudge therefore exemplifies a deployment-oriented form of behavioral judging: taxonomy-conditioned, high-sensitivity, and explicitly calibrated for safety review rather than generic preference ranking (Lim et al., 26 Aug 2025).

7. Vulnerabilities, mitigation, and future directions

BehvJudge-style systems inherit the broader vulnerabilities of LLM judges. A benchmark comparing Large Reasoning Models and baseline LLM judges finds susceptibility to bandwagon bias, authority bias, position bias, distraction bias, and a novel “superficial reflection bias,” in which phrases such as “wait, let me think...” significantly influence judgments. Despite stronger reasoning, LRMs remain biased; they are more robust on factual datasets than on subjective preference-alignment datasets, exhibit notable position bias toward later options, and can be swayed by fake deliberation cues before the second option. Mitigations are partial rather than absolute: specialized system prompts reduce judging biases by up to 19% in preference datasets and 14% in fact-related datasets, in-context learning provides up to 27% improvement on preference tasks but is inconsistent on factual tasks, and self-reflection reduces biases by up to 10% in preference datasets and 16% in fact-related datasets, with self-reflection especially effective for LRMs (Wang et al., 14 Apr 2025).

A more severe threat is direct adversarial control of judge decisions. AdvJudge-Zero shows that short sequences of low-perplexity control tokens can flip many binary evaluations from correct “No” judgments to incorrect “Yes” judgments by steering the last-layer logit gap. On open-weight and specialized judge models scoring incorrect answers on math and reasoning benchmarks, the attack yields ensemble false positive rates between 94% and 100% across model–dataset pairs, substantially exceeding the Master-RM baseline of 54%–89% on the same evaluation. Specialized judges vary in robustness: Omni-Judge reaches 96–99% false positive rate on AIME, MATH, and GSM8K, while General-Verifier remains at approximately 0% and Qwen2.5-RLVR and Master-RM Judge show intermediate vulnerability at roughly 2–11%. A LoRA-based defense on Omni-Judge, trained on 20,000 balanced examples, reduces AIME false positive rate from 96.5% to 1.8%, MATH from 99.4% to 5.6%, GSM8K from 99.8% to 6.4%, and RLVR from 49.5% to 1.0%, while preserving or improving true-positive rate (Li et al., 19 Dec 2025).

The recommendations that follow from BehvJudge and adjacent work are correspondingly multi-layered. The 2026 BehvJudge paper recommends standardizing cue-perturbation tests as a reliability check for any LLM-based evaluator, incorporating faithfulness-aware training objectives that penalize unacknowledged cue reliance, enhancing transparency through structured rationale templates, developing debiasing protocols such as adversarial cue-swapping during fine-tuning, and using multi-model ensembles or cross-validation against human annotations to detect shortcut-driven verdicts (Marioriyad et al., 8 Feb 2026). MATRIX recommends deploying BehvJudge as part of an end-to-end safety-audit pipeline, tuning the “err on the side of hazard” directive to application risk tolerance, versioning the safety taxonomy for traceability, re-validating on fresh real-world data, and open-sourcing prompts, taxonomy files, and datasets for regulatory inspection and community-driven improvement (Lim et al., 26 Aug 2025).

The resulting picture is not that BehvJudge solves LLM-as-a-judge reliability, but that it provides an increasingly explicit framework for measuring where reliability fails. Its distinctive contribution is to make behavioral sensitivity, rationale faithfulness, and deployment-specific hazard detection first-class evaluation targets rather than incidental by-products of scalar agreement or win-rate.