Latent Judges: Hidden Mechanisms in LLM Evaluation
- Latent Judges are hidden evaluator mechanisms in LLMs that derive judgments from internal signals and latent features, often overriding explicit prompts.
- They enable measurement of biases, calibration of outputs, and assessment of internal decision policies using methods like probe-based scoring and ensemble aggregation.
- Their application offers actionable insights into improving reliability by auditing and steering latent evaluator behavior in various evaluation settings.
Searching arXiv for papers on latent judges and LLM-as-a-judge reliability. Latent Judges are internal or partially hidden evaluator mechanisms underlying model-based judgment systems. In contemporary LLM-as-a-judge research, the term denotes several closely related ideas: internal decision boundaries that govern evaluator outputs even when prompts specify alternative criteria; latent evaluative signals encoded in probabilities, activations, or sparse circuits rather than in sampled verdict text; hidden judge-specific tendencies that emerge only after aggregation across tasks or systems; and latent nuisance factors such as severity, bias, or formatting effects that shape observed judgments without being directly visible in the final output. Across recent work, the common theme is that the observable judgment is often an incomplete readout of a deeper evaluator state or policy, so reliability requires analyzing not only verdicts but also latent structure, steerability, bias, consistency, and measurement validity (Girrbach et al., 29 Sep 2025, Alloula et al., 5 Jun 2026, Feldhus et al., 15 May 2026, Yang et al., 9 Jul 2026).
1. Conceptual scope and definitions
The contemporary literature uses “Latent Judges” in both narrow and broad senses. In the narrowest sense, "Reference-Free Rating of LLM Responses via Latent Information" defines Latent Judges as methods that derive scalar ratings from internal model signals rather than from sampled textual ratings, specifically “probability-weighted scores over integer ratings,” “verifier-style probabilities of yes,” and “linear probes trained on model activations at the rating position” (Girrbach et al., 29 Sep 2025). In a broader sense, several papers treat the judge as a hidden conditional mechanism whose outputs depend on internal priors, learned policies, or evaluator-specific latent variables rather than only on explicit prompts or rubrics (Alloula et al., 5 Jun 2026, Yang et al., 6 Feb 2026).
One major strand characterizes judges as latent because they contain internal decision boundaries that can override prompt-level definitions. "Safety is Contextual, LLM-Judges Are Not: Navigating the Rigid Priors of Evaluators" studies safety judgment as binary classification and argues that judges are governed by “relatively rigid internal safety priors,” effectively “a latent internal decision boundary learned during pretraining and post-training” (Alloula et al., 5 Jun 2026). In this view, a prompt may specify a safety definition and context , but the effective evaluator remains partly hidden because the model can continue to classify according to its prior notion of unsafe content when explicit instructions conflict with it.
A second strand treats judging behavior itself as latent policy. "FairJudge: An Adaptive, Debiased, and Consistent LLM-as-a-Judge" replaces a function-based view of judging with an explicitly conditional policy,
$\pi_{\text{judge}(y \mid x, c, m),$
where is the evaluation input, is the evaluation context, and is the evaluation mode (Yang et al., 6 Feb 2026). The paper does not introduce an explicit latent variable , but it frames the hidden object of interest as “judging behavior” rather than a static output function. This suggests a latent-judge interpretation in which observable verdicts are realizations of a learned internal evaluator policy.
A third strand uses latent-judge language for hidden measurement variation. "When the Judge Changes, So Does the Measurement: Auditing LLM-as-Judge Reliability" argues that evaluator identity is itself a hidden measurement variable: if candidate responses are fixed and only the evaluator is replaced, the reported score can change (Yang et al., 9 Jul 2026). Here the latent aspect lies not inside one model alone but in the underdetermined measurement function implemented by a particular judge, prompt, parser, and aggregation protocol.
A fourth strand is mechanistic. "Judge Circuits" presents a circuit-level account in which judgments are split into a “shared internal evaluator” and “format-specific terminal branches” (Feldhus et al., 15 May 2026). The paper defines the Latent Evaluator as
$\mathcal{C}_{\text{LE} := \mathcal{C}_{\text{rate} \cap \mathcal{C}_{\text{class},$
that is, the subgraph shared between matched rating and classification tasks. This is one of the clearest internal formulations of latent judging: an abstract judgment signal is computed before it is mapped into a requested output format.
2. Latent priors, steerability, and evaluator rigidity
A central question in the literature is whether explicit evaluation instructions actually control the judge. The strongest evidence for latent internal priors comes from safety evaluation. In "Safety is Contextual, LLM-Judges Are Not," judges evaluate prompts under a supplied safety definition and context 0, producing
1
The paper distinguishes susceptibility, meaning whether judges change predictions under added context or demonstrations, from steerability, meaning whether they change predictions when the safety definition itself is altered (Alloula et al., 5 Jun 2026).
The empirical pattern is asymmetrical. Demonstrations have little effect: across 13 judges, adding correct demonstrations moves average F1 only from 0.68 to 0.71 on MultilingualPrompts, from 0.57 to 0.59 on NovelPrompts, and decreases it from 0.69 to 0.65 on Sorry-BENCH; misleading demonstrations also barely change outcomes (Alloula et al., 5 Jun 2026). The paper interprets this as evidence that current judges are “mostly applying an already-learned classifier.”
Prompt-specific semantic context sometimes matters, but mainly when prior knowledge is weak. On NovelPrompts, adding correct context improves mean F1 by 0.06, described as about a 10% gain over no context, whereas MultilingualPrompts shows no consistent gain because the models often already know the local concepts (Alloula et al., 5 Jun 2026). The authors further report a significant negative correlation between prompt frequency and prediction flipping, using FineWeb/FineWeb2 Zipf frequency as a proxy for prior strength. This suggests that contextual adaptation emerges primarily where the latent prior is weak or absent.
The decisive result concerns policy shifts. Removing the safety definition entirely changes accuracy by only about 2 across datasets, implying that prompt-level policy text often contributes little when the benchmark aligns with the model’s internal notion of unsafe content (Alloula et al., 5 Jun 2026). But when the policy contradicts that notion, adaptation largely fails. On MultilingualPrompts, judges flip only about 5% of predictions on average, even though over 15% would need to change to follow the modified policy correctly, and aggregate accuracy relative to relabeled ground truth drops by as much as 0.15 (Alloula et al., 5 Jun 2026). The paper interprets this as evidence that the latent judge, not the prompt, remains in control.
The absurd-policy and A/B-reframing experiments refine this diagnosis. When the new policy is orthogonal to learned safety semantics, such as “ball sports are unsafe,” most judges can follow it nearly perfectly on the synthetic sports dataset, often above 95% accuracy (Alloula et al., 5 Jun 2026). When the same safety partition is restated as arbitrary class prediction 3, baseline performance under the original definition remains essentially unchanged, but steerability under modified definitions more than doubles. This suggests that the models can apply logical category definitions, yet the semantic construct of “safety” activates a sticky internal evaluator manifold.
3. Latent signals inside judge models
A separate line of work studies latent judges as internal scalar signals recoverable from model probabilities or activations. "Reference-Free Rating of LLM Responses via Latent Information" examines reference-free single-response evaluation and reports two systematic problems with ordinary prompted ratings: instability under sampling and poor calibration, especially compression near the top of the scale (Girrbach et al., 29 Sep 2025). On 5,000 prompt-response pairs from the Tülu Preference Mixture and 12 judge models, agreement of a sampled rating with the mode across 10 runs is often only around 70–80% for stronger models and 40–50% for weaker ones. Strict agreement with GPT-4 preferences is much lower than lenient agreement because discrete ratings frequently collapse into ties; for example, on the 1–5 scale, Llama 70B shows 50.1% strict versus 92.6% lenient agreement, and InternLM2.5 20B shows 16.9% strict versus 85.9% lenient agreement (Girrbach et al., 29 Sep 2025).
The paper proposes three latent judge variants. The first is the probability-weighted score, the expectation of the next-token rating distribution: 4
The second is a verifier-style score, the probability of "yes" under a binary acceptability prompt: 5
The third is a probe-based score on hidden activations: 6
where 7 is the activation at the rating position (Girrbach et al., 29 Sep 2025).
Across pairwise benchmarks, latent methods generally match or surpass standard prompting. Average pairwise accuracy reaches 0.82 for Selene weighted, 0.80 for Phi-4 weighted, and 0.80 for Llama 3.3 70B weighted, versus 0.78, 0.74, and 0.76 for corresponding 10-scale baselines (Girrbach et al., 29 Sep 2025). Probes are especially informative when output logits are miscalibrated: Qwen3 14B weighted performs poorly at 0.64 average pairwise accuracy, while its probe reaches 0.78, and Prometheus probe reaches 0.73 despite the weighted and verifier versions essentially failing under those prompts (Girrbach et al., 29 Sep 2025). On single-rating benchmarks, weighted scores are strongest for Pearson correlation, whereas verifier-style scores tend to saturate near 0 or 1 and underperform on linear correlation.
This work implies that the judge signal often exists in a richer internal form than the sampled textual rating reveals. A plausible implication is that some failures attributed to “weak judges” are partly readout failures: the latent evaluator may be more discriminative than the explicit response channel.
Mechanistic evidence for such latent signals appears in "Judge Circuits." The paper introduces Position-aware Edge Attribution Patching and reports that judgments across structured understanding and open-ended preference tasks share a sparse Latent Evaluator subgraph in mid-to-late MLPs (Feldhus et al., 15 May 2026). It defines expected rating value as
8
and uses causal circuit tracing to recover sparse judge circuits with high faithfulness; across 25 model-task combinations, 21/25 reach median faithfulness 9 at some $\pi_{\text{judge}(y \mid x, c, m),$0 edges (Feldhus et al., 15 May 2026). Zero-ablation of the Latent Evaluator collapses judgment while preserving world knowledge in architecturally modular models such as Qwen2.5-7B, Qwen2.5-14B, and Gemma-3-27B, but not Gemma-3-12B, which the paper classifies as entangled (Feldhus et al., 15 May 2026). The authors interpret this as evidence that judgment is implemented by a specialized evaluator module in some architectures.
The same paper also presents format-transfer injection, showing that latent judgment can transfer across formats when formatter geometry permits it. On Qwen2.5-7B, injecting latent evaluator activations from a pristine rating prompt into a corrupted classification prompt raises CoLA from 17.4% to 93.5% with a 100.0% flip rate, MNLI from 3.4% to 88.0% with a 99.1% flip rate, and RewardBench from 1.6% to 96.9% with a 100.0% flip rate (Feldhus et al., 15 May 2026). The authors conclude that benchmark-level format inconsistency is partly measuring formatter geometry rather than evaluation quality.
4. Latent judging ability versus explicit explanations
Several papers show that explicit rationales do not reliably expose the real basis of judgment. "The Judge Who Never Admits: Hidden Shortcuts in LLM-based Evaluation" studies six cue families—source, temporal, age, gender, ethnicity, and educational status—by attaching synthetic metadata to candidate responses while keeping the response text fixed (Marioriyad et al., 8 Feb 2026). The paper defines Verdict Shift Rate (VSR) as the change in first-response selection rate under cue swapping and Cue Acknowledgment Rate (CAR) as how often the rationale explicitly refers to the injected cue. Its central result is an “explanation gap”: judges often show high VSR with low CAR.
This pattern is strongest in LitBench, the open-ended creative-writing setting. Claude-3-Haiku on LitBench shows VSR 71 and CAR 0 for recency, and Qwen3-235B shows VSR 74 and CAR 13 for educational status; Claude shows VSR 65 and CAR 1.5 on the same cue (Marioriyad et al., 8 Feb 2026). The paper also reports a provenance hierarchy $\pi_{\text{judge}(y \mid x, c, m),$1, again with CAR typically at or near zero (Marioriyad et al., 8 Feb 2026). The interpretation is not that the model necessarily conceals the cue deliberately, but that natural-language rationale is often an unreliable readout of the actual decision process.
"Evaluating Judges as Evaluators: The JETTS Benchmark of LLM-as-Judges as Test-Time Scaling Evaluators" reveals a related gap between explicit critique and useful evaluation signal (Zhou et al., 21 Apr 2025). Judges can be competitive with outcome reward models in response reranking, but they are consistently worse than process reward models in step-level beam search, and their natural-language critiques do not improve refinement. The paper defines normalized helpfulness as
$\pi_{\text{judge}(y \mid x, c, m),$2
and reports that while SFR-Judge 70B and Skywork-Critic 70B achieve reranking helpfulness 0.171 and 0.177, respectively, the best process reward model reaches 0.195 in beam search, and all judges remain below 1.0 on the effective improvement ratio for critique-based refinement (Zhou et al., 21 Apr 2025). The authors’ qualitative analysis shows false positives and false negatives in critiques: judges praise wrong answers for clarity or criticize correct answers for superficial style reasons. This suggests that evaluation and explanation are separable abilities; a judge may contain useful latent preference information without producing optimization-useful critiques.
"Judging the Judges: Evaluating Alignment and Vulnerabilities in LLMs-as-Judges" also points to hidden evaluator policies. In a deliberately high-human-agreement TriviaQA setting, only the strongest judges approach reasonable alignment with humans, and even they remain about 8 points behind human-human Scott’s $\pi_{\text{judge}(y \mid x, c, m),$3 (Thakur et al., 2024). The paper introduces a simple latent-bias model with $\pi_{\text{judge}(y \mid x, c, m),$4, the probability of following the correct evaluation criterion, and $\pi_{\text{judge}(y \mid x, c, m),$5, the probability of defaulting to “correct” when not following the criterion, yielding
$\pi_{\text{judge}(y \mid x, c, m),$6
Most judges show strong leniency bias, with $\pi_{\text{judge}(y \mid x, c, m),$7 values such as 0.87 for Gemma-2B, 0.75 for Llama2-7B, 0.82 for Llama3.1-70B, and 0.90 for Llama3-70B (Thakur et al., 2024). The paper interprets this as a latent evaluation policy that often defaults to passing answers unless there is strong evidence to fail them.
5. Latent judge quality as hidden measurement structure
Another major theme is that a judge is not a neutral measuring device. "When the Judge Changes, So Does the Measurement: Auditing LLM-as-Judge Reliability" frames evaluator replacement as a measurement-validity problem (Yang et al., 9 Jul 2026). Across LLMBar, PandaLM, Arena, and Judge’s Verdict, the best judge differs by dataset, and no judge wins all datasets. The paper’s headline result is that only Qwen3 1.7B$\pi_{\text{judge}(y \mid x, c, m),$84B gives a robust adjacent gain after Holm correction, whereas MiniMax adjacent releases do not (Yang et al., 9 Jul 2026). This rejects a single stable latent “judge quality” axis along which upgrades monotonically improve evaluation.
The paper broadens reliability into four components: judgment validity, bias robustness, aggregation independence, and protocol auditability. Stronger judges reduce but do not remove position and verbosity bias: on LLMBar, Qwen3-1.7B has position-flip rate 0.320 and verbosity bias 0.547, while MiniMax-M2.7 still changes 14.7% of verdicts under A/B reversal and retains verbosity bias around 0.13 (Yang et al., 9 Jul 2026). Repeated-sample juries add little because judge errors are correlated. The paper models homogeneous-jury dependence with
$\pi_{\text{judge}(y \mid x, c, m),$9
and estimates 0 for Qwen3 homogeneous juries on LLMBar (Yang et al., 9 Jul 2026). Thus multiple samples from the same judge do not create independent latent evaluators.
"JuStRank: Benchmarking LLM Judges for System Ranking" shifts the focus from instance-level judgment to system-level ranking fidelity (Gera et al., 2024). A judge 1 maps instruction-response pairs to scores
2
which are then aggregated into system-level scores 3. Judge quality is measured by Kendall’s 4 between induced system ranking and a human-based gold ranking. The paper defines system-specific bias as
5
and a decisiveness factor 6 via Beta-CDF calibration of judge win-rates (Gera et al., 2024). It finds that system-ranking quality depends not just on per-instance correctness but on hidden system preferences, decisiveness, and realization effects. Qwen2.5-72B-Instruct with Likert and Win-Rate aggregation achieves 7, while TokenProbs realizations are much weaker (Gera et al., 2024). This supports the claim that judges possess latent system-level preferences invisible to instance-only benchmarks.
"RankJudge: A Multi-Turn LLM-as-a-Judge Synthetic Benchmark Generator" likewise treats judge quality as a hidden trait inferred from judge-item interactions. Each benchmark item is a tuple
8
and strict correctness requires jointly predicting the better conversation, flawed turn, and failure type (Tang et al., 20 May 2026). The benchmark ranks judges with a Bradley–Terry model
9
where 0 is judge strength and 1 is pair difficulty (Tang et al., 20 May 2026). This latent-skill/latent-difficulty framing is directly aligned with a latent-judge interpretation: ability is not observed directly but inferred from sparse judge-problem outcomes.
6. Aggregating latent judges and auditing ensembles
If individual judges are latent, biased, or partially informative, a natural question is how to combine them. "Calibrate, Don’t Curate: Label-Efficient Estimation from Noisy LLM Judges" addresses multi-judge pairwise evaluation with a labeled calibration split (Li, 10 May 2026). The central result is that when the target is calibrated probabilistic evaluation rather than point accuracy, retaining the full judge panel and calibrating it consistently beats selecting only the most accurate judges. On RewardBench2, all judges achieve NLL 0.006 versus 0.013 under top-5 selection, more than doubling NLL under pruning (Li, 10 May 2026).
The paper models each judge as a noisy channel and defines the latent posterior
2
where 3 is the true pairwise label and 4 is judge 5’s verdict (Li, 10 May 2026). Its default aggregator is a Bayesian one-coin model; the oracle counterpart is
6
The paper then applies beta calibration
7
and proves monotonicity of oracle-calibrated risk: 8 for 9 (Li, 10 May 2026). It also proves that below-chance judges can still help if their signal is learnable: 0 The practical implication is that latent judge signals should be kept when they are parseable, non-redundant, and calibratable, rather than discarded by standalone accuracy alone.
A more adversarial ensemble-setting result comes from "No-Knowledge Alarms for Misaligned LLMs-as-Judges" (Corrada-Emmanuel, 10 Sep 2025). This paper assumes no access to ground-truth labels and asks what can be deduced from disagreement alone. With 1 tasks and label set 2, the hidden answer-key counts satisfy
3
The method introduces latent count variables 4 and constructs a linear-programming feasibility problem over integer response counts. If no latent answer key exists under which all judges satisfy a required minimum labelwise grading ability threshold, a no-knowledge alarm triggers. The guarantee is one-sided but exact: the alarms can detect, “with no false positives,” that at least one judge in the ensemble violates the specified grading ability requirement (Corrada-Emmanuel, 10 Sep 2025). This is latent-judge auditing by impossibility rather than by estimation.
A related but more application-driven ensemble architecture appears in "Who judges the judges? Governance from metrics: a runtime framework for continuous LLM compliance monitoring" (Dussert, 23 May 2026). Here the latent aspect is operationalized as criterion-specialized evaluative roles. A governance profile maps criteria 5 to judges 6 via
7
and profile score is
8
The paper treats inter-judge variance
9
as a regulatory uncertainty signal rather than mere noise (Dussert, 23 May 2026). On a 49-case compliance corpus, no single small local judge dominates across all criteria, while a specialized panel reaches 72.6% global score versus 69.1% for the best single judge and 61.7% for mean aggregation (Dussert, 23 May 2026). This suggests that evaluator plurality can expose hidden criterion-specific competence profiles better than monolithic judging.
7. Latent judges beyond LLM evaluation
Although much of the recent literature concerns LLM evaluators, the latent-judge idea extends to human institutions. "Judges matter more than papers in post-publication research assessment" studies 239,521 ratings assigned by 12,649 judges to 193,128 papers on H1 Connect and uses multilevel models to decompose rating variance (Ward et al., 8 Jul 2026). In the full model, judge-level intercepts explain 11.5% of total variance and judge-specific slopes explain 49.5%, for 61% combined judge-related variance, whereas paper and journal effects explain only 7% (Ward et al., 8 Jul 2026). The interpretation is that observed ratings are governed more by latent evaluator severity and attribute weighting than by stable paper quality. This provides a direct analogue for LLM judging: assessment outcomes may be driven more by judge-specific latent structure than by the objects being evaluated.
"Early Career Citations Capture Judicial Idiosyncrasies and Predict Judgments" offers a different latent-judge construction in legal prediction (Mahari et al., 2024). It builds 30-dimensional nonnegative matrix factorization embeddings from early-career citation patterns of U.S. District Court judges and shows that these embeddings predict future civil judgments with accuracies exceeding 65% for high-confidence predictions on balanced out-of-sample test cases (Mahari et al., 2024). For 6–8% of judges, the latent representations are significant predictors across all judgments. This suggests that stable evaluator idiosyncrasies can be represented as low-dimensional latent objects extracted from professional behavior, not only from model activations or prompt responses.
8. Methodological implications and open questions
The literature converges on several methodological implications. First, benchmark agreement alone is insufficient. Static agreement can hide failures of steerability, evidence faithfulness, calibration, or measurement invariance. "Safety is Contextual, LLM-Judges Are Not" shows that accuracy can remain high under ordinary definitions even when judges ignore supplied policy text (Alloula et al., 5 Jun 2026). "When the Judge Changes, So Does the Measurement" shows that replacing one evaluator with another can change the score even with candidate responses fixed (Yang et al., 9 Jul 2026). "JudgeBench" shows that many judges near chance on objective correctness still appear plausible under weaker benchmarks (Tan et al., 2024).
Second, output format matters because the mapping from latent judgment to explicit response is fragile. "Judge Circuits" argues that format-induced inconsistency is partly a formatter problem rather than an evaluator problem (Feldhus et al., 15 May 2026). "Reference-Free Rating of LLM Responses via Latent Information" similarly shows that discrete Likert outputs are unstable and tie-prone, whereas probability-weighted and activation-based readouts are more discriminative (Girrbach et al., 29 Sep 2025). This suggests that future evaluation systems may increasingly separate latent scoring from verbalized explanation or categorical surface form.
Third, latent judge properties are multidimensional. The literature distinguishes at least: internal priors and rigidity (Alloula et al., 5 Jun 2026), policy conditioning and cross-mode consistency (Yang et al., 6 Feb 2026), hidden evaluator skill and difficulty (Tang et al., 20 May 2026), system-specific preferences and decisiveness (Gera et al., 2024), latent circuits and formatter geometry (Feldhus et al., 15 May 2026), and ensemble-level calibration or impossibility constraints (Li, 10 May 2026, Corrada-Emmanuel, 10 Sep 2025). A plausible implication is that “judge quality” is not a single scalar but a structured object with distinct axes for validity, steerability, robustness, calibration, faithfulness, and auditability.
Fourth, disagreement should not always be collapsed away. In some settings, disagreement reveals hidden evaluator heterogeneity or uncertainty rather than mere noise. This is explicit in governance-oriented multi-judge work (Dussert, 23 May 2026), in reliability auditing (Yang et al., 9 Jul 2026), and in no-knowledge alarms (Corrada-Emmanuel, 10 Sep 2025). For system-ranking and research-assessment settings, aggregate outcomes can be more sensitive to latent evaluator variation than to the evaluated objects themselves (Gera et al., 2024, Ward et al., 8 Jul 2026).
Important open questions remain. One concerns identifiability: many papers expose latent structure but cannot fully recover which latent component is “true evaluation” versus hidden bias. Another concerns controllability: the A/B masking result in safety judging suggests some internal priors can be bypassed by reframing, but robust methods for doing so are not yet established (Alloula et al., 5 Jun 2026). A third concerns faithfulness of explanations: critiques and rationales often fail to reveal causal basis, so explanation generation may need to be treated as a separate modeling problem (Marioriyad et al., 8 Feb 2026, Zhou et al., 21 Apr 2025). A fourth concerns architecture dependence: "Judge Circuits" shows that modularity is not universal even among open-weight models (Feldhus et al., 15 May 2026). Finally, there is a practical governance question: if evaluators are latent and context-dependent, reports should include bias probes, slice analyses, audit trails, and calibrated uncertainty rather than a single score (Yang et al., 9 Jul 2026).
In sum, Latent Judges are not one technique but a research perspective on evaluation: the observable verdict is often a lossy projection of hidden evaluator structure. Recent work shows that this hidden structure can reside in rigid policy priors, conditional judging policies, latent logits and activations, sparse causal circuits, system-level preference patterns, or ensemble disagreement geometry. The shared lesson is that reliable evaluation requires modeling the judge itself as an object of inference and audit, not merely as a source of labels (Girrbach et al., 29 Sep 2025, Alloula et al., 5 Jun 2026, Yang et al., 6 Feb 2026, Feldhus et al., 15 May 2026, Yang et al., 9 Jul 2026).