Technical Summary: Gaming the Answer Matcher

Problem Statement

Automated answer matching, which evaluates free-text responses against a reference answer using Large Language Models (LLMs), offers a scalable alternative to human evaluation. However, its reliability is threatened by the potential for "gaming" strategies—text manipulations designed to artificially inflate scores without improving factual correctness. Prior research indicates that LLMs can be swayed by superficial cues such as verbosity, chain-of-thought prompting, and punctuation. This paper investigates whether answer matching models are vulnerable to specific, inexpensive text manipulation tactics: (1) generating verbose responses, (2) embedding multiple answers (including conflicting ones) when uncertain, and (3) placing the correct answer early in the response while contradicting it later.

Methodology

The study employs a systematic experimental workflow involving "examinee" models generating responses and "matcher" models scoring them against ground truth.

Datasets and Generation:
The authors utilized subsets of MMLU-Pro and GPQA Diamond, categorized into qualitative and quantitative domains. To ensure the examinee models could not see the reference options during generation, questions referencing multiple-choice options (e.g., "Which of the following...") were filtered out. The final datasets included:

• MMLU-Pro Qualitative (1,405 questions) and Quantitative (1,962 questions).
• GPQA Diamond Qualitative (106 questions) and Quantitative (92 questions).

Examinee models (GPT-4.1 mini and Qwen2.5-7B-Instruct) generated responses under four conditions:

1. Baseline: Standard generation.
2. Verbose: Added length without content change.
3. Strategic: Included multiple plausible answers when uncertain.
4. Forward: Embedded the correct answer at the start and a contradictory answer at the end.

Matching and Scoring:
Four matcher models (GPT-4.1 mini, Qwen2.5-7B-IT, Qwen3-4B, and Gemma-2-2B-IT) evaluated the responses using two paradigms:

• Binary Judgment: Assigning a definitive "1" (correct) or "0" (incorrect).
• Continuous Judgment: Assigning a score between 0 and 1 to indicate partial correctness.

Metrics:

• Average Alignment: The mean score assigned to responses in each condition.
• Attack Success Rate (ASR): The proportion of instances where a manipulated response received a higher score (or a "correct" binary label) compared to its baseline counterpart.
• Cohen's d: A measure of effect size to determine if attack conditions caused significantly different judgments compared to baselines.

Key Results

The study's findings largely contradict the initial hypotheses that answer matching is easily manipulated.

1. Robustness Against Manipulation: The proposed attack strategies (verbosity, strategic ambiguity, and forward embedding) did not increase scores; in many cases, they significantly reduced them. The baseline prompts consistently outperformed attack prompts with statistical significance (p < 0.05, often p < 0.001).
2. Negative Cohen's d Values: Across most experiments, Cohen's d values were negative, indicating that attacked responses performed worse than baseline responses. The highest positive Cohen's d observed was 0.300, which the authors characterize as confirming the absence of significant attack success.
3. Binary vs. Continuous Scoring: Binary judgment proved more robust to attacks than continuous judgment. Attack Success Rates (ASR) were consistently higher under continuous scoring, suggesting that the flexibility of partial credit allows for more leniency, whereas binary judgment enforces stricter alignment.
4. Model-Specific Anomalies: While most matchers were robust, Gemma-2-2B-IT exhibited anomalous behavior, producing substantially inflated accuracy scores (occasionally reaching 1.0) on certain subsets, particularly when acting as a binary matcher on GPQA Diamond. This suggests that robustness may vary significantly by model family and size.
5. Comparison to LLM-as-a-Judge: Consistent with prior work, answer matchers functioned as stricter evaluators than traditional LLM-as-a-judge approaches, which tend to yield higher accuracies.

Key Contributions

• Systematic Investigation of Gaming: The paper provides empirical evidence that simple, low-cost text manipulations (verbosity, ambiguity, strategic ordering) fail to deceive answer matching models, challenging the assumption that these models are easily swayed by presentation over content.
• Evaluation of Judgment Paradigms: The study demonstrates that binary scoring is a more robust defense against gaming than continuous scoring, offering a more reliable metric for high-stakes evaluation.
• Model Sensitivity Analysis: The work highlights that while answer matching is generally robust, specific model architectures (e.g., Gemma-2-2B-IT) may exhibit different robustness profiles, indicating that model selection is critical for reliable evaluation.

Significance and Claims

The authors claim that answer matching is a viable and robust alternative to human evaluation and traditional LLM-as-a-judge methods, provided that reference answers are available. The findings suggest that:

• Answer matching is generally resistant to inexpensive text manipulation, making it a reliable tool for pre-deployment model validation.
• Binary judgment systems offer a stricter, more secure evaluation framework compared to continuous scoring.
• The method is particularly valuable for high-impact domains (e.g., medicine, law) where objective comparison against known truths is necessary, and where preference learning might fail to detect incorrect outputs.

The paper concludes modestly, noting that while current results are promising, further research is needed to test robustness against optimized, dynamic adversaries and to investigate whether model size influences robustness more than specific attack strategies.