Technical Summary: Beyond Accuracy: Policy Invariance as a Reliability Test for LLM Safety Judges

1. Problem Statement

The deployment of Large Language Models (LLMs) as autonomous agents in safety-critical domains (e.g., finance, healthcare, code execution) necessitates robust safety evaluation. Current benchmarks (e.g., ASSEBench, R-Judge) rely on the "LLM-as-a-Judge" paradigm, where a separate LLM evaluates agent trajectories against written safety policies to produce a binary verdict (SAFE/UNSAFE). These verdicts are treated as ground-truth proxies for safety compliance.

However, existing evaluations primarily focus on accuracy (agreement with human labels) or surface-level prompt sensitivity (e.g., position bias, formatting). They fail to address a critical gap: Policy Invariance. A trustworthy safety judge must ensure that its verdict depends solely on the agent's behavior and the normative content of the policy, not on how the policy is phrased. If a judge changes its verdict based on synonymous rewrites, structural reordering, or the placement of exceptions—without any change in the underlying normative meaning—the resulting safety scores conflate the agent's actions with the evaluator's prompt engineering. This paper argues that without policy invariance, safety scores are unreliable ground truths.

2. Methodology: The Policy Invariance Framework

The authors operationalize policy invariance into three testable principles and design a stress-test protocol to evaluate four agent-class judges: GPT-5.4-mini, Claude-Haiku-4.5, DeepSeek-V3.2, and Gemini-3-Flash. The evaluation uses trajectories from ASSEBench and R-Judge.

2.1 Three Invariance Principles

1. Rubric-Semantics Invariance (Principle 1):

   • Goal: Verdicts should remain stable under certified-equivalent rewrites of the policy.
   • Method: Policies are transformed using three types of certified-equivalent rewrites (verified by human annotators on six deontic dimensions: force, scope, exception set, burden of proof, default rule, and implied threshold):
     • T1 (Syntax): Passive/active voice, clause reordering.
     • T2 (Lexicon): Synonym substitution within the same deontic family (e.g., "must not" $\to$ "is prohibited from").
     • T4 (Exception Placement): Moving exception clauses from inline to front-loaded sections.
   • Metric: Excess flip rate ($\Delta_{flip}$), calculated as the flip rate under rewrite minus the baseline nondeterminism (jitter) rate.

2. Rubric-Threshold Invariance (Principle 2):

   • Goal: Verdicts should change directionally and proportionally when the policy's normative threshold is intentionally shifted.
   • Method: Pairs of policies are created where one is Strict (e.g., "must not," "any violation") and the other is Lenient (e.g., "should avoid," "clear and significant violations").
   • Metric: Directional Ratio ($R_{dir}$). A reliable judge should flip predominantly from UNSAFE (strict) to SAFE (lenient), with near-zero reverse flips.

3. Ambiguity-Aware Calibration (Principle 3):

   • Goal: Instability should be concentrated on genuinely ambiguous cases, not clear-cut ones.
   • Method: Observed flips are decomposed into:
     • Explainable: Flips on ambiguous items (where human annotators disagree) or near-equivalent transforms.
     • Unreasonable: Flips on clear items (unanimous human labels) under certified-equivalent transforms.
   • Metric: Unreasonable Flip Rate ($U_{rate}$). Any flip on a clear item under a content-preserving rewrite is a measurement failure.

2.2 Metrics and Reporting

• Policy Invariance Score (PIS): A composite metric summarizing the three principles:
  $$PIS = \max(0, 1 - (w_1 \cdot \Delta_{cert}^{flip} + w_2 \cdot (1 - R_{dir}) + w_3 \cdot U_{rate}) \cdot S)$$
  Where weights are $w_1=0.4, w_2=0.3, w_3=0.3$ and $S=5$.
• Judge Card: A standardized reporting template that discloses the PIS and per-principle breakdowns alongside traditional accuracy metrics.

3. Key Results

The study reveals that current safety judges fail policy invariance in a specific and damaging way: they react to meaningful normative shifts and meaningless structural rewrites with comparable strength, unable to distinguish the two.

• Failure of Semantic Invariance:

  • Gemini-3-Flash exhibited the highest instability, with a pooled certified $\Delta_{flip}$ of 7.6% (rising to 26.6% when parse failures are imputed as flips).
  • DeepSeek-V3.2 showed a 9.1% flip rate specifically under T4 (Exception Placement), the worst offender across three of the four models.
  • Claude-Haiku-4.5 and GPT-5.4-mini also showed significant instability (3.6% and 1.1% respectively, though GPT's raw flip rates were high, its jitter was also high, reducing the excess flip rate).
  • Crucially, 18% to 43% of all observed flips occurred on unambiguous items under certified-equivalent rewrites. This indicates that a non-trivial portion of safety scores measures how the rubric was phrased rather than the agent's behavior.

• Success of Threshold Invariance:

  • All models demonstrated near-perfect directional sensitivity to strict-to-lenient shifts ($R_{dir} \approx 1.00$). Strict-to-lenient switches flipped 32% to 71% of verdicts in the expected direction.
  • Diagnosis: Judges do read the policy content, but they cannot distinguish between a semantic change (threshold shift) and a syntactic change (rewrite). They treat both as equally significant triggers for verdict changes.

• PIS Rankings:

  • GPT-5.4-mini: PIS = 0.70 (Moderate reliability).
  • Claude-Haiku-4.5: PIS = 0.47 (Fragile).
  • DeepSeek-V3.2: PIS = 0.28 (Unreliable).
  • Gemini-3-Flash: PIS = 0.03 to 0.41 (Unreliable to Fragile, depending on parse failure handling).
  • This represents an order-of-magnitude spread in reliability invisible to accuracy-only leaderboards.

4. Contributions

1. Conceptual Framework: Formalizes Policy Invariance as a minimum requirement for LLM safety judges, distinguishing between content-preserving rewrites and normative shifts.
2. Stress-Test Protocol: A reproducible protocol using certified-equivalent rewrites, threshold shifts, and ambiguity decomposition to audit judges.
3. Policy Invariance Score (PIS) & Judge Card: Tools to quantify and report judge reliability, exposing gaps that accuracy metrics miss.
4. Empirical Evidence: Demonstrates that existing safety scores conflate agent behavior with evaluator prompting, with up to 43% of verdict flips on clear cases being measurement failures.

5. Significance and Claims

The paper claims that the credibility of agent-safety evaluation depends not just on what the agent did, but on whether the judge reads the policy stably. The authors argue that:

• Current Benchmarks are Flawed: By treating judge verdicts as ground truth without checking for policy invariance, existing benchmarks may be ranking models based on prompt sensitivity rather than actual safety.
• Reliability is Multidimensional: A judge can be accurate on a fixed rubric but unreliable if its verdicts fluctuate based on cosmetic policy edits.
• Actionable Improvement: The proposed Judge Card allows benchmarks to audit their own evaluators. The authors release the protocol and code to enable the community to shift the default question from "How often is the judge right?" to "Is the judge right for the right reason?"

Limitations Acknowledged by the Authors:

• The study perturbs a single standardized base policy; results may not scale linearly to complex, multi-clause deployment rubrics.
• The evaluation focuses on small, cost-optimized models; frontier-scale evaluators may exhibit different fragility patterns.
• The PIS weights reflect the authors' prior on failure mode costs rather than downstream-validated calibration.
• The framework currently operates on whole-trajectory, English-language, binary verdicts.