A Four-Axis Trustworthiness Benchmark for LLM-as-Judge in Principle-Based Regulation

Technical Summary: A Four-Axis Trustworthiness Benchmark for LLM-as-Judge in Principle-Based Regulation

Problem Statement
Current automated compliance systems in high-stakes domains (finance, healthcare, autonomous systems) predominantly rely on a "rule-based" paradigm, treating regulations as Horn clauses—binary predicates that are either satisfied or violated. However, modern regulatory frameworks, such as the UK Financial Conduct Authority's (FCA) Consumer Duty and COBS 4.5A.3R, utilize principle-based regulation. These standards (e.g., "fair, clear, and not misleading" or "deliver good outcomes") are evaluative and outcome-based, resisting reduction to binary logic. A promotion may contain all required disclaimers yet remain misleading overall.

While Large Language Models (LLMs) are increasingly deployed as "LLM-as-Judge" to evaluate these principles, they present significant trustworthiness gaps: they are often opaque, poorly calibrated by default, lack per-example justifications for regulatory interrogation, and are vulnerable to adversarial gaming. The paper argues that for secure deployment, an LLM-judge must be evaluated not just on aggregate accuracy, but across four specific axes: accuracy, paraphrase robustness, adversarial robustness, and calibration.

Methodology and Contributions
The paper introduces two primary contributions to operationalize this four-axis evaluation:

1. Principle-Bench: The first benchmark specifically designed for principle-based regulatory assessment.

   • Scope: It contains 168 scenarios mapped to two UK FCA principles: COBS 4.5A.3R ("fair, clear, and not misleading") and PRIN 2A/FG22–5 Consumer Duty ("deliver good outcomes").
   • Structure: The dataset is divided into four splits:
     • Original (100): Scenarios generated from author-prepared summaries of public FCA material.
     • Paraphrase (30): Rewrites with $\le$ 5 shared content tokens with any exemplar.
     • Adversarial (28): "Keyword-stuffed" inputs where short factual assertions are inserted verbatim into substantively non-compliant promotions to invert the verdict.
     • Boundary (10): Near-threshold cases.
   • Integrity: The assessment rubric was pre-registered (git-tagged) before any scenario was scored or labelled, ensuring a tamper-evident record.

2. Ceca (Calibrated Exemplar-Cluster Assessment): A transparency-by-design alternative to opaque LLM judges.

   • Mechanism: Ceca uses a pluggable sentence-transformer embedder to calculate raw cluster confidence based on the mean cosine similarity between the input and positive/negative exemplar clusters.
   • Calibration: Raw scores are mapped to a calibrated probability $s \in [0, 1]$ via Platt scaling on a development split.
   • Auditability: As a closed-form function of the exemplar set, Ceca emits exact counterfactual attributions ($\Delta_e = s - s_{\setminus e}$), showing exactly which exemplar drove the verdict and how the score would change if that exemplar were removed.
   • Cascade: A hybrid approach where Ceca acts as the primary; if its confidence falls within a tuned uncertainty band, it defers to an LLM-judge.

Experimental Setup
The author evaluated six methods across the four axes:

• Keyword Counting: A deterministic bag-of-clusters approach.
• Sentence-Transformers: Three embedders (MiniLM, BGE, Ollama-mxbai).
• LLM-Judge: An open-weight model (gpt-oss:120b) prompted with the principle text and exemplars.
• Cascade: Keyword primary with LLM-judge fallback.

Metrics included accuracy, F1, AUC, Expected Calibration Error (ECE), and Cohen's $\kappa$ for inter-judge agreement.

Key Results
The study finds that no single method dominates all four axes, revealing a critical trade-off between performance on benign inputs and robustness to adversarial manipulation.

• Benign Performance: On original (benign) inputs, the LLM-judge and the Cascade significantly outperform sentence-transformers and keyword counting. For example, on COBS, the LLM-judge achieved 0.96 accuracy versus 0.50 for embedders.
• The "Compliance Theatre" Failure: The LLM-judge is highly susceptible to adversarial gaming. On the Consumer Duty principle, when faced with keyword-stuffed inputs, the LLM-judge's accuracy collapsed from 0.74 to 0.27 (a 47-point drop). The model over-credited surface-level factual assertions inserted into non-compliant text, effectively passing the promotion.
• Adversarial Robustness Paradox: Counter-intuitively, the uncalibrated sentence-transformer embedders were the most robust on the Consumer Duty adversarial split (0.67 accuracy). Because they could not "read" the injected phrases as semantic evidence, they were blind to the manipulation that fooled the LLM.
• Model-Side Vulnerability: Inter-judge agreement between the gpt-oss:120b judge and a different-family judge (kimi-k2.6) collapsed to $\kappa=0.16$ on the Consumer Duty adversarial split, confirming the failure is inherent to the model architecture rather than an artifact of the corpus.
• Calibration Necessity: Raw LLM confidences were polarized (ECE 0.22–0.27). Post-hoc Platt scaling reduced the test ECE to 0.04–0.10, demonstrating that calibration is non-optional for regulatory deployment.
• Auditability: Ceca's counterfactual attribution was found to be faithful; removing the top-attributed exemplar shifted scores significantly (10$\times$ the effect of a random exemplar) and flipped verdicts on 4% of inputs, enabling regulators to contest specific evidence.

Significance and Claims
The paper argues that the "strongest" LLM-judge on benign benchmarks is often the most easily gamed, a trustworthiness failure invisible to headline accuracy metrics.

• Deployment Requirement: Any deployment-grade LLM-judge for principle-based regulation must report per-principle adversarial deception rates and post-hoc calibration alongside aggregate accuracy.
• Auditability: Verdicts must be paired with an auditable, contestable attribution layer (like Ceca) rather than opaque narrative rationales.
• Generalizability: The methodology (pre-registered rubrics, seed grounding, perturbation suites) is applicable to other principle-based domains, such as "informed consent" in healthcare or "reasonable safety" in autonomous vehicles.

The author concludes that secure and trustworthy LLM evaluation for governance cannot rely on aggregate accuracy alone; it must be grounded in multi-axis evidence that exposes vulnerabilities to adversarial gaming and lack of calibration.