LLM-as-a-judge: when a model can grade another model

In 2023 a Berkeley group reported that GPT-4 agreed with human evaluators on more than 80% of comparisons. The comparison that made it land: that is roughly the rate at which humans agree with each other.

If a model can approximate human judgment at human-level consistency, the case for replacing annotation pipelines with API calls is settled, and the field treated it as settled almost immediately.

A 2026 study by RAND found that no judge is uniformly reliable across benchmarks, and that frontier models exceeded 50% error rates on challenging bias benchmarks.

Both numbers are real and they are not in conflict. The 80% holds under conditions that most production evaluation pipelines do not preserve, and the failure modes are now documented specifically enough to design around. The question is not whether model judging works. It is which of your evaluations are inside the conditions where it does.

The four documented biases

The literature has converged on a taxonomy, which is more useful than a general warning because each item has a different fix.

Position bias. Judges favour a position in the prompt rather than the content in it. This one is well characterised and the characterisation is unsettling: the direction of preference is highly volatile, varying between tasks within a single judge, so you cannot correct for it by knowing which way a model leans. It is also very weakly correlated with response length, ruling out the obvious confound.

The fix is cheap and non-negotiable: run every pairwise comparison in both orders and discard the pairs where the verdict flips. Those flips are not noise to be averaged away; they are the cases the judge cannot actually distinguish.

Verbosity bias. Longer answers score higher, independent of quality. This interacts badly with generation, since the systems being judged were themselves preference-trained toward completeness.

Self-preference bias. Judges score their own outputs, and outputs from their own model family, above others. The mechanism was traced to self-recognition: a model's ability to identify its own text contributes substantially to the effect, which means it is not a general leniency but a specific response to recognising itself. It is amplified in self-refinement loops, where a model generates, judges and revises, each pass reinforcing its preference for its own style.

Style over substance. Presentation cues distort scoring, and judges have been shown to be fooled by surface-level text manipulation. This matters most in safety evaluation, where refusal behaviour is frequently formatted differently from compliance, so the format itself becomes a systematic scoring artifact.

The correlation that undermines the whole arrangement

The biases above are individually fixable. There is a structural problem underneath them that no bias control addresses.

A judge is itself an imperfect system, so an evaluation stack built on judges rests on uncertain foundations, and the uncertainty is not independent. Judge and subject frequently share training data, architecture and failure modes. Where the subject is confidently wrong because of something in its training, the judge is liable to be confidently wrong in the same direction for the same reason.

That is the opposite of what you want from a measurement instrument. A useful check fails independently of the thing being checked. A judge that errs where the system errs supplies confirmation rather than verification, and it supplies it exactly on the cases that matter most, since easy cases are easy for both.

The empirical shadow of this is visible in the position-bias work: instances where many judges agree are generally easy to judge, while instances where they disagree are harder and more prone to bias. Judge agreement is highest where you least need it.

The picture is contested, and that matters

An article assembling only the negative findings would misrepresent the state of the field, so it is worth stating the counter-evidence at full strength.

A 2025 study reassessing extractive question-answering datasets found correlations up to 0.85 with human judgments, no evidence of self-preference bias when the same model both answered and judged, and no sibling-preference bias within a model family. It also found that prompt phrasing and configuration mattered little, with zero-shot context-free judging often performing best.

That is a direct contradiction of the self-preference literature, and the explanation is probably scope rather than error. Extractive question answering has short, largely verifiable answers. Self-preference has been demonstrated on open-ended generation, translation and mathematical reasoning, where "better" is a stylistic judgement and there is room for a model to prefer its own voice.

The reconciliation worth carrying: judge reliability is a property of the task, not of the judge. Asking whether LLM-as-a-judge is reliable is the wrong question. Asking whether it is reliable for scoring this specific kind of output is answerable, and the answers differ enormously.

Where it works and where it does not

Use a judge when the criterion is nuanced and the answer is not. Grounding against a provided context, instruction adherence, tone, and pairwise ranking are the established strong cases. Short-form and extractive answers score well.

Use conventional metrics when there is one ground truth. Exact match, or a task-specific check, is cheaper, deterministic and not subject to any of this. A judge on a task with a verifiable answer is an expensive way to introduce error.

Do not use a judge as the sole gate on anything consequential. The taxonomy above describes a screening instrument, and screening instruments route work to humans rather than replacing them.

Do not use a judge from the same family as the generator. This is the single easiest control and it is routinely skipped, usually because the same API key is already configured.

The five mistakes

Stated as mistakes because each has a specific correction.

Deploying without human calibration. A judge score that has never been compared against human labels on your data correlates with nothing you can name. Calibration is a few hundred labelled examples, once, and then periodically because the correlation does not hold as either model changes.

One rubric across multiple intents. A judge prompted for general chat quality applied to code review, medical summarisation and retrieval grounding is measuring chat-quality heuristics in all three. The criteria that predict human preference in conversation do not transfer, and this is the most common cause of a judge that scores confidently and means nothing.

Pairwise comparison in one order. Position bias inflates whichever side you happened to put first, and since the direction varies by task you cannot correct it after the fact. Alternate, and treat flips as unscoreable.

Judging with the generating model. Self-preference guarantees inflated scores, and the effect compounds in self-refinement loops.

Treating scores as comparable across rubric versions. A score is only meaningful relative to the rubric that produced it. Lock the rubric, and when you change it, resample the baseline rather than comparing across the change.

A calibration protocol that takes an afternoon

The advice to calibrate against human labels is universally given and rarely specified, which is why it rarely happens. Here is the whole procedure.

Sample 150 items from real traffic, not from a curated set. Stratify so roughly a third are cases you expect the system to handle well, a third borderline, and a third where you suspect problems. The middle third does the work.

Label them yourself, or have someone who knows the domain do it. Blind to the judge's score. This is the expensive step and it is a few hours once, not a standing cost.

Run the judge on the same 150. Both orders for any pairwise comparison.

Compute three numbers, not one. Overall agreement, which will look reassuring. Agreement on the borderline third, which is the number that matters and will be much lower. And the flip rate on order reversal, which tells you what proportion of comparisons the judge cannot actually make.

Then decide the routing threshold. Where the judge and your labels agree strongly, let it score autonomously. Where they diverge, route to a human. That threshold is the actual output of the exercise, and it converts the judge from a replacement for review into a triage mechanism, which is what the evidence supports it being.

Re-run quarterly, and after any model change on either side. The correlation is not stable, because both the judge and the system under test move.

Two findings usually emerge and both are useful. Overall agreement is high enough to be reassuring and comes almost entirely from the easy third. And the flip rate is higher than anyone expected, frequently in double digits, which quantifies how much of the scoring was arbitrary.

Fine-tuned judges, and their specific trap

Training a smaller model to judge a particular task is increasingly common and is cheaper at production volume.

The finding to know: fine-tuned judges beat frontier models on their in-domain test set and underperform them on generalisability, fairness and adaptability. The explanation offered is that a fine-tuned judge is effectively a task-specific classifier, which is exactly why it does well in-domain and exactly why it does not transfer.

That is a fine trade if you accept it deliberately. It becomes a problem when the task distribution shifts underneath a judge nobody re-validated, because the failure is silent: the judge continues producing confident scores about something it no longer measures.

Why panels are weaker than they look

Aggregating several judges is the standard response to single-judge unreliability, and it is worth being precise about what averaging can and cannot fix.

Averaging removes independent error. If three judges make mistakes for unrelated reasons, their mean is closer to truth than any of them. This is the whole basis of ensemble methods and it works.

Averaging does nothing about correlated error. If three judges share training data, they share the misconceptions in it. Their agreement then reflects a common cause rather than convergent evidence, and the mean is not closer to truth, it is merely more confident.

The uncomfortable arithmetic: a panel of models from the same family is close to the second case. They were trained on overlapping corpora, tuned against similar preference data, and share architectural biases. Whatever makes one of them wrong about a case is likely to make the others wrong about it too.

So the value of a panel is entirely in its diversity, and diversity has to be constructed rather than assumed. Different families, ideally different training data, ideally different scale. A panel of three models from one provider is one judge with error bars, not three judges.

There is a diagnostic. Take a set of items where you have human labels and the panel disagreed with them. If the panel members were wrong in the same direction, their errors are correlated and the panel is not buying what you think. If they were wrong in different directions, averaging is doing real work.

Almost nobody runs this, and it is the difference between a panel that improves reliability and one that manufactures agreement.

What is unresolved

Whether progress measured by judges is real. If judges favour outputs resembling their own training distribution, and successive models share that distribution, then reported improvements may partly reflect the judge's preferences rather than capability. The systematic review raises exactly this, that some reported gains may be artefacts of the dynamic rather than real. Nobody has cleanly separated the two.

How to meta-evaluate at frontier scale. Validating a judge requires human labels, and the reason judges are used is that human labelling does not scale. The circularity is real: the meta-evaluation gap is named in the literature and not closed.

Whether panels help or launder. Aggregating several judges reduces individual bias and does nothing about correlated bias, and correlation is likely when the panel shares training data. A panel of similar models may produce a more confident wrong answer rather than a more reliable one.

Judges as an attack surface. Security analyses now treat judge systems as targets, since a system that can be manipulated by surface features can be manipulated deliberately. Where a judge gates deployment, that is a control worth attacking.

The counter-argument

The alternative is usually nothing, not human evaluation. The realistic comparison is not judge against expert annotation; it is judge against no evaluation at all, because human labelling at production volume is not affordable. An imperfect instrument used knowingly beats an unused one.

80% agreement is good. It matches inter-human agreement, and holding an automated evaluator to a standard human evaluators do not meet is not a coherent position. Human annotators also have position effects, verbosity preferences and inconsistency.

The failure conditions are known and controllable. Alternate order, cross-family judge, locked rubric, periodic calibration. A pipeline doing all four is in substantially better shape than the pessimistic reading suggests, and none of the four is expensive.

And the contradictory evidence cuts both ways. The extractive QA study finding no self-preference is a reason to doubt the generality of the negative findings, not only a reason to scope them. Some of the bias literature may itself be scoped narrowly and reported broadly.

The short version

Foundational work found GPT-4 agreeing with human evaluators over 80% of the time, matching the rate humans agree with each other, and the field adopted model judging almost immediately. A 2026 RAND study found no judge uniformly reliable across benchmarks, with frontier models exceeding 50% error on hard bias benchmarks. Both are real: the 80% holds under conditions most production pipelines do not preserve.

Four biases are documented. Position bias, where judges favour a slot rather than its content, with a preference direction so volatile it varies by task within one judge, so the only fix is running both orders and discarding flips. Verbosity bias, favouring length. Self-preference bias, traced to a model's ability to recognise its own text, amplified in self-refinement loops. And style over substance, where presentation cues distort scoring and judges can be fooled by surface manipulation.

Underneath sits a structural problem no bias control addresses: judge and subject frequently share training data and failure modes, so the judge errs where the subject errs. A useful check fails independently of what it checks. This one supplies confirmation rather than verification, and it does so precisely on the hard cases, since judge agreement is highest where you least need it.

The picture is contested. A 2025 extractive QA study found correlations up to 0.85, no self-preference and no sibling-preference, which likely reflects scope: self-preference appears on open-ended generation where "better" is stylistic, not on short verifiable answers.

The reconciliation worth carrying is that judge reliability is a property of the task rather than of the judge. Whether LLM-as-a-judge is reliable is the wrong question. Whether it is reliable for scoring this specific kind of output is answerable, and the four controls that make it so are cheap: alternate the order, use a different model family from the generator, lock the rubric, and calibrate against human labels on your own data.

Common questions

What is LLM-as-a-judge? Using a language model to evaluate the outputs of another model, assigning scores or choosing between candidates. Introduced in 2023 as a scalable alternative to human annotation, after the finding that GPT-4 agreed with human evaluators on over 80% of comparisons, which is roughly the rate humans agree with each other.

How accurate is LLM-as-a-judge? It depends on the task, not the judge, which is the most useful thing to know about it. Foundational work found over 80% agreement with humans on multi-turn conversation. A 2025 study on extractive question answering found correlations up to 0.85. A 2026 RAND study found no judge uniformly reliable across benchmarks and frontier models exceeding 50% error on challenging bias benchmarks. Reliability is high for short verifiable answers and much lower where quality is a stylistic judgement.

What is self-preference bias? The tendency of a judge to score its own outputs, and those from its own model family, above others. The mechanism has been traced to self-recognition: a model's ability to identify its own text contributes substantially to the effect, so it is a specific response to recognising itself rather than general leniency. It is amplified in self-refinement pipelines where the same model generates, judges and revises.

What is position bias in LLM judges? Favouring a position in the prompt rather than the content occupying it. The troubling property is that the direction of preference is highly volatile, varying between tasks within a single judge, so you cannot correct for it by knowing which way a model leans. It is also weakly correlated with response length, ruling out the obvious confound. The fix is running every comparison in both orders and treating verdict flips as unscoreable.

Can I use the same model to generate and judge? Not for anything consequential. Self-preference bias guarantees inflated scores, and the effect compounds in self-refinement loops. Use a judge from a different model family than the generator, which is the single cheapest control available and is routinely skipped because the same API credentials are already configured.

Why does judge reliability not solve evaluation? Because judge and subject frequently share training data, architecture and failure modes, so the judge errs where the subject errs. A useful measurement instrument fails independently of the thing being measured; this one supplies confirmation rather than verification. It also does so on exactly the cases that matter, since instances where judges agree are generally the easy ones and disagreements cluster on the hard ones.

Should I fine-tune a judge for my task? It is cheaper at volume and carries a specific trap. Fine-tuned judges beat frontier models on their in-domain test set and underperform on generalisability, fairness and adaptability, because a fine-tuned judge is effectively a task-specific classifier. That is an acceptable trade taken deliberately, and a problem when the task distribution shifts under a judge nobody re-validated, since it keeps producing confident scores about something it no longer measures.

What are the main mistakes to avoid? Five. Deploying without calibrating against human labels on your own data, which leaves a score correlating with nothing you can name. Using one rubric across multiple intents, so chat-quality heuristics get applied to code review and retrieval grounding. Running pairwise comparison in a single order. Judging with the generating model. And treating scores as comparable across rubric versions rather than locking the rubric and resampling when it changes.