JudgeStealer: Extracting LLM Judging Capabilities across Evaluation Protocols
cs.CL
Submitted: 2026-08-27
Updated: 2026-08-27
Comments: 20 pages, 8 figures
Code: https://github.com/tatsu-lab/stanford_alpaca
License: http://creativecommons.org/licenses/by/4.0/
The gist: Large language model (LLM) judges are increasingly used across various evaluation scenarios, making their judgment capabilities valuable intellectual property.
Terminology
Abstract
Large language model (LLM) judges are increasingly used across various evaluation scenarios, making their judgment capabilities valuable intellectual property. However, black-box access exposes these capabilities to model extraction attacks. Existing extraction methods do not specifically target LLM judges and provide limited support for multiple evaluation protocols under restricted query budgets. In this study, we propose JUDGESTEALER, the first query-efficient model extraction framework for replicating judging capabilities across pointwise scoring, pairwise comparison, and listwise ranking protocols. JUDGESTEALER exploits the strong cross-protocol agreement to acquire pointwise scores and transform them into pairwise and listwise supervisions without additional victim queries. To capture informative judge patterns and improve query efficiency, JUDGESTEALER dynamically selects pointwise inputs based on semantic diversity, predictive uncertainty, and potential judge biases. It further applies score smoothing and multi-protocol review to preserve the ordinal structure of scores and mitigate catastrophic forgetting during surrogate adaptation. Extensive experiments on state-of-the-art LLM-as-a-judge and reward models show that JUDGESTEALER consistently outperforms existing extraction baselines, achieving up to 73.3%, 87.0%, and 71.6% accuracy for pointwise, pairwise, and listwise evaluation, respectively. JUDGESTEALER also remains effective across different sur- rogate model scales, adaptation strategies, and reasoning settings. Moreover, JUDGESTEALER demonstrates robustness against representative extraction defenses.
Sources
- Model Leeching: An Extraction Attack Targeting LLMs
- Stealing Part of a Production Language Model
- Killing One Bird with Two Stones: Model Extraction and Attribute Inference Attacks against BERT-based APIs
- Knowledge Distillation of Black-Box Large Language Models
- Stealing Neural Networks via Timing Side Channels
- The Llama 3 Herd of Models
- LoRA: Low-Rank Adaptation of Large Language Models
- Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations
- Thieves on Sesame Street! Model Extraction of BERT-based APIs
- LLMs-as-Judges: A Comprehensive Survey on LLM-based Evaluation Methods
- DOGe: Defensive Output Generation for LLM Protection Against Knowledge Distillation
- An Embarrassingly Simple Detector for Model Extraction Attacks in Large Language Model API Traffic
- DeepSeek-V4: Towards Highly Efficient Million-Token Context Intelligence
- Qwen3 Technical Report
Related papers
- Exploring Solution Divergence and Its Effect on Large Language Model Problem Solving
- Ishigaki-IDS-Bench: A Benchmark for Generating Information Delivery Specification from BIM Information Requirements
- Subliminal Steering: Stronger Encoding of Hidden Signals
- MedStruct-S: A Benchmark for Key Discovery, Key-Conditioned QA and Semi-Structured Extraction from OCR Clinical Reports
- The End of Transformers? On Challenging Attention and the Rise of Sub-Quadratic Architectures
- Untangling the Mechanisms of Misleading Context in Medical Question Answering