LLM Judges And Debate — Deep Dive

The provided context includes only abstracts and metadata; no actual source code is present.

Imagine a cooking contest where one chef tastes the dishes of others and decides who wins. This is what happens when a computer program is used to judge the quality of another program's answers. It’s needed because comparing words exactly isn’t enough to measure whether an answer is good, and human judges can’t review everything.

But this judge can be too generous or too strict. A lenient judge raises scores too much—the false acceptance rate climbs to 7.9%. A blind judge, one that never sees the correct recipe, gets only 22.3% of those judgments right. Even when given the full source document, the judge agrees with the right answer only 54.3% of the time and wrongly accepts one in every three wrong answers. These errors happen most often in exact recall (50% false acceptance), multi‑step reasoning (46%), and threshold checks (33%).

The non‑obvious point is why a judge with all the facts still fails. It does not simply check facts—it makes its own subtle assumptions, and those assumptions can be wrong. For structured tasks like finding an exact number or following a chain of steps, the judge’s built‑in biases let plausible‑sounding but incorrect answers slip through. Without this subsystem, evaluations would either be far too generous or miss mistakes completely. A beginner would feel the failure when, say, a financial report gets a perfect score for a wrong number because the judge nodded along with the wrong detail.

In the subsystem of models judging models, the ordered evaluation mechanism begins with the construction of a provably correct reference using a Geometric Memory System (GMS), which establishes graph-verified ground truth for structured retrieval questions. The LLM judge is then presented with a question and a candidate answer under one of three conditions: a strict judge receives the ground truth directly, a blind judge receives no additional material, and a grounded judge receives the full source document but not the ground truth. The judge produces an acceptance or rejection decision, and this output is compared against the GMS-verified truth. On failure—when the judge’s decision disagrees with the geometric memory ground truth—the system records the discrepancy as a false acceptance or false rejection. This comparison relies on the exact identifiers from the source: the strict, blind, and grounded judges, with the GMS providing the definitive reference.

The invariant preserved by this design is that the graph-verified ground truth acts as the gold standard, guaranteeing correctness because it is constructed via a Geometric Memory System that yields provably accurate answers for structured financial documents. The system ensures that any deviation from this ground truth is measurable, and the invariant is explicitly that the GMS truth is treated as the ultimate arbiter. This invariant holds regardless of the judge’s access level—strict, blind, or grounded—and it provides a fixed baseline against which judge reliability is calibrated, preventing circular validation where the judge’s own outputs define correctness.

The key trade-off is scalability versus reliability: using an LLM-as-judge allows evaluation to scale far beyond human reviewers, but it introduces systematic false acceptance errors that are absent when relying on graph-based verification. The obvious alternative rejected is full human adjudication or exclusive use of the Geometric Memory System itself for evaluation—neither scales to large volumes of output. By adopting LLM judges, the design avoids the high cost of human labor and the computational overhead of running the GMS on every evaluation query. This rejection of a human-in-the-loop approach, however, incurs a specific cost: a strict judge with ground truth still disagrees in 5.9% of cases, a grounded judge achieves only 54.3% agreement with a 33.1% false acceptance rate, and a blind judge reaches only 22.3% agreement. The trade-off is thus between the saved cost of manual evaluation and the degraded accuracy from unreliable LLM judgments.

A concrete failure mode is the false acceptance of a wrong answer by a grounded judge when answering an exact recall question. The source reports that 50% of false acceptances occur in exact recall categories, meaning the judge, despite having the full source document in context, approves an answer that the GMS identifies as incorrect. An operator would see a log entry where the grounded judge returned an acceptance decision for a question whose GMS-verified truth is different, with the false acceptance rate for grounded judges measured at 33.1%. This signal is easily observable by cross-referencing the judge’s output against the geometric memory ground truth, revealing the mismatch and highlighting the unreliability of LLM-based evaluation for structured tasks.

Grounded Judge False Acceptance

• Trigger — The grounded judge is given the full source document but no ground truth, then asked to verify structured information extraction. Under these conditions, it approves one in three wrong answers (33.1% false acceptance rate).
• Guard — No guard is described in the source; the judge proceeds without any exception handler, retry, fallback, or validation against ground truth.
• Posture — Fail-soft. The evaluation continues to produce scores and pass or fail labels, but with a high rate of accepting incorrect answers, degrading the reliability of the entire judge output.
• Operator signal — The observed false acceptance rate of 33.1%, alongside an overall agreement of only 54.3%. No explicit error log is generated because the judge does not self-detect its own errors.
• Recovery — The source proposes using graph-based verification as an alternative, but within this subsystem there is no automatic recovery. The operator must manually review outputs, rerun with ground-truth checks, or switch to a different verification method.

Blind Judge Low Agreement

• Trigger — The judge is run without any ground truth or source document, relying solely on its internal knowledge. This condition yields only 22.3% agreement with correct answers.
• Guard — No guard is described in the source; the blind judge executes without any fallback or validation mechanism.
• Posture — Fail-soft. The judge returns a score for every query, but the scores are unreliable; the system does not abort or refuse to output.
• Operator signal — The metric agreement reading 22.3% (i.e., 77.7% of judgments disagree with ground truth). No explicit error log; the silence of the judge masks the failure.
• Recovery — No automatic recovery. The operator must supply ground truth or a source document and re-evaluate, or discard the judge results entirely.

Lenient Judge Score Inflation

• Trigger — A lenient judge (one that applies permissive criteria) evaluates outputs, inflating scores to 7.9% higher than they should be.
• Guard — No guard is described in the source; there is no calibration, threshold override, or exception handler for leniency.
• Posture — Fail-soft. The judge continues to assign inflated scores; the system does not detect or abort the inflation.
• Operator signal — An unexpectedly high aggregate score (7.9% inflation) when compared against a known baseline or against human ratings. No direct log line; the inflation is only observable through cross-method comparison.
• Recovery — The operator must manually adjust scoring thresholds, re-run with a stricter judge, or apply calibration using ground-truth examples.

False Acceptance in Exact Recall Tasks

• Trigger — The grounded judge is asked to verify exact recall extraction tasks. Half (50%) of the false acceptances occur in this category, meaning the judge incorrectly approves answers that require precise verbatim retrieval even when the source document is present.
• Guard — No guard is described in the source; the judge applies the same verification logic to exact recall as to other tasks, with no special handling for precision-sensitive fields.
• Posture — Fail-soft. The judge continues to output accept/reject, but the false acceptance rate in exact recall tasks is disproportionately high, degrading evaluation quality specifically where accuracy matters most.
• Operator signal — A breakdown by category shows false acceptance rate of 50% for exact recall tasks. Without per-category reporting, the operator may see only the aggregate 33.1% false acceptance and miss the concentration.
• Recovery — No automatic recovery. The operator must implement task-specific guardrails—for example, requiring an exact string match fallback or using a separate verification step for recall tasks.

False Acceptance in Multi-Hop Tasks

• Trigger — The grounded judge evaluates multi-hop reasoning tasks (requiring combining information from multiple parts of the source) and makes false acceptances in 46% of those cases.
• Guard — No guard is described in the source; the judge does not perform any intermediate verification of reasoning steps or cross-reference evidence.
• Posture — Fail-soft. The judge still outputs a pass/fail per answer, but with a high false acceptance rate in multi-hop tasks, undermining the validity of the evaluation.
• Operator signal — Per-category reporting shows a false acceptance rate of 46% for multi-hop tasks. The operator would see no error unless category-level metrics are logged.
• Recovery — No automatic recovery. The operator must either replace the LLM judge with a process reward model or graph-based verifier for multi-hop queries, or manually audit multi-hop cases.

Routing trace dataclass for Debate Agent Router.

@dataclass
class RoutingTrace:
    ts: int               # sufficiency step
    ek: str               # selected expert
    r_hat_k: str          # adjudicated risk level
    referenced_box_indices: list

Imagine a sports referee who calls fouls based on gut feeling rather than a rulebook—sometimes too lenient, sometimes too strict, and often missing the real infraction. That is the problem this subsystem solves: it provides clear scoring rules so an automated judge can reliably verify answers, especially in structured tasks where accuracy is critical. Without such rules, a lenient judge inflates scores to seven point nine percent, a blind judge (no context) reaches twenty-two point three percent false acceptance, and even a judge given the full source document achieves only fifty-four point three percent agreement—still approving one in three wrong answers. This subsystem introduces specific rubrics—categories like “exact recall” (perfect match), “multi-hop” (logical chains across facts), and “threshold” (pass/fail boundaries)—that force the judge to score against precise criteria rather than relying on vague impressions. Step by step, the referee now has a rulebook: first check if the answer exactly recalls the source (exact recall), then verify whether it correctly connects multiple steps (multi-hop), and finally apply a threshold to decide if the answer is close enough. Even with the full source document in hand, the judge still fails on these structured tasks because it does not automatically enforce these rubrics internally. The trickiest point is that the rubrics are not just a list—they expose a deeper limitation: the language model cannot reliably perform structured verification, so the rules act as a scaffold that highlights where the judge’s intuition breaks down. Without this subsystem, the judge would blindly accept one in three wrong answers, leading to untrustworthy results in high-stakes domains like financial regulation, where an incorrect exact recall or a missing reasoning step could have real consequences.

The subsystem implements a graph-verified evaluation framework grounded in the Geometric Memory System (GMS) to establish provably correct ground truth from financial documents. The ordered mechanism proceeds as follows: first, GMS constructs a verifiable truth base from the source documents; second, an LLM judge—configured as either strict, lenient, blind, or grounded—assesses answer correctness; third, the framework compares the judge’s verdict against the GMS-verified truth to detect disagreements. On failure—that is, when the LLM judge approves an answer that conflicts with the GMS truth—the system records a false acceptance and classifies the error into structured categories such as exact recall, multi-hop, or threshold. This explicit comparison replaces silent counting with a transparent audit trail.

The design preserves an invariant of graph-verified truth correctness: the GMS-derived ground truth is provably correct, serving as an absolute reference that breaks the circularity of relying on the same class of system being evaluated. No aggregate score is trusted until each claim-level decision has been reconciled with this verified baseline. This invariant ensures that any false acceptance or rejection is exposed rather than hidden inside a single success rate, maintaining a strict boundary between the judge’s output and the independently established truth.

The key trade-off is between evaluation simplicity and reliability. The obvious alternative—using an LLM as judge without graph verification—is explicitly rejected because it yields unacceptable error rates: a lenient judge inflates false acceptances to 7.9%, a blind judge reaches 22.3%, and even a grounded judge given the full source document achieves only 54.3% agreement with a 33.1% false acceptance rate, approving one in three wrong answers. The cost avoided by adopting the graph-verified framework is the silent approval of incorrect answers in structured tasks where accuracy matters most, such as exact recall, multi-hop, and threshold queries. Building the GMS imposes the upfront cost of constructing provably correct ground truth, but this investment eliminates the systematic unreliability of LLM-as-judge alone.

A concrete failure mode an operator would see: a strict LLM judge, despite having access to ground truth, disagrees with the GMS-verified truth in 5.9% of cases, with a false acceptance rate of 2.9%. For example, on an exact recall question, the judge may approve a wrong answer as correct, and the framework flags this as a false acceptance in the exact recall category. The operator receives a report showing the discrepancy between the judge’s verdict and the GMS truth, along with the error category and the percentage of such failures across the 258 structured retrieval questions. This signal unambiguously identifies where the judge fails, rather than hiding the error in a single aggregate score.

Blind Judge False Acceptance

• Trigger: The judge is deployed without any ground-truth reference document.
• Guard: No guard is present in the source; the study simply measures the resulting false-acceptance rate.
• Posture: Fail‑soft – the judge continues to produce scores and the run proceeds, but wrong answers are falsely approved at a 22.3% rate.
• Operator signal: The metric “22.3% false acceptance” for a blind judge; no alert is raised at runtime.
• Recovery: No automatic recovery exists. The source identifies graph‑based verification (using a Geometric Memory System, GMS) as a necessary alternative, but that external system is not part of the judge itself.

Lenient Judge False Acceptance

• Trigger: The judge applies lenient scoring criteria (e.g., accepting partially correct answers).
• Guard: No guard is present in the source; the lenient judge’s behavior is simply reported as inflating false acceptance to 7.9%.
• Posture: Fail‑soft – the judge continues scoring and the pipeline proceeds, but false acceptances degrade reliability.
• Operator signal: The metric “7.9% false acceptance” for a lenient judge; no explicit log line or error field.
• Recovery: No automatic recovery. The source implies a stricter rubric is needed but does not implement a fallback.

Strict Judge False Acceptance

• Trigger: Even a strict judge that has access to the full ground‑truth document still makes mistakes.
• Guard: No guard is present; the source reports a 2.9% false acceptance rate and 5.9% overall disagreement with GMS‑verified truth.
• Posture: Fail‑soft – the judge continues to output scores, but incorrect approvals still occur.
• Operator signal: The metric “2.9% false acceptance” or “5.9% disagreement”; false acceptances concentrate in exact‑recall, multi‑hop, and threshold categories.
• Recovery: No automatic recovery. The source recommends graph‑based verification as a replacement, not a guard within the judge.

JSON‑Generation Fragility

• Trigger: A sub‑2B‑parameter LLM is used as a judge and must produce a valid JSON evaluation output.
• Guard: The “rule‑based fallback” (part of the dual‑mode judge in the EFTP‑J framework) catches failures by switching to deterministic rules.
• Posture: Fail‑soft – when the LLM fails to generate valid JSON, the dual‑mode judge falls back to the rule‑based evaluator, so the pipeline continues with degraded but usable output.
• Operator signal: Absence of a valid JSON from the LLM component (i.e., a JSON parse failure); the EFTP‑J paper notes that this fragility prevents pure LLM judges from operating reliably on small models.
• Recovery: The rule‑based fallback executes immediately; there is no retry or backoff – the fallback value replaces the missing LLM score.

Dimension‑Level Failure Masking

• Trigger: A rubric with multiple dimensions is used, and high‑scoring dimensions hide failures in lower‑scoring dimensions during preference‑pair filtering.
• Guard: The “DimensionAwareFilter” (introduced in ADARUBRIC) provably prevents high‑scoring dimensions from masking dimension‑level failures.
• Posture: Fail‑soft without the guard – the system would produce an inflated score and continue; with the guard, the mask is removed and the failure is revealed. The original ADARUBRIC paper describes the filter as a necessary condition to avoid masking.
• Operator signal: Without the filter, silent masking produces an artificially high success metric; with the filter, the operator observes the corrected per‑dimension feedback.
• Recovery: The DimensionAwareFilter prunes preference pairs so that only those with genuine failures are used; no manual step is required.

Stability detection for judge consensus dynamics using Beta-Binomial mixture and Kolmogorov-Smirnov adaptive stopping.

def stability_detection(judges_votes, alpha=0.05):
    """
    Models judge consensus dynamics using a time-varying Beta-Binomial mixture
    and stops adaptively based on distributional similarity (Kolmogorov-Smirnov).
    """
    mixture = BetaBinomialMixture().fit(judges_votes)
    p_value = kolmogorov_smirnov(mixture.distributions)
    should_stop = p_value < alpha
    return should_stop, mixture

Imagine a teacher grading a test, but the teacher sometimes makes mistakes. This subsystem is for spotting how unfairly that teacher grades—whether they’re too easy, too blind, or too trusting of their own notes. The gist: a grading system that looks at how often the teacher gets it wrong, so you don’t trust a score that’s actually a lucky guess.

Now zoom in: the teacher has three common flaws. A lenient teacher gives a passing score to almost everything, inflating the grade by 7.9%. A blind teacher, who doesn’t know the right answer at all, still agrees with the test key 22.3% of the time—but that’s just chance. Even a grounded teacher who holds the full textbook but no answer key only matches the correct grade 54.3% of the time, and worse, it accepts one wrong answer out of every three (a 33.1% false acceptance rate). These errors pile up in specific question types: exact recall (50% wrong), multi-hop reasoning (46%), and threshold tasks (33%).

Deepest layer: the non‑obvious trap is why the grounded teacher still fails so badly. The textbook helps, but the teacher’s own bias interprets “exact recall” questions as easier than they are, so it lets wrong exact‑match answers slip through half the time. Without this subsystem, you’d trust that teacher’s grades blindly—and accept one in three wrong answers on the very tasks where accuracy matters most, like financial regulation or safety checks.

In the subsystem studied under “When the Judge is Wrong,” the ordered mechanism proceeds as follows: first, a provably correct ground truth is constructed from financial documents using the Geometric Memory System (GMS), establishing a graph-verified evaluation framework. Next, that GMS-verified truth is used to measure how accurately LLM judges assess answer correctness across 258 structured retrieval questions spanning five financial report types. On failure, the design reveals that even a strict LLM judge with access to ground truth disagrees with GMS-verified truth in 5.9% of cases, and the analysis then proceeds to examine the performance of a lenient judge, a blind judge, and a grounded judge against the same verified baseline.

The invariant or guarantee the design preserves is that the graph-verified ground truth produced by the GMS is provably correct, thereby breaking the circularity where ground truth is typically established by the same class of system being evaluated. This ensures that any deviation from that truth is a measurable reliability gap in the LLM judge, not an artifact of an unverified reference. The design explicitly names the Geometric Memory System as the source of this invariant, and every subsequent comparison—strict, lenient, blind, or grounded—is anchored to that single, verifiable point.

The key trade-off is that the graph-verified evaluation framework is used instead of relying on an LLM-as-judge without ground truth. This design rejects the obvious alternative of trusting a blind LLM judge, which achieves only 22.3% agreement and, in the grounded case, a false acceptance rate of 33.1%—approving one in three wrong answers even with the full source document in context. The cost that rejection avoids is the unacceptably high error rate in structured tasks where accuracy matters most in financial regulation, particularly in exact recall (50% false acceptances), multi-hop (46%), and threshold (33%) categories. By requiring graph verification, the subsystem trades the convenience of pure LLM evaluation for a measurable, audit-able guarantee.

A concrete failure mode is the grounded judge achieving only 54.3% agreement with GMS-verified truth, with a false acceptance rate of 33.1%. An operator would see that, despite being given the full source document as context, the grounded judge still approves wrong answers—specifically, one in three incorrect responses. The signal would be a low agreement rate against the GMS baseline, concentrated in the exact recall, multi-hop, and threshold categories, indicating that the LLM judge is systematically unreliable for structured information extraction even when the source material is provided.

Failure 1: Surface-Level Outcome Detection Failure

• Trigger — The outcome check relies on a surface signal, such as verifying that the agent clicked “Save,” instead of confirming that the intended state change actually occurred. The agent may have modified the wrong record, yet the check passes because it only observed the click.
• Guard — The outcome evidence reporting layer from the source applies a locked checklist after each completed run and assigns one of three labels: Evidence Pass, Evidence Fail, or Unknown. It also reports evidence-supported score bounds that quantify uncertainty arising from Unknown cases.
• Posture — fail-soft. The layer does not abort the run; it keeps uncertain cases explicitly visible and reports bounded scores rather than a single aggregate success rate, thereby degrading confidence transparently.
• Operator signal — The operator would observe Unknown labels for runs where the stored artifacts do not allow a definitive evidence verdict, and the reported score is a range (e.g., “success rate between X% and Y%”) instead of a single number.
• Recovery — No automatic recovery. The operator must manually inspect Unknown cases to determine true outcomes. The framework prevents silent counting or discarding of uncertain data.

Failure 2: Dimension-Level Failure Masking by High-Scoring Dimensions

• Trigger — A static evaluation rubric assigns high scores to some dimensions while a critical failure in another dimension goes unnoticed, because the overall score masks the dimension-level error. For example, a lenient judge might reward fluency while overlooking factual errors.
• Guard — The DimensionAwareFilter from ADARUBRIC. This filter is a provably necessary condition that prevents high-scoring dimensions from masking dimension-level failures. ADARUBRIC generates task-specific rubrics on the fly and scores trajectories step‑by‑step with confidence-weighted per-dimension feedback.
• Posture — fail-soft. The filter does not abort evaluation; it filters preference pairs before training, improving the reliability of the judge without stopping the run.
• Operator signal — The operator would observe a higher Pearson correlation with human judgment (0.79 vs. 0.63 for static baselines) and a Krippendorff’s alpha of 0.83, indicating deployment-grade reliability. When DimensionAwareFilter is used, DPO agents gain +6.8 to +8.5 percentage points task success across benchmarks.
• Recovery — ADARUBRIC generates new rubrics and applies DimensionAwareFilter to produce filtered preference pairs, which are then used to train DPO agents. The training recovers from the masked failures by learning from corrected preferences.

Failure 3: Hallucination in LLM Judge

• Trigger — The LLM judge produces a score or rationale that is not grounded in the provided context or source document, inventing facts or reasoning that are absent. The source identifies hallucination as a separable factuality risk.
• Guard — No explicit guard for hallucination is named in the source. The survey only lists hallucination as a risk without specifying a function or variable that catches it.
• Posture — fail-soft. The judge continues generating outputs, but the evaluation score becomes unreliable.
• Operator signal — The operator would observe high benchmark performance (e.g., “lenient judge inflates a score”) but low real-world reliability, or inconsistency between answer accuracy and reasoning faithfulness. The source notes that reasoning traces can improve answer accuracy without demonstrating process faithfulness.
• Recovery — No automatic recovery. The operator must manually verify claims made by the judge against the source document. The source suggests that process reward models (PRMs) could provide step-wise rewards, but they are not applied as a guard in this context.

Failure 4: Attribution Error in LLM Judge

• Trigger — The judge attributes a statement or piece of evidence to the wrong source, or fails to attribute at all, leading to a factuality risk even when the generated answer is correct.
• Guard — No explicit guard for attribution error is named in the source. The survey lists attribution error alongside hallucination as a distinct risk but provides no specific function or variable that catches it.
• Posture — fail-soft. The judge continues, but its output is unreliable with respect to source grounding.
• Operator signal — The operator would observe that the judge’s evaluation lacks proper citations or references, or that it agrees with an answer despite attributing it to an incorrect source. The source mentions “attribution” as a dimension of evidence-use reliability.
• Recovery — No automatic recovery. The operator must manually cross-check claims against the source document. The source does not describe a retry or fallback for this failure.

Failure 5: Sycophancy Bias in LLM Judge

• Trigger — The judge systematically agrees with the user’s stated preference, prior outputs, or known popular answers, rather than evaluating correctness independently.
• Guard — No explicit guard for sycophancy is named in the source. The survey lists sycophancy as one of the separable factuality risks, but does not provide a function or variable that detects or mitigates it.
• Posture — fail-soft. The judge continues producing biased scores, which may be inflated or deflated depending on the direction of the sycophancy.
• Operator signal — The operator would observe that the judge’s scores correlate strongly with user-provided hints or repeated answer patterns, and that the false acceptance rate or false rejection rate is asymmetrical. The source does not provide a specific metric for detection.
• Recovery — No automatic recovery. The operator must design countermeasures such as blind evaluation protocols, but the source does not describe any built‑in recovery mechanism.

Three outputs from the Judge Agent gamma: sufficiency label, adjudicated risk level, selected expert.

# and outputs a sufficiency label, an adjudicated risk level, and the selected expert
sufficiency_label, adjudicated_risk_level, selected_expert = None, None, None

Imagine a group of friends trying to decide on the best pizza topping by a simple show of hands—but each friend secretly dislikes pineapple for the same unfounded reason, so the vote lands on pepperoni even when pineapple is the right answer. This subsystem is designed to make a panel of automated judges reach a trustworthy decision, not just by counting votes, but by forcing them to debate and then watching for when their opinions stop shifting.

The process works like this: each judge first gives its answer, then the judges share their reasoning and update their own answers based on what others said, going back and forth. Meanwhile, a stability detector tracks how the group’s overall correct rate changes after each exchange. It uses a Beta-Binomial mixture to model that rate over time, and a Kolmogorov-Smirnov test to decide when the distribution of answers has become similar enough to stop—meaning the panel has genuinely converged. This prevents stopping too early, before real debate has happened.

The trickiest part is why simple majority voting fails here: even though the judges are separate, they often share the same blind spots—for example, all struggling with exact-recall or multi-hop questions because of overlapping training data. Majority voting just rubber-stamps that shared error. The stability detection catches this false consensus: if the group’s answer distribution barely changes between rounds, it might be stuck, not resolved. So the system keeps debating until the distribution is genuinely stable over time, not just momentarily similar. Without this subsystem, the panel would confidently accept the wrong answer—falsely approving one in three errors in critical financial tasks like exact recall, multi‑hop, and threshold checks, where accuracy matters most.

The subsystem under discussion is a panel of grounded judges, each given the full source document but no ground truth, tasked with verifying structured information extraction. The ordered mechanism begins with each judge independently evaluating a candidate answer against the provided source material, producing a verdict. Next, these individual verdicts are aggregated via simple majority voting to produce a final decision. On failure — that is, when the vote yields an incorrect verdict — the system outputs a false acceptance or rejection. Because each judge carries identical blind spots, the majority can confirm the wrong decision, making the aggregation step unreliable despite the appearance of consensus.

The design does not preserve any invariant of correct verification. The source empirically demonstrates that even a single grounded judge achieves only 54.3% agreement with the ground truth and exhibits a 33.1% false acceptance rate — approving one out of three wrong answers. Adding multiple such judges does not correct this because their errors are systematically correlated; simple majority voting cannot break the shared bias. The only guarantee the system offers is that the verdict will be the one favored by the majority, but that guarantee carries no assurance of factual accuracy. The source explicitly concludes that LLM-as-judge is unreliable for structured information extraction and that an alternative — graph-based verification — is necessary to achieve reliable outcomes.

The key trade-off is between reducing random error through aggregation and failing to remove systematic bias. The obvious alternative is to rely on a single grounded judge, but its false acceptance rate of 33.1% is unacceptable for structured tasks. The multi-judge panel rejects this alternative in favor of collecting multiple opinions, hoping that majority voting will dilute individual mistakes. However, this rejection incurs the cost of amplifying correlated errors: because each judge shares the same blind spots, the panel’s false acceptances remain concentrated in the exact recall, multi-hop, and threshold categories — precisely the tasks where accuracy matters most in financial regulation. The cost of rejecting the single-judge approach is that the panel inherits its systematic failures while adding computational overhead.

A concrete failure mode occurs in a multi-hop task: the panel of grounded judges unanimously approves an answer that contains an incorrect intermediate step. The operator would observe a trace showing that all judges voted “pass,” yet the answer is actually wrong. The signal is the false acceptance rate itself — empirically, the grounded judge approves 1 in 3 wrong answers, and for multi-hop tasks that rate reaches 46%. An operator reviewing the panel’s output would see consistent approval across judges for an erroneous result, with no mechanism to flag the correlated error. Without a graph-based verification layer to enforce structure-level correctness, the panel silently accepts the mistake, making the false acceptance rate the visible indicator of systemic failure.

The source describes a grounded judge that agrees with full source material only 54.3% of the time and falsely accepts one out of three wrong answers. Errors concentrate in exact recall, multi-hop, and threshold tasks. Aggregating multiple such judges via simple majority voting does not eliminate these flaws because each judge carries the same blind spots, and the vote can confirm the wrong decision. No exception handlers, retry loops, fallback values, or validation guards are disclosed for any of these failures. All failures are fail-soft: the evaluation continues, but the output is unreliable.

False Acceptance of Wrong Answers by an Individual Judge

• Trigger — The grounded judge evaluates a wrong answer but, due to its 33% false‑acceptance rate, marks it as correct. The source explicitly states: “That same judge falsely accepts one out of three wrong answers.”
• Guard — No guard is identified in the source. There is no validation layer, confidence threshold override, or cross‑check against ground truth.
• Posture — fail‑soft. The judge’s acceptance is treated as final; the system continues without aborting or refusing the output.
• Operator signal — The operator would observe a false‑acceptance rate of “one out of three wrong answers” (≈33%) when auditing judge decisions. No per‑run signal distinguishes false from true acceptance.
• Recovery — No recovery mechanism is described. The wrong answer propagates into the next stage (e.g., majority voting). Manual re‑evaluation of flagged cases would be required.

Low Agreement Rate Between Grounded Judges

• Trigger — Two judges using the same full source material disagree on 45.7% of cases. The source reports: “a single grounded judge with full source material only agrees fifty‑four point three percent of the time.” This implies that even when the same material is presented, the judge’s verdict is inconsistent.
• Guard — No guard is identified. No inter‑judge reconciliation, confidence‑based filtering, or repeated sampling is implemented.
• Posture — fail‑soft. The disagreement is not surfaced; whichever judge’s vote is selected (or whichever is first) continues.
• Operator signal — The operator would observe an agreement rate of “fifty‑four point three percent” between judges. A low Kappa statistic or reliability coefficient would be visible during calibration.
• Recovery — No automated recovery. Manual investigation of the disagreement source — such as prompt ambiguity or evidence misinterpretation — would be needed.

Systematic Errors on Structured, High‑Stakes Tasks

• Trigger — Errors are not distributed uniformly; they “concentrate in exact recall, multi‑hop, and threshold tasks.” These are the very tasks where “accuracy matters most in financial regulation.”
• Guard — No guard is identified. No task‑specific validation, domain‑adaptive threshold, or fallback to a rule‑based checker is present.
• Posture — fail‑soft. The evaluation proceeds, but the outputs in those critical task categories are disproportionately wrong.
• Operator signal — The operator would observe higher error rates on exact‑recall, multi‑hop, and threshold tasks compared to other tasks. Aggregate metrics would mask these concentrated failures.
• Recovery — No recovery is described. The errors remain invisible until a separate audit categorises outputs by task type. Manual re‑evaluation of those task clusters would be necessary.

Majority Voting Confirms Wrong Decisions Due to Common Blind Spots

• Trigger — Multiple judges share the same blind spots (e.g., all struggle with exact recall). The source warns: “Each judge carries the same blind spots. The vote can then confirm the wrong decision.”
• Guard — No guard is identified. No diversity‑injection mechanism, outlier detection, or weight‑adjustment exists to break the consensus.
• Posture — fail‑soft. The majority vote is accepted as the final decision despite being incorrect.
• Operator signal — The operator would observe a high‑confidence (unanimous or near‑unanimous) vote that, upon manual inspection, is wrong. No internal flag indicates the blind‑spot issue.
• Recovery — No recovery is described. The incorrect consensus is used for downstream decisions. Manual post‑hoc analysis of common failure patterns would be required to detect systematic bias.

The provided context does not contain source code for the debate stopping mechanism.

# The paper describes a stability detection mechanism using Beta-Binomial mixture and Kolmogorov-Smirnov test,
# but the actual code is not included in the context.

Imagine a group of friends debating where to eat dinner. A smart moderator—watching the conversation—can sense when everyone is starting to agree, so they cut the discussion short, saving time and keeping everyone happy. This thing is for deciding exactly when to stop a reasoning process that otherwise would keep going in circles, wasting effort.

In practice, the system works step by step: at every round of the debate, it uses something called a Process Reward Agent (PRA) to give a real‑time score to each argument being considered. Those scores let it rank and prune low‑quality lines of thinking, so only the strongest ones survive. At the same time, a Decoupled Multi‑Objective GRPO algorithm drives the overall learning: it separately optimises how accurately the system retrieves the right information and how effectively it uses that information to make decisions. Together, these pieces let the system continuously check whether the group’s opinions have statistically stabilised, and when they have, it stops immediately rather than wasting more compute.

The trickiest part is the non‑obvious trade‑off: stopping too early can push success rates down, but stopping too late burns tokens. The PRA’s search‑based decoding prunes candidate trajectories at every generation step, meaning the system evaluates consensus not just once but continually, dynamically balancing the cost of extra rounds against the risk of an incomplete answer. Without this subsystem, a fixed‑number‑of‑rounds debate would either run well past the point of agreement—consuming compute and time needlessly—or cut off before a real consensus forms, leaving the user with a wrong or incomplete result they can feel immediately.

In the Process Reward Agents (PRA) subsystem, the ordered mechanism begins with a frozen policy generating a candidate trajectory step. At every generation step, PRA provides domain-grounded, online, step-wise rewards via search-based decoding, which ranks and prunes candidate trajectories. If the reward for a given step is low, the entire trajectory is discarded and alternative paths are explored; this iterative pruning continues until either a high-reward trajectory is fully generated or all candidates are exhausted, at which point the system stops early instead of completing a fixed number of rounds.

The invariant the design preserves is the availability of domain-grounded, online, step-wise rewards at every step, ensuring that the reward signal is always grounded in the domain and computed in real time. This guarantee prevents wasting compute on trajectories that will later be scored as low-quality, and it maintains a strictly online evaluation that can inform immediate pruning decisions.

The key trade-off is rejecting the alternative of post hoc process reward models (PRMs) that score completed trajectories. PRMs prevent integration into dynamic inference, forcing the system to waste tokens on full trajectories before any quality signal is available. PRA avoids this cost by enabling online pruning, which can reduce token usage substantially—though this comes at the cost of requiring a carefully calibrated reward module that must be both accurate and fast enough to not bottleneck generation. The rejection of post‑hoc scoring avoids the overhead of processing many low‑value reasoning paths to completion, but it demands that the reward module itself be robust to domain shifts.

A concrete failure mode occurs when subtle errors propagate through reasoning traces because the reward module fails to detect a small mistake early. The operator would observe a drop in final accuracy—for example, on MedQA with Qwen3‑4B, accuracy would fall below the reported 81.9%—and might see that the system completes many full trajectories without early pruning, indicating that the step‑wise reward signals are not effectively filtering low‑quality steps.

Failure 1: Null-Value Integration in Stabilization Criterion

• Trigger – A null value (e.g., missing agent response or empty retrieval result) is fed into the statistical stabilization calculation (e.g., variance or entropy estimates) during the debate, causing the detection to fire falsely or fail to fire.
• Guard – The source does not show a guard for null-value integration in this subsystem. The outcome evidence reporting layer could later label the run as Unknown if the stored artifacts are insufficient, but it does not prevent the integration at runtime.
• Posture – Fail-soft — the system continues to output a possibly incorrect consensus, degrading answer quality while still completing the debate.
• Operator signal – The operator observes a null-value integration coded failure in the failure taxonomy dataset; at runtime, the outcome evidence reporting layer may report an Unknown label for the run.
• Recovery – No automatic recovery; manual inspection of the debate trajectory and re-run with a missing-value filter required.

Failure 2: Premature Commitment to Consensus

• Trigger – The statistical stabilization signal triggers before genuine convergence because the process reward agent or monitoring function incorrectly scores the current reasoning trace as stable (e.g., a dimension like response uniformity is met but deeper agreement is lacking).
• Guard – DimensionAwareFilter from ADARUBRIC — a provably necessary condition that prevents high-scoring dimensions from masking dimension-level failures. If a dimension associated with consensus is failing, this filter can reject the premature stop.
• Posture – Fail-soft — the debate ends early, producing a consensus that may be incorrect, but the system continues to output that consensus.
• Operator signal – The operator sees a dimension-level failure flagged by DimensionAwareFilter, or the outcome evidence reporting layer assigns Evidence Fail because the final answer is not grounded.
• Recovery – The system could fall back to continuing the debate for additional rounds if the process reward score remains below a threshold; the source does not specify an automatic fallback, so manual re-run with a higher stabilization threshold is required.

Failure 3: Repetitive Invalid Re-Invocations After Tool Error

• Trigger – A tool call fails during the debate (e.g., retrieval error). The model, instead of interpreting the feedback and recovering, falls into repetitive invalid re-invocations of the same failing tool.
• Guard – Fission-GRPO is a training-time framework that converts execution errors into on-policy corrective supervision; at inference time the source does not show a runtime guard, so the model loops without correction.
• Posture – Fail-soft — the model continues retrying, wasting tokens, until a retry limit is exhausted; then the run may become stuck and eventually time out (fail-hard) or output a partial result.
• Operator signal – The operator observes repetitive invalid re-invocations in the agent trajectory log, and the outcome evidence reporting layer may assign Unknown because the action path is incomplete.
• Recovery – No automatic recovery in the source; manual intervention to kill the process or inject a correct tool call.

Failure 4: Adversarial Injection Blindness in Consensus Signal

• Trigger – An adversarial input (e.g., a malicious agent in a multi-agent debate) injects a distorted signal that makes the statistical stabilization detection believe consensus has been reached when it has not.
• Guard – The source identifies adversarial injection blindness as a failure mode, but does not show a guard for this specific scenario. contamination controls and uncertainty and refusal behavior are mentioned for evaluation protocols, not as runtime guards.
• Posture – Fail-soft — the debate stops with a corrupted consensus, outputting an incorrect result without raising an alert.
• Operator signal – The operator observes adversarial injection blindness in the failure taxonomy report; at runtime, the outcome evidence reporting layer may give Evidence Pass falsely if the outcome check is also blind, or Evidence Fail if artifacts conflict.
• Recovery – No automatic recovery; manual adversarial robustness checks and re-run with anomaly detection required.

Failure 5: Surface-Level Outcome Detection Failure

• Trigger – The debate’s stopping decision is based on a surface-level check (e.g., verifying that all agents have spoken or a “Stop” button was clicked) rather than confirming the actual consensus was reached.
• Guard – outcome evidence reporting layer — it specifies which stored artifacts are required to verify the claimed outcome, applies a locked checklist, and assigns Evidence Pass, Evidence Fail, or Unknown.
• Posture – Fail-soft — the run is recorded as successful even if the outcome is not truly achieved, misleading operators and downstream metrics.
• Operator signal – The operator sees an Evidence Fail or Unknown label on the run, or evidence supported score bounds that quantify uncertainty.
• Recovery – The operator must manually examine the stored artifacts and re-run with the outcome evidence layer active. The layer makes uncertain cases explicitly visible rather than silently counting them.

Failure 6: Skill Reuse Masking Dimension-Level Failures

• Trigger – Reusing learned skills to reduce token usage improves overall efficiency but causes a failure in one dimension (e.g., tool combination effectiveness) that is masked by success in other dimensions (e.g., response length).
• Guard – DimensionAwareFilter — a provably necessary condition that filters preference pairs to prevent high-scoring dimensions from masking dimension-level failures. This guard would expose the hidden failure during evaluation.
• Posture – Fail-soft — the run continues and appears successful overall, but the masked dimension degrades result quality without immediate alert.
• Operator signal – The operator observes a dimension-level failure flagged by DimensionAwareFilter in the evaluation rubric output, or a drop in execution efficacy while tool retrieval accuracy remains high.
• Recovery – Manual adjustment of the reuse strategy (e.g., disabling reuse for that dimension) and re-training with AdaRubrics guided preference pairs.

No source code excerpt is present in the provided context.

Imagine a triage nurse in a busy clinic who quickly checks each patient but only sends the most uncertain cases to the doctor. This subsystem is for an automatic judge that checks whether extracted information is correct, but it knows it makes mistakes—especially on certain tricky types of questions—so it flags its uncertain judgments for a human to double-check instead of pretending to be final.

The judge acts like that nurse: it reviews each answer against the source document, and when it feels unsure, it sends the case to a human reviewer using confidence signals. But even when it has the full source document in front of it, the judge only agrees with the correct answer fifty-four point three percent of the time, and it falsely approves wrong answers at a rate of thirty-three point one percent—that is, one in three wrong answers gets a false thumbs-up. Most of these false acceptances happen in three specific categories: exact recall tasks (fifty percent false), multi-hop tasks (forty-six percent false), and threshold tasks (thirty-three percent false). These are exactly the structured jobs where accuracy matters most, so the judge deliberately flags those kinds of cases for human review rather than trusting its own verdict.

The non‑obvious twist is that the judge’s confidence signals are not themselves perfectly reliable—yet they are still used to decide when to escalate. The deeper reason why triage is essential is that the judge’s errors concentrate in the very tasks where a single mistake can be catastrophic (for example, misreading a precise number in a regulation). Without this triage layer, a user would blindly accept the judge’s stamp of approval and act on wrong information one‑third of the time on critical structured tasks—like relying on a mislabeled dosage in a medical document or a false financial threshold.

The subsystem implements a triage layer where a judge—termed here the outcome evidence layer—evaluates agent trajectories before final approval. The ordered mechanism proceeds as follows: first, the judge applies a locked checklist to each completed run, specifying which stored artifacts are required to verify the claimed outcome. It then assigns one of three evidence labels—Evidence Pass, Evidence Fail, or Unknown—based on whether the required artifacts confirm the outcome. On a failure (Evidence Fail), the case is escalated to a human reviewer; on an Unknown label, the uncertainty is explicitly reported rather than silently counted, and the case may also be escalated depending on confidence thresholds. This sequential check precedes any final success scoring.

The invariant preserved is the reporting of evidence-supported score bounds that quantify uncertainty arising from Unknown cases, as described in the outcome evidence layer. This guarantees that every evaluation run produces a transparent record of whether the outcome artifacts were successfully verified, rather than conflating uncertain cases with confirmed successes. The design ensures that the reported score is always accompanied by a bounded range that makes the uncertainty visible, preventing silent counting of unverifiable outcomes.

The key trade-off is rejecting a design where the judge acts as final authority without explicit evidence verification. The obvious alternative is a no-triage approach: treating a surface-level signal—such as a button click—as proof of task success, which the source identifies as misleading because the agent may have modified the wrong record. This rejection avoids the cost of benchmark contamination from false acceptances, where one in three wrong answers would otherwise be silently approved, particularly in tasks requiring exact recall or multi-hop reasoning. Instead, the layer adds verification overhead but ensures that only outcomes with grounded artifact evidence contribute to the success rate.

A concrete failure mode an operator would see is an Evidence Fail label on a case where the agent clicked “Save” on a shipping-address change, but the stored record shows the address was modified for the wrong customer. The operator receives the locked checklist showing that the required artifact—the updated database record for Alice’s address—was not found, and the system explicitly reports “Evidence Fail” instead of a pass. This signal directly indicates that the run’s outcome could not be verified, prompting manual inspection rather than relying on the misleading click event.

Failure 1: Judge False Acceptance of Wrong Answers

• Trigger: The judge evaluates a wrong answer and, due to low discrimination, assigns a passing confidence, leading to approval without human review. This occurs in 33.1% of evaluated wrong answers as reported.
• Guard: The outcome evidence reporting layer applies a locked checklist to each completed run and assigns the label Evidence Fail when stored artifacts do not verify the claimed outcome. However, this guard operates post‑hoc, not inline; the judge itself has no explicit guard.
• Posture: Fail‑soft – the approved wrong answer propagates forward, degrading overall system accuracy.
• Operator signal: A recorded false acceptance rate of 33.1% in the evaluation log; for individual runs, the operator sees a final state of Evidence Fail after the outcome check.
• Recovery: No automatic retry. Manual audit of all Evidence Fail flagged runs is required; the system does not roll back the accepted action.

Failure 2: Judge False Rejection of Correct Answers

• Trigger: The judge incorrectly flags a correct answer as uncertain or low‑confidence, escalating to a human reviewer unnecessarily.
• Guard: The outcome evidence reporting layer would later assign Evidence Pass to the same run, confirming the answer was correct. The judge’s internal confidence signals are not named explicitly and provide no inline protection.
• Posture: Fail‑soft – the system escalates to a human, adding latency and resource cost but preserving correctness.
• Operator signal: A surplus of human‑reviewed items that later carry Evidence Pass; no direct metric is logged for false rejection, but operator can compute a false‑positive rate from Evidence Pass labels on escalated cases.
• Recovery: The human reviewer approves the correct answer, providing a manual fallback. No automatic reroute exists.

Failure 3: Judge Failure to Escalate Uncertain Cases (Overconfidence in Wrong Answers)

• Trigger: The judge’s confidence signals are mis‑calibrated, causing it to assign high confidence to a wrong answer and bypass the human reviewer. This is the root cause of the observed 33.1% false‑acceptance rate, especially on exact‑recall, multi‑hop, and threshold tasks.
• Guard: None. The source states only that “confidence signals help decide when to flag a judgment” but provides no named guard variable or threshold.
• Posture: Fail‑soft – the wrong answer is accepted and executed, degrading system reliability.
• Operator signal: The absence of an escalation log for a case that later receives Evidence Fail; the operator sees a silent approval followed by an outcome failure.
• Recovery: No automatic correction. The system relies on the outcome evidence reporting layer to surface the failure after the fact, prompting manual rollback or correction.

Failure 4: Judge Systematic Bias in Structured Task Types

• Trigger: The judge performs disproportionately poorly on exact‑recall, multi‑hop, and threshold tasks, where “most of those false acceptances happen.” This bias is inherent to the judge’s model and does not depend on a single execution event.
• Guard: The DimensionAwareFilter from the ADARUBRIC framework is a provably necessary condition for preventing high‑scoring dimensions from masking dimension‑level failures; if applied to the judge’s scoring, it could expose the bias per task dimension. However, the described judge does not implement it. The Process Reward Agents (PRA) method provides step‑wise rewards that, if used, could detect reasoning gaps in multi‑hop tasks, but again it is not part of this judge.
• Posture: Fail‑soft – accuracy degrades specifically on high‑impact structured tasks.
• Operator signal: Stratified performance metrics show lower accuracy on exact‑recall, multi‑hop, and threshold tasks compared to free‑form tasks; no single log line, but a breakdown in the evaluation report.
• Recovery: Proactive redesign of the judge or explicit routing of structured tasks to human reviewers, as suggested by the source (“the judge should send uncertain cases to a human reviewer”). No automated recovery exists within the current subsystem.

Failure 5: Judge Premature Commitment to an Incomplete Evaluation

• Trigger: The judge commits to a final verdict (accept or escalate) after only partial reasoning, before all necessary evidence is collected. This aligns with the general failure mode “premature commitment on causal tasks” (20% of failures in the taxonomy), applied here to the judge’s decision‑making.
• Guard: The Process Reward Agents (PRA) method provides “domain‑grounded, online, step‑wise rewards to a frozen policy” and could score intermediate reasoning steps, preventing premature commitment. The described judge does not use PRA.
• Posture: Fail‑soft – the verdict may be wrong, leading to false acceptance or false rejection.
• Operator signal: The judge’s output is logged without evidence that all steps were completed; an operator might infer premature commitment if subsequent Evidence Fail or Evidence Pass conflicts with the judge’s confidence level.
• Recovery: No automatic recovery. Manual review of the judge’s reasoning trace is required to confirm whether all steps were evaluated; the outcome evidence reporting layer’s Unknown label may be assigned if artifacts are insufficient, triggering manual inspection.