Arena‑style LLM leaderboards found vulnerable to rank‑boosting attacks

A new arXiv study shows that preference‑based model rankings can be gamed through strategic voting, prompting and nomination, moving models up dozens of spots.

Grafy News DeskNov 14, 20265 min read

Add to Preferred Sources

Illustration for the news story: Arena‑style LLM leaderboards found vulnerable to rank‑boosting attacks

Source: Grafy Research Lab

Arena‑style rankings of language models are a cornerstone of many online leaderboards, yet a new arXiv paper demonstrates that these rankings can be deliberately skewed. The authors, from UC Berkeley, Bocconi, Stanford and MIT, show that three straightforward tactics—strategic voting, strategic nomination and strategic prompting—can lift a target model by up to 45 positions in a leaderboard that uses the Bradley‑Terry (BT) aggregation method.

What are arena‑style model leaderboards and how do they work?

Arena‑style evaluations let users submit a free‑form prompt and then compare the responses of two anonymously labeled models. Each pairwise preference is recorded, and the collection of votes is fed into the Bradley‑Terry model, which assigns each model a score $\xi$ such that the probability of model $A$ beating model $B$ is

\frac{e^{\xi_{A}}}{e^{\xi_{A}}+e^{\xi_{B}}}

(see the paper’s description of the BT choice model). The resulting scores are often rescaled to Elo‑style numbers and displayed as a ranking. Popular platforms include Artificial Analysis, DesignArena and LMArena.

Figure 1: Top: Highest model rank (dark bars) and Elo (light bars) achieved under greedy strategic voting, capped at 10K votes (∼10% of total votes). Numbers above bars i… — **Figure 1.** Top: Highest model rank (dark bars) and Elo (light bars) achieved under greedy strategic voting, capped at 10K votes (∼10% of total votes). Numbers above bars indicate the best absolute rank that a model achieves. Models are boosted up to 20 places in the rankings; 23 models (42% of the dataset) move over 10 places up, and eight models move into the top 5. Bottom: Highest model rank & Elo achieved… Figure 1 of “Leaderboard Hacking: Preference-Based Model Evaluations are Vulnerable to Manipulation” by Eve Fleisig, Joachim Baumann, Dylan Hadfield-Menell et al. (arXiv.org), CC BY 4.0.

Figure 4: Change in rank and Elo when performing strategic nominations followed by strategic prompting. Models are boosted up to 45 places in the rankings, with 9 models… — **Figure 4.** Change in rank and Elo when performing strategic nominations followed by strategic prompting. Models are boosted up to 45 places in the rankings, with 9 models moving over 10 places upwards. Figure 4 of “Leaderboard Hacking: Preference-Based Model Evaluations are Vulnerable to Manipulation” by Eve Fleisig, Joachim Baumann, Dylan Hadfield-Menell et al. (arXiv.org), CC BY 4.0.

How can rankings be manipulated?

The study identifies three low‑cost attack vectors that exploit the BT aggregation’s equivalence to the Borda count, a voting rule known for its susceptibility to strategic behavior.

Strategic voting – By casting votes on matches that do not involve the target model, an attacker can alter the relative strengths of competing models, indirectly improving the target’s rank. The authors devise a greedy heuristic that requires only a fraction of the total votes (≈10 % or 10 K votes) to achieve noticeable gains.
Strategic nomination – Leaderboards that allow anyone to submit new models can be flooded with copies of a model that the target consistently outperforms. Adding ten such copies, as illustrated in Figure 1, can push a model up by 15 places.
Strategic prompting – Since users choose the prompts, an adversary can concentrate prompts in a subcategory where the target excels (e.g., a specific language or domain). Deploying 10 K favorable prompts yields rank improvements of up to 15 spots.

When the three tactics are combined, the effect compounds dramatically. Figure 4 shows that a model can climb as many as 45 positions when nomination and prompting are applied together.

How much impact do the attacks have in practice?

Using public data from LMArena, the researchers ran simulations on a dataset of 55 models and roughly 100 K pairwise battles. The results indicate:

Individual attacks can move a model up 15‑20 places, with 23 models (42 % of the set) improving by more than 10 spots.
Small rank gains (2‑3 places) require as little as 2 % of the total vote pool, while larger jumps need roughly 10 % of votes or prompts.
The combined nomination‑plus‑prompting attack can shift a model from the lower‑middle of the table into the top‑5, as highlighted in Figure 4.

These findings suggest that even modestly resourced actors could substantially alter the perceived performance of a model, potentially influencing user adoption, funding decisions, or competitive positioning.

What defenses do the authors propose?

The paper outlines mitigation strategies tailored to each attack vector:

For strategic nomination, the authors recommend a "harmonic" Borda weighting that reduces the influence of low‑ranked (or duplicate) entries, cutting the maximum boost from 15 to 8 places (see Figure 5 in the appendix).
Against strategic voting, they suggest limiting the number of votes a single user can cast on a given model pair and applying statistical anomaly detection to flag unusually coordinated voting patterns.
To curb strategic prompting, platforms could enforce a more balanced prompt selection process, such as randomizing prompt assignment or requiring a diverse language mix, thereby preventing any one subcategory from dominating the evaluation.

Implementation of these defenses would require changes to the leaderboard infrastructure, but the authors argue they are feasible and would restore confidence in preference‑based rankings.

How can Grafy users explore or protect against such manipulation?

Grafy creators and researchers can investigate these vulnerabilities directly with the Reader app, which lets you upload the arXiv PDF and query the paper using natural language. For example, you can ask the assistant to summarize the attack heuristics or to reproduce the rank‑boost calculations on a custom dataset. Developers building their own evaluation pipelines can also experiment with alternative aggregation methods—such as the harmonic Borda variant—using the Chat app to prototype quick scripts with multiple LLMs side‑by‑side.

If you already run an internal model arena, consider integrating the defensive ideas from the study: limit duplicate model submissions, monitor voting patterns, and randomize prompt assignment. Grafy’s Watch tool can monitor changes to public leaderboards and alert you when sudden rank shifts occur, giving an early warning of possible manipulation.

Source: https://arxiv.org/abs/2611.14769

Source: Grafy Research Lab — Leaderboard Hacking: Preference-Based Model Evaluations are Vulnerable to Manipulation

More news

MarkTechPost7 h ago5 min read

Cmpnd launches dspy-wsp: weight‑space programming

Cmpnd released dspy-wsp, a prototype DSPy optimizer that edits model weights directly without gradients.

Try in Grafy Codeweight-spacedspy

Grafy Research Lab16 h ago4 min read

Prefix‑Guided Sampling Cuts Test‑Time Costs While Boosting LLM Reasoning

A new method called Prefix‑Guided Sampling (PreG) uses early confidence signals to prune low‑quality reasoning paths.

Try in Grafy Codellmtest-time scaling

Grafy Research Lab16 h ago4 min read

guardscope Framework Quantifies Runtime Control Coverage for LLM Agents

A new arXiv study introduces guardscope, a two‑stage framework that measures how many of an LLM agent's action paths are inspected by runtime controls.

Try in Readerllmruntime-control