CARE: Confounder-Aware Aggregation for Reliable LLM Evaluation

AI summary

Overview

• Research area: Machine learning / LLM evaluation — specifically, how to aggregate scores from ensembles of LLM-as-a-judge systems, with connections to weak supervision, latent-variable graphical models, and tensor methods.
• Technical level: Advanced. The paper relies on Markov random fields, sparse-plus-low-rank matrix decomposition, CP tensor decomposition, and identifiability/sample-complexity theory. The experimental sections are readable, but the method and theory require graduate-level background in statistics or machine learning.
• Scope (one sentence): The paper proposes a framework, CARE, that models LLM judge scores as coming from a true-quality signal plus shared latent confounders, and shows across 12 benchmarks that this improves aggregation accuracy, cutting error by up to 26.8%.

Note: the paper content provided is truncated (the Related Work section is cut off mid-sentence), and several details — such as individual dataset sizes, the full judge model list, and prompt templates — are referenced to appendices that are not included in the excerpt. Where a figure is not in the supplied text, I say so rather than supplying one.

What This Paper Is About

Ensembles of LLM judges are the standard way to evaluate model outputs at scale, but their aggregation rules — majority vote, averaging, ad-hoc reweighting — implicitly assume each judge makes independent errors. In practice, judges share biases (verbosity, style, training artifacts), so their errors are correlated and simple aggregation can add little or even amplify shared mistakes. This paper's goal is to explicitly separate the latent "true quality" of a response from these shared confounders using only the observed judge scores, with no ground-truth labels.

Key Contributions

1. A confounder-aware aggregation framework (CARE). The paper introduces CARE, which models LLM judge scores through latent factors corresponding to both true quality (Q) and shared confounders (C), rather than treating judges as independent noisy labelers.
2. Two complementary estimators with different information requirements. CARE-SVD uses second-order (covariance/precision) structure under a joint-Gaussian assumption, while CARE-Tensor uses the learned sparse dependency structure to form approximately independent judge "views" and then applies tensor decomposition for discrete, binary, and preference-based regimes.
3. Identifiability and finite-sample theory under shared confounding. The paper provides a proposition on identifiability and stability of latent–judge directions (Proposition 4.1), a finite-sample recovery rate for the spectral path (Theorem 4.2), a sample complexity result for recovering mixture means and proportions in the tensor path (Theorem 4.3), and a bound on the systematic bias incurred when a model omits confounding latent factors (given in Appendix D).
4. Empirical validation across 12 public benchmarks. The paper reports consistent improvements over majority vote, averaging, two weak-supervision baselines (WS and UWS), and classical aggregation methods (Dawid–Skene, GLAD, MACE), reaching up to 26.8% error reduction.

Main Findings

• Scoring tasks: CARE-SVD achieves the lowest MAE in all cases. On the six scoring datasets (ASSET, FeedbackQA, Review-5K, Summarize, UltraFeedback, Yelp), CARE-SVD records MAE values of 27.629 ± 0.156, 0.730 ± 0.002, 1.957 ± 0.018, 1.325 ± 0.004, 0.623 ± 0.006, and 0.694 ± 0.004 respectively, beating MV (31.153, 0.822, 2.608, 1.417, 0.851, 0.923), AVG (33.663, 0.830, 2.274, 1.394, 0.686, 1.037), WS (29.073, 0.793, 2.593, 1.364, 0.829, 0.977), and UWS (33.928, 0.875, 2.602, 1.362, 0.680, 0.987).

• Magnitude of improvement on scoring: The largest single gain is a 26.8% error reduction compared to MV on UltraFeedback. Averaged across scoring datasets, CARE-SVD yields a 17.37% relative improvement over AVG and a 12.75% improvement over MV.

• Classification and preference tasks: best accuracy on 5 of 6 datasets. On Chatbot-Arena, CivilComments, PKU-BETTER, PKU-SAFER, SHP, and Summarize, CARE-SVD leads on Chatbot-Arena (0.580 ± 0.004) and CivilComments (0.778 ± 0.004), while CARE-Tensor leads on PKU-BETTER (0.779 ± 0.002), SHP (0.695 ± 0.008), and Summarize (0.814 ± 0.001) — including a 13.4% relative accuracy improvement on Summarize over the strongest baseline. MACE remains best on PKU-SAFER (0.735 ± 0.000).

• Latent factors are interpretable as confounders. On Review-5K (described as the ICLR 2024 peer-review dataset), the first CARE-SVD confounder correlates positively with response length (ρ ≈ 0.49) and negatively with average sentence length and SMOG complexity (ρ ≈ −0.39 and −0.38); the second shows the opposite pattern, correlating with shorter reviews (ρ ≈ −0.46) but more complex sentence structure and higher readability complexity (ρ ≈ 0.28–0.29) and slightly more numeric content (ρ ≈ 0.17). On PKU-Safer, the CARE-Tensor confounder posterior Pr(C = 1 | J) shows its largest positive correlation with length/verbosity (ρ ≈ +0.12) and a modest negative association with numeracy/technicality (ρ ≈ −0.07). The authors explicitly state these correlations are for interpretation and do not provide a unique causal explanation.

• Programmatic judges can be integrated profitably. Starting with 30 synthesized programmatic judges generated by prompting OpenAI's GPT-4o, greedy selection on a validation set (10% of the training dataset) with early stopping after four steps without MAE reduction led CARE to add eight additional programmatic judges, reducing MAE on FeedbackQA by 15.2% compared to MV and 11.1% compared to UWS.

• Robustness to injected stylistic bias. Against the Chen et al. (2024) dataset with beauty bias (emojis/formatting) and authority bias (fake citation), CARE-SVD shows the lowest MAE between bias-injected and original versions: 0.375 and 0.233, versus MV (0.919, 0.824), AVG (0.506, 0.325), WS (1.229, 0.754), and UWS (0.508, 0.271).

• Defense against adversarial answers. Against the Zhao et al. (2025) adversarial responses, CARE-Tensor reduces false positive rates on all six attack types: ":" (0.496 vs MV 0.577, WS 0.520), "," (0.000 vs 0.441, 0.546), "Solution" (0.371 vs 0.558, 0.522), "Thought process:" (0.000 vs 0.674, 0.587), " " (0.432 vs 0.641, 0.577), and "Step by step" (0.392 vs 0.571, 0.504).

• Theory: identifiability holds up to sign and permutation, with explicit rates. Proposition 4.1 shows latent–judge directions are identifiable from the low-rank component L up to sign and permutation under diagonal K_HH with decreasing entries and orthogonal columns of K_JH, with eigenvector perturbation scaling as ‖K_HH⁻¹‖₂ · ‖E‖₂ / δᵢ. Theorem 4.2 gives max eigenvector error O(√(η/n) · 1/(ξ(T)δ)) with probability at least 1 − 2e^(−η). Theorem 4.3 gives a sample complexity of n ≳ (σ_max⁶ / (δ² π_min²)) · p log(p/ε) for recovering (μ_qc, π_qc).

• The setup names three obstacles, and the methods are designed around them. C1: the latents H = (Q, C) are never observed — neither ground truth nor confounders. C2: no particular interaction structure in the graph can be assumed. C3: even with recovered parameters, Q must be distinguished from the confounders.

Methodology in Plain English

The authors treat the table of judge scores — one row per evaluated item, one column per judge — as data generated by a hidden graphical model with three kinds of nodes: the observed judge scores, an unobserved true-quality factor, and unobserved shared confounders. Their approach rests on the observation that the sparsity of that graph and the presence of hidden nodes pull in different directions, and neither alone is enough.

The key move is to combine two classical techniques that each solve only one half of the problem. First, they take the precision matrix (inverse covariance) of the observed judge scores and split it into a sparse part plus a low-rank part. The sparse part captures direct judge-to-judge conditional dependencies; the low-rank part captures the influence of the hidden quality and confounder factors. This addresses C1 and C2. Second, they use the recovered sparse graph to select groups of judges that are conditionally independent given the latents, form a higher-order moment (a tensor) from those groups, and decompose it. Tensor decomposition has the rigidity needed to pin down the factors uniquely — addressing C3, which plain SVD can only achieve up to rotation.

The two named instantiations pick different halves of this template. CARE-SVD handles fully Gaussian (continuous) scores, where odd central moments vanish and only second-order structure is informative; it takes the SVD of the low-rank component and selects a quality direction. CARE-Tensor handles Gaussian mixtures, binary label outputs, and other discrete or mixture regimes, using three conditionally independent judge groups and a CP (CANDECOMP/PARAFAC) decomposition of the third-order cross-moment to recover component means and mixture proportions.

One step has no purely mathematical solution: deciding which recovered factor is quality rather than a confounder. For the Gaussian case, the authors use a heuristic that the leading eigenvector of the fitted low-rank component is the quality axis, reasoning that quality induces the strongest shared variation while confounders are weaker or concentrated on a subset. Alternatives offered are a small human-rated anchor set or a balanced-loading criterion. For mixtures, they score states by s_r = vᵀμ̂_r and map the highest-scoring states to Q = 1.

Finally, they weight judge scores according to the loadings of the identified quality factor to produce the aggregate estimate.

Why This Matters

Impact on research. Most multi-judge aggregation methods assume conditional independence or unstructured noise. This paper reframes correlated judge errors as a latent-variable identification problem and gives conditions under which quality can be recovered without labels. It also quantifies the misspecification bias that ordinary aggregation methods incur when confounders are omitted, which clarifies when heuristic ensembling is fundamentally the wrong tool rather than merely suboptimal in practice.

Real-world applications (drawn from the settings and data used in the paper):

• Model leaderboards and release decisions — aggregating many cheap LLM judges into a single reliable quality score for comparing model outputs on QA, feedback, and summarization tasks (ASSET, FeedbackQA, Summarize, UltraFeedback, Yelp).
• RLHF and preference data curation — preference-based judging is used in RLHF pipelines, and this method targets pairwise preference scores on datasets like SHP and Chatbot-Arena.
• Content moderation — toxicity and safety annotation appear in the CivilComments, PKU-SAFER, and PKU-BETTER benchmarks, where judge bias toward surface features could distort moderation signals.
• Peer review assistance — the Review-5K analysis shows reviewers (or review-simulating judges) respond to verbosity and writing complexity; explicitly modeling those confounders could separate style from substance in review scoring.
• Cost reduction through programmatic judges — the paper shows CARE can productively integrate cheap but biased deterministic program codes as judges, which matters for teams that cannot afford large-scale human or frontier-model annotation.

Industry relevance. Evaluation pipelines are a bottleneck for shipping LLMs. The paper's demonstration that CARE stays robust to adversarial token injections (reducing false positives to 0.000 in two of six attack cases) and to superficial formatting changes suggests it could serve as a guardrail layer for automated model monitoring, where manipulation of judges is a live concern.

Future Directions

1. Removing the symmetry-breaking heuristic. The quality-vs-confounder selection currently leans on a heuristic (leading eigenvector = quality), with alternatives such as a small human-rated anchor set or a balanced-loading criterion. The paper notes the guiding assumption can be violated; establishing when it holds and what minimal supervision reliably replaces it is an open question.
2. Scaling to richer latent structure. The illustrative derivations use one binary confounder and one binary quality variable. The authors state this extends to multi-class or multiple confounders, and cover the fully binary setting in Appendix C, but the empirical behavior under many confounders is not established in the supplied text.
3. Characterizing misspecification more tightly. The paper provides a bias bound for omitted confounders in Appendix D, quantifying how it scales with confounder strength and alignment with recovered directions. Using that bound to build diagnostics for when a given evaluation setup is confounded would be a natural next step.
4. Understanding the adversarial-defense mechanism. The paper reports that CARE reduces false positive rates on adversarial responses but does not (in the supplied content) explain why confounder modeling confers this protection, nor how it would fare against adaptive attacks that target the confounder model itself.

Target Audience

Researchers and practitioners in LLM evaluation and weak supervision who are already comfortable with latent-variable models, spectral methods, or tensor decomposition and want a principled alternative to majority vote and averaging. It is also relevant to applied teams running large-scale model evaluations or RLHF data pipelines who need to understand why their multi-judge ensembles plateau — though those readers will likely want the appendices, since the main text relies on them for dataset details, the full judge model list, prompt templates, and several technical assumptions. Readers looking for a beginner-friendly introduction to LLM-as-a-judge evaluation or a purely empirical benchmark comparison will find the paper's theoretical framing more demanding than its conclusions.

Authors’ abstract

LLM-as-a-judge ensembles are the standard paradigm for scalable evaluation, but their aggregation mechanisms suffer from a fundamental flaw: they implicitly assume that judges provide independent estimates of true quality. However, in practice, LLM judges exhibit correlated errors caused by shared latent confounders -- such as verbosity, stylistic preferences, or training artifacts -- causing standard aggregation rules like majority vote or averaging to provide little gain or even amplify systematic mistakes. To address this, we introduce CARE, a confounder-aware aggregation framework that explicitly models LLM judge scores as arising from both a latent true-quality signal and shared confounding factors. Rather than heuristically re-weighting judges, CARE separates quality from confounders without access to ground-truth labels. We provide theoretical guarantees for identifiability and finite-sample recovery under shared confounders, and we quantify the systematic bias incurred when aggregation models omit confounding latent factors. Across 12 public benchmarks spanning continuous scoring, binary classification, and pairwise preference settings, CARE improves aggregation accuracy, reducing error by up to 26.8\%. Code is released in \href{https://github.com/SprocketLab/CARE}{https://github.com/SprocketLab/CARE}.