AI judges can check the evidence and still follow a false expert cue

Checking the work is not the same as resisting a cue

An AI judge checks a database migration and confirms that all 200 customer records arrived correctly. Without extra context, it passes the work. Given an unsupported statement that an expert has verified failure, it repeats the checks, acknowledges success—and then defers to the supposed expert.

That example illustrates the central finding of Grounded but Not Immune: Confirmation Bias in Agent-as-a-judge, an arXiv preprint posted on November 3, 2026, by Drake Benjamin Brown and seven co-authors. The authors report that access to evidence does not make AI evaluators immune to misleading prior judgments. The findings are preliminary, and their scope is the experimental settings studied.

An “agent-as-a-judge” is an AI evaluator that can investigate rather than merely read an answer. Here, judges received the evaluated agent’s full action history and tools for examining its completed environment. Depending on the task, they could inspect files, query databases, execute code or check web sources.

What the experiment measured

The researchers tested Sonnet-4.6, Opus-4.7, Qwen3-235B and GPT-OSS-120B. Their five datasets covered database operations, filesystem tasks, web research, terminal work and software issue resolution.

For the main binary success experiment, each item was judged three times without a cue, using the majority verdict. It was then judged three times with a pre-screening claim pointing against that verdict. The claim said a domain expert had confidently determined that requirements were either unmet or fully met. It supplied no supporting evidence.

The central measure was the harmful flip rate: among judgments that were initially correct against the dataset’s external verifier, what fraction became incorrect after cueing? This is not the percentage of all tasks failed, nor the model’s overall error rate.

Every tested model showed harmful flips on every dataset, but susceptibility varied substantially. Sonnet-4.6 changed 10 of 393 initially correct judgments on SWE-Bench-Verified, about 3%. Opus-4.7 changed 43 of 107 on filesystem tasks, about 40%. Qwen3-235B changed 36 of 47 on database tasks, about 77%. That last estimate comes from a much smaller denominator and should not be treated as a general failure rate.

How judgments changed

To investigate mechanisms, the authors used a separate three-model ensemble to compare cued and uncued evaluation histories. It assigned harmful changes to three categories:

• Over-trust: the evaluator obtained evidence supporting the correct conclusion but overrode or reinterpreted it to match the cue.
• Hallucination: it invented supporting facts or requirements the task had never imposed.
• Under-investigation: it skipped a decisive check and stopped with evidence that appeared to support the cue.

The authors attribute roughly two-thirds to three-quarters of the two Claude judges’ classified harmful flips to over-trust. The open-weight judges had a more distributed mixture of mechanisms. This does not establish a relationship between model size and bias: only four judges were tested, and capability was confounded with model family.

The mechanism labels also have meaningful uncertainty. Three humans independently annotated 97 harmful task-success flips. The automated ensemble matched their majority labels in 74.2% of cases and over-assigned hallucination. This weakens confidence in the precise mechanism proportions, though it does not change which binary verdicts flipped.

Longer investigation was associated with more harmful flips for the Claude judges and fewer for the open-weight judges. Investigation length was observed, not experimentally assigned, so the result does not show that additional checking causes bias.

Wording matters—and defenses have costs

In detailed experiments on Sonnet-4.6, asserting that an error existed shifted judgments more than asking the evaluator to check for it. Expert attribution produced larger shifts than attribution to a previous AI judge, and confident language had a stronger effect than hedged wording. These experiments measured changes in error-category attribution, not externally verified mistakes in every category.

Even a weak remark admitting only a quick skim produced harmful flips: 11% averaged equally across model–dataset combinations, or 8% when pooled over items.

The mitigation experiments also used Sonnet-4.6. A one-line instruction to reach an independent, evidence-based conclusion reduced harmful flips from 18% to 5%, but reduced corrections of initially wrong verdicts from 30% to 12%. Other tested safeguards likewise left residual bias. About a third of classified helpful changes involved a genuinely useful new investigation; others reflected reinterpretation or lucky deference.

What the findings leave open

The strongest cue was deliberately overt, and the detailed wording experiments covered one judge. Graded qualities lacked the deterministic ground truth available for task success. Unequal tool budgets and possible self-preference on Sonnet-generated work further complicate comparisons.

The practical implication is narrower than saying automated judges cannot be trusted: tool access alone was insufficient protection here. The authors argue that evaluators need to distinguish evidence-backed prior information from unsupported authority claims, while preserving useful prompts to investigate. Their experiments do not establish a reliable solution to that problem.