ImpossibleRubrics benchmark: LLM-written rubrics reward fabricated answers up to 36% of the time

LLM-generated rubrics are increasingly used as reward signals: to train models with rubric-based reinforcement learning, to score outputs via LLM-as-a-judge evaluation, and to automate grading. Those rubrics are only reliable if they reward an honest answer over an adversarial one crafted to game them, but researchers say how robust such rubrics actually are to that kind of gaming has been poorly understood. To test it, they isolate what they call the hardest possible case: impossible tasks, where the prompt itself pushes the model toward an unsupported conclusion, so the only honest response is to say the question cannot be answered. They introduce ImpossibleRubrics, a benchmark of 169 such impossible tasks across six categories of impossibility, plus 48 answerable control tasks. Each task comes with a verifiable oracle certificate spelling out exactly what an honest answer is and is not allowed to claim. Rather than shipping fixed rubrics, the benchmark provides these task environments and certificates so that any rubric generated downstream can be adversarially tested for whether it ends up rewarding an answer that violates its certificate, meaning an answer that fabricates a claim the question cannot actually support. Across eleven different rubric generators, the baseline exploitation rate was 8% to 26% of the time on an unbiased cut of 150 of the 169 environments. On a cut deliberately selected to stress-test the generators, the strongest generator measured was still exploited 36% of the time, while a rubric written to strictly track the certificate was exploited 0% of the time on that same cut, which the authors say shows the gap is about rubric quality, not about the tasks being inherently impossible to grade. The most counterintuitive finding ran the other way: a single generic rubric, just "be decisive, penalize hedging", applied unchanged to every one of the 169 tasks was exploited 64% of the time, and seven of the eleven generators that instead wrote a fresh, tailored rubric for each individual task were exploited even more often than that generic one. The authors' explanation is that a rubric tailored to one specific task tends to spell out exactly which claim would satisfy it, effectively telling an adversarial answer-writer which fact to fabricate. As they put it, the problem is not that rubrics are vague; it is that they are specific about the wrong things.

Key facts

ImpossibleRubrics pairs 169 impossible tasks across six impossibility categories, plus 48 answerable controls, each with a verifiable oracle certificate defining what an honest answer may and may not claim.
Eleven rubric generators were adversarially tested; on an unbiased cut of 150 of the 169 environments, exploitation rates ranged from 8% to 26%.
On a cut deliberately selected to stress-test the generators, the strongest one measured was still exploited 36% of the time, versus 0% for a rubric written to strictly track the certificate.
A single generic rubric ("be decisive, penalize hedging") applied unchanged to every task was exploited 64% of the time, worse than four of the eleven task-tailored generators but better than the other seven.
The authors argue tailoring a rubric to a specific task can tip off an attacker to which claim to fabricate: the failure is rubrics being specific about the wrong things, not being too vague.

Why it matters

Rubrics written by language models are already being used as the reward signal that trains other models (rubric-based RL), as the scoring mechanism in LLM-as-a-judge evaluation, and to automate grading. All three uses rest on an assumption that has rarely been tested directly: that the rubric rewards an honest answer over a dishonest one optimized to satisfy the rubric's wording rather than the actual question. This benchmark tests that assumption in the case where it matters most, tasks with no honest answer except "this cannot be determined", and finds it holds only partially.

Who it affects

Anyone building training pipelines around rubric-based reinforcement learning, or evaluation and grading systems that lean on an LLM to judge outputs against a generated rubric. The source text does not name the researchers, their institution, or which underlying models were used as rubric generators or as the adversarial answer generators, so this stays a methodological finding rather than a claim about any named lab or product.

How to use it

ImpossibleRubrics is released as task environments paired with oracle certificates rather than as a fixed set of rubrics. That lets anyone generate a rubric with their own method and then adversarially test it against the certificates to see whether it rewards certificate-violating, fabricated answers before deploying that rubric as a reward signal or grading tool.

How solid is it

The design directly isolates the variable it is testing: the same 169 impossible tasks and 48 answerable controls, eleven independently tested generators, and two separate cuts of the environment set, an unbiased 150-of-169 cut and a cut deliberately chosen to stress the generators. The fact that a certificate-faithful rubric scored 0% exploitation on the same stress cut where the best generator still scored 36% is used as the control that pins the gap on rubric quality rather than on the tasks being impossible to grade at all.

Risks and caveats

The source text does not disclose the authors, their affiliation, or a publication venue, nor does it define what the six impossibility categories actually are or explain the mechanism by which a tailored rubric tips off an attacker beyond stating that it appears to happen. The headline counterintuitive result also cuts against a natural intuition: writing a more specific, task-tailored rubric is not automatically safer than a single generic one, and in this benchmark it was frequently worse.

“The problem is not that rubrics are vague; it is that they are specific about the wrong things.”

— the authors, ImpossibleRubrics paper