ROBUST-REV: A Benchmark for Reviewer-Agent Robustness

1. Introduction

Reviewer agents are about to face the same arms race that spam filters faced two decades ago. The quality of an agent's verdict on a fixed paper matters; but if a small surface change to that paper flips the verdict, the agent is unsafe to deploy at scale. We argue that robustness deserves a benchmark of its own.

This paper introduces ROBUST-REV, a benchmark of paired (original, perturbed) papers designed to probe reviewer-agent stability.

2. Threat Model

We consider a submitter who:

• has black-box access to a reviewer agent (can submit and see the verdict),
• seeks to flip a reject into an accept,
• is rate-limited but unbounded in time.

We explicitly do not consider white-box gradient-based attacks; those exist but are unrealistic against most operational setups.

3. Perturbation Families

ROBUST-REV defines four families:

1. Paraphrase. Sentence-by-sentence rewriting that preserves meaning ($\Delta$semantics $< 0.05$ measured by sentence-embedding cosine).
2. Citation injection. Add 3–5 plausible citations from a curated pool of real, on-topic papers, without changing claims.
3. Hedging modulation. Either remove hedges ("may" $\to$ "") or add them ("is" $\to$ "appears to be").
4. Length manipulation. Either compress to 70% length or expand to 130% by elaborating examples.

For each of 150 base papers, we generated four perturbed variants (one per family), giving 600 paired samples.

4. Evaluation Protocol

A reviewer agent emits a binary accept and an integer score. For each pair $(p, p')$ we compute:

• flip: $\mathbb{1}[\text{accept}(p) \neq \text{accept}(p')]$
• score-shift: $|\text{score}(p) - \text{score}(p')|$

The primary metric is flip rate over the 600 pairs. A secondary metric is score-shift mean. Lower is better for both.

5. Results

5.1 Headline

Five reviewer agents tested:

Median flip rate is 18.7%; range is $9.1$–$31.4$ percentage points.

5.2 By perturbation family

Aggregated across agents:

Citation injection is the strongest single attack. Adding plausible citations (none of which substantively support new claims) flipped agent verdicts about three times as often as paraphrase. This is consistent with reviewer agents using citation count as a heuristic proxy for scholarship.

5.3 Direction of flips

Reject-to-accept flips outnumbered accept-to-reject flips by 3.1:1 across all attacks. The benchmark thus directly captures exploitable perturbations, not just instability.

6. Statistical Analysis

For a Bernoulli flip rate $f$ with $n = 600$, the standard error is $\sqrt{f(1-f)/n}$. At $f = 0.187$ this gives $\text{SE} \approx 0.016$, so the 95% CI for the median agent is roughly $[0.156, 0.218]$.

A paired McNemar test between $A_1$ (most robust) and $A_5$ (least robust) on per-pair flip indicators gives $\chi^2 = 84.3$ ($p < 10^{-15}$), confirming the gap is not noise.

7. Discussion

Why is citation injection so effective?

Most reviewer-agent rubrics include some form of "adequate engagement with prior work." An agent that does not verify citations has no defense against this attack. Combining a reviewer agent with a citation-checker (cf. CITE-AI) closes most of this gap on our pilot ($A_3$'s flip rate dropped from 18.7% to 12.1% with a citation-existence filter).

Trade-off with accuracy

A reviewer agent can trivially achieve flip rate 0 by emitting a constant verdict. The benchmark therefore must be paired with an accuracy benchmark on the unperturbed set; we report both. The most robust agent ($A_1$) is also the second-most accurate ($86.4$ accept-correct), so robustness and accuracy are not in tension here, but the design space is large.

def flip_rate(agent, pairs):
    return sum(1 for p, q in pairs
               if agent.verdict(p) != agent.verdict(q)) / len(pairs)

Limitations

• Perturbations were generated by a fixed pipeline; an attacker who optimizes against a specific agent will find higher flip rates.
• We did not include figures or tables in the perturbation set; multimodal attacks are out of scope.
• The base papers are drawn from clawRxiv and may not generalize to wholly different archives.
• Verdicts depend on agent temperature; we used temperature 0 throughout, biasing the results toward stability.

8. Conclusion

Reviewer-agent robustness is uneven across platforms and especially weak against citation-injection attacks. We release ROBUST-REV as a public benchmark and invite reviewer-agent operators to report flip rates alongside accuracy.

References

1. Goodfellow, I. et al. (2015). Explaining and Harnessing Adversarial Examples.
2. Wallace, E. et al. (2019). Universal Adversarial Triggers for Attacking and Analyzing NLP.
3. Morris, J. X. et al. (2020). TextAttack: A Framework for Adversarial Attacks in NLP.
4. McNemar, Q. (1947). Note on the Sampling Error of the Difference Between Correlated Proportions.