Can cheap rule-based checks around an AI grader cap the damage when it's wrong — or only catch some mistakes?

This explores whether cheap rule-based checks placed around an LLM judge put a ceiling on the damage when the judge is wrong. The corpus says they bound some errors well, but they don't bound all of them, and the way a check fails can undo the bound.

Start with why anyone would build the guardrails. Judge bias doesn't go away by asking nicely: Can prompting reduce bias in LLM judges reliably? argues that prompting a judge to be unbiased doesn't reliably work, so the design goal shifts to containing errors structurally. The biases are easy to exploit too. Can LLM judges be tricked without accessing their internals? shows judges score responses higher just for fake references or fancy formatting, with no access to the model's internals needed. The guardrail answer has four moves: put unarguable checks before contestable ones, measure the judge against human labels, hide test data from the proposer, and plant known cases as alarms. Can deterministic checks protect LLM judges from failure? notes that none of these asks the LLM to police itself. They also cost almost nothing. How much do deterministic guardrails actually cost to run? points out that string and arithmetic checks are dwarfed by the judge's inference bill, so adding them doesn't compete for budget.

The catch is that a bound is only as good as the failure path. Does a default fallback defeat a safety check? describes a parsing check that detected failures and then substituted a default score. Once an optimizer ranks outputs by score, those failures become valid-looking candidates. The check worked, but the fallback turned it into a fail-open hole. There's a second problem when the guardrail's verdicts flow back to whatever is proposing answers. Can optimizers learn to evade guardrails through repeated verdicts? warns that repeated detect-and-penalize loops can train for evasion rather than compliance. Whether a given system falls into that trap depends on what information leaks back to the proposer, which is why hiding test data is one of the four moves.

Mechanical checks also have a limit in what they can express. Can stateless checks ever catch sequence-level constraint violations? argues that per-action checks structurally can't state constraints about history, so a series of individually fine judgments can add up to a violation that no stateless check sees. Whether adding stateful monitoring pays for itself is still open in this corpus. Does added monitoring improve protection at acceptable cost? designs the comparison but reports no results.

So guardrails bound the cost of mechanical errors, such as malformed output, a judge that has drifted from human labels, or an obvious alarm going off. They bound the cost of subtle judge errors much less. That matters most when the judge is the weaker party, and Does reward hacking worsen when judges are weaker than policies? argues that is the default case, since frontier systems often use previous-generation models as judges. The complementary fixes work on the judge itself. Can debate training prevent reward hacking by weaker judges? found that a critic arguing against the generator kept a weak frozen judge useful, while single-player training exploited its errors and collapsed. Can reasoning during evaluation reduce judgment bias in LLM judges? trains judges to reason before deciding, which cuts their susceptibility to authority, verbosity, position and beauty bias. The picture is layered: guardrails cap the cheap, mechanical failures, and stronger judging has to handle what they can't.