Impossible Code, Barely Changed Score

The problem

Training a language model with reinforcement learning needs a scorer that says whether an answer is right. For code, the dependable scorer runs the program against tests. That is slow and needs a sandbox, so many studies ask a large language model to read the code and judge it instead. This page reports what that substitution cost inside one real evaluation.

What happened

A finished study had trained Qwen-2.5-7B-Instruct with GRPO and saved the code its checkpoints wrote for 421 HumanEval and MBPP problems (32 samples each). Later we downloaded the same checkpoints and asked the same questions again (128 samples each), on different hardware. The untrained model behaved as before. Two trained checkpoints did not: most of what they now wrote was Python that does not parse, almost always because of one extra closing bracket. The judge that scored the study barely reacted.

0.42% → 66.90%

samples that do not parse, SLJ-trained checkpoint, first run to second run (base model: 0.39% to 0.40%)

0.9667 → 0.9395

the strong judge's Pass@32 for the same checkpoint over the same step

0.0071 vs 0.1591

how far the judge and execution place the base model above the damaged checkpoint at 128 attempts (0.1601 and 0.2232 at one attempt)

0 of 70,239

samples that fail the parse check and still get execution credit

What the paper proposes

Report one free number beside every judge score.

The share of outputs that parse. It needs no tests and no sandbox, and it would have flagged this change on the day it happened. Applied as a gate on the judge, it lowers judge-based Pass@1 by 0.0019 on a healthy run and by 0.4051 on a damaged one. Parsing does not show that code runs or is correct.

import ast

# extracted_code: the last code block of the response
def gated(judge_says_yes, extracted_code):
    if not extracted_code.strip():
        return False
    try:
        ast.parse(extracted_code)
    except Exception:
        return False
    return judge_says_yes

A judge's accuracy and its sensitivity to change are different properties.

A high judge-based score can sit next to a model whose outputs have stopped being programs.

Why it matters for self-evolving search

Program-search systems such as FunSearch and AlphaEvolve score each candidate by running it through an automated evaluator. Self-rewarding training scores candidates with a model's own judgment. A judge that cannot tell broken output from working output can steer such a search toward whatever it accepts.

Figure 1

Two passes over the same checkpoints

Left: share of samples that do not parse, first run versus second run, for the base model and the CE- and SLJ-trained checkpoints. Right: base minus SLJ-trained Pass@k as the number of attempts grows, for code execution, the judge with a syntax gate, and the judge alone. — **Left:** how often each model wrote code that does not parse, in the first run and in the second (log scale). **Right:** how far apart the base model and the damaged SLJ-trained checkpoint look on the same second-run outputs, as the number of attempts per problem grows. Running the code keeps them apart. The judge's gap has almost vanished by 128 attempts.

Code that does not parse

checkpoint	first run	second run	HumanEval / MBPP (second run)
Qwen-2.5-7B base	0.39%	0.40%	0.1% / 0.6%
CE-trained	0.42%	63.04%	64.8% / 61.9%
SLJ-trained	0.42%	66.90%	68.4% / 66.0%

Share of samples that do not parse (empty extracted code counts as not parsing). 421 problems; 32 samples per problem in the first run, 128 in the second.

Four readings of the same outputs

checkpoint	samples parsing	judge Pass@128	judge + gate	execution Pass@128
Qwen-2.5-7B base	99.60%	0.9715	0.9715	0.4418
CE-trained	36.96%	0.9525	0.6627	0.3017
SLJ-trained	33.10%	0.9644	0.6651	0.2827

The gate keeps a judge verdict only when the code also parses. Execution uses a hardened harness that credits a sample only after the tests have run. Absolute execution levels are low partly because the MBPP prompts do not name the function the tests call.

The judge prefers parsing code without requiring it

On the SLJ-trained outputs the strong judge accepts 83.35% of samples that parse and 60.56% of samples that do not. Once two thirds of the outputs are broken, 59.49% of everything the judge approves cannot run. For the base model the judge accepts 47.69% of its 216 broken samples, but they are only 0.23% of its approvals.

Further checks in the paper

Truncation and extraction

98.6% of the SLJ-trained parse errors are an unmatched or mismatched closing bracket, and only one has the signature of a cut-off generation. Parsing any fenced block instead of the last one changes the parse rate from 33.10% to 33.12%.

Milder damage

Adding one extra bracket to 10% to 60% of the base model's samples moves judge Pass@32 by at most 0.0024 while the parse rate falls from 99.5% to between 89.3% and 39.9%.

A second judge

The weak 7B judge rejects broken code more often (it accepts 28.0% and 30.4% of it), and its Pass@32 falls by about 0.16 between runs. Both judges are from one model family.

Paired intervals

Over the 421 problems, the judge's base-minus-damaged separation at 128 attempts is 0.007 with a 95% interval of [−0.012, 0.026]; execution's is 0.159 [0.121, 0.200].

Repository

curiousorbitnotes/evorobust-replay-audit

Open on GitHub

The repository holds the analysis scripts, the study's extraction, execution and judge code (with the exact judge prompt), and the summary results those scripts write. It does not hold model checkpoints, generated samples, judge verdicts or per-sample scores, so the analyses cannot be re-run from it alone.

Reproduce Figure 1

pip install -r requirements.txt
python scripts/evorobust_figure.py

This reads only the summary tables in tables/ and runs as is.

What each part does

scripts/evorobust_replay_audit.pyParse rates of both passes, the error taxonomy, judge acceptance and the parse gate

scripts/evorobust_analyses.pyPaired comparisons with prompt-level bootstrap intervals and simple-signal baselines

scripts/canon4.py, canon5.pyHardened execution harness (explicit success token; not a security boundary)

scripts/judge_recheck.pyRe-judges a seeded subset to check that cached verdicts belong to their samples

scripts/corrdose_*.pyThe milder-corruption experiment

scripts/wljdam_analyze.pyThe weak judge on the damaged checkpoints

rewards/llm_judge.pyJudge code and the prompt template used by both judges

tables/Summary tables written by the scripts

data/code/eval.jsonThe 164 HumanEval and 257 MBPP problems (original licenses apply)

Judge prompt

You are an expert grader. Your job is to decide whether a candidate
answer is CORRECT or INCORRECT for the given problem.

Output exactly one character: '1' if the candidate answer is correct,
or '0' if it is incorrect. Do not output anything else — no reasoning,
no punctuation, no whitespace.

PROBLEM:
{prompt}

GOLD ANSWER:
{gold}

CANDIDATE ANSWER:
{response}

YOUR VERDICT (1 or 0):

Quoted verbatim from the code. Both judges (Qwen2.5-72B-Instruct and Qwen2.5-7B-Instruct) were served with vLLM at temperature 0.

Cite

@inproceedings{fetanat2026impossible,
  title     = {Impossible Code, Barely Changed Score: A Replay Audit of Judge-Based Evaluation},
  author    = {Fetanat, Masoud},
  booktitle = {NeurIPS 2026 Workshop on Self-Evolving Diversity-Driven Search for Robust AI Systems (EvoRobust)},
  year      = {2026},
  url       = {https://openreview.net/forum?id=MvVQZGiN8V}
}