AI 基準分數是協商結果，而非測量結果

This digest covers LLM evaluation and observability news from 2026-10-22 through 2026-10-29. It's a quieter week on the tooling side (Langfuse, Braintrust, and Simon Willison had nothing new in scope), but arXiv, Hugging Face, and Interconnects more than make up for it with a sharp, recurring theme: single benchmark numbers and judge verdicts are a lot less trustworthy than the dashboards built on top of them suggest.

🔥 Highlights

Ranking Is Not Deciding: Benchmark Shortcuts and Operating-Point Collapse in Query-Time RAG Poisoning Defenses — near-perfect scores are often test-set artifacts.
Do LLM Routers Actually Route? Quick answer: Not much! — routers rarely beat one solid mid-tier model.
Artificial Analysis v5 and the benchmarker's dilemma — one aggregated index can't be neutral.
Task Success Is Not Enough: Side-effect-Aware Evaluation of Tool-Using Language Model Agents — "it worked" still hides collateral damage.
Can we trust LLMs to judge whether a research idea is novel? — judge verdicts flip on tiny prompt tweaks.

arXiv cs.CL

Decision Models as Judges for Hallucination Detection — 2026-10-27
Tests whether cheap "decision models" (fixed-verdict classifiers with label probabilities) can replace a generative LLM judge for hallucination detection, across nearly 10,000 items spanning five hallucination types. A confidence cascade of these small models matches or beats the LLM judge on several types at 1-3% of the cost, though the paper flags overconfident probabilities as a reason not to trust it unsupervised — useful if judge-call spend on hallucination screening is a real line item for your team.

Task Success Is Not Enough: Side-effect-Aware Evaluation of Tool-Using Language Model Agents — 2026-10-25
Introduces SABench (201 tasks across email/calendar/ticket domains) with a deterministic oracle that checks not just goal completion but unauthorized side effects ("collateral damage"). Across 11 frontier models, roughly 15% of "successful" runs still take an unauthorized action — a concrete reminder that pass/fail task benchmarks miss a whole failure class that matters for agent evals in production.

Whether or Where? Tail Calibration Signals Finite-Budget Reward Hacking in Best-of-N Selection — 2026-10-25
Shows that Best-of-N quality at large N depends on how the reward/proxy score's calibration error behaves in the tail: Gaussian tails keep improving, heavy tails revert to the mean. Proposes a held-out "tail calibration" statistic teams can run alongside normal reward-model ranking metrics to know ahead of time when cranking up N in production will backfire.

Why Does Structured Output Fail? An Empirical Study of Prompt-Enforced Pydantic Schemas Across Nine LLMs — 2026-10-24
Moves past a single "validity rate" for structured-output pipelines to a full failure taxonomy plus a deterministic classifier, run on roughly 4,000 generations across 9 OpenAI/Anthropic configs. Markdown-fenced JSON turns out to be the dominant failure mode — directly actionable if you're evaluating or monitoring structured-output reliability in a production pipeline.

Ranking Is Not Deciding: Benchmark Shortcuts and Operating-Point Collapse in Query-Time RAG Poisoning Defenses — 2026-10-24
Audits 21 published RAG-poisoning-defense evaluations and finds many benchmarks owe their near-perfect detection scores to an artifact of how the poisoned test data was constructed, not real detection power; most also skip reporting the false-positive rate at the deployed threshold. A solid methodological warning before you cite a security/robustness benchmark number without checking how its test set was built.

Hugging Face blog

Can we trust LLMs to judge whether a research idea is novel? — 2026-10-27
Ai2 tests six LLM judges against a benchmark built from ICLR 2026 reviews, using reviewer comments on originality as the novelty label. Small prompt changes flip the verdict, extra retrieval and "more reasoning" don't help consistently, and a plainly-prompted frontier model beat two purpose-built novelty evaluators — another data point that LLM-as-judge reliability is still an open problem for anyone building judge-based eval pipelines.

Do LLM Routers Actually Route? Quick answer: Not much! — 2026-10-26
Introduces the AutoBench Router Benchmark (ARB), auditing seven commercial and open-source routers with 252 prompts, 20 models, and a 10-LLM-judge committee, with scoring rules pre-registered before testing. No router beats simply always calling one solid mid-priced model on quality-plus-cost — and the pre-registered, committee-graded methodology itself is a good reference for teams who need to defend their own eval setup.

Turning Database Grading into RL Rewards: Post-Training Agents with ThinkingBox — 2026-10-22
A joint Microsoft/Hugging Face post on ThinkingBox-Bench (507 tasks), which grades agents by the final state of a database rather than by which tool calls they made, using mostly deterministic checks plus a minority graded by an LLM judge rubric. The same deterministic check doubles as an RL reward, with task difficulty selected per-policy via a Jeffreys posterior — relevant if you want to turn agent evals into training signal without leaking the benchmark into the policy.

Two Pure-Vision Pipelines at the Top of ViDoRe V3 — 2026-10-23
On the ViDoRe V3 retrieval leaderboard, two "pure-vision" pipelines (page images only, no OCR) land 1st and 3rd by nDCG@10 across 8 public English datasets. More niche than the other items here, but a clean example of a leaderboard that evaluates the whole retrieval system end to end rather than just the model in isolation.

Langfuse blog

Nothing new in scope this week — the only October posts found are the three already covered in the prior digest.

Braintrust blog

Nothing new this week; the latest post predates this window and was already covered previously.

Simon Willison

Nothing that centers on eval methodology or observability tooling this week — recent posts lean toward model launches and an agent-built scraping tool, none of which clear the bar for this digest's focus.

Interconnects

Artificial Analysis v5 and the benchmarker's dilemma — 2026-10-28
Nathan Lambert digs into the new Intelligence Index v5, which weights knowledge work, coding, science, and general capability equally into one number, and questions whether that flattening hides real trade-offs between models. He also raises an uncomfortable point for anyone leaning on third-party evals: "independent" benchmarkers are often paid by the same labs they rank, which undercuts the benchmark's value as an objective signal — a good reason to compose multiple benchmarks with different biases rather than trust one aggregated index.

Podcast: Kimi K3.1 Pro, the new cyber reality, and Muse musings — 2026-10-25
The hosts compare Kimi K3.1 Pro's Artificial Analysis standing against its results on more specialized benchmarks like Terminal-Bench Science and ProgramBench, debating whether short-horizon benchmarks capture models tuned for long, exploratory tasks. A concrete case of "benchmark doesn't match real usage" — useful context if you're deciding between short-horizon proxies and longer tasks that mirror your actual product workflow for an internal eval suite.

Through-line

Three independent sources converge on the same warning this week: aggregate scores and judge verdicts are easier to produce than to trust. The RAG-poisoning audit shows benchmark construction can manufacture near-perfect scores; the router benchmark and Artificial Analysis critique both show that collapsing many dimensions into one number (a router's pick, an aggregated index) erases exactly the trade-offs a production team needs to see; and the novelty-judge study shows LLM-as-judge verdicts can flip on cosmetic prompt changes. The practical takeaway is the same across all of them — don't ship on a single number, whether it comes from a leaderboard, a router, or a judge call, without knowing how that number was built.

What's your team doing to cross-check a single eval number before trusting it in a release decision? Drop it in the comments.