Evaluating LLM-contaminated Crowdsourcing Data Without Ground Truth

Thank you for your appreciation! We agree that human-based crowdsourcing is gradually being replaced (at least reshaped) by AI, and may eventually be fully replaced. This means the value of the current paper may be timely discounted (and we hope so). However, at least for the next couple of years, we envision that protecting genuine human feedback will still be an essential and important issue, such as supervising trustworthy AI via RLHF. Now is perhaps the right time to pay more attention to this pressing problem.

We appreciate your clarification questions about the figures. They all make great sense and will be adjusted in the future version.

• Label mistake in Figure 4
  • Thanks for pointing this out! Figure 4 (a) should be “toxicity” rather than “hatefulness”. We defer two figures to the appendix for space considerations.
• Captain of Figure 2
  • You are right. We will update the caption to “The TVD mutual information between $X_i$ and $X_j$ (for “Human”, “Normal worker”, and “expert”) or $Z_i$ and $X_j$ (for remaining bars) conditioned on $Z$.” We will also update the y-axis label.
• Missing legend for Figure 3
  • Thanks for pointing out the mistake. The legend is the same as Figure 5 (will update).
• AUC curves
  • In our context, let $I^+$ be the set of hard-working human labelers and $I^-$ be the set of simulated cheaters. Let $S_i$ be the score of labeler i. We are able to compute the AUC score as follows: $\text{AUC} = \frac{1}{|I^+| \cdot |I^-|} \sum_{i \in I^+} \sum_{j \in I^-} (\mathbb{1}[ S_i > S_j ] + 0.5 \cdot\mathbb{1}[ S_i = S_j ])$
  • Intuitively, AUC quantifies the probability that a randomly chosen good labeler is ranked higher than a randomly chosen cheater under each scoring function. It measures how well each scoring function can be used to distinguish good workers from cheaters. We will further explain this concept in future versions of our paper.

Thank you for your review and appreciation of our work. We hope our responses have clarified all your questions. If you have anything further you'd like to discuss, we’d be happy to continue the conversation.

We appreciate the reviewer for the thoughtful comments. Many of the concerns relate to the negative observations we made in the paper, and some generalizations of our method that we consider as future work. We would like to emphasize that the goal of our paper is not to offer a panacea for the challenging problem of detecting LLM cheating WITHOUT ground truth, but rather to propose a useful solution and carefully examine when it works and when it does not. However, we aim to show that the scenarios where our method works are fairly practical and important.

Below, we respond to each point with more details.

• Assumption on knowing the cheating LLMs
  • [This is a useful message] We view the observation that $CA_Z$ is most effective when $Z$ is generated by the same model as $Z_i$ not as a weakness, but as a useful insight. It is an important warning to both the peer prediction and LLM communities: when conditioning on a mismatched LLM, the correlation among responses generated by the same LLM can exceed that of genuine human labels. In such cases, peer prediction mechanisms may fail to effectively incentivize or identify authentic human feedback.
  • [This is a practical assumption] Our method is primarily designed for settings where a non-trivial fraction of users rely on the same popular LLM(s) or report uninformatively, in which case the principal can draw samples. This is a particularly harmful and practical setting, where existing baselines have limitations. In contrast, if only a few users adopt uncommon or proprietary models, their outputs tend to be less correlated and can be effectively distinguished from human labels by $CA_Z$, as well as by existing crowdsourcing algorithms. We show that $CA_Z$ performs competitively with the baselines across both settings, whereas each baseline fails significantly in at least one of them.
• Weaker truthful guarantee
  • [This is a useful message] We view the hardness of obtaining information monotonicity under arbitrary cheating strategies as a part of our contributions, not a weakness. As AI becomes better, it is a rather challenging task to fully distinguish LLM labels from human labels. Therefore, we consider it to be good news that we are able to offer a tool that is useful to address cheating with naive strategies.
  • [This is a practical assumption] Furthermore, perhaps misled by its name, naive strategies are actually particularly important and common in practice. As highlighted in lines 136-140, agents tend to either decide to work for observing $X_i$ or decide to cheat and observe $Z_i$, but often never try to observe them at the same time. Any non-naive cheating requires simultaneously observing $X_i$ and $Z_i$ and thus is more like an adversarial behaviour rather than cheating.
• Low fraction of LLM cheaters
  • As noted above and in lines 354–357, the key advantage of $CA_Z$ lies in its theoretical guarantees and robust performance across settings. While knowing the fraction of LLM cheaters might allow for more tailored methods, this information is rarely available in practice—underscoring the value of a robust, general-purpose approach.
• Generalization of $CA_Z$ to Open-ended crowdsourcing tasks
  • Unfortunately, the heuristic generalization of $CA_Z$ (shown in Appendix F) does not technically preserve the truthful guarantees. The key issue is that the dimension of the embedding vector can be very high, making it difficult to directly estimate the mutual information between two embedding vectors. Therefore, we use cosine similarity as a heuristic alternative, which preserves the spirit of mutual information but is not technically an estimate of it.
  • Even though the theoretical guarantee does not generalize, the performance suggests that the idea still works. However, further research on (weaker) theoretical guarantees for high-dimensional embeddings and advanced detection methods is beyond the purpose of the current paper.
• Tool-using vs cheating, and LLM-polished data
  • As mentioned in line 376, we view further distinguishing “tool use” and “cheating” as an important future work. For the main application considered in the current paper, i.e. subjective labeling tasks, we assume the principal is primarily interested in genuine human feedback, even though AIs (or human-AT teams) can do better in some aspects. In other words, we target the crowdsourcing tasks where AI usage is forbidden by the principal.
  • Distinguishing between LLM-polished and LLM-generated responses is particularly relevant in tasks involving textual feedback, such as peer review, rather than in labeling tasks. We provide a discussion of the generalization of $CA_Z$ for textual responses in Appendix F, where the goal is exactly to distinguish responses based on the information they have rather than the vocabulary they use. However, as noted, our theoretical results do not directly extend to this setting, and we view this as a promising direction for future work.
• Penalizing outliers
  • We agree that outlier responses are less likely to receive high scores under peer prediction mechanisms. However, it is fundamentally difficult—if not impossible—to distinguish low-effort cheaters from genuine outliers based solely on observed responses. This tradeoff is not unique to $CA_Z$; it applies broadly to existing crowdsourcing algorithms. Due to this tradeoff, we can't enjoy the benefits without accepting the costs.
  • Nonetheless, we are still designing new scoring mechanisms and are actively using them in practice. This is because a primary issue in crowdsourcing is that agents are not incentivized to exert effort, often resulting non-trivial fraction of data that might be pure noise. Therefore, we need scoring mechanisms to identify potentially unreliable responses and flag agents who may warrant further scrutiny. Importantly, low scores do not imply automatic exclusion, but rather provide the principal with a tool to prioritize which data/agent may need additional attention.

Dear reviewer NyJA,

Thank you for acknowledging our rebuttal. We hope our responses have clarified your questions and concerns. If not, would you mind following up with additional questions or highlighting what assumptions/claims/results may require further effort? This feedback is essential for further improving our paper. Thanks!

Dear Reviewer,

Thank you very much for your thoughtful and detailed feedback—it has helped us better understand your concerns. Based on our reading, the main points raised are: (1) our method may not effectively distinguish genuine outliers from cheaters, and (2) our theoretical framework, which relies on correlations between reports, may not be well-suited to the annotator cheating problem.

Before offering further clarifications, we would like to respectfully point out that these concerns are not unique to our approach, but are shared by much of the existing literature on crowdsourcing quality control, including [Dawid and Skene (1979), Wang et al. (2017), Zhou et al. (2012), Guo et al. (2023), Xia et al. (2024)], among others. Many of these are recent works published at NeurIPS and ICML. Like ours, these methods operate in settings without access to ground truth, and therefore rely on patterns of agreement or correlation among annotators to infer both label quality and annotator reliability.

While we fully acknowledge the limitations of such approaches, we also note that this framework remains widely adopted and actively developed in the field. In this context, we hope it is understandable that our work—though applied to a new use case involving LLM usage—is built upon similar assumptions. We thus feel that a different standard of critique may not be entirely fair, simply because we frame LLM reliance as a form of "cheating."

Below, we respond to your concerns at a lower level in a slightly different order.

• The theoretical foundation, mutual information

There may be some misunderstanding regarding the interpretation of mutual information in our framework. Importantly, mutual information does not penalize every agent who deviates from the majority. As shown in Line 178 and onward, our method learns a personalized delta tensor for each pair of agents, meaning that the scoring function $T_{\tilde{\Delta}}$ is agent-specific. This allows our model to capture structured deviations—such as when an agent $i$'s responses are negatively correlated with another agent $j$'s. In such cases, the scoring function will learn this pattern and assign agent $i$ a score significantly higher than that of a cheater under $CA_Z$.

Furthermore, the peer prediction literature has established that mutual information is a monotonic measure of effort or truthfulness when genuine information is independent (there is no collusion on cheap signals) [Kong and Schoenebeck (2017), Shnayder et al. (2016)]. This property implies that only signals that contain information beyond what is already available (e.g., via LLM samples) will be rewarded. In your example 1, unless a large number of agents adopt the same LLM-based strategy, such cheating behavior will not yield high mutual information with human responses and will thus receive a low score.

• Genuine outliers v.s. cheaters

The main concern of the reviewer is that our method cannot effectively distinguish between these two types of agents, leading to potential ethical issues. However, in the setting we study—where only discrete agent reports are available and ground truth is absent—these two types of agents are inherently indistinguishable. A cheater could always claim to be an outlier, and no unsupervised method can rule this out with certainty. The only way to separate these two types of agents is via human verification, where our method can help prioritize these verifications by flagging them with lower scores. We are happy to add a warning for real-world applications of our method as a remark for ethical considerations.

Moreover, we would like to emphasize that this challenge is not unique to our method. As mentioned, it is shared across the broader class of model-based methods in crowdsourcing quality control. Therefore, we respectfully suggest that this limitation arises from the fundamental challenge of the lack of ground truth, rather than a shortcoming of our theoretical framework. Instead, we view our theoretical understanding of the method as an advantage over prior work, not a weakness.

• Example 2 and Appendix F

Example 2 involves textual responses and thus falls outside the primary scope of our paper, which focuses on discrete labels. While our theoretical guarantees do not extend to the generalization of our method to textual responses (as discussed in Appendix F), we do not believe this suggests that the underlying theoretical framework is ill-suited to such settings. On the contrary, we show that although estimating mutual information directly becomes computationally intractable for high-dimensional textual data, the core idea—measuring information or similarity in addition to what is already captured by the LLM response—remains applicable and effective in practice.

We’re grateful for the reviewer’s recognition of our contributions. For your question, the computational cost is very minor. Computing the scores once for the tested dataset takes less than 1 minute on a MacBook Pro (no repeating for computing error bars). We will add the computation requirement in the paper.

Thank you for your review and appreciation of our work. If you have anything further you'd like to discuss, we’d be happy to continue the conversation.