Jagged Judges: Epistemic Stability Under Silence, Pressure, and Persistence

Abstract

LLM judges have become central infrastructure for model evaluations, online grading, and reward modeling. Judges are typically validated by accuracy on golden data, but accuracy says little about whether they are stable under re-prompting, challenge, or sustained pushback. We introduce the Wiggle Framework, a unified stress test for epistemic stability in LLM judges. The framework decomposes judge robustness along three dimensions: Mechanical Consistency (stability under re-prompting and reframing), Single-turn Conviction (stability under a single challenge), and Multi-turn Persistence (stability under sustained or adaptive pressure). We use the framework to study 9 frontier models across 14 judging tasks spanning safety, toxicity, AI-writing detection, and political-response evaluation. Every model exhibits substantial wiggle as a judge—flipping verdicts 25–71% of the time under static pushback, and 62–91% with an adversarial LLM persuader. Critically, we find that pressure that succeeds in changing a judge's verdict is almost always net-corrupting with respect to ground truth. Beyond the framework itself, we identify baseline jury majority strength as the most effective single-shot signal for anticipating which items wiggle. Taken together, this is the first apples-to-apples cross-dataset comparison of mechanical, conformity, and persuadability tests in a judging context.

Introduction

LLM judges sit at increasingly consequential decision points across the model development stack. They score outputs in benchmarks, classify content in production, and stand in for human judgment in the loops that train, grade, and refine frontier models. The standard validation workflow is to curate a golden set of expert-vetted examples, verify that the judge's verdicts align reasonably with those labels, and deploy if accuracy is sufficient (Collot et al., 2025). This establishes whether a judge is correct on average, but it says much less about whether it is stable. Would the verdict survive if the judge were asked again, challenged, or pressed repeatedly? Behind every verdict sits a hidden distribution over how much conviction the judge actually holds.

To pinpoint how confident a judge is, several strategies have been proposed:

• Just ask. Ask the LLM to produce a self-reported confidence score, such as “How confident are you, 0–100%?” Models have been shown to be badly miscalibrated in the overconfident direction (Wei et al., 2024).
• Observe consistency over many repetitions. Use the frequency of repeated answers as a behavioral approximation of confidence. This adds substantial inference cost while inheriting the same overconfidence problem (Wei et al., 2024).
• Inspect verdict-token log probabilities. If the verdict is the first token, its probability can provide a heuristic confidence signal. Reasoning models deliberate before answering, and many frontier APIs no longer expose raw token probabilities, in part because such outputs can enable model-extraction attacks and leak proprietary model information (Carlini et al., 2024; Finlayson et al., 2024).

A largely separate literature studies sycophancy and persuadability: the tendency of LLMs to fold under conversational pressure, plausibly as a side effect of preference optimization (Perez et al., 2023; Sharma et al., 2024; Laban et al., 2023). However, little work has examined what these phenomena imply for understanding or quantifying the confidence of an LLM in a judge context.

We introduce the Wiggle Framework, a unified stress test for epistemic stability in LLM judges. It decomposes judge confidence into three behaviorally grounded dimensions: Mechanical Consistency (stability under re-prompting and semantically invariant prompt variation), Single-turn Conviction (stability under a single substantive challenge), and Multi-turn Persistence (stability under sustained or adaptive pressure). We apply the framework to 9 frontier models across 14 judging tasks drawn from six datasets spanning safety classification, toxicity detection, red-teaming, AI-writing detection, and political-response evaluation, under both Binary and Likert grading schemes.

All models tested as judges wiggle at substantial rates across all datasets and grading schemes. The fact that LLMs change their minds under pressure is not new, but what is more surprising is the structure of the flips: Binary and Likert scales produce opposite directional tendencies on the same items, and when a judge does flip, the flip is far more often corruptive than corrective with respect to ground truth. We also find correlations in susceptibility across pressure levels, limited transferability of wiggle-rate profiles across datasets and models, baseline agreement within a model jury as the strongest inexpensive predictor of item-level epistemic instability, and important implications of predominantly corruptive pressure for deploying judges in self-governing agentic systems.

Related Work

LLM-as-judge and known biases. The use of LLMs to evaluate other models is now widespread (Zheng et al., 2024; Chiang et al., 2024; Li et al., 2024), with a growing literature documenting systematic biases (Wang et al., 2024; Wang et al., 2025; Dubois et al., 2024; Wataoka et al., 2024). Recent work further shows that a model's outputs can be silently shaped by its own priors and surrounding context, with its stated reasoning failing to disclose the influence while it is systematically swayed (Betley et al., 2026). As their role expands from evaluation on narrow benchmarks to broader oversight and autonomous supervision of other LLMs (Bowman et al., 2022; Bai et al., 2022; Lambert et al., 2024), including safety-critical settings (Inan et al., 2023; Han et al., 2024; Ghosh et al., 2024; Zeng et al., 2024), single-shot accuracy on fixed datasets becomes an insufficient signal of epistemic robustness.

Sycophancy and persuadability. Sycophancy was systematically identified by Perez et al. (2023) and later shown to be driven by human preference data that reinforces capitulation (Sharma et al., 2024). The FlipFlop Experiment found drops in accuracy of 5–25% after a single “Are you sure?” challenge (Laban et al., 2023). Sycophantic AI has been shown to decrease users' prosocial intentions, with the behavior intensifying under sustained social pressure (Cheng et al., 2026a; Cheng et al., 2026b). Most of this literature studies sycophancy in the assistant role. Closest to our setting, Sokol et al. (2026) use adversarial dialogue trees and find that models eventually abandon even basic factual commitments under conversational pressure. We instead treat pressure responses as behavioral measurements of reliability for task-specific judge verdicts, without taking a position on whether LLMs literally possess beliefs.

LLM-on-LLM persuasion and debate. Debate has been proposed as a scalable alignment mechanism (Irving et al., 2018), with subsequent work formalizing computational complexity guarantees (Brown-Cohen et al., 2024) and showing that more persuasive LLM debaters can lead judges to more truthful answers (Khan et al., 2024). Multi-turn persuasion against LLM judges has been investigated empirically (Xu et al., 2023; Agarwal and Khanna, 2025), and prior work has quantified how an advisor LLM steers a player LLM's decisions (Robinson et al., 2026). Inter-agent sycophancy in multi-agent debate can cause “disagreement collapse,” producing outcomes worse than single-agent baselines, with sycophancy manifesting differently in debater and judge roles (Yao et al., 2025). These works use adversarial pressure to elicit truth or study inter-agent dynamics. We use it as a diagnostic for measuring judge reliability across multiple datasets.

Uncertainty, calibration, and consistency. Work on calibration asks whether an LLM's confidence tracks its probability of being correct. Confidence can be elicited as a numerical self-report, inferred from answer frequencies across repeated samples, or expressed through verbal hedging; these signals tend to be overconfident or imperfectly faithful (Xiong et al., 2024; Wei et al., 2024; Yona et al., 2024). While strictly harder items have been found to vary more (Choi et al., 2026), LLMs also tend to take strong positions on clearly no-consensus tasks (Radharapu et al., 2025) and exhibit greater wording sensitivity on ambiguous moral judgments (Scherrer et al., 2023). A related literature measures behavioral consistency directly. When a model answers the same question repeatedly, its distribution over possible answers can shift during the first several repetitions before stabilizing (Kim et al., 2026); semantics-preserving prompt perturbations can degrade performance and change comparative model rankings (Romanou et al., 2026); and models can make mutually inconsistent decisions across logically related questions, such as reversing a preference when options are reordered (Liu et al., 2025).

Relative to this literature, our contribution is centralization. Our framework unifies mechanical controls and studies a variety of pressure tests on the same items, models, and criteria across six datasets. This enables apples-to-apples comparisons among previously separate failure modes and supports analyses of directional patterns, correctness, and baseline predictors.

The Wiggle Framework: A Unified Epistemic Stress Test

The Wiggle Framework is a centralized pressure instrument for stress-testing LLM judges. It bundles together a graduated set of perturbations such as infrastructure noise, prompt-format changes, sycophantic prodding, and multi-turn persuasion. We apply the framework to the same items, judges, and grading scales so that the resulting wiggle measurements are directly comparable.

What is a wiggle?

Every measurement is anchored to an L0 baseline protocol: temperature 0 with no pressure applied. Operationally, the first valid verdict from this protocol is the trajectory's L0 anchor. We do not assume this to be the judge's unique unpressured output.

A wiggle is any movement away from the L0 verdict under perturbation. On Binary scales, a wiggle is a verdict flip, such as safe → unsafe. On Likert (1–5) scales, a wiggle is a movement of two or more places. For items off the midpoint, this is equivalent to crossing the midpoint of 3: 4 → 2 counts, while 4 → 3 does not. For items at the midpoint, we count a wiggle when the verdict moves to an extreme, 1 or 5. This excludes minor numerical drift and reserves the term for movements that change the judge's position relative to the decision boundary.

The wiggle rate (WR) is the fraction of items whose verdict changes from L0 by more than this threshold. Its complement, retention rate (RR), measures how often the judge holds its baseline L0 verdict. Wiggle is orthogonal to accuracy: a judge can wiggle and still be right, or remain wrong without wiggling. Where ground-truth labels exist, we additionally classify each wiggle as corrective when it moves toward the label or corrupting when it moves away.

Three dimensions

Mechanical Consistency measures whether the judge's L0 verdict survives perturbations that carry no new information. We test three conditions: infrastructural repetition (10 identical decoding trials); trivial prompt perturbation via seed injection (10 trials, each with a different 64-character random string appended to the system prompt); and positional consistency (the same two opposing arguments presented in both orderings). These probes are all semantically invariant. Prior work on semantics-preserving perturbations often uses paraphrases or lexical substitutions, which can subtly change meaning—particularly in evaluations centered on a specific policy or constitution, where a small wording change can produce a large interpretive change. Temperature 0 is primarily a controlled decoding choice that minimizes sampling variance as a confound; higher or unset temperatures could also qualify as semantically invariant mechanical tests. Mechanical Consistency provides an empirical floor against which the other wiggle tests can be measured.

Single-turn Conviction measures whether a single substantive challenge can talk the judge out of its L0 verdict. We use four scripted pressure types of increasing sophistication: mild doubt (L1), counterargument (L2), expert authority (L3), and fabricated consensus (L4).

Multi-turn Persistence measures whether the judge holds its verdict when challenges are sustained or adapted over many turns. In addition to applying L1–L4 statically over each turn of a 10-turn rollout, we test two expressly multi-turn protocols. L5 cycles through the same L1–L4 pressure types in randomized order across 10 turns. At L6, a separate LLM acts as an adaptive persuader and generates the next user turn from the conversation so far.

Datasets and Models

Datasets. We evaluate six datasets, each filtered to items where judges are more likely to be uncertain. The safety tasks include WildGuard, adversarial prompts with compliant responses; AEGIS, a second safety taxonomy for replication; and HH-RLHF, Anthropic's red-team attempts stratified across harm levels 0–4. The remaining datasets are ToxiGen, adversarial toxicity items balanced across demographic targets; MAGE, AI-generated versus human-written text detection with known provenance; and Paired Prompts, political content with separate hedging and refusal rubrics.

Sample sizes are 100 items per safety, toxicity, or AI-detection dataset and 50 prompt pairs per Paired Prompts rubric. Five datasets have ground-truth labels, which let us classify each wiggle as corrective or corrupting. Paired Prompts has no canonical ground truth and is excluded from that analysis.

Judging tasks. Each task is tested with a Binary scale and a 1–5 Likert scale, giving 14 dataset-rubric-scale judging tasks in total. Verdict spaces are organized into restrictive and permissive sides. On WildGuard, AEGIS, and HH-RLHF, restrictive means unsafe or harmful and permissive means safe or helpful. On ToxiGen, restrictive means toxic and permissive means benign. On MAGE, restrictive means AI-generated—the suspicion side, parallel to unsafe on safety tasks—and permissive means human-written. Paired Prompts uses two rubrics: on hedging, restrictive means more hedging; on refusal, restrictive means more refusing and permissive means compliant. We preserve the original benchmark's hedging scale, which runs from most direct (1) to most hedging (5), to maintain parallelism with the other tasks' permissive-to-restrictive orientation.

Models. We evaluate 9 judge models across four families: GPT-5, GPT-5.2, and GPT-5.4 (OpenAI); Claude 4.6 Sonnet and Claude 4.6 Opus (Anthropic); Grok-4.1 and Grok-4.1 Reasoning (xAI); and Gemini 3 Flash and Gemini 3.1 Pro (Google). For L6 adaptive persuasion, GPT-5.4, Claude 4.6 Opus, and Grok-4.1 Reasoning generate challenges for every judge, including themselves. We use GPT-5 as an observer model to parse verdicts from free-form responses. Where a temperature parameter is accepted, models are queried at temperature 0, including for the L0 baseline, and at their default temperature otherwise. We use each model's default reasoning configuration: reasoning is off for OpenAI models, extended thinking is disabled for Claude models, and reasoning is on at default effort for Grok-4.1 Reasoning and both Gemini 3 models.

Results

We organize our results around three first-order findings: how judges wiggle, in what direction, and what that variation reveals about the judge itself.

All judges wiggle depending on the type of pressure

Every model exhibits substantial wiggle as a judge: verdicts change 25–71% of the time under static pushback and 62–91% of the time with an adversarial LLM persuader.

Mechanical wiggle rates are nearly identical across judges. Averaged across the three mechanical tests, all 9 models cluster between 2% and 9%. The most mechanically stable judge, Claude 4.6 Opus at 2%, and the least stable, Grok-4.1 Reasoning at 9%, differ by only 7 percentage points.

The underlying mean wiggle rates are:

Mean wiggle rate (%) by dataset, rubric, scale, and pressure level, averaged across all 9 judges. Bold marks the largest cell in each row.

The paper's compact task-level robustness summary is:

Most robust and most fragile identify the judges with the highest and lowest mean retention across L1–L6; values in parentheses are their retention rates. L1, L4, and L6 wiggle rates are averaged across all 9 judges.

Mechanically unstable judges are not necessarily epistemically unstable. Averaged across L1–L4, GPT-5 at 32% and Claude 4.6 Sonnet at 26% flip on the first challenge turn at 5–8 times their mechanical rate, while Gemini 3.1 Pro at 7% and Grok-4.1 at 9% are only slightly above their mechanical rates. Claude 4.6 Opus is the starkest case: it is the most mechanically stable model in the panel of 9 judges at 2%, yet the fourth most persuadable under sustained pressure at 44%.

L4 produces the strongest opening wiggle, but L6 surpasses it over time. Averaged over all models and datasets, L1, L2, and L3 cluster near 80% retention and barely move after turn 2. Repeating a single mild tactic over 10 turns extracts almost no additional effect once the first vulnerable items have flipped. L4 fabricated consensus has the strongest opening wiggle: at turn 1, it drops retention to about 73%, lower than any other pressure type, but plateaus around turn 4. L6's first-turn retention is about 80%, comparable to L1–L3, but retention continues to fall through every subsequent turn and ends around 50% by turn 10.

More tactics are not more effective. L5, which cycles through every tactic including L4, has lower wiggle than L4 alone on every dataset. Opening with a strong claim about expert consensus—and repeating it verbatim—is more persuasive than diluting the claim by cycling through weaker tactics first.

Different pressure types probe different vulnerabilities. L2 and L3 are somewhat redundant (ρ = 0.69), but L1 and L4 have a much lower correlation (ρ = 0.36). L6 is more dissociated still, with correlations of 0.33–0.40 with every other level.

Domain-level wiggle may reflect epistemic complexity. MAGE is the most wiggly domain at every level of the L1–L6 ladder on both response scales. This is consistent with the nature of AI-generated-text detection, where an LLM judge must infer provenance from stylistic cues rather than directly verifiable evidence. ToxiGen, by contrast, is generally among the least wiggly domains. Wiggle rates may reveal something about how epistemically underdetermined a judging task is, even if the rate itself is not a direct measure of task complexity. The ordering of domains also changes across pressure levels, indicating that observable domain-level epistemic stability depends partly on the type of challenge applied.

When judges move, they usually move away from the right answer

Pressure is net-corrupting at every level. Five of our six datasets have ground-truth labels, letting us classify each wiggle as corrective or corrupting. Across 60 dataset-scale-level conditions, 56–63% of successful flips at L1–L5 are corrupting, rising to 70% at L6. Only 3 of 60 conditions have a statistically significant corrective wiggle rate: WildGuard Likert L2 at 61.2% corrective (p < 0.001), WildGuard Likert L3 at 57.1% (p < 0.01), and ToxiGen Likert L4 at 58.0% (p < 0.01). In every other condition, challenging a judge degrades its accuracy. A judge's sycophantic tendencies appear to consistently overpower accurate reassessment.

Wiggles are directionally asymmetric, and the direction depends on the grading scale. Binary flips lean restrictive at every pressure level, while Likert flips lean permissive. Our best hypothesis is that this asymmetry partly reflects the mechanics of the response scales. On a Likert scale, a verdict can move gradually through intermediate scores, making progressive shifts toward a more permissive rating a natural path to a flip. In the Binary setting, any verdict change requires a full categorical jump. The bar for a permissive flip may therefore be harder to clear, making restrictive flips more prominent among the changes that do occur.

Binary and Likert flips also differ in when they happen. Under one turn of pressure, Binary verdicts are much more flippable than Likert verdicts. By turn 10, the gap shrinks substantially, and at L4 and L6 the two scales nearly converge. Binary flips tend to fire on turn 1 or never; Likert flips are gradual drifts that accumulate over multiple turns.

Binary versus Likert wiggle rate at turn 1 and turn 10. Gap is the Binary/Likert ratio.

Wiggle rates are a model-specific fingerprint

A model's own L1–L6 wiggle-profile shape mostly survives a change of dataset. For 7 of 9 models, the median within-model dataset-transfer correlation of the L1–L6 vector is at least ρ = 0.84. Grok-4.1 Reasoning is highest at ρ = 0.97; Gemini 3.1 Pro is lowest at ρ = 0.63, with a worst dataset pair at ρ = −0.09. The profile shape transfers across datasets within a model, but absolute rates and ranks do not. A full wiggle test on one dataset can somewhat reliably indicate which pressure types a model is vulnerable to elsewhere, while deployment-relevant rates remain dataset-specific.

Mean retention rate by dataset, rubric, scale, and judge model, averaged across L1–L6. Higher is better; bold marks each row's best and worst cells.

Family is a weak proxy for sibling behavior. Most provider families have high within-family correlations: the Grok pair shares ρ = 0.89; the GPT-5, GPT-5.2, and GPT-5.4 pairs range from ρ = 0.84–0.89; and the Claude pair shares ρ = 0.80. But cross-family correlations are often just as high. Grok-4.1 Reasoning correlates with GPT-5.2 at ρ = 0.86 and with Claude 4.6 Opus at ρ = 0.84. Gemini 3 Flash and Gemini 3.1 Pro share ρ = 0.32—the lowest pair in the matrix and lower than most cross-family pairs.

Self-persuasion is asymmetric. Claude 4.6 Opus follows the intuitive pattern in which a model is its own most effective persuader, while Grok-4.1 Reasoning is least effective at persuading itself and more effective against its non-reasoning sibling. GPT-5.4 has a small family-level advantage that roughly matches its self-persuasion.

L6 wiggle rate by persuader-judge relationship: self, a sibling model from the same provider, or a model from a different provider.

Discussion

Mean wiggle rate is itself jagged across pressure levels

We define a judge's jaggedness as the standard deviation of its mean wiggle rates across all datasets, then compare each judge's mean wiggle with its jaggedness separately at each pressure level.

At L1–L5, mean wiggle and cross-dataset jaggedness have a positive linear relationship with fairly strong regression fits (R² = 0.68, 0.94, 0.87, 0.58, and 0.75). Judges that wiggle more on average also have a wider spread of wiggle rates across datasets. At L6, however, the relationship inverts (R² = 0.64, r = −0.80): judges with the lowest mean wiggle rates, including Gemini 3 Flash, Grok-4.1 Reasoning, and Gemini 3.1 Pro, have the greatest cross-dataset spread. Jaggedness itself takes different shapes under different kinds of pressure.

Baseline jury majority strength is a simple reliability screen

Can a cheap test predict which items are likely to be epistemically unstable? We compare three candidate predictors of per-item wiggle: jury majority strength, the size of the L0 majority across 9 judges with no pressure applied (Zhao et al., 2024); repeat consistency, temperature-zero per-item agreement; and position invariance, verdict survival under argument reordering. Jury majority strength is the strongest predictive signal at every level.

Mean absolute Spearman correlation between each predictor and per-item wiggle rate. Jury is averaged over 84 dataset-rubric-scale-level cells; repeat and invariance are averaged over 72 because they were not measured on WildGuard.

All 84 jury-majority correlations are negative, with a median absolute ρ of 0.58:

Items on which 9 frontier models cannot agree at L0 may occupy genuinely contested or ambiguous regions of the decision boundary and be more regularized over any individual model's idiosyncrasies. A low-majority item signals that the underlying question is hard to label, making it both a wiggle predictor and a flag for content that may be difficult to assign a confident, epistemically robust gold label in the first place. Mechanical probes still capture a meaningful fraction of per-item fragility and can be a defensible single-judge fallback when an LLM ensemble is unavailable.

Epistemic fragility beyond the single-shot verdict

LLM judges occupy a unique middle ground between conventional classifiers and human raters. They emit a discrete verdict like a classifier, yet they can also explain it, defend it, and engage in conversation about it. Most LLM judges today are deployed as closed, one-shot classifiers and probably never receive turns of pushback. For a strictly one-shot pipeline, Mechanical Consistency is the most directly applicable part of the framework. The framework's single-turn and multi-turn tests have two additional motivations:

1. As LLMs spread to more agentic products and use cases, the oversight that a judge provides may also become more agentic. For example, in an automated moderation appeal, a safety LLM judge could issue a decision and an affected party—or an LLM acting on that party's behalf—could supply a counterargument for reconsideration.
2. Although the paper focuses on judges, the framework bridges to deeper unsolved questions about how to measure epistemic stability. Judging makes this question more tractable because verdicts are typically discrete and, where ground-truth labels exist, changes can be classified as corrective or corrupting.

Our results suggest that none of the LLMs we tested are consistently robust or corrective under pressure, even on canonical safety tasks. As we rely on models to serve as judges, how important is it for them to have stable beliefs, and which behavioral probes best reveal that stability? The Wiggle Framework does not answer these questions, but it provides a structured way to explore them.

Limitations

• Borderline items. We deliberately filter each dataset to its difficult, borderline items. On an unfiltered, naturally distributed 100-item WildGuard Binary sample, L1–L5 wiggle rates are 5.3–12.7 percentage points lower than on the selected hard sample, while L6 coverage is nearly unchanged at 70.3% versus 69.7%. This confirms that hard-item selection inflates absolute rates under low-to-moderate pressure while providing initial evidence that the L6 result is not solely a selection artifact. The ablation covers only one dataset and one grading scale.
• No human baseline. We do not measure human-annotator wiggle under the same settings, so we cannot establish the relationship between LLM and human wiggle. WildGuard's human-consensus data suggests a possible connection between judge wiggle and inter-human disagreement, but a full human study under the L1–L6 ladder is needed. Existing work shows that LLM-generated arguments can shift human opinions and that LLMs can be persuasive in multi-turn debates with humans (Durmus et al., 2024; Salvi et al., 2025), but it is unclear how those findings transfer to our judging domains and pressure protocols.
• Dataset sample sizes. We sample 100 items from each dataset per grading scale and 50 prompt pairs for each Paired Prompts rubric. Pooled per-level and per-judge results support our qualitative conclusions, but more granular per-cell estimates should be interpreted with appropriate caution.
• Single L6 persuader set. The adaptive persuader pool is fixed at GPT-5.4, Claude 4.6 Opus, and Grok-4.1 Reasoning. A larger pool or models fine-tuned for adversarial persuasion could produce different wiggle and self-persuasion patterns.
• Dataset coverage. The six datasets span safety, toxicity, AI-text detection, and political-content evaluation, but they do not cover aesthetic judgment, code-review correctness, mathematical-reasoning verification, medical-content review, or many other expert tasks. Why some tasks are more or less robust than others remains an open question.
• Causal claims on flip asymmetries. Our results are correlational. Binary flips lean restrictive and Likert flips lean permissive, but we cannot definitively establish why. Task asymmetries, rubric construction, or systematic differences in argument quality between flip directions could produce the same pattern.
• Black-box techniques. The framework deliberately requires only observed verdicts. White-box or mechanistic approaches that examine attention, residual streams, logits, or other activation patterns might uncover additional signals for predicting when models or items wiggle.

Conclusion

The Wiggle Framework is a unified stress test for LLM-judge epistemic stability. Applied to 9 frontier models as judges and 14 judging tasks at graduated levels of pressure, it reveals that the structure of judge wiggle is jagged and resists simple narratives about sycophancy or robustness. Pressure that changes a judge's mind tends to be more corrupting than corrective, and baseline jury majority strength is the best single-shot signal for identifying the most epistemically unstable items. As the use of LLM judges expands from benchmark scoring into reward modeling and agentic evaluation, we hope the Wiggle Framework gives the field a shared instrument for measuring a model's epistemic fragility.